diff --git a/DESIGN.md b/DESIGN.md index 5e7f84ba7a4..9169bfd9584 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -1,85 +1,82 @@ # gunbc — Design -`README.md` and `CLAUDE.md` symlink here — this is the single source of truth. (v1 ships the `gunbc` CLI and is v2's seed · v3 was removed, migrated into v1 · v2 is active.) +`README.md` and `CLAUDE.md` symlink here; this is the single source of truth. It is a projection of `gunbc.design_document` and is never hand-edited. v1 is the `gunbc` CLI and v2's seed; v2 is active. -This document is reasoned **serially**: §1 fixes the axioms, and each later section is a consequence of the ones before it (or an independent peer) — never a restatement of it. The principles apply recursively, including to this document, which is a projection of `gunbc.design_document` and is never hand-edited. +The document is reasoned **serially**: §1 fixes the axioms, and each later section is a consequence of the ones before it, or an independent peer, never a restatement. The principles apply to this document too. -It carries the REASONING only. Recurring failure modes live one class per file under `dag/gunbc/recurring_failure_mode/`; a combined markdown projection is not a committed merge surface. The on-demand combined view is `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/instruments/docs_projection_gate.dag --function regen` (`tools.docs_projection_gate` `regen`, also `gunbc.design_ledgers` `expected_design_failure_modes_md`). Declared §4b(3) rung drops are projected into [docs/design-rung-drops.md](docs/design-rung-drops.md). A ledger grows without bound while these sections are fixed by §1, and this file is loaded in full on every turn of every session. Plans and analyses live under `docs/plans/` and are linked from the section that governs them. +It carries reasoning only, because it is loaded in full on every turn of every session while ledgers grow without bound. The ledgers live apart: recurring failure modes one class per file under `dag/gunbc/recurring_failure_mode/` (combined view: `tools.docs_projection_gate` `regen`); declared rung drops in [docs/design-rung-drops.md](docs/design-rung-drops.md) (`gunbc.rung_drop`); dated operator rulings in `gunbc.design_ruling`, cited below by symbol. Plans live under `docs/plans/`, linked from the section that governs them. --- ## 1. The objective (the axioms) -Three **axioms** — assumed, not derived: +Three **axioms**, assumed rather than derived: - **A1 — there is a goal.** To *solve a problem* presupposes an agent with a goal; with no goal there is nothing to optimize. -- **A2 — time is the value.** Every agent intrinsically values time — it is finite and is the substance of acting at all: **time is life**. It is the one value we may assume is *shared*. +- **A2 — time is the value.** Every agent intrinsically values time: it is finite and is the substance of acting at all. **Time is life**, and it is the one value we may assume is *shared*. - **A3 — agreement is temporal.** Intersubjective agreement is possible only *across* time, and only on what stays stable under it. Three things follow, in order: -- **From A1 and A2 — the solution is minimal, safe, efficient.** A solution is good exactly insofar as it spends less of the only thing valued, and time is spent three ways: **cost** (time to run), **safety** (time to recover from a silent wrong answer, paid later at interest), **complexity** (time to change). These are not preferences layered on — they are A2 applied to A1, and the project optimizes them jointly. +- **From A1 and A2 — the solution is minimal, safe, efficient.** A solution is good exactly insofar as it spends less of the only thing valued, and time is spent three ways: **cost** (time to run), **safety** (time to recover from a silent wrong answer, paid later at interest), **complexity** (time to change). These are A2 applied to A1, not preferences, and the project optimizes them jointly. - **From A2 and A3 — grounding is intersubjective.** Because time is the only assumed-shared value, a fact is grounded only by pointing at a shared, time-stable framework (§4), never an internal taxonomy. -- **At the limit — reduce intersubjectivity to physics.** The deepest such framework is physics. So the aim is to replace convention with necessity until nothing arbitrary survives. This is why §3 models the universal frameworks and real upstream rather than re-coining them: a nickname is convention standing where physics was available. +- **At the limit — reduce intersubjectivity to physics.** The deepest such framework is physics, so the aim is to replace convention with necessity until nothing arbitrary survives. This is why §3 models the universal frameworks and real upstream rather than re-coining them: a nickname is convention standing where physics was available. -The safety axis carries its own measure, used throughout: **safety is measured by how far each error class has climbed from runtime harm toward structural impossibility** — the guarantee ladder of §4b. +Safety has its own measure, used throughout: **how far each error class has climbed from runtime harm toward structural impossibility** — the guarantee ladder of §4b. ## 2. Minimize redundancy (the master move for cost and complexity) -Redundant work — **duplicated, unnecessary, or irrelevant** — loses on all three of §1's quantities at once: it costs more to run, it widens the surface where harm hides, and it adds complexity to maintain. So a perfectly DRY process is, by the meaning of redundant, the minimal one. Through §1's time lens this is *why* DRY matters: redundant work **defers** cost into the future — it shoves a problem onto a later fixer, or builds a process destined to be thrown out — so DRY is the refusal to spend someone's future time to buy the author's present convenience. +Redundant work — **duplicated, unnecessary, or irrelevant** — loses on all three of §1's quantities at once: it costs more to run, widens the surface where harm hides, and adds complexity to maintain. A perfectly DRY process is therefore the minimal one. Through §1's lens, redundant work **defers** cost onto a later fixer or into a process destined to be thrown out; DRY is the refusal to spend someone's future time to buy the author's present convenience. -Redundancy is removed along two directions — one move seen two ways: +Redundancy is removed along two directions of one move: -- **Horizontal — one concept, every scale and breadth.** Model a concept once; derive every use. At the right layer there is nothing fundamentally different between scales, so the same concept spans nanosecond memoization and broad infra deployment. *e.g.* `dag/std/integer.dag`: `Int8`…`UInt128` are 10 `Compose>` rows — one axis, not 10 types. -- **Deep — every concept decomposed to grounded atoms.** Nothing is opaque that is not *genuinely* atomic. The move is `decompress → map → reduce`: reveal the structure the source names, map each part onto the concept that already exists (DFS the concept DAG first), reduce duplicates. A `String` leaf hiding named parts is anemic modeling. *e.g.* `"LGA4926"` → `CpuSocket { package: LandGridArray, contact_count: 4926 }`, where the number is a grounded `Int` rather than a fresh enum. +- **Horizontal — one concept, every scale and breadth.** Model a concept once and derive every use; at the right layer nanosecond memoization and broad infra deployment are the same concept. *e.g.* `dag/std/integer.dag`: `Int8`…`UInt128` are 10 `Compose>` rows, one axis rather than 10 types. +- **Deep — every concept decomposed to grounded atoms.** Nothing is opaque that is not *genuinely* atomic. The move is `decompress → map → reduce`: reveal the structure the source names, map each part onto the concept that already exists (DFS the concept DAG first), reduce duplicates. A `String` leaf hiding named parts is anemic modeling. *e.g.* `"LGA4926"` → `CpuSocket { package: LandGridArray, contact_count: 4926 }`, the number a grounded `Int` rather than a fresh enum. -**Minimize the demand graph before materializing its answers.** A repeated computation is first evidence about why the same semantic fact is demanded again, not yet a cache obligation. When several demands have a shared-state least common ancestor, the repetition is authored duplication: carry, rewire, or share the first value — caching a later request only makes redundant work cheap and suppresses the signal that would make it rank for deletion. One undeclared pure demand may recompute; isolated consumers, declared replay, or unbounded future siblings instead create one reuse obligation at their least common visible ancestor. One computation identity must join those demands to a provider whose scope reaches that ancestor, whose coverage includes the identity, whose key represents every declared input the result depends on, and whose retention spans the obligated lifetime; otherwise refuse with a typed cause. Demand minimization decides whether another production may exist, and cache purity decides whether a materialized value denotes the same fact. Only after both hold does §6 choose the economically optimal realization: unavoidable recurrence may explicitly recompute below the cost floor, and a provider is an optimization only when measured total serving cost is below recomputation. The structural authority is `std.materialization_ladder`; a cache may discharge unavoidable recurrence, and may never excuse authored duplication. +**Minimize the demand graph before materializing its answers.** A repeated computation is first evidence of authored duplication: where demands share a least common ancestor, carry or share the first value — a cache there only makes redundant work cheap and hides the signal that ranks it for deletion. Unavoidable recurrence creates one reuse obligation at the least common visible ancestor, discharged by a provider whose scope, coverage, key (every declared input) and retention reach it, or refused with a typed cause; a provider earns its place only when serving is measured cheaper than recomputing. Authority: `std.materialization_ladder` — a cache may discharge unavoidable recurrence, never excuse authored duplication. -The test that an edit actually *reduced* redundancy rather than moving it: **net concepts must not grow by re-invention.** Decomposing a leaf by minting a fresh authority for a concept that already exists is a failed decomposition. +The test that an edit *reduced* redundancy rather than moving it: **net concepts must not grow by re-invention.** Decomposing a leaf by minting a fresh authority for a concept that already exists is a failed decomposition. ## 3. Single authority (what keeps §2 from being undone) -Minimization holds only if each fact lives in exactly one place. The recurring violation is **nicknaming — a second name for one concept** — which duplicates work at the meaning layer and, since we generate from concepts, duplicates it again in everything derived. A fork always gets consolidated later, so it is a correctness concern, not a style one. Until it is enforceable this is diligence: faithfully model the accepted universal frameworks (classical logic, set theory, algebra), and in `extdeps/` the real upstream spec — cite the source, keep its real names, declare its version, model what the API actually returns. +Minimization holds only if each fact lives in exactly one place. The recurring violation is **nicknaming — a second name for one concept** — which duplicates work at the meaning layer and again in everything generated from it. A fork is always consolidated later, so it is a correctness concern, not a style one. Until enforceable this is diligence: model the accepted universal frameworks (classical logic, set theory, algebra) faithfully, and in `extdeps/` the real upstream spec — cite the source, keep its real names, declare its version, model what the API actually returns. -Single authority applies to meaning, not only to code symbols. Nicknaming gives one meaning two names; its dual, a **meaning fork**, gives one name two materially different meanings. Product names, service names, tier names, status names, and terms in every layer are semantic carriers: within one naming surface and one declared effective version or epoch, holding the name constant may not silently change the obligations, quality floor, refusal behavior, billing consequence, or remedy — while the same spelling in explicitly distinct scopes, or across a declared version transition, is legitimate reuse. A materially different contract needs a materially different name. +Single authority governs meaning, not only symbols. Nicknaming's dual is a **meaning fork**: one name, two materially different meanings. Within one naming surface and one declared version or epoch, holding a name constant may not silently change obligations, quality floor, refusal behavior, billing consequence or remedy; the same spelling in distinct scopes, or across a declared version transition, is legitimate. A materially different contract needs a materially different name. -Two corollaries. The import graph's only structural law is **acyclicity**: the `std`/`extdeps`/`compiler`/`workflow` folders are browsing conventions, not a direction rule. And a fact's home is its *layer*, not its file — paths are discriminators, not gospel. +Two corollaries. The import graph's only structural law is **acyclicity**: the `std`/`extdeps`/`compiler`/`workflow` folders are browsing conventions, not a direction rule. And a fact's home is its *layer*, not its file. -The load-bearing consequence is that **interface, realization and policy are three facts, not one row.** For a dependency: the *interface shape* is what `extdeps/` owns; the *transport* (shell, REST, SDK) is a §2 Realization handler bound to that shape, one of N, never a fact about the dependency; and *business policy* — which base ref, which flag, an idempotency protocol the dependency does not provide — is a workflow fact, and modeling it in extdeps is a layer inversion. The tells are mechanical: policy has leaked when an argv carries a literal it should receive as a parameter; transport has fused when one operation is forked once per transport instead of one shape with N bound handlers. Its direction is always the same: **the dispatch that selects a realization is itself realization**, so it sits peripheral, never in the interface. +The load-bearing consequence: **interface, realization and policy are three facts.** `extdeps/` owns a dependency's *interface shape*; *transport* (shell, REST, SDK) is one of N handlers bound to it; *business policy* (which base ref, which flag) is a workflow fact. Policy has leaked when an argv carries a literal it should receive as a parameter; transport has fused when an operation is forked per transport. **The dispatch that selects a realization is itself realization**, so it sits peripheral. -*e.g.* one "vendor" concept once forked three ways by rigor — `CpuVendor`/`DramManufacturer` closed enums vs a stringly `GpuFacts.vendor` — now dissolved into a single generic `Vendor` whose cited company entities live one-file-each in `extdeps/vendor/`. Likewise `std/os.dag` projects per-vendor rows with no `match`, while the cited rows and the product-to-vendor dispatch live in `extdeps/os/`. +*e.g.* one vendor concept once forked three ways by rigor — `CpuVendor`/`DramManufacturer` closed enums beside a stringly `GpuFacts.vendor` — dissolved into one generic `Vendor` whose cited company entities live one file each in `extdeps/vendor/`. Likewise `dag/std/os.dag` projects per-vendor rows with no `match`, while the rows and the product-to-vendor dispatch live in `extdeps/os/`. -**§3 standing rule — cite the symbol, not the position.** A `file:line` pointer is a second, positional naming scheme for something the containment tree already names, and it decays in a way a nickname does not: any edit *above* the cited line silently invalidates it. Name the module and symbol; add a position only where no symbol exists to name — a generated artifact, a data row, a line inside a blob — and where a position is carried, it is a convenience beside the symbol, never the citation itself. Grep-verifying a symbol is the same `Node`-tree read the namespace authority already performs, so a stale name is decidable and enforceable; a line is not reachable from that tree at all. +**Cite the symbol, not the position.