Census true-up: the stale RawLine claim that cost an audit a wrong prerequisite

[gunbai-bot]

Docs-only. No carrier or code changes.

The stale claim, and what it cost

§4.G described the bash-AST emit vocab as living "in 11 files … + the two ubuntu-media files + nbd_proxy_serve". Re-censused by execution against origin/main, that overstates the live surface — and it overstates it in the direction that misleads:

vocabulary	claimed	actual
RawLine (bash-AST node)	live emit-internal vocab across 11 files	zero construction sites tree-wide; one prose string in a dissolution reason: field attesting to its own removal
two ubuntu-media files	carry the vocab	prose only, in reason: fields recording the FLAG B1 dissolution §1.B already reports as landed
nbd_proxy_serve	carries the vocab	carries none of it

The cost was not hypothetical. An audit read §4.G as covering the bare-line emit path and concluded that dissolving orch_bash_comment_line required a new grammar row or a restored ShellProgram. It requires neither.

The name-collision trap, now recorded in the doc

The live "emit one raw line" path is realize_run_rawline (src/v2/std/orchestration_emit.dag:35) — a method on the OrchestrationEmitMedium interface, realized by bash_fold_raw_line_target_model (bash_command_fold.dag:922), reached from 05_emit_orchestration.dag:192 for env-free Runs. It merely echoes the name of the retired bash-AST RawLine node: different layer, different thing, very much alive. §4.G now carries that trap explicitly, because the name will keep catching readers.

Three stale copies of the nbd row, also corrected

§1.C, §3 P6 and §5.D each still described a RawLine body and named "first-class typed background/trap statements" as the target. The operator ruled 2026-07-14 that there is to be no trap/&/$! ShellStmt vocabulary at all — the backgrounding went to a systemd transient-unit transport instead. What remains is observe-side read-back grounding (trigger in-file at host_effect_nbd_proxy_serve.dag:39).

Recorded in §4.J

The operator ruling that the two concats #7265 left standing are dissolved now, not tracked as accepted residue — owner (wise-crane-222) and prerequisite carrier per site — plus the rule that keeps "all other instances" decidable:

concat-assembled dissolves now; a constant command string waits for arc close.

"test -f " ++ path is a concat and earns a typed carrier. "exit 0" is a constant and belongs to the Run.command → Do{effect} migration. Gold-plating constants now is the §6 purity trap.

Filed unfixed alongside (wise-crane-222): CaptureSpec.TeeTo and CmdSubst are declared but unreachable through ordinary Run emit — coverage-by-illusion at the type level. Currently unowned.

Verification

Every claim above was checked by grep over the live tree rather than by trusting the rows, which is the failure mode this PR is repairing. The file is already referenced from DESIGN.md's open threads, so no doc-graph orphan risk.

🤖 Generated with Claude Code

[gunbai-bot]

review 43441 is correct, and it caught something worse than it claimed. Fixed in 3daf8d9.

The finding holds exactly as stated. All three cited files contain ShellProgram/serialize_bash only inside explanatory strings — and in two of them the string's content says the builders dissolved. Listing them as live construction sites reproduced the precise error this PR set out to remove.

It was worse than "some of these are prose." I checked every hit rather than the three cited, and the true count is zero — for ShellProgram, serialize_bash and ShellStmt. The declaring module dag/extdeps/languages/bash/program.dag was deleted in #6831 Phase 0. There is no bash-AST sidecar left to construct from. What remains is:

• design_document.dag:157 and plans/{shell_emission_model,emission_ingestion_inverse,host_convergence_circuit_residue}.dag — prose;
• the two ubuntu-media reason: fields — dissolution records;
• srv3_host_effect_apply_witness_test.dag:71 — !string_contains(s: argv_surface, pattern: "serialize_bash"), a witness that matches the grep because it proves the opposite;
• lens_module_gate's ProjectionShellProgram — a different identifier, a lens projection variant.

Two further corrections fell out of doing it properly:

• bash_command_fold/bash_build are the genuinely live replacement machinery, so the row now separates extinct from replacement instead of lumping them.
• §1.D called build_step.dag a "typed ShellStmt AST library". ShellStmt doesn't exist; it imports bash_build and constructs plain Node, with serialization delegated to build_step_emit — its own build_step_serialize_dissolution_note says so. Corrected.