** A `file:line` pointer is a second, positional naming scheme that any edit above the line silently invalidates. Name the module and symbol; a position is carried only where no symbol exists (a generated artifact, a data row, a line inside a blob), and then beside the symbol, never as the citation. A stale symbol is decidable from the `Node` tree; a line is not reachable from it at all. -### §3 standing rule — a witness discriminates at one interface +### A witness discriminates at one interface -A fact's home is its layer; so is a CLAIM's subject. A witness exists to discriminate at ONE INTERFACE — it establishes what a function returns for inputs of a given shape — and its inputs belong at that boundary as SUPPLIED VALUES rather than as the output of executing the layers beneath it. Deriving them re-executes production the claim is not about, and it does so once per claim, so the same computation is paid again by every witness downstream of it. That is §2's duplicated work wearing a test's clothes, and because the substrate is a pure dependency graph, supplying a value IS the whole mechanism: no framework, no injection, just constructing the input instead of computing it. +A claim's subject has a layer too. A witness establishes what ONE interface returns for inputs of a given shape, so its inputs are SUPPLIED VALUES at that boundary; deriving them re-executes production the claim is not about, once per claim — §2's duplicated work in a test. The tell: the claim's cost does not move when its assertions change. Reach is usually transitive (a fold over fifteen producers gives its claims their union), and its sharpest form is a production module importing `test.claim.*` (receipt gunbc#11457: 1,212,647 eval steps, approved twice). Supply the values; never buy the reach with a debt row. -The tells are mechanical and cost-shaped. A claim whose evaluation is dominated by ONE call whose RESULT SHAPE is all it inspects. Two claims making the same call on the same input where one assertion implies the other, each paying the call in full. A conjunction of independent cases that forces every case through one budget when splitting them loses no coverage. And the diagnostic is the same in every instance: the claim's cost does not move when its assertions change, because the assertions were never the expense. +**The pairing obligation:** every supplied boundary owes ONE INHABITANCE CLAIM that the real producer emits that shape, asserting the ROUTE and not only the answer, and SUPPLYING INPUTS MAY NEVER REMOVE THE LAST EXECUTION OF THE REAL PATH — deleting the integration must make a control fail. A designed fixture can stay green after its world moves by reaching the same verdict another way; the inhabitance claim is what turns a supplied hypothesis into a reading. -**The pairing obligation is what keeps this from being the absorbing fallback, and it is not optional.** Every boundary whose inputs a claim supplies owes ONE INHABITANCE CLAIM that the real producer emits that shape, AND SUPPLYING INPUTS MAY NEVER REMOVE THE LAST EXECUTION OF THE REAL PATH. A boundary may be supplied in any number of claims only while some claim still runs it for real: the test is that DELETING THE INTEGRATION MUST MAKE A CONTROL FAIL, and a claim over a designed field cannot fail for that reason because its field is not the product's. An inhabitance claim that checks only SHAPE satisfies the letter of this obligation and loses its substance -- shape agreement and execution are different facts, and only the second is evidence that the program runs — the real field reaches the real decision, the real observation populates the real screen. Without it a suite is fast, green and establishes nothing, which is §5's specification-without-execution moved down a layer: each claim is individually honest and the set proves no program. A supplied input is a hypothesis about a boundary; the inhabitance claim is what makes it a reading. +### Replacement migrations cut over at the root -The failure the pairing catches is not hypothetical and it is quiet. A designed fixture can keep passing after the world it was designed against moves, by reaching the same verdict through a DIFFERENT mechanism than the one the claim exists to exercise — so the claim is green, its assertion is true, and the wall it was built to be is gone. That is why the inhabitance claim must assert the ROUTE and not only the answer. +When two structures answer one semantic question and one is to disappear, the change is a **replacement migration**: editing X leaf-upward keeps its root alive while every intermediate state becomes load-bearing, and a surviving X is an **attractor** whose vocabulary keeps shaping decisions premised on an assumption scheduled to die. -THE RULE IS ABOUT LAYERS, AND COST IS ONLY ITS SYMPTOM. A claim reaches too far the moment its subject stops being ONE interface, and the reach is usually transitive rather than written: a fold that assembles a report from fifteen producers gives any claim over it the union of their subjects. The sharpest form is a claim that re-executes ANOTHER MODULE'S CLAIM FUNCTIONS — each of those already has its own subject and its own discriminating red, so re-running them asserts nothing new and pays for all of it again, which is §2's duplicated work wearing a test's clothes. Its enabling condition is a LAYER INVERSION worth refusing on its own: a production module that imports `test.claim.*` has made every consumer of that module a transitive consumer of those claims. RECEIPT (gunbc#11457): `gunbc.demo.semantic_system_readout` imported five witness modules and called thirteen of their claim functions; one claim over its fold measured 1,212,647 eval steps and 3,743ms against a 302ms enrolment margin, and TWO REVIEWERS APPROVED IT, one citing it as satisfying the pairing obligation. So the budget refusal is the tell that fires, not the rule that was broken — a cheap claim reaching the same way is the same defect undetected, and the remedy is to supply the values and keep ONE inhabitance claim for the real path, never to buy the reach with a debt row. +So the default is **delete-first**: uproot the root early, then fix forward minimally, solving each surfaced problem from first principles rather than restoring its old binding. In a fail-closed substrate **the deletion is the census — but only over the population a run compiles**. Outside the required gate (`gunbc.emitted_subject_build_gate emitted_subject_build_rows`, the closures of the entries those rows emit, so nearly every root is outside it) a dependent can stop resolving while the required job reports SUCCESS, so **for a root outside the gate, enumerate the consumers by name before you delete**. What cannot break loudly is covered by a declared, bounded §4b rung drop, never by silence. -### §3 standing rule — replacement migrations cut over at the root +Two carve-outs: -When two structures answer the same semantic question and one is intended to disappear, the change is a **replacement migration**, not a refinement. §2 prices an intermediate representation destined to be discarded as redundant work, and §3 forbids X and Y both answering for one fact. Editing X from its leaves upward preserves its root while every intermediate state becomes observable and load-bearing, so the migration creates more authority before it removes any. The deeper cost is that a surviving X is an **attractor**: while it stands, every nearby question is answered in its vocabulary, so decisions keep being premised on an assumption already scheduled for death — and A3 grounds agreement only on what stays stable across time, which a dead assumption by definition does not. +- **A gap-intolerant boundary keeps the staged form:** Y in shadow, then one transition that switches the root and deletes X. +- **Where no Y can hold the boundary, X stays frozen:** no new investment, no new rows on its growth surfaces. -So the default is **delete-first**: uproot the root as early as you can, then fix forward minimally with the new solution, solving each surfaced problem from first principles rather than restoring it to its old binding. In a fail-closed substrate **the deletion is the census — but only over the population a run compiles**. Every real dependent refuses loudly, so what breaks is exactly what was load-bearing. Outside the required gate (`gunbc.emitted_subject_build_gate emitted_subject_build_rows`: since the 2026-10-09 ruling the one required lane compiles only the import closures of the entries those rows emit, so nearly every root is outside it) the substrate still refuses and nothing asks it to: a product-layer dependent can stop resolving, stay broken, and let every required lane report SUCCESS — so **for a root outside the gate, enumerate the consumers by name before you delete**. What cannot break loudly is covered by a declared, bounded §4b rung-drop, never by silence. Two carve-outs: a gap-intolerant boundary keeps the staged form — Y built in shadow, then one transition that switches the root and deletes X together — and where no Y can hold the boundary at all, X stays but stays **frozen**: no new investment, no new rows on its growth surfaces. +**Atomic describes the authority transition, not the effort:** X's authority ends in one motion, Y never falls back to, resolves through or derives from X (X may serve as an offline differential oracle), and the minimum Y preserves every required refusal. -**"Atomic" describes the authority transition, not the amount of implementation work.** Y has one coherent root, ordinary production never accumulates consumers that understand both representations, and X's authority ends in one motion. Y may freely reuse stable primitives, and X may serve from history as an offline differential oracle — but Y never falls back to X, resolves through it, or derives its answer from it. And the minimum Y is not the smallest thing that executes the happy path: it must preserve every required refusal, or it has erased a correctness distinction rather than completed the replacement. +Frozen is the wrong state for a production-critical X whose replacement paused indefinitely, which is the v1 seed's situation; v1 is semantics-frozen, maintenance-active, under a PURPOSE test: a change is admitted when it serves the v2 self-host program. The authority is `gunbc.v1_maintenance_standing v1_seed_standing`, which also records that an active-maintenance arm becomes absorbing if every proposal classifies as admissible, and that its vocabulary is enforced by review, not by a gate. -The frozen-X carve-out is the wrong state for a production-critical X whose replacement was paused indefinitely, which is the v1 seed's situation. v1 is therefore reclassified — semantics frozen, maintenance active — under a PURPOSE admission test: a change is admitted when it serves the v2 self-host program, and v1 stays closed to growth for its own sake. The authority is `gunbc.v1_maintenance_standing v1_seed_standing`, which also records the standing danger that an active-maintenance arm becomes an absorbing one if every proposal classifies as admissible, and states its own rung honestly: the vocabulary is consumed by review diligence, not by any gate. - -The full doctrine — the operative loop, the consumer-relative root, the disposition census, the greedy root-first cut search, the terminal receipt — is → [replacement migration doctrine](docs/plans/replacement-migration-doctrine.md), with its cut programs at → [floor-cut](docs/plans/floor-cut-replacement-plan.md) · [namespace-cut](docs/plans/namespace-cut-replacement-plan.md). +The full doctrine (operative loop, consumer-relative root, disposition census, root-first cut search, terminal receipt): → [replacement migration doctrine](docs/plans/replacement-migration-doctrine.md); cut programs → [floor-cut](docs/plans/floor-cut-replacement-plan.md) · [namespace-cut](docs/plans/namespace-cut-replacement-plan.md). ### External upstream decomposition -“One concept, one authority” unifies a shared interface or formal shape; it does not merge independently governed entities that inhabit that shape. Each independently versioned upstream product, implementation, engine, vendor, or specification has its own extdeps module authority. A generic hub may define or re-export agnostic shapes, but it may not enumerate concrete products, dispatch among their authorities, carry product-specific version rows, or store consumer coverage state. - -Observations produced by this repository are receipts in the observing product or workflow layer, not facts owned by the observed upstream. Missing observations are coverage obligations downstream, never `Unobserved` properties authored inside an upstream module. +One concept, one authority unifies a shared interface or formal shape; it does not merge independently governed entities that inhabit it. Each independently versioned upstream product, implementation, engine, vendor or specification has its own extdeps module. A generic hub may define agnostic shapes but may not enumerate concrete products, dispatch among them, carry product version rows, or store consumer coverage state. Observations this repository makes are receipts in the observing layer, not facts of the observed upstream; a missing observation is a downstream coverage obligation, never an `Unobserved` property inside the upstream module. ``` extdeps.whatwg.html_navigation shared standard @@ -93,177 +90,332 @@ A Chrome change must not require editing Safari’s module. Adding Opera must no ## 3b. Conformance (§2–§3 applied to a change) -§2 and §3 describe the corpus at rest: one concept, one authority. **Conformance is the same law applied to a change in motion**, and it is stated separately because it has received far less attention than the law it applies (operator ruling, 2026-09-06: "it needs more attention than it has received because it is incredibly important"). A change touches some set of concept domains — it caches something, holds something exclusively, places work on a machine, restates an upstream fact — and for every such domain the corpus already carries a home: the module whose declarations *are* that concept. The conformance question is not "is this change good" but **"does this change inhabit the existing model of each domain it touches, and where it does not, does it say why?"** The answer is three-valued, and the middle value is the whole reason the question is worth asking: **conforms**; **diverges with a stated reason** (a deliberate departure, its reason beside it, which is often the correct move and is admitted); **diverges with no reason** — the only red, because an unstated divergence is a fork of the authority (§3) that will be consolidated later at interest (§2), and its author is the one person who could have said cheaply whether it was intended. A two-valued reading loses exactly the middle, so it either blocks every deliberate departure or admits every accidental one. +**Conformance is §2–§3 applied to a change in motion** (ruling `gunbc.design_ruling conformance_needs_attention`). A change touches concept domains — it caches, holds something exclusively, places work, restates an upstream fact — and for each the corpus already has a home module. The question is: **does this change inhabit the existing model of each domain it touches, and where it does not, does it say why?** The answer is three-valued: + +- **Conforms.** +- **Diverges with a stated reason** — admitted, and often correct. +- **Diverges with no reason** — the only red, because an unstated divergence forks the authority (§3) and its author was the one person who could cheaply say whether it was intended. + +A two-valued reading loses the middle and either blocks every deliberate departure or admits every accidental one. + +A domain is added by adding a row with its home; the leasing row's authorization-pattern clause was added that way (ruling `gunbc.design_ruling authorization_pattern_is_a_selection`). A domain whose home does not yet exist is a modeling obligation (§6), not a row; a home that does not resolve is a §3 citation defect; a home that owns only part of the row's claimed scope is a scope mismatch on the row. Single authority (§3) keeps naming and citation, minimize-redundancy (§2) keeps copied work, and conformance owns *inhabitance*. Criterion keys are distinct (`gunbc.roadmap.roadmap_review_criteria` `review_criterion_identities_are_unique`) but not semantically exclusive, so two criteria may report one defect from two perspectives. + +**On the ladder (§4b)** a reviewer over a finished diff is *mitigation*. The climb: which domains a change touches is derivable before any worker runs — from the modules its plan imports and the vocabulary it introduces that a home already owns — so plan admission can name the homes in the brief and spawn only the reviewers the change reaches, leaving the roster as the safety net. + +The roster is modeled in `gunbc.design_argument` `conformance_domains`, and `gunbc.roadmap.roadmap_review_criteria` derives one reviewer from each row; the reviewer's question and tells live in its brief. Each domain below states: + +- **Owns** — the part of a change reviewed under this domain. +- **Boundary** — a nearby responsibility owned elsewhere. +- **Existing authorities** — declarations that already carry the model. A conforming change reuses or extends them rather than introducing a parallel representation. + +### External facts + +**Owns.** Facts governed by an independently versioned upstream: a specification, product, implementation, vendor, protocol, unit or tool. Each such upstream has its own extdeps module (section 3, external upstream decomposition). + +**Boundary.** Product policy, observations this repository makes, dispatch among upstreams and coverage state belong to the consuming layer, never to extdeps. + +**Existing authorities** + +- **Upstream ownership** — what an external model may own + - `extdeps.external_authority::ExternalModelScope` + +### Materialization / realization + +**Owns.** Faithfully storing and executing an admitted identity and result contract: completeness, readback, retention, transport, refusal and binding, with no substituting, truncating or bypassing the admitted key. Cache purity is one discriminator, not the whole domain. + +**Boundary.** The key relation itself belongs to keys / hashing; this domain begins once the identity and contract are admitted. + +**Existing authorities** + +- **Materialization contract** — what is requested and what result is promised + - `std.realization::Materialization` + - `std.materialization_provider::ArtifactRequest` +- **Storage contract** — how admitted results are stored and read back + - `std.artifact_store::ArtifactStore` + - `std.cache_interface::StorageSurface` + +### Leasing, locking, grants and privileged access + +**Owns.** Exclusive or bounded use of a resource, and the authorization a privileged effect requires. + +**Boundaries.** + +- A slot whose generation line is an audit trail keeps it whole; a slot whose only fact is its head uses the distinct windowed operations, a separate contract rather than a mode. +- Which authorization pattern performs a privileged effect is a section 3d selection, not a call-site choice; its census classifies every current site by executing the selection. + +**Existing authorities** -The domain roster is a modeled fact, not this prose: `gunbc.design_argument` `conformance_domains` carries one row per domain — key, label, question, the home authorities as declaration references, tells, narrative — and `gunbc.roadmap.roadmap_review_criteria` derives one reviewer per row from it, exactly as it derives every other criterion from its proposition (§3: no second list). The domains carried at this writing, named so a reader knows what the reviewers are checking against: +- **Lease and exclusion** — time-bounded possession and atomic updates of shared state + - `std.temporal_effect::HeldLease` + - `std.durable_compare_and_set::CasExpectation` + - `gunbc.durable_cas_file_store::file_compare_and_set_windowed` + - `std.durable_exclusive_hold::DurableHoldState` +- **Grant and resource scope** — what may be used, by whom, under what authority + - `std.scoped_authorization::ScopedAuthorization` + - `std.effect_grant::Grant` + - `std.resources::ResourceHandle` +- **Authorization-pattern selection** — chooses the admissible mechanism for an effect + - `gunbc.auth.authorization_pattern_selection::select_authorization_pattern` + - `gunbc.auth.access_token_source::select_access_token_source` +- **Recurring automated access** — workload identity and scoped secret access + - `gunbc.auth.github_gcp_federation::github_wif_provider` + - `gunbc.auth.gcp_secret_access::SecretAccessGrant` +- **One-off approved access** — requests, capabilities and redemption + - `gunbc.auth.access_request::AccessRequest` + - `gunbc.auth.approval_capability::ApprovalCapability` + - `gunbc.auth.approval_broker::redeem_capability` +- **Coverage evidence** — classifies the privileged-effect sites that exist today + - `gunbc.auth.privileged_effect_census::privileged_effect_census` -- **external facts** — each independently versioned upstream has its own module; this is the strongest instance and was, until this section, the only one with a reviewer. Home authorities: `extdeps.external_authority::ExternalModelScope`. -- **materialization / realization** — materialization and realization are separate interfaces with admissible handlers: materialization presents and stores an admitted identity and result contract; realization orders, places and transports work. This row owns whether a handler, provider or placement faithfully realizes that admitted identity and result contract (completeness, readback, retention, transport, refusal, binding obligations) without substituting, truncating or bypassing the admitted key. Cache purity is one discriminator across that boundary, not the whole domain. Key RELATION -- what relation, what scope, what complete canonical preimage, equality and collision disposition, and whether declared inputs are complete -- is owned by conformance-identity. Home authorities: `std.realization::Materialization`, `std.materialization_provider::ArtifactRequest`, `std.artifact_store::ArtifactStore`, `std.cache_interface::StorageSurface`. -- **leasing / locking / grants / privileged access** — exclusive or bounded use and privileged access are one domain: leases with a declared deadline, compare-and-set expectations, scoped authorizations, grants naming who may perform an effect and how it is released, resource handles -- and, since 2026-09-19, which AUTHORIZATION PATTERN performs a privileged effect. That pattern is a §3d selection (gunbc.auth.authorization_pattern_selection consumes std.decision over the effect's frequency, reversibility, surface, workload-identity binding, minted reach and billing consequence): workload identity federation with a per-secret cell for recurring automated effects, one operator approval through the ntfy loop for one-off or witnessed effects, and a named human-only step where no API exists. The census (gunbc.auth.privileged_effect_census) classifies every current site by executing that selection, so the reviewer's three-valued answer is derived for the sites that exist and asked of the site a change adds. A compare-and-set slot's generation line is kept whole by file_compare_and_set and observe_cas_slot_state (gunbc.durable_cas_file_store), because several slots read it as an audit trail; a slot whose only fact is its head -- the materialization store's occupancy index and family holds are the first -- uses the distinct windowed operations (file_compare_and_set_windowed, observe_cas_slot_state_windowed, and the file_hold_*_windowed family) with a CasGenerationWindow of k >= 2, so a bounded store's own bookkeeping does not grow with its commits. They are two contracts, not one operation with a mode: keep-all callers are untouched, and only a caller that names the windowed operation can delete generations. A window read takes the head from a listing of the slot root and verifies head+1 is absent, re-reading on a race and never guessing; a write reclaims below head-k only after its own commit, and a refused delete is reported, never fatal. Exclusion is unchanged -- losers re-read and retry -- so nothing waits on a hold. docs/plans/fabric-storage.md names the head-probe bound this also lifts and assigns its remedy to compaction -- a head that starts from a snapshot; a window is that head-starting-above-1 shape for a slot whose history needs no snapshot, and the fabric heads are not opted in. Home authorities: `std.temporal_effect::HeldLease`, `std.durable_compare_and_set::CasExpectation`, `gunbc.durable_cas_file_store::file_compare_and_set_windowed`, `std.durable_exclusive_hold::DurableHoldState`, `std.scoped_authorization::ScopedAuthorization`, `std.effect_grant::Grant`, `std.resources::ResourceHandle`, `gunbc.auth.authorization_pattern_selection::select_authorization_pattern`, `gunbc.auth.github_gcp_federation::github_wif_provider`, `gunbc.auth.gcp_secret_access::SecretAccessGrant`, `gunbc.auth.access_request::AccessRequest`, `gunbc.auth.approval_capability::ApprovalCapability`, `gunbc.auth.approval_broker::redeem_capability`, `gunbc.auth.access_token_source::select_access_token_source`, `gunbc.auth.privileged_effect_census::privileged_effect_census`. -- **fabric / compute** — allocation, placement and negotiation of resources. The shared authority is product.capacity (lease, pool, seat events) and product.fabric (priced selection over a provider parameter); the subjects that consume it are compute cells (work contracts, compute layouts, cell reservations, capacity class admission) and inference serving (seat binding, co-tenancy admission). Serving is INSIDE this domain, not beside it -- but the sharing is partial and the boundary is the point: both subjects reach the same priced selection fold, and each carries its OWN occupancy producer and linearization (serving: a termed LeaseGrant settled by fabric_seat_acquire over an event chain; compute: a timeless LeaseIdentity settled by file_compare_and_set). They differ further in what the lease is over -- a compute cell is stateless between grants and settles money, a serving seat is over a replica with loaded state and is quality-conditioned instead. The argument is [the serving capacity home ruling](docs/plans/serving-capacity-home-ruling.md). Home authorities: `product.fabric.selection::select_supply`, `product.capacity.lease::LeaseGrant`, `product.capacity.pool_events::SeatRequest`, `product.fabric.work::ExecutionRequirements`, `gunbc.fabric_event_log::fabric_seat_acquire`, `gunbc.compute.work_request::WorkOperation`, `gunbc.compute.work_provider_local::ComputeLayout`, `gunbc.fabric_control_plane::CellReservation`, `gunbc.fabric_executor_class::CapacityClassAdmission`, `gunbc.harness.harness_seat::harness_bind_seat`, `gunbc.serving.turn_admission::serving_group_admission`. -- **decision / selection** — a choice must remain attributable to its subject, candidate field, constraints, evidence and policy, and conformance exposes accidental forks of that authority; the hard selection laws -- no answer outrunning its evidence, no front standing as a winner -- stay with the §3d reviewer, and goal assessment (std.goal_assessment) is a boundary of this row, not a member of it. Home authorities: `std.decision::DecisionSubject`, `std.decision::RealizationSelectionResult`, `std.decision::SelectionReceipt`, `std.decision::select_realization`, `std.pareto::SelectionAxis`, `std.pareto::ParetoEntry`, `std.pareto::DominanceVerdict`. -- **keys / hashing** — the row's scope today is the three keying relations that have a consumed home: structural node identity (v2.std.node content_hash over std.content_hash HashFamily), the request and artifact keys of std.materialization_provider (request_key, artifact_request_key), and occurrence identity within one source graph (std.occurrence_identity) -- plus the declared-equality admissibility of a key TYPE (std.algebra algebra_profile_equality_extensional), which governs whether distinct keys of a finite map are decidably distinct (consumed by the map-literal duplicate-key check, docs/plans/map-literal-introduction-design.md). That admissibility is instantiation-blind at this rung: an opaque brand or a type parameter admits unjudged, and its next-rung trigger is instantiation-grain admission (v1 infer equality_admission_wall_note). This row owns the key RELATION -- what relation, what scope, what complete canonical preimage derives it, what equality and collision disposition govern it -- and whether the declared inputs are complete. Faithful realization of an admitted identity and result contract (completeness, readback, retention, transport, refusal, binding; cache purity as one discriminator) is owned by conformance-realization. Two further relations -- demand identity (the question asked) and the dependency read set an answer consumed -- are a declared frontier, not members: they have no home authority yet, are modeled by docs/plans/demand-engine-program.md, and enter this row when M1 of that program lands their carriers; until then a reviewer asks nothing about them under this row (DESIGN §3b: a home that owns only part of a claimed scope is a scope mismatch, so the scope is stated at what the homes own). Each member is a named keying relation within a named scope, derived rather than authored; the relation model is docs/plans/keying-relation-design.md. Home authorities: `std.content_hash::HashFamily`, `std.materialization_provider::request_key`, `v2.std.node::content_hash`, `std.occurrence_identity::OccurrenceIdAllocator`, `extdeps.realization.cache_purity::CachePurityVerdict`, `std.computation_identity::ComputationIdentity`, `std.algebra::algebra_profile_equality_extensional`. -- **process observability / reporting** — operators and automated readers need reports traceable to the facts and occurrences they describe; the owning domain establishes the fact, the observation model represents its occurrence, the renderer or codec encodes it, and a bound effect delivers it -- four responsibilities, and producing bytes is not delivery. The row is scoped to process reporting: a repository population measured at a revision stays with gunbc.repository_census_observation, and durable delivery with the effect authorities. Home authorities: `std.observation::ObservationEvent`, `std.observation::RecordedObservation`, `std.observation::ObservationPresentation`, `gunbc.observation_ci_render::ci_event_line`, `gunbc.observation_ci_render::ci_render_line`. +### Fabric / compute -A domain is added by adding a row with its home; a domain whose home does not yet exist is not a conformance row but a modeling obligation (§6), and a row naming a home that does not resolve is a §3 citation defect. Two boundaries keep this criterion exclusive of its neighbors: **single-authority** (§3) keeps naming and citation — a second name, a literal where a modeled value exists, a positional citation — while conformance owns *inhabitance* of an existing model; and **minimize-redundancy** (§2) keeps copied work regardless of domain. The partition is a boundary between propositions, not a proof: `gunbc.roadmap.roadmap_review_criteria` `review_criterion_identities_are_unique` establishes only that no two criteria share a key and explicitly disclaims semantic exclusivity, and the worker feedback's overlap count groups findings by file for presentation, so two criteria may legitimately report one defect from two perspectives. Semantic exclusivity is held at the level of representative boundary cases in review, at its actual evidence level and no higher. One more distinction the row vocabulary keeps: a home that resolves but owns only part of the scope a row claims is a scope/ownership mismatch on the row, not the citation defect of a reference that fails to resolve. +**Owns.** Selection, allocation, placement and admission of compute resources. product.capacity and product.fabric are the shared authority, consumed by compute cells and by inference serving. -**Where this sits on the ladder (§4b).** As a reviewer over a finished diff it is *mitigation*: the divergence has been written and is caught after the fact. Its climb is the printing-press direction (operator, 2026-09-06): which domains a change touches is derivable *before* any worker runs — from the modules its plan imports, and from the vocabulary it introduces that a home already owns — so plan admission can name the home authorities in the brief, spawn only the domain reviewers the change reaches, and hand each one a single diff against a single named interface. That turns a twenty-round exploration into a one-round question, and it leaves the review roster as the safety net it should be rather than the place the model is first consulted. +**Boundary.** Compute cells and serving share the priced selection fold but not one occupancy model: a compute cell is stateless between grants and settles money, while a serving seat holds a loaded, quality-conditioned replica ([serving capacity home ruling](docs/plans/serving-capacity-home-ruling.md)). + +**Existing authorities** + +- **Shared demand and supply selection** — what work needs and which supply serves it + - `product.fabric.selection::select_supply` + - `product.fabric.work::ExecutionRequirements` + - `gunbc.compute.work_request::WorkOperation` +- **Compute cells** — layout, reservation and admission + - `gunbc.compute.work_provider_local::ComputeLayout` + - `gunbc.fabric_control_plane::CellReservation` + - `gunbc.fabric_executor_class::CapacityClassAdmission` +- **Seats and serving** — seat demand, grants and occupancy + - `product.capacity.lease::LeaseGrant` + - `product.capacity.pool_events::SeatRequest` + - `gunbc.fabric_event_log::fabric_seat_acquire` + - `gunbc.harness.harness_seat::harness_bind_seat` + - `gunbc.serving.turn_admission::serving_group_admission` + +### Decision / selection + +**Owns.