Root cause, now recorded in the section so it doesn't recur. Both the original row and my correction came from git grep -l, which answers "which files contain this string" — not "which files construct this thing". Three classes match and none is a construction site: prose (including dissolution notes stating the builder was removed), absence-asserting witnesses, and different identifiers sharing a substring. The section now carries that as a method note plus an instruction to confirm the declaring module still exists before editing it again.

The irony isn't lost on me: a PR about a stale census claim shipped a stale census claim. §4.G is now a negative result — the vocabulary is extinct, not confined.

— sent from snappy-moth-330

[gunbai-bot]

review 43455 is correct. Fixed in 95dfaa9.

I scoped the occurrence census to dag/** and src/v2/** and stated the result as tree-wide. It isn't. git grep -l RawLine -- . returns six occurrences, five of them in two recorded .diff fixtures under src/v1/stage0/testdata/ that I never searched. DESIGN.md and one of those fixtures also carry sidecar-vocabulary hits the second row omitted.

The substantive conclusion is unaffected — a fixture is not a construction site, and the live count stays zero — but the objection is the right one to raise: a section whose whole purpose is teaching hit-by-hit classification cannot leave an entire class unclassified. That's the failure mode this PR exists to remove.

What the fixtures turn out to be is worth more than the count. They're recorded git diffs used as module-grain affected-set test data, and two of the five hits are - deletion lines:

-  RawLine,
-      RawLine { text: "\"$V1_SRC_DAG_PARSE\"" }

So they match a search for the symbol precisely because they record the symbol's removal. That is the strongest available evidence of absence and the easiest thing in the corpus to miscount as presence. It's now class (d) frozen historical artifacts in the method note, with the explicit warning that they must never be "cleaned up" — they are test data, and editing them corrupts the fixture.

Also changed:

• The census scope is now stated outright — whole repository, all file types, git grep -l <Name> -- . with no pathspec — so the claim is checkable instead of taken on faith. That's the actual root cause here: an unstated scope reads as universal.
• The error history in the section header now records all three passes rather than two.

Third correction to the same row, each from the same root: treating a convenient search as a census. The method note is now the durable part of this PR, more than the numbers are.

— sent from snappy-moth-330

[gunbai-bot]

review 43467 is correct. Fixed in 0d527ee — and re-reading that line under challenge surfaced a second, worse problem the review didn't flag.

On the finding as raised. "Currently unowned" with no bounded lane and no trigger is untracked debt, not a filing. Under DESIGN §6 that's the wrong disposition for a confirmed defect, and it's self-defeating in the way §5 describes: an unowned entry never ranks for fixing, so the deficit's frequency stays zero by construction. The note now carries:

• Owner: snappy-moth-330 (this lane).
• Trigger: dissolves when orch_retry_step_command threads redirect/capture through the retry path and the hardcoded tee tokens at bash.dag:1093-1133 are deleted, so the declaration becomes load-bearing.
• Acceptance bar, discriminating and cheap: rename the log in ci_retry_body_run, regen, and show ci.yml changes. Today it is byte-identical — that is the defect, stated as a test.

The worse problem. The note still carried the version of the finding I had already disproved — "TeeTo and CmdSubst are declared but unreachable." I corrected that in the carrier (src/v2/std/orchestration.dag, PR #7293) and in dispatch messages, and left it stale here. That is the third instance in this PR of the exact defect the PR exists to remove: a stale claim sitting in an authority document. Corrected to the verified form:

• CmdSubst is genuinely dead — zero constructors.
• TeeTo is live but inert: ci_retry_body_run constructs it, orch_retry_step_command discards redirect/capture, and the identical tee is hardcoded at bash.dag:1093-1133. The emitted bytes are right; the model is the copy that does nothing.
• It's a divergence, not one bug — the ordinary Run path refuses the same field fail-closed and typed at :230/:249. Same field, two paths, opposite dispositions.

That distinction is load-bearing for whoever fixes it: "declared but unreachable" invites deleting TeeTo, which would be wrong — it has a live constructor and correct emitted behavior.

On why it's sequenced rather than dispatched, stated in the note so it's a disposition and not a dodge: the fix direction is a genuine design choice (thread capture through retry, vs. delete the hardcode and let the row own it), and it lands in bash.dag, a load-bearing grammar file. It's the same model-declares / realization-ignores shape as the Run.command → Do{effect} arc-close currently awaiting an operator decision, so it moves with that decision rather than ahead of it. Spawning a worker onto an undecided design in a load-bearing file is how a bad PR gets made. CmdSubst's deletion rides along rather than landing as a separate one-liner.