** A choice that stays attributable to its subject, candidate field, constraints, evidence and policy; this domain exposes accidental forks of that authority. + +**Boundaries.** + +- The hard selection laws stay with the section 3d reviewer. +- Goal assessment (std.goal_assessment) checks an already chosen state; it is a boundary of this domain, not a member. + +**Existing authorities** + +- **Decision subject, result and receipt** — what is decided and the record of the choice + - `std.decision::DecisionSubject` + - `std.decision::RealizationSelectionResult` + - `std.decision::SelectionReceipt` + - `std.decision::select_realization` +- **Pareto evidence** — axes, readings and dominance; a frontier, never a winner + - `std.pareto::SelectionAxis` + - `std.pareto::ParetoEntry` + - `std.pareto::DominanceVerdict` + +### Keys / hashing + +**Owns.** The key relation: what is identified, in what scope, from what complete canonical preimage, under what equality and collision rules, and whether its declared inputs are complete. + +**Boundaries.** + +- Faithfully realizing an admitted identity belongs to materialization / realization. +- Demand identity and the dependency read set are a declared frontier, entering when M1 of [demand-engine-program.md](docs/plans/demand-engine-program.md) lands their carriers. The relation model is [keying-relation-design.md](docs/plans/keying-relation-design.md). + +**Existing authorities** + +- **Hash family and structural identity** — how a node's identity is computed + - `std.content_hash::HashFamily` + - `v2.std.node::content_hash` +- **Request, computation and occurrence identity** — the keys materialization and source graphs use + - `std.materialization_provider::request_key` + - `std.computation_identity::ComputationIdentity` + - `std.occurrence_identity::OccurrenceIdAllocator` +- **Equality and cache admissibility** — whether a key type's equality may be relied on (instantiation-blind at this rung) + - `std.algebra::algebra_profile_equality_extensional` + - `extdeps.realization.cache_purity::CachePurityVerdict` + +### Process observability / reporting + +**Owns.** Process reports traceable to the facts and occurrences they describe: the owning domain establishes the fact, the observation model represents its occurrence, a renderer encodes it, and a bound effect delivers it. + +**Boundaries.** + +- Producing bytes is not delivery. +- A repository population measured at a revision stays with gunbc.repository_census_observation. + +**Existing authorities** + +- **Observation and recording** — the occurrence and its record + - `std.observation::ObservationEvent` + - `std.observation::RecordedObservation` +- **Presentation** — how an observation is shown + - `std.observation::ObservationPresentation` +- **CI encoding** — the rendered CI line + - `gunbc.observation_ci_render::ci_event_line` + - `gunbc.observation_ci_render::ci_render_line` ## 3c. Consumption (who consumes a change, and how) -Conformance (§3b) asks whether a change inhabits the models that already exist. **Consumption asks the converse of every model the change adds: who consumes it, and by what executing route** (operator ruling, 2026-09-06: adding dangling modeling is interrogated separately, and the consumption must be understood well). The question is older than this section — §5 already rules that a typecheck and a grep are not consumers, and §6 lists *a new artifact with no final consumer* among the tells of experimental residue — but it was folded into other reviewers' questions, so a diff that added a well-shaped type, a data row and a witness proving the row exists could pass every criterion while nothing ever read the row. A declaration nothing consumes is §2's redundant work in its purest form: it costs authoring, review and maintenance and displaces nothing. +Conformance asks whether a change inhabits existing models; **consumption asks the converse of every model it adds: who consumes it, and by what executing route** (ruling `gunbc.design_ruling consumption_interrogated_separately`). §5 already rules that a typecheck and a grep are not consumers, but folded into other questions it let a diff add a well-shaped type, a row and a witness that the row exists while nothing read the row. A declaration nothing consumes is §2's redundant work in its purest form. -The reviewer's question is therefore two-part and both halves are located: for each declaration the change adds — type, function, data row, module, witness — **name the consumer** (the fold, the entry point, the realization, the emitted artifact) **and the route** by which it reaches that consumer at execution, or classify the declaration as one of three honest states: consumed by execution in this change; consumed by a named consumer that lands in a named later change (a declared frontier, which is admissible only with the trigger stated beside it); or dangling. Only the third is red, and it is red regardless of how well modeled the dangling piece is — the review is not of the model's shape but of its inhabitance by the rest of the program. The tells are mechanical: a `pub` declaration with no call site in the closure; a data row no fold reads; a module no module imports; a witness that asserts a declaration exists rather than exercising it; consumption described in the PR body but absent from the diff. +For each added declaration, **name the consumer** (fold, entry point, realization, emitted artifact) **and the executing route**, or classify it: consumed in this change; consumed by a named later change (a declared frontier, with its trigger); or dangling — the only red, however well modeled. Tells: a `pub` declaration with no call site in the closure, a row no fold reads, a module nothing imports, a witness asserting existence rather than exercising behavior, consumption claimed in the PR body but absent from the diff. -**Where this sits on the ladder (§4b).** As a reviewer it is *mitigation*; its climb is the same one §6 names for authorship facts: a declaration's consumers are a fact the namespace tree already carries, so the unconsumed set is derivable at ingestion for the closure a change compiles, and plan admission can require a change's new declarations to arrive with their consumers in the same closure, refusing a dangling set before any worker runs. Until that lands, the reviewer is the wall, and it is the one criterion that reads the change from the outside in — from the consumers toward the declaration — rather than from the declaration outward. +**On the ladder (§4b)** the reviewer is *mitigation*. A declaration's consumers are already a fact of the namespace tree, so the unconsumed set is derivable at ingestion and plan admission can refuse a dangling set before any worker runs. Until then this is the one criterion that reads a change from its consumers inward. ## 3d. Selection precedes convergence -**Selection precedes convergence.** A convergence primitive (`std.goal_assessment`, `ensure`) neither enumerates subjects nor chooses a realization: it assesses a caller-supplied goal against an independent observation, or decides Noop/Apply/Refuse over a caller-supplied requirement with independent readback. Generating candidates or choosing policy inside convergence is the conflation this section forbids. The selection authority sits *before* those folds, in `std.decision`. +**Selection precedes convergence.** A convergence primitive (`std.goal_assessment`, `ensure`) neither enumerates subjects nor chooses a realization: it assesses a caller-supplied goal against an independent observation, or decides Noop/Apply/Refuse over a caller-supplied requirement with independent readback. Choosing inside convergence is the conflation forbidden here; the selection authority sits before those folds, in `std.decision`. -**Pareto assessment is not realization selection.** `std.pareto` computes dominance and the frontier — axis identities rather than positional alignment, per-axis orientation, interval-valued readings, `Incomparable` separated from `DominanceUndecided`, and refusal on missing or duplicated funded-axis readings. A Pareto front of two is not a winner. Realization selection is the policy-bound operation that can produce one desired realization; it **consumes** `std.pareto` and must not redeclare dominance, axis orientation, intervals, or evidence-gap vocabulary. Growing a second decision algebra beside Pareto is the §3 fork this law exists to prevent. +**Pareto assessment is not realization selection.** `std.pareto` computes dominance and the frontier: axis identities rather than positions, per-axis orientation, interval readings, `Incomparable` distinct from `DominanceUndecided`, and refusal on missing or duplicated funded-axis readings. A front of two is not a winner. Realization selection is the policy-bound operation that produces one desired realization; it **consumes** `std.pareto` and must not redeclare its vocabulary — a second decision algebra is the §3 fork. -The result is scoped, never `Optimal`: `SelectedWithin` binds a `SelectionReceipt` (decision subject, candidate-field identity and standing, constraint authority, funded axes, evidence snapshot, Pareto survivors, policy authority, selected identity). A different field, constraint set, evidence snapshot, funded-axis set or policy is a **different decision**, so a stale choice is mechanically detectable. Unresolved evidence is `SelectionNeedsEvidence`; two non-dominated survivors without a policy is `SelectionNeedsPolicy`; an attractive candidate that violates a hard constraint is excluded *before* Pareto, never ranked. Completeness of the subject — required (objective-term × decision-variable) cells as an identity join, invariance as a three-place relation, term drops only with order-preservation — remains a closed-subject obligation of the same home: absence is not irrelevance, and `SelectedWithin` may not mint over an incomplete closure. +The result is scoped, never `Optimal`: `SelectedWithin` binds a `SelectionReceipt` (subject, candidate-field identity and standing, constraint authority, funded axes, evidence snapshot, Pareto survivors, policy authority, selected identity). A change to any of those is a **different decision**, so a stale choice is detectable. The other outcomes: -This is also why §6 does not independently carry "prioritize holistically": ranking work on a funded multi-axis field rather than a bottleneck KPI **is** this law applied to authorship. Home: `std.decision`. A conformance domain is admitted only once its home is a consumed authority — a domain without a home remains a modeling obligation (§6), not a conformance row (§3b) — and `std.decision` now is one: `gunbc.spark.serving_deployment_selection` `select_serving_deployment` and `product.fleet_operating_point` `fleet_operating_point_selection` call `select_realization` and carry its result arms through, so the `conformance-decision` row of §3b names this home. That row is deliberately narrow. It asks whether a change *inhabits* the decision and Pareto models or states its departure; the hard laws above — no answer outrunning its evidence, no front standing as a winner, no missing reading becoming a zero, no convergence primitive choosing — stay with this section's own reviewer, and a stated departure admitted by the row excuses none of them. What the row does not cover is the effectful cycle that follows selection: planning, admission, actuation with uncertain completion represented, and independent post-actuation observation of the exact subject. `std.goal_assessment` owns remedy-free assessment against an observation and nothing after it, so that cycle has no consumed home yet, and its conformance row waits on one (its named first consumer is the fleet admission spine). Selection's receipt cannot substitute for admission or readback, and a successful actuation return cannot mint convergence. +- Unresolved evidence is `SelectionNeedsEvidence`. +- Two survivors without a policy is `SelectionNeedsPolicy`. +- A candidate violating a hard constraint is excluded *before* Pareto, never ranked. +- An incomplete subject — required (objective-term × decision-variable) cells are an identity join, and terms drop only with order preservation — refuses: absence is not irrelevance, and `SelectedWithin` may not mint over an incomplete closure. -## 4. The closed, grounded substrate (what makes §2–§3 decidable) +Ranking work on a funded multi-axis field **is** this law applied to authorship, so §6 does not restate it. `std.decision` is consumed (`gunbc.spark.serving_deployment_selection` `select_serving_deployment`, `product.fleet_operating_point` `fleet_operating_point_selection`), so §3b's decision row names it; that row checks inhabitance only, and the hard laws above stay with this section's reviewer. The effectful cycle after selection — admission, actuation with uncertain completion, independent observation — has no consumed home yet (first consumer: the fleet admission spine); a receipt cannot substitute for readback, and an actuation return cannot mint convergence. -You can unify and decompose *mechanically* only in a closed, grounded system. A program is a dependency graph over two primitives (`Node` + `Edge`) and a closed vocabulary: 6 connectives and 6 behaviors — `Value`, `Transform`, `Branch`, `Loop`, `Bind`, `Match`. Surface syntax is sugar that adds no power. Execution is **bounded and forward** (cyclic relations via acyclic encodings, never cyclic values; recursion is sugar over `Loop`), so decidability and termination *fall out* rather than being separately proved. +## 4. The closed, grounded substrate (what makes §2–§3 decidable) -**Grounding is intersubjective** — point at a shared framework, not an internal taxonomy — and in a closed system **a heuristic is never necessary**: the richer source always exists or can be written. This is why the structure is acyclic, in the substrate and in this document: agreement holds only across time, which demands claims that stay stable under it, so each is written as a consequence-chain you can re-interrogate, never a cycle that could quietly redefine itself. +You can unify and decompose *mechanically* only in a closed, grounded system. A program is a dependency graph over two primitives (`Node` + `Edge`) and a closed vocabulary of 6 connectives and 6 behaviors — `Value`, `Transform`, `Branch`, `Loop`, `Bind`, `Match`. Surface syntax is sugar that adds no power. Execution is **bounded and forward** (cyclic relations via acyclic encodings, recursion as sugar over `Loop`), so decidability and termination fall out rather than being separately proved. -Because the substrate is closed and grounded, the wins of §2 fall out for free: operations come from *inhabitance* (no per-type ops), and emission, ingestion, and coercion are **one** total decision procedure run in different directions — N models, not N×M adapters, every refusal a located, typed mismatch. +**Grounding is intersubjective**, and in a closed system **a heuristic is never necessary**: the richer source always exists or can be written. Because the substrate is closed, operations come from *inhabitance* (no per-type ops), and emission, ingestion and coercion are **one** total decision procedure run in different directions — N models, not N×M adapters, every refusal a located, typed mismatch. - *e.g.* `dag/std/algebra.dag` derives `Int.add` from `Int` inhabiting a ring; termination is *checked, not discovered* — `DescentEvidence = Strict | NonIncreasing | DescentUnknown` inhabits a `BoundedLattice` with bottom = fail-closed. -- *e.g.* **one grammar, read in both directions.** Ingest selects a production forward to fold surface syntax into a core `Node`; emit selects from the *same* rows backward — the structural inverse, not a second emitter — so a new target language is rows authored in `extdeps/languages/`, never an edit to the fold. Coercion is that same move turned sideways: whether one model inhabits another is a homomorphism check. One procedure asked in three directions, not three procedures. +- *e.g.* **one grammar, read in both directions.** Ingest selects a production forward to fold surface syntax into a core `Node`; emit selects from the *same* rows backward, so a new target language is rows in `extdeps/languages/`, never an edit to the fold. Coercion is the same move sideways: a homomorphism check. -**Coercion is the implicit-safe subset of declared conversions, not the name for every representation crossing** (operator ruling, 2026-09-26). An implicit route must be total, exact, semantics-preserving, unique, pure and consent-free; any phase that changes interpretation, requires proof, may lose information, needs a policy, or has competing routes makes implicit coercion refuse, and the author proceeds only by selecting a named conversion plan. Every phase stays represented in the typed program: a named composite may abbreviate the surface syntax but may not hide its composition. Target realization consumes the selected plan and may refuse inability to realize it, but never decides whether the conversion is semantically legal — so a target's cast table is not the source language's conversion semantics. *e.g.* `Bool` does not implicitly inhabit `Int`, a `Bool` literal is not an `Int` literal, and a plain `true as Int` refuses unless it names a declared route such as `bool_indicator`. +**Coercion is the implicit-safe subset of declared conversions** (ruling `gunbc.design_ruling coercion_is_the_implicit_safe_subset`). An implicit route must be total, exact, semantics-preserving, unique, pure and consent-free; a phase that changes interpretation, needs proof, may lose information, needs a policy or has competing routes refuses implicit coercion, and the author names a conversion plan. Every phase stays represented in the typed program. Target realization may refuse to realize a plan but never decides whether a conversion is legal, so a target's cast table is not the source language's semantics. *e.g.* `Bool` does not implicitly inhabit `Int`; `true as Int` refuses unless it names a declared route such as `bool_indicator`. -**Text has two representations of one type, and every crossing between them goes through the declared unfold or refuses** (operator ruling, 2026-09-27, revising XL-0T to B). Ruling 3 stands: `v2.std.text` `String` is `FreeMonoid`, and the kernel `String` is host text. Neither is a nickname for the other, so the only lawful route from host text to the structural carrier is the declared Unicode scalar unfold — the literal homomorphism `gunbc.structural_realization_bindings` `literal_homomorphism_rows` `UnicodeScalarSequenceUnfold` — and this section's law applies to it unchanged: a crossing with no such route is not coerced, it refuses. Four consequences are committed. Type compatibility keys on the exact declaration a position resolves to, never its leaf name, so the pairs Ruling 3 grounds through its declared identity are admitted and an untranslated crossing refuses — the discrimination the withdrawn identity wall lacked, which is why its first execution refused grounded code and was falsified. The unfold is not a property of literals: a non-literal value at any crossing elaborates through the same route or the crossing refuses, because a conversion that holds only where a spelling happens to be a literal leaves the value case to leaf-name agreement. The untranslated crossings already inside the emitted compiler are measured and each is dispositioned, as `gunbc.rung_drop.text_boundary_identity_wall` describes, and that drop's standing follows the measurement rather than the ruling. And the ruling is stated here, in the public design document, because a ruling that lives in a side chat leaves every lane that depends on it waiting on the chat. +**Text has two representations of one type, and every crossing goes through the declared unfold or refuses** (ruling `gunbc.design_ruling text_crossings_go_through_the_unfold`). `v2.std.text` `String` is `FreeMonoid`; the kernel `String` is host text; neither is a nickname for the other. The only route between them is the Unicode scalar unfold, `gunbc.structural_realization_bindings` `literal_homomorphism_rows` `UnicodeScalarSequenceUnfold`. Type compatibility keys on the exact declaration a position resolves to, never its leaf name; the unfold is not a property of literals, so a non-literal value at a crossing takes the same route or refuses; and the untranslated crossings inside the emitted compiler are measured and dispositioned under `gunbc.rung_drop.text_boundary_identity_wall`, whose standing follows the measurement. ## 4b. Safety: the guarantee ladder -Safety is not the presence of diagnostics or the absence of crashes — it is the reduction of the state space in which a program can silently do the wrong thing. Every discovered error class sits on one ordered ladder and is obligated to climb it: +Safety is the reduction of the state space in which a program can silently do the wrong thing — not the presence of diagnostics or the absence of crashes. Every discovered error class sits on one ordered ladder and is obligated to climb it: 1. **mitigatable** — the failure occurs; harm is contained by total operations, typed outcomes, bounds, rollback, isolation. -2. **mechanically preventable** — a generated test, lens, or gate reliably exposes and blocks it, but the invalid state remains writable and safety depends on that mechanism executing and staying enrolled. +2. **mechanically preventable** — a generated test, lens or gate reliably exposes and blocks it, but the invalid state remains writable and safety depends on that mechanism executing and staying enrolled. 3. **structurally guaranteed** — the source can still describe the invalid state, but no `Accepted` program contains it: the compiler derives a proof or refusal from modeled structure. -4. **structurally impossible** — the invalid state has no constructor in the canonical model. Validation is unnecessary because the bad state cannot be written. +4. **structurally impossible** — the invalid state has no constructor in the canonical model. -The higher rung subsumes the lower — construction over proof, proof over validation, validation over mitigation. Below the floor sits **silent wrongness, which is not a rung: it is outside the ladder and forbidden outright** (§5). Adjacent, and deliberately *not* a fifth rung, is **outside the modeled guarantee**: external reality, undecidable properties, undeclared intent. That column is observed, refused, or mitigated at a declared boundary, never fabricated — keeping it off the ladder prevents "we do not model this" from masquerading as a weak implementation that should climb. +Higher subsumes lower: construction over proof, proof over validation, validation over mitigation. **Silent wrongness is not a rung**: it is below the ladder and forbidden outright (§5). Beside the ladder, deliberately not a fifth rung, is **outside the modeled guarantee** — external reality, undecidable properties, undeclared intent — observed, refused or mitigated at a declared boundary, never fabricated, so that not modeling something cannot masquerade as a weak implementation. -**At the top rung, ask whether the check's RED is authorable before writing the check.** If the forbidden state cannot be expressed anywhere the check could run, the check is not a weak wall but a decoration — permanently green by construction, carrying no information, and worse than absent because it will be cited as coverage. That question has two boundaries and only the second decides it: a state unrepresentable in the ACCEPTED corpus may still be perfectly representable as SOURCE HANDED TO THE COMPILER BY A FIXTURE, and a compiler is precisely a thing whose regression probes are invalid programs. If the refusal is still authorable there, the evidence is enrollable there and declining it is specification-without-execution. Where no fixture harness can express the subject, that missing harness is the class's next-rung trigger, not a permanent ceiling. +**Before writing a top-rung check, ask whether its RED is authorable.** A check whose forbidden state is expressible nowhere it runs is a decoration, green by construction and later cited as coverage. A state unrepresentable in the accepted corpus is often still writable as fixture source handed to the compiler, and then declining that red is specification-without-execution; where no harness can express it, the missing harness is the next-rung trigger. -Every class carries an **attainable ceiling — derived, not aspirational**: a decidable, fully modeled class may reach structural impossibility; a decidable class missing its authority is §5's *wall after grounding*; a class blocked on a missing language capability names that capability as its trigger; an undecidable property honestly remains a ratchet or validator; an external fact remains a boundary obligation. **Below ceiling is a correctness gap, never optional elegance** — this is what keeps §6's purity trap from pricing out mandatory walls. +Every class has an **attainable ceiling, derived rather than aspirational**: a decidable, fully modeled class may reach structural impossibility; a decidable class missing its authority is §5's wall after grounding; a class blocked on a language capability names it as its trigger; an undecidable property remains a ratchet or validator; an external fact remains a boundary obligation. **Below ceiling is a correctness gap, never optional elegance.** Four meta-obligations make the ladder operational: -1. **Rung honesty, at a declared subject grain.** The reported rung must equal the rung established by executed evidence — a discriminating RED refused on the real acceptance path plus an accepted positive control — measured against a declared boundary. Source→interpretation, source→each emission target, and phase-carrier→phase-carrier are different paths with independently different rungs; a class's current rung is the **minimum across its in-scope paths**. Citing the strongest path while another stays silent is inflation, and a type name, diagnostic variant, inert lens, or plan establishes nothing. **Rung inflation** is the fabricated-plausible-output failure applied to the compiler's self-description — worse than sitting low, because an inflated class never ranks for climbing. -2. **No untracked stall.** A class below its ceiling must name its next-rung trigger, separating *cannot climb further* from *can climb after one grounding* from *can climb now but unbuilt*. Only the first is permanent. -3. **No silent regression.** A change may lower a rung only by declaring previous rung, temporary rung, reason, bounded population, and restoration trigger. A compatibility exemption is not bootstrap glue; it is a visible safety regression with a finite runway. **The trigger must name the CAPABILITY, not an artifact that would contribute to one** — a declared drop is retired by its trigger and by nothing else, so a trigger naming less than the capability it restores will be satisfied while the capability stays dead. Where a trigger names an artifact, the row must state what that artifact must be SUFFICIENT FOR. The review tell is a grain mismatch between the loss sentence and the trigger sentence: a plural loss with a singular trigger, a corpus loss with a per-module trigger, a route loss with a single-call trigger. -4. **Dissolution on climb — production handling only, never the evidence.** A climb deletes the redundant lower-rung *production* machinery it obsoletes, but the class's discriminating RED and positive control **remain enrolled** as the executing evidence that the higher rung stays real. An expecting-red probe that greens when its wall lands flips to a permanent regression control; it does not retire. +1. **Rung honesty, at a declared subject grain.** The reported rung equals the rung established by executed evidence — a discriminating RED refused on the real acceptance path plus an accepted positive control. Source→interpretation, source→each emission target and carrier→carrier are separate paths, and a class's rung is the **minimum across its in-scope paths**. A type name, diagnostic variant, inert lens or plan establishes nothing. **Rung inflation** is worse than sitting low, because an inflated class never ranks for climbing. +2. **No untracked stall.** A class below ceiling names its next-rung trigger, separating *cannot climb further* from *can climb after one grounding* from *can climb now but unbuilt*. Only the first is permanent. +3. **No silent regression.** A rung may be lowered only by declaring previous rung, temporary rung, reason, bounded population and restoration trigger. **The trigger names the CAPABILITY restored**, because a drop is retired by its trigger and nothing else; a trigger naming an artifact states what the artifact must be sufficient for. The review tell is a grain mismatch between loss and trigger: plural loss with singular trigger, corpus loss with per-module trigger. +4. **Dissolution on climb — production handling only, never the evidence.** A climb deletes the lower-rung production machinery it obsoletes, but the discriminating RED and positive control **stay enrolled**; an expecting-red probe that greens when its wall lands becomes a permanent regression control. -At a service boundary, rung honesty has a commercial consequence: a dimension may remain opaque only above a falsifiable quality floor with a named consequence. A claim that can change billing, trigger a remedy, or require refusal is a contract; without such a consequence it is marketing and establishes no rung. Delivery below the floor must refuse or discharge the remedy; a materially different delivery may be admitted only as its own named and priced product — a different contract subject, not a declared drop of the premium one; and a temporary loss of the ability to verify or enforce a floor is a §4b(3) declared drop on that same subject, which may force the commercial path to refuse and never authorizes silent below-floor delivery. Deviation is allowed; silence is refused. +At a service boundary rung honesty is commercial: an opaque dimension needs a falsifiable quality floor with a named consequence (billing, remedy or refusal), or the claim is marketing. Below-floor delivery refuses or discharges the remedy; materially different delivery is its own named, priced product; losing the ability to verify a floor is a declared drop that may force refusal and never licenses silent below-floor delivery. -Every newly discovered error class — incident, review finding, runtime exception, falsifier divergence — files or updates one row under `dag/gunbc/recurring_failure_mode/`, authority `gunbc.recurring_failure_mode`: invalid state, harm, distinguishing facts, rung found at, ceiling with reason, next trigger. Membership is the directory of those files, not a second hand-appended list. Declared drops are rostered separately and in full — previous rung, temporary rung, reason, population, restoration trigger — in [docs/design-rung-drops.md](docs/design-rung-drops.md), authority `gunbc.rung_drop`. The two are separate because they are separately appended: one lane recording a failure mode must not rewrite the file another lane is appending a drop to. A drop is retired BY ITS TRIGGER AND BY NOTHING ELSE, so the trigger is the whole check. The drops standing today are rostered in that file, one section each; this document deliberately does not restate their names, because a list derived here would make every drop declaration regenerate DESIGN.md, putting every appending lane back on the same driver-bound generated path. +Every newly discovered error class — incident, review finding, runtime exception, falsifier divergence — files or updates one row under `dag/gunbc/recurring_failure_mode/` (`gunbc.recurring_failure_mode`): invalid state, harm, distinguishing facts, rung found at, ceiling with reason, next trigger. Declared drops are rostered in full in [docs/design-rung-drops.md](docs/design-rung-drops.md) (`gunbc.rung_drop`). The two are separate because they are appended separately, and this document names neither population so that an append never regenerates it. -**The floor first, the differentiator above it.** gunbc must first hold the ordinary compiler floor — names resolve, applications bind in exact bijection, values inhabit declared types, fields exist, closed variants eliminate exhaustively — and a failure there is a below-baseline safety regression, never compensated by higher-order capability. The differentiating claim begins above that floor: because the substrate carries causal, cardinality, algebraic, effect, ownership, cost, and realization facts structurally, the same ladder applies to classes ordinary compilers leave to tests, review, profiling, or production postmortems — a possibly-empty collection flowing into a nonempty consumer, recursion without a descent proof, a non-idempotent effect under automatic retry, a computation exceeding its declared complexity bound, a realization that does not preserve modeled behavior. +**The floor first, the differentiator above it.** gunbc must hold the ordinary compiler floor — names resolve, applications bind in exact bijection, values inhabit declared types, fields exist, closed variants eliminate exhaustively — and no higher capability compensates a failure there. Above it, because the substrate carries causal, cardinality, algebraic, effect, ownership, cost and realization facts, the ladder reaches classes ordinary compilers leave to tests and postmortems: an empty collection into a nonempty consumer, recursion without descent proof, a non-idempotent effect under retry, a blown complexity bound, a realization that does not preserve behavior. -The promise is **not** that every property becomes impossible; it is that every modeled class climbs to the highest honest rung its facts and decidability permit, with the ceiling and the residual risk explicit. So, stated beside the ladder: the compiler does not invent unstated intent; does not prove unmodeled external reality; does not lift arbitrary predicates to proof; and richer type names are not safety — a brand, wrapper, or `Validated` is cosmetic until construction and acceptance enforce the distinction. Runtime mechanisms — typed refusal, totality, rollback, budgets — remain real and necessary at honest boundaries; they must only never be mislabeled as construction. The rung census and climb plan: → [compiler-guarantee recovery gap analysis](docs/plans/compiler-guarantee-recovery-gap-analysis.md). +The promise is **not** that every property becomes impossible, but that every modeled class climbs to its highest honest rung with ceiling and residual risk explicit. The compiler does not invent intent, prove unmodeled reality or lift arbitrary predicates to proof, and a brand or `Validated` is cosmetic until construction enforces it. Rung census and climb plan: → [compiler-guarantee recovery gap analysis](docs/plans/compiler-guarantee-recovery-gap-analysis.md). ## 4c. Source annotations (prose the substrate can see) -**Source annotations are captured authored-source data, not semantic program data and not discarded trivia.** A language realization that admits annotation syntax routes it through an annotation-specific lexical channel; it may not produce an ordinary semantic token or namespace binding. Annotation capture is disjoint from semantic occurrence allocation: adding, deleting, or moving an annotation cannot alter any semantic occurrence identity, semantic graph, resolution result, semantic hash, or target-program bytes. Semantic compiler passes receive only the annotation-erased projection. The initial `.dag` realization admits only standalone leading `//` blocks attached to module-scope declarations; trailing, body, unattached, and block-comment forms refuse until separately modeled. - -**Prose is not forbidden; unclassified prose is.** Any invariant, receipt, event, ruling, citation, status, count, or dissolution condition belongs in a typed carrier; an ordinary `String` declaration whose sole purpose is commentary is misplaced or dead data. The rule exists because the opposite was tried and measured: removing `//` as a parse error made comment *syntax* unwritable without making commentary unwritable, so the corpus hoisted comments into `data …: String` rows — where intent is mechanically indistinguishable from program data — and the first cleanup swept 215 dead prose rows across ~130 files. `//` is therefore the explicit quarantine boundary. +**Source annotations are captured authored-source data — neither semantic program data nor discarded trivia.** Annotation syntax goes through an annotation-specific lexical channel and may not produce a semantic token or binding; adding, deleting or moving an annotation cannot alter any occurrence identity, semantic graph, resolution, semantic hash or target bytes, and semantic passes see only the annotation-erased projection. The `.dag` realization admits only standalone leading `//` blocks on module-scope declarations; other forms refuse until modeled. -Two consequences bind authors: an annotation may preserve irreducible human rationale about *why* a construction has its shape, and it must not restate what the declaration structurally says; and an annotation is never evidence that a machine claim holds, because no `Accepted` program can read one. +**Prose is not forbidden; unclassified prose is.** An invariant, receipt, event, ruling, citation, status, count or dissolution condition belongs in a typed carrier, and a `String` declaration whose only purpose is commentary is misplaced or dead data. This was measured: making `//` a parse error made comment syntax unwritable but not commentary, which moved into `data …: String` rows indistinguishable from program data. `//` is the explicit quarantine boundary. An annotation may record irreducible rationale for *why* a construction has its shape; it must not restate what the declaration says, and it is never evidence that a machine claim holds, since no `Accepted` program can read it. ## 4d. Epistemic humility (what the corpus may assert about the world) -This section is a consequence of A2 and A3 — a fact is grounded only by pointing at a shared, time-stable framework — applied to authored claims about the world. It is an independent peer of §4b, not a restatement: §4b's *outside the modeled guarantee* column governs what the compiler can guarantee about a program; this section governs what the corpus may assert about the world. - -The obligation is symmetric (operator ruling, 2026-09-10). Three arms, not one: +A consequence of A2 and A3 applied to authored claims about the world, and a peer of §4b: §4b governs what the compiler can guarantee about a program; this section governs what the corpus may assert about the world. -- **Do not assert as deduced what is only inferred.** An inference is a bet. It is not deleted and it is not promoted: it is typed as a bet, and a later reader who consumes it as a fact is the defect. -- **Do not over-generalize a prohibition.** A mechanism that forbids more than the evidence supports costs real opportunities. The cost is the thing you never did, so the failure looks like rigor and is the one nobody catches. This is adjacent to §5's *"never" is the trap* (a ratchet masquerading as a wall) and is not that trap: §5 is about claiming construction for an undecidable class; this arm is about forbidding more of the world than the cited variables support. -- **Do assert what you are confident in.** Under-asserting is not humility. A fact you decline to state is a wall that does not exist, and the next process pays for the missing protection. A section that only warns against over-claiming would push the corpus into this arm. +The obligation is symmetric (ruling `gunbc.design_ruling epistemic_humility_is_symmetric`): -The principle is unnamed practice the corpus already obeys. The homes, not new vocabulary: `extdeps.external_authority` `CitedFigureStanding` = `CitedToAuthority { authority }` | `TranscribedUncited { read_obligation }` — a figure carries its evidentiary standing in the type, and an uncited one must name what would ground it (the same warrant kind as `gunbc.product.node_power_envelope` `TwoDpcRateCeiling.evidence` and `std.decision` `ObjectiveTerm.ground`). The second home is `strategy.node_rental` `SupplierHypothesis` (gunbc-private #54): `SharedCommodityPartOnly` rules nothing in and names the discriminator that would close it; `CandidateRuledOut` is the one real negative; `SupplyRelationshipObserved` is the only arm that answers true and requires a cited discriminator. +- **Do not assert as deduced what is only inferred.** An inference is a bet: typed as a bet, neither deleted nor promoted. A reader who consumes it as fact is the defect. +- **Do not over-generalize a prohibition.** Forbidding more than the evidence supports costs opportunities nobody sees, so it looks like rigor. This is not §5's never-trap (claiming construction for an undecidable class); it is forbidding more of the world than the cited variables support. +- **Do assert what you are confident in.** A fact declined is a wall that does not exist. Under-asserting is not humility. -Two receipts, one per direction. Over-assertion: gunbc-private #54's retraction of a headline that treated a shared processor SKU as a supply relationship — two firms deploying the same SKU is evidence the SKU is commodity; a supply relationship needs a discriminator only a supply relationship would produce. The tell worth keeping: the standard is usually present and locally unapplied. The retraction is that PR's specimen, not a landed fact about any supplier. Over-prohibition: `gunbc.product.node_power_envelope` `altra_two_dpc_ceilings` — both rows on main are self-declared `TranscribedUncited` with a read obligation naming what would ground them, and `effective_data_rate` consumed them as a wall. That is the whole lesson: a typed bet consumed as a deduced fact, independent of what the sources later say. gunbc#10954's finding is that the Ampere Altra and OCP Mt. Jade sources it cites publish no rank-dependent derate; that reading is that PR's, not this document's settled fact. +The homes: `extdeps.external_authority` `CitedFigureStanding` = `CitedToAuthority { authority }` | `TranscribedUncited { read_obligation }` carries a figure's evidentiary standing in its type, an uncited figure naming what would ground it; and `strategy.node_rental` `SupplierHypothesis`, whose only arm answering true requires a cited discriminator. The cautionary specimen: `product.node_power_envelope` `altra_two_dpc_ceilings` were self-declared `TranscribedUncited`, and `effective_data_rate` consumed them as a wall — a typed bet consumed as deduced fact, whatever the sources later say. ## 5. Fail-closed (§1's safety axis) -Minimizing cost and complexity is worthless if a wrong thing passes silently. This code is digital: a wrong answer is a **loud error, never a warning** — a bridge collapses, it does not warn. Every path succeeds fully or fails with a typed, located diagnostic; no fabricated plausible output. Relax toward application-layer leniency only under protest, and lean to infra so others can build on your work. +Minimizing cost and complexity is worthless if a wrong thing passes silently. A wrong answer is a **loud error, never a warning**: every path succeeds fully or fails with a typed, located diagnostic, and no plausible output is fabricated. Relax toward application-layer leniency only under protest, and lean to infra so others can build on your work. -Stronger than *catching* a wrong state is making it **unwritable** — **correctness by construction, not validation.** A check that re-states a constraint the model already carries is a second representation of it (§2/§3), so prefer a single authority from which the realization is derived over a check that flags the bad state after the fact. The tell that a check was validation standing where construction was available: it can be satisfied by editing the *declaration* while the realization still lies. +Stronger than catching a wrong state is making it **unwritable — correctness by construction, not validation.** A check restating a constraint the model already carries is a second representation of it (§2/§3). The tell that validation stood where construction was available: it can be satisfied by editing the *declaration* while the realization still lies. -Construction makes a class unwritable only when membership is **decidable**, so every class is one of three: a *wall now* (decidable and grounded); a *wall after grounding* (decidable but waiting on its single authority); or a *ratchet forever* (undecidable — optimality, by Rice, never reaches "never"). The word **"never" is the trap**: it lets a ratchet masquerade as a wall, so check decidability before claiming one. +Construction works only where membership is **decidable**, so every class is a *wall now* (decidable and grounded), a *wall after grounding* (decidable, awaiting its authority), or a *ratchet forever* (undecidable — optimality, by Rice). The word **never is the trap**: it lets a ratchet masquerade as a wall. -The deepest trap is **specification-without-execution**: a typecheck and a `.contains()` grep are not consumers. "Done" means a real consumer **green by execution** plus a discriminating input that goes red when the behavior is wrong. For the LLM agent especially: fluent, type-checking, grep-passing output is precisely the artifact that looks finished without running. +### Done means executed -The same demand for an independent referent governs a test's oracle. **A merge-blocking test may compare a live repository population to a numeric literal only when that literal is grounded in a controlled fixture, external or versioned authority, explicit policy budget, or a monotone debt contract over a closed subject universe. A measurement copied from the same current tree is not an oracle. Completeness is an identity join, not a count equality.** A monotone debt contract is legitimate only when the subject universe is independently discovered and closed, membership is checked at identity grain rather than by count, and every removal carries a typed disposition. Review tell: if automating the literal's update collapses the assertion to `measure() == measure()`, the manual update was the test's entire content — a change detector, not a check. +The deepest trap is **specification-without-execution**: a typecheck and a `.contains()` grep are not consumers. Done means a real consumer **green by execution** plus a discriminating input that goes red when the behavior is wrong. Fluent, type-checking, grep-passing output is exactly what looks finished without running. -A third named trap, the subtlest because it wears this section's own name: **the absorbing fallback — degradation is disguised fail-open.** When a mechanism cannot compute its precise answer, the tempting arm substitutes the *superset*: can't compute the affected set → rerun everything; cache key uncertain → scan all keys. Nothing is missed, so the arm gets labeled fail-closed — but it is **⊤-as-answer conflated with ⊤-as-ignorance**, and it fails open twice. On safety: absorption destroys the only signal that the precise mechanism has a deficit, so the deficit never ranks for fixing and the anemia compounds. On cost: the fallback is denominated in the *corpus*, not the *change*, so it grows until the budget breaks instead of the build. The confidence threshold that selects such an arm is a smuggled heuristic, so its existence *locates* the anemic modeling it papers over. **The rule, and the review tell: a failure arm must refuse, never widen** — every degradation a typed, located, countable diagnostic. Two neighbors are not this pattern: a structural over-approximation computed *as* the answer, and a deliberate interim fallback that is loud, budget-bounded, and lands with its dissolution trigger. +A test's oracle needs an independent referent. **A merge-blocking test may compare a live repository population to a numeric literal only when the literal is grounded in a controlled fixture, an external or versioned authority, an explicit policy budget, or a monotone debt contract over a closed, independently discovered universe checked at identity grain.** A count copied from the current tree is a change detector: if automating its update collapses the test to `measure() == measure()`, it checked nothing. Completeness is an identity join, not a count equality. -When §2's deferred cost is moved from the actor that accepted or caused it onto another principal, it becomes **externalization**. A risk intermediary or cost-causing actor fails open across an accountability boundary when it quietly re-exports an accepted risk or leaves a caused cost unpriced while preserving the apparent name, price, or contract — onto customers, employees, sellers, liquidation buyers, neighbors, or future maintainers. There are only two honest arms: absorb the risk and reserve for it, or expose the transfer as a separately named and priced contract; a materially degraded service is therefore its own product. Keeping the old name, price, or contract while another principal bears the changed burden is **externalized degradation**. +### Stop visibly; never conceal the deficit -A corollary on the refusal itself: **no escape hatches** — a toggle whose only effect is "proceed as if the refusal had not fired" re-opens the arm §5 just closed. The operative discipline is the **factory model**, a merge requirement rather than a preference: a deficit stops the line; the stopped line is analyzed before it restarts; the only sanctioned second mode is a stopped-line audit that replays the run to ledger every deficit for that analysis — it reports, it does not green. **Review bar:** a diff that lands a non-fail-closed failure arm — a silent widen, a fabricated default, an uncounted degradation, an escape hatch — is a **hard reject**, regardless of what else it delivers. The reviewer's three questions: does the line stop? is the stop typed and located? does analysis precede restart? +**When the precise answer or the final construction is unavailable, stop visibly. Do not hide the deficit by widening, bypassing, or installing a second path.** The concealment erases the only signal that the precise mechanism has a deficit. It takes four forms: -The same arm exists at authoring time: **the workaround — an absorbing fallback executed by the author.** When the obstacle is the substrate itself — a parse error you do not understand, a check that will not green — the tempting move is to route around it: a different spelling, a dodged codepath, a "for now". The concealment is identical, except the concealed deficit is usually in the *language layer*, precisely what §6 says to root-cause first. So: **noticing you are implementing a workaround IS the line-stop signal.** Back up, reassess, root-cause it or flag for help. +- **Runtime uncertainty → typed refusal.** Substituting the superset (rerun everything, scan all keys) is the *absorbing fallback*: it conflates ⊤-as-answer with ⊤-as-ignorance and its cost scales with the corpus rather than the change. A failure arm refuses, never widens, and every degradation is typed, located and countable. Not this pattern: an over-approximation computed *as* the answer, or a loud, budget-bounded interim fallback landing with its dissolution trigger. +- **A refusal that fires → the line stops.** A toggle that proceeds as if a refusal had not fired is an *escape hatch*. The discipline is the **factory model**: a deficit stops the line and is analyzed before restart; the only second mode is an audit replay that ledgers deficits and reports rather than greens. +- **An authoring obstacle → root cause.** Routing around a parse error you do not understand, or a check that will not green, is the *workaround*. The concealed deficit is usually in the language layer (§6), so **noticing you are implementing a workaround IS the line-stop signal.** +- **A temporary deviation → operator approval outside the diff.** A dissolution condition describes how admitted debt ends; it does not authorize creating it. A scaffold's benefit is zero where the modeled path exists. → [scaffold admission doctrine](docs/plans/scaffold-admission-doctrine.md). -**A dissolution condition describes how admitted debt ends. It does not authorize creating the debt.** The default and expected landing state is the final construction; a scaffold is an operator-approved exception, not an ordinary alternative. A throwaway artifact costs authoring plus review plus maintenance plus deletion plus review of the deletion, against a benefit bounded by its lifetime — so if the modeled path already exists the benefit is zero and the trigger was ceremony. Approval is external to the diff, because an author who can write a scaffold can equally write a row claiming it was approved. The verdict vocabulary and the out-of-band-actuation case: → [scaffold admission doctrine](docs/plans/scaffold-admission-doctrine.md). +**A diff landing a silent widen, fabricated default, uncounted degradation or escape hatch is a hard reject.** + +Distinct from these, because it crosses a principal boundary: moving deferred cost onto someone else — customers, employees, neighbors, future maintainers — is **externalization**. The honest arms are to absorb and reserve for the risk, or to expose the transfer as a separately named and priced contract; keeping the old name, price or contract while someone else bears the burden is **externalized degradation**. ## 6. How to work (given §1–§5 — these coexist) -- **Model:** DFS the concept DAG before inventing vocabulary; invent or reuse on proven coincidence, never bare-alias; a finished stage is one fold (any non-fold residue is either a named irreducible kernel or un-migrated modeling); model just-in-time and let the mark on the carrier be the authority, not a parallel-ledger doc; no scaffold lands by author declaration alone. -- **Intellectual sustainability:** do not spend future author, reviewer, operator or maintainer time to buy present convenience. Work expected to be thrown away is *presumed redundant*, so back up and complete the construction that will survive. The reviewer's independent test, applied whether or not the author labelled anything: **will this artifact survive the terminal architecture substantially unchanged, and be consumed by it?** If no, presume scaffold and stop the merge. A *missing* dissolution condition makes the finding **more** severe, not less; adding a trigger after review does not resolve the objection, it only makes the proposal eligible for a decision. -- Tells, each carrying a presumption: a hand-authored workflow, deployment or migration script (out-of-band actuation); a second path beside an existing modeled route (parallel authority); "bridge", "shim", "for now", "temporary", "until", "later" (deferred refactor); a model to be deleted whole when the real one lands (throwaway model); a hand-authored projection the model should generate (manual application committed as source); raw shell implementing semantics already expressible in `.dag` (unmodeled realization); a broad wrapper around a type or modeling deficit (workaround hiding substrate work); a condition whose terminal is "rewrite this properly"; a new artifact with no final consumer (experimental residue). -- **Selection precedes convergence (§3d):** rank work on a funded multi-axis field rather than a bottleneck KPI — do not independently restate "prioritize holistically" as a second authority. A 5ms step does not get a pass for not being the 80s one; it might be a 5ns step. One consequence is a standing rule, **bare minimum cost**: a proven cost-shape defect — a copied accumulator, a quadratic fold — is *always fixed*, regardless of the realized n. "n is small here" is not a time-stable fact (reuse changes n), and pricing per-site exceptions is itself redundant work. -- **Denominate the benefit:** the deliverable is a *displaced cost* — a pain someone pays to remove; the lens or substrate is the *mechanism*, not the product. Priced in elegance instead, the work is self-referential and unbounded (the purity trap — the economic twin of "never" in §5). -- **Enforce with lenses,** not grep — but **construction first**: a lens is validation, so make the class unwritable by single authority where you can and reserve the lens for the unstructurable residue. As a residue mechanism it earns its keep: a pure reader over the same `Node` tree, storing nothing, so a new analysis costs zero substrate edits. Beware the tier where the machinery exists but nothing gates on it — an inert lens is itself a lie. -- **Root-cause to the language layer** and fix related systems together — a local subsystem patch is the forked-logic trap. *e.g.* one catamorphism `fold_node` is reused by all 7 v2 stages; #4699 dissolved `06_translate` 4,912→3,973 lines. The symptom recurs wherever the root is unfixed: v2 still hand-rolls `ParseTable` because the Realization carrier is staged, not inhabited. -- **Name the instrument, never transcribe its output.** A measurement is cited by naming the producer that re-derives it — the run, the flag, the entry point — never by copying its numbers into prose, exactly as §3 requires a citation to name a symbol rather than a line, and for the same reason: a transcribed number is unreachable from the thing that owns it, so it rots without anyone touching either end. If a measurement is worth re-deriving it is worth an entry point; if it is not worth an entry point it is not an instrument but a one-off. +- **Model:** DFS the concept DAG before inventing vocabulary; invent or reuse on proven coincidence, never bare-alias; a finished stage is one fold (any residue is a named irreducible kernel or un-migrated modeling); model just-in-time and let the mark on the carrier be the authority, not a parallel ledger. +- **Intellectual sustainability:** do not spend future author, reviewer, operator or maintainer time for present convenience. Work expected to be thrown away is *presumed redundant*. The reviewer's test, whatever the author labelled: **will this artifact survive the terminal architecture substantially unchanged, and be consumed by it?** If not, presume scaffold and stop the merge; a missing dissolution condition makes that more severe, and adding one after review only makes the proposal eligible for a decision. +- **Tells, each a presumption:** a hand-authored workflow, deployment or migration script (out-of-band actuation); a second path beside a modeled route (parallel authority); bridge, shim, for now, temporary, until, later (deferred refactor); a model to be deleted whole when the real one lands; a hand-authored projection the model should generate; raw shell implementing semantics expressible in `.dag`; a broad wrapper around a type or modeling deficit; a condition whose terminal is rewrite this properly; a new artifact with no final consumer. +- **Rank on a funded multi-axis field (§3d).** A 5ms step gets no pass for not being the 80s one; it might be a 5ns step. Hence **bare minimum cost**: a proven cost-shape defect — a copied accumulator, a quadratic fold — is *always fixed*, regardless of realized n, because n is small here is not time-stable. +- **Denominate the benefit:** the deliverable is a *displaced cost* someone pays to remove; the lens or substrate is the mechanism. Priced in elegance, the work is unbounded — the purity trap, economic twin of §5's never. +- **Enforce with lenses, not grep — but construction first.** A lens is validation: make the class unwritable where you can and keep lenses for the residue, where a pure reader over the same `Node` tree costs no substrate edits. A lens nothing gates on is itself a lie. +- **Root-cause to the language layer** and fix related systems together; a local subsystem patch is the forked-logic trap (§6b). *e.g.* one catamorphism `fold_node` serves every v2 stage, and #4699 dissolved `06_translate` from 4,912 to 3,973 lines by using it. +- **Name the instrument, never transcribe its output.** Cite a measurement by the producer that re-derives it — run, flag, entry point — for the reason §3 cites symbols: a transcribed number rots unreachably. A measurement not worth an entry point is a one-off, not an instrument. ## 6b. Chain re-derivation (how a defect is worked) -A consequence of §2, §3 and §5 applied to the act of debugging, and the procedure by which §6's *root-cause to the language layer* is discharged -- stated separately because the opposite is the default habit (operator ruling, 2026-09-15). A program is a derivation: a defect is observed at one link `c` of the relevant dependency slice `a → b → c → d` -- a slice of the graph, with whatever producers and consumers it really has, not necessarily a line and not necessarily reaching a repository root. The habitual repair reads `c`, finds the local condition under which `c` misbehaves, and guards or patches `c` there. When the fault is upstream, that patch is validation standing where construction was available (§5): it encodes a fact about `a` or `b` that neither declares, so it is a second, positional authority for that fact (§3) and redundant with the derivation it shadows (§2) -- the defect recurs at the next link that consumed the same undeclared fact, and the patches accumulate into a system nobody can re-derive. - -**Chain re-derivation** is the discipline instead: when `c` is observed wrong, start at `a` and re-derive the slice qualitatively -- what each link *means*, what it is entitled to assume from the link before it, and what its owning result contract and every relevant downstream consumer establish that it owes. Include `d`: the owning interface defines what `c` owes, and the downstream consumers establish which of those outputs this derivation actually needs. Work outside that admitted contract and consumer population is redundant; work required by the interface, by another relevant consumer, or by a safety or completeness obligation is not made redundant because one consumer does not inspect it. **The walk stops at the earliest boundary at which the derivation cannot be justified**: a contract violated, missing, under-specified, duplicated by another authority, or insufficient to ground its consumer. If the observed link `c` is itself that boundary -- it implements its own grounded contract wrongly -- then a local correction at `c` *is* the root-cause repair. Upstream links whose contracts remain sufficient are not rewritten; downstream links are consequences to be re-realized, not second defects to be patched. The output is a reassessment of the slice from that boundary: where an assumption was never declared, declare it on the carrier that owns it; where two links answer one question, consolidate them under one authority; where a link does work no admitted consumer demands, delete it. The repair is derived from the chain, not applied to the symptom. +§2, §3 and §5 applied to debugging, and how §6's root-cause rule is discharged (ruling `gunbc.design_ruling chain_re_derivation`). A defect is observed at one link `c` of a dependency slice `a → b → c → d`. Patching `c` where it misbehaves, when the fault is upstream, encodes an undeclared fact about `a` or `b` — validation where construction was available (§5), a second authority (§3), redundant with the derivation it shadows (§2) — and the defect recurs at the next consumer of the same fact. -**The stance rejected here is black-box quantitative optimization standing in for derivation** -- not measurement. Measurement locates the expensive or failing route, identifies scaling shape, prioritizes which slice to read, falsifies a causal claim, and confirms afterwards that the old computation is gone; it remains the instrument for all of that, and §6 requires it to be named rather than transcribed. What it does not do is define the repair. **Its sharpest use is adversarial.** A sound reading of the slice states, before the confirming run, the necessary structural consequences that follow if the reading is right: which producer multiplicity must collapse, which route must disappear, which semantic outputs must remain equal, and which residual work may remain. A contradicting result from an admitted, reconciled instrument falsifies the corresponding claim; a failed fidelity or reconciliation check falsifies the instrument -- and neither arm may be selected merely to protect the preferred explanation. Estimates of magnitude are labelled separately: missing one falsifies that estimate, not automatically the underlying boundary diagnosis. #11401 recorded both kinds honestly -- structural identity claims and quantitative predictions, including the misses. Measurement may begin discovery: it locates the symptom and identifies the slice worth reading. What it cannot do is uniquely derive the chain that produced the number or select the semantic repair by itself -- a number underdetermines the chain, so a causal account fitted to it inherits the target's scope and the symptom link's vantage. The slice is re-derived before the correction is chosen, and measurement then acts as its adversary. Once the derivation has established several semantically admissible realization or materialization strategies, quantitative policy may choose among them; it never substitutes for establishing which changes are lawful. The rejected move treats `a → d` as opaque -- measure the input and the output, set a target on one axis ("resolve takes 200 s; make it 10% faster") -- and reaches for the moves that stance affords at the link where the number was read: a cache, a batch, a wider pool, a knob. Each is *locally sound* on the axis it was priced on and *globally inefficient* when it moves cost rather than removing it: it trades time for space plus a key plus an invalidation rule plus one more piece that can go stale, and §2 names the deeper loss -- caching a repeated demand makes redundant work cheap and suppresses the signal that would make it rank for deletion. The target also sets the scope: "10% faster" licenses the smallest patch that hits 10%. A cache, shared context, batch or pool is therefore neither right nor wrong by category: it is right when derived from the demand graph, a complete identity, recurrence or isolation facts, and an admitted provider (`std.materialization_ladder`), and wrong when it merely makes authored duplication cheaper. The qualitative stance is *locally frictional* -- the slice is read -- and *globally efficient*, because the fix is unconditional: a link that rebuilds a fact its predecessor already established is wrong at any n and is fixed without a percentage (§6, bare minimum cost). +The method: -Ownership is what makes the open box obligatory. Internals are treated as a black box where they lie outside our observation or ownership boundary -- an external upstream's implementation, §4b's outside-the-modeled-guarantee column -- while its contract and observable behaviour are still modeled honestly. An owned component may stay abstract behind a grounded, sufficient contract; when that contract is missing, violated, duplicated or insufficient to derive the symptom, ownership removes the excuse not to open it and re-derive. +1. Identify the producer-to-consumer slice the defect sits in. +2. For each link, state what it means, what it may assume, and what its owning contract and every relevant consumer (`d` included) establish that it owes. +3. **Stop at the earliest boundary where the derivation cannot be justified** — a contract violated, missing, under-specified, duplicated, or insufficient for its consumer. +4. Repair there: declare the missing assumption on its owning carrier, consolidate duplicate answers, and delete work no admitted consumer demands. Work required by the interface, another consumer or a safety obligation is not redundant because one consumer ignores it. +5. Re-realize the downstream links rather than patching them; leave sound upstream links alone. +6. Use measurement to falsify or confirm the derivation, never to choose the repair. -**No level is presumed correct -- including the structure the slice sits in.** Re-deriving is not a search for the one wrong link inside an otherwise sound arrangement; which links exist, what each is named and which layer each fact lives in are on the table. This is §4d's humility turned inward: it is not that the reader knows better than the existing structure, and the author is not presumed right either; a structure is a bet its authors made under what they knew, A3 grounds agreement only on what stays stable across time, and the only way to learn whether a layer has stayed stable is to comb it. A structure that is never re-derived is not trusted, merely unexamined, and an unexamined layer is where undeclared facts accumulate. Preservation and reorganization are both outcomes of re-derivation and neither is presumed: a layer is preserved when its contract still follows and reorganized when it does not. Three consequences bind the reader. **Touching code is taking responsibility for it**: there is no "someone else's code, tread lightly" -- a link read and found wrong is followed to its owning authority and not left as found; this grants no unilateral merge authority and waives no review, coordination, consumer obligation or exact-head evidence. **There are no special layers**: the seed, the emitter, the floor, a stage DESIGN names load-bearing -- a higher evidence bar for landing a change there is not an exemption from the read, and a link is not correct because it is old, central or generated. **A qualitative error is admitted as a defect on its reasoning alone**: it needs no percentage, incident count or performance threshold to deserve repair, with no exception for the layer it sits in or the author who wrote it. The *implementation* of that repair still owes the evidence appropriate to the affected contract and layer -- discriminating controls, production-route inhabitance, semantic-equivalence receipts, exact-head qualification where required; that is the difference between why a change is required and whether this patch implements it correctly. +If the earliest unjustified boundary is `c`, the local fix *is* the root-cause repair. *e.g.* resolve once rebuilt corpus-wide state per module, and the repair was upstream: one shared `ResolutionContext` per native ingest in `v2.compiler.compile`. By contrast, when the emitter's own tail-call lowering was the earliest unjustified boundary, the local repair was the right one. -The tells are mechanical. A fix whose diff touches only the link where the symptom appeared, with no statement of why that link is the earliest unjustified boundary. A guard that tests for a state the earlier links could have made unwritable. A fix that cites the symptom and not the derivation. A second fix to the same link within a short time. A fix justified by a percentage on one axis with no statement of what the chain should have established. A new cache, pool, batch or knob at the link where the symptom was measured, with no identity, recurrence or provider derivation beside it. And the one the author can feel: knowing *that* `c` is wrong without being able to say what `a` and `b` established -- §5's workaround signal one link earlier, and the line-stop. The class is rostered as `gunbc.recurring_failure_mode` `symptom_link_patched_without_the_earliest_unjustified_boundary`, whose discriminator runs in both directions: a cache or guard added at the symptom link without naming the upstream boundary is red, and a local fix at a link that violates its own grounded contract is green -- so the rule cannot become an over-prohibition on legitimate local corrections. +**Measurement is the adversary, not the selector.** It locates the failing route, prioritizes the slice and confirms the old computation is gone; a sound reading states beforehand which multiplicity collapses, which route disappears and which outputs stay equal, and a contradiction from a reconciled instrument falsifies the claim (a failed reconciliation falsifies the instrument). But a number underdetermines the chain. Targeting one axis (make resolve 10% faster) yields a cache, batch, pool or knob at the measured link that moves cost rather than removing it; such a mechanism is right only when derived from the demand graph, a complete identity and an admitted provider (`std.materialization_ladder`). -Three specimens, each a slice read where a number had been offered. *R1, #11401 (landed):* resolve summed to 20 s over 16 modules; reading `a → b` found that resolve rebuilt the corpus-wide resolution state -- language model, root validation, symbol index -- once per module, a fact established once and never carried to its consumers, who therefore repeated it. The repair is a correctly placed shared context, one `ResolutionContext` per native ingest in `v2.compiler.compile`: sharing was not the defect, reconstruction inside subject-local demand was. *B1 versus the prepared choice plan, #11422 (in progress):* choice backtracking led the profile and a measured skip of a left branch that cannot start bought a fraction of it; it is kept only as the baseline, because reading the link found that every ordered `Choice` is a realization of the authored grammar owed one prepared plan -- the per-token dispatch was the wrong link, not a slow one, and the cutover deletes it; the figures are re-derived by that PR's bounded A/B harness, not transcribed here. *The TCO loop, #11444 (in progress):* CI runs stayed silent until their 90- and 180-minute cancellation caps; extending the timeout or reverting the triggering work would have treated the downstream symptom. Re-deriving the emitter's tail-call lowering found `is_tco_identity_passthrough` mistaking source-name equality for loop-state identity after the lowering had split one binding into a mutable local and a persistent slot. This is also the balancing case: the emitter's own lowering contract was the earliest unjustified boundary, so the right repair really was local to that owning link. +- **Owned components get opened.** An external upstream stays a black box with an honestly modeled contract; an owned component whose contract is missing, violated, duplicated or insufficient must be opened. +- **No level is presumed correct**, including the structure the slice sits in (§4d turned inward). Touching code is taking responsibility for it. +- **There are no special layers.** The seed, the emitter or a load-bearing stage raises the evidence bar for landing, not an exemption from the read. -Two boundaries keep this from being ceremony. The slice is re-derived at the grain of *meaning*, not of code -- a qualitative reading of what each link establishes, which is minutes, not a rewrite. And it stops at the earliest unjustified boundary: everything downstream is a consequence to be re-realized. +The tells: a symptom-link fix with no statement of why that link is the earliest unjustified boundary; a guard for a state earlier links could have made unwritable; a second fix to one link in a short time; a percentage on one axis as justification; knowing *that* `c` is wrong without being able to say what `a` and `b` established — the line-stop. The class is `gunbc.recurring_failure_mode` `symptom_link_patched_without_the_earliest_unjustified_boundary`. ## 7. Self-hosting (the principles applied to the compiler itself) -The compiler is a pure transform and an ordinary substrate fact, analyzable by its own lenses. It is written in itself: the `.dag` graph is the truth and Rust is one realization — a seed that shrinks toward zero. v2 emits its own sources as the cleanest principled realization, proven **by execution**: the emitted module compiles and holds its own `.dag` contract on a discriminating corpus. **The bar is that v2 is better than the seed, not that it resembles it** (operator ruling, 2026-10-02). The seed is a regression oracle, never a specification: where the two diverge, the divergence is either a *v2 regression* — something the seed got right that v2 lost, which is a defect — or a *seed defect* v2 does not carry forward — an ambiguity, a quirk, a refusal standing where a rule was missing — which v2 fixes and records as the correction it is. "The seed reads it this way" is evidence of what v2 must not lose, never by itself the reason v2 reads it that way. So neither a byte-identical fixed point nor behavioral equivalence to the seed is the goal: the first would force v2 to reproduce the seed's warts to match bytes, and the second reproduces the same warts one level up, cementing poor decisions either way. +The compiler is a pure transform and an ordinary substrate fact, analyzable by its own lenses. The `.dag` graph is the truth and Rust is one realization — a seed that shrinks toward zero. v2 emits its own sources, proven **by execution**: the emitted module compiles and holds its own `.dag` contract on a discriminating corpus. **The bar is that v2 is better than the seed, not that it resembles it** (ruling `gunbc.design_ruling v2_better_than_the_seed`). The seed is a regression oracle, never a specification: a divergence is either a *v2 regression* (a defect) or a *seed defect* v2 does not carry forward and records as a correction. The seed reading something one way is evidence of what v2 must not lose, never by itself why v2 reads it that way — so neither a byte-identical fixed point nor behavioral equivalence is the goal; both would cement the seed's warts. -The seed shrinks across a **typed self-host frontier**: each module is either *self-emitted* (green by execution) or *seed-retained*, and a seed-retained module is a declared row with a reason and a migration trigger — countable, prioritizable — never a silent escape hatch. Its tests are data. Its ontology dissolves into `std/`. This is the recursion: every principle above governs the system that implements them, and this document. +The seed shrinks across a **typed self-host frontier**: each module is *self-emitted* (green by execution) or *seed-retained*, and a retained module is a declared row with reason and migration trigger, never a silent escape hatch. Its tests are data; its ontology dissolves into `std/`. -The payoff is that **language design itself opens up.** It is normally locked by cost: a new check means owning a *compiler fork*, and a new language means an *adoption* problem. Both dissolve here at once: a wall is a **row** (no fork), and because the substrate is medium-agnostic — one grammar read in both directions over many media — that row applies *on top of an existing language* (no adoption). So language design collapses from (compiler-fork × language) to (row + medium): a domain's bug-class can be made extinct in Rust or TypeScript without forking their compilers. It is sound exactly where ingest is lossless and fail-closed where it is not — "any language, with a typed honesty boundary about where the wall holds." This is §1's reduce-convention-to-necessity at the meta-level, and the place the purity trap bites hardest: bounded by §5 (decidability) and §6 (displaced cost, not elegance). +The payoff is that **language design opens up.** It is normally locked by cost: a new check means owning a compiler fork, a new language means an adoption problem. Here a wall is a **row** (no fork), and because the substrate is medium-agnostic, that row applies *on top of an existing language* (no adoption): a domain's bug class can be made extinct in Rust or TypeScript without forking their compilers. It is sound exactly where ingest is lossless and fail-closed where it is not — any language, with a typed honesty boundary about where the wall holds. This is §1's convention-to-necessity at the meta-level, bounded by §5 (decidability) and §6 (displaced cost, not elegance). ## Recurring failure modes (instances of §3–§5, kept for pattern-matching) -One row per class, each carrying its recognition rule and its receipts, as a file under `dag/gunbc/recurring_failure_mode/` — authority `gunbc.recurring_failure_mode`. They are rostered there rather than here because they are a LEDGER and not a consequence: every lane that finds a new class appends one file, so the section grows without bound while this document's sections are fixed by §1. The class names are NOT indexed here either: an index derived into this file would regenerate DESIGN.md on every ledger append. +One file per class under `dag/gunbc/recurring_failure_mode/` (`gunbc.recurring_failure_mode`), each with its recognition rule and receipts. They are a ledger, not a consequence, so they live there and are not indexed here: an index in this file would regenerate it on every append. ## Building & checks -**This section assumes you already have a built `gunbc`, and nothing here tells you how to get one — so it is not the first page for a reader who has just cloned.** That reader wants [docs/onboarding.md](docs/onboarding.md): the ordered path from a bare clone to one landed reviewed change, with every command derived from the authority that owns it (`gunbc.contributor_onboarding_path`), the obstacles attached to the step each one breaks, and a reading order for THIS document saying what is needed before a first build, what is needed before a first commit, and what can wait. That page is a projection of a path that was walked, not a substitute for it: the exit it serves is measured by an outcome, so a step there that does not work is a defect worth reporting as one. +The CI contract. From a bare clone, start at [docs/onboarding.md](docs/onboarding.md) (`gunbc.contributor_onboarding_path`): the walked path to a first landed change, the CLIs, local checks, hooks and regeneration, and a reading order for this document. -- Local checks, each named with what executes it — a check named here with no executing step is a decoration (§4b), and since the 2026-10-09 ruling (the v1 withdrawal, stated under **CI** below) two of the three have none. `cargo fmt --all --check` runs in the generated pre-commit hook (`gunbc.githooks_pre_commit_emit`). `cargo clippy --all-targets -- -D warnings` (`gunbc.repo_self_build` `repo_self_clippy_command`, the only command that compiles the integration-test and example targets) and `cargo test --release -p v1-compiler --lib` (`repo_self_test_command`) are LOCAL ONLY: the `generated` and `rust-unit-tests` lanes that ran them were deleted with the other v1 lanes, so a lint red or a v1 unit-test red blocks nothing. That loss is part of the declared drop `gunbc.rung_drop` `v1_required_lanes_withdrawn`. `cargo test --workspace` is local only, as it was: the test targets are compiled by nothing on the merge path and run by nobody. -- one-time per clone: `git config core.hooksPath .githooks` — the only documented manual seed; generated pre-commit/pre-push hooks then idempotently converge `merge.generated-artifact.driver` and re-assert `core.hooksPath` via argv derived from `gunbc.repo_local_git_config` (clones that skip hooksPath degrade to vanilla text-merge for generated-artifact paths, and since the 2026-10-09 ruling no CI step compares a generated artifact with its authority: `gunbc.rung_drop` `v1_required_lanes_withdrawn`). The driver REFUSES rather than answering `true`: git reaches a low-level merge driver only when both sides changed the path since the merge base — measured on a four-case matrix, one-sided and identical changes never reach it — and taking the ours side there dropped the other side's authority-derived bytes with no conflict, twice on #7836 against the stage0 seed. It now leaves the ours side in the worktree with no conflict markers, marks the path unmerged, and prints the regeneration recipe; the class is mechanically preventable, not structural, and its next-rung trigger is the commit-writer binding rows in `gunbc.commit_workflow` -- **`gunbc test