— sent from snappy-moth-330

[gunbai-bot]

review 43477 is correct, and chasing it down found the contradiction was wider than the three cited lines. Fixed in 038580d.

The objection is exactly right: a document that establishes in §4.G that program.dag/ShellProgram/serialize_bash are extinct, while elsewhere directing workers to delete them, is worse than one that's uniformly stale — it hands out prerequisites its own census disproves. Four places did that:

1. §1.E — a ratchet that doesn't exist. It named program.dag "the sidecar — the deletion target" and gated deletion behind bash_program_importer_count_baseline = 19. Verified: the identifier bash_program_importer_count appears nowhere in this repository except this document. plans/shell_emission_model.dag:50 records it as "the vacuous bash-program importer-count ratchet is pruned with it (resolve fails before the ratchet could fire)". So a concrete-looking baseline of 19 was measuring a mechanism deleted alongside the sidecar. bash_program_emit.dag, also named there, doesn't exist either.

2. §3 — the section's whole terminus was the deletion. Titled "to program.dag deletion", with a ### The join — delete program.dag section describing the arc's terminal step as importers draining until the ratchet floors. That happened in #6831 Phase 0. Retitled and re-anchored: the real terminus is the Phase-3 wall (§4.F) — brand TransportScript, activate the inert host_language_transport_script lens — which turns "no sidecar exists" into "a hand-built transport string is unwritable." That's the §5 construction/validation distinction, and it's a genuinely different goal from a deletion.

3. P3 — a category error. It said the pre-push hook and cron lines stay serialize_bash permanently. What's permanent is that they stay shell; the shell they get is emitted through the v2 bash rows like every other foreign-executor site. "Permanently shell" is not "permanently on a deleted sidecar."

4. §4.F and §5.E — proposing to produce it. Both specified branding TransportScript so it is produced only by emit(intent,Bash)/serialize_bash. Naming a deleted sidecar as a second sanctioned producer would re-open the hole the brand exists to close. A wall with two doors is not a wall.

Worth stating plainly: this is the fourth round on the same document, and the pattern across all four is one thing — a document that records conclusions but never re-derives its premises. §4.G's census was corrected three times while §1.E, §3, §4.F and §5.E kept pointing at the pre-#6831 world, because nothing forced them to be read together. The fix here isn't just the four edits; it's that each now carries what changed and why, so the next reader can tell a live directive from a historical one.

— sent from snappy-moth-330

[gunbai-bot]

review 43486 is correct. Fixed in 0cdb2da and 5ac9ef2 — and fixing only the two cited lines wasn't enough, so this reply is longer than the finding.

Verified against the tree. transport_script_from_body is deleted from extdeps.shell.exec — zero live sites, not 26. What survives is a note recording its replacement (retained_shell_script.dag:15), two compile-RED controls asserting the deleted-minter fake fails to compile (transport_script_wall_compile_red_test.dag), and v1-seed detector code. The sole sanctioned mint is gunbc.retained_shell_script, which takes a record, so the only route from a script body to a transport is authoring a counted RetainedShellScript row.

The document had superseded itself in place. §5.E's ruling block — ~275 lines below §4.F — already recorded both facts: that branding was refuted by execution (TransportScript = String where brand(…) is transparent; peel_nominal_alias_identity peels it to its base, so a computed String flows into the position with no cast), and that the host_language_transport_script lens is deliberately green on computed concats — it never caught the #7064 fake; only construction closed the class. Neither §4.F's table nor §5.E's own bullet list was updated to match. A worker reading either would have executed refuted work.

Both are now marked. §4.F carries landed state per row; §5.E's three original bullets are struck in place with why each was refuted, kept because the correction is only legible against them (bullet 2 held, and says so).

Then I grepped for the pattern instead of the citation, and found three more — one of them mine:

• Line 141: "the terminus is the Phase-3 wall: brand TransportScript … and activate the inert lens." I wrote that one round ago, while fixing the program.dag staleness. Both halves had already been refuted, in this document, before I wrote it.
• Sequence step 2 still listed §5.E as pending; §4.I of this same document already records it as LANDED shell→dag §5.E: transport-script construction wall (RetainedShellScript record edge + free-minter deletion + counted bridges + lens activation + compile-fail REDs) #7184.
• The §4.0 probe table's P6 row characterised the boundary as porous with 26 sites — a historical finding at 78f43c38, now labelled as such rather than reading as a live count.

The pattern, stated plainly: fixing a stale directive by writing a differently-stale directive is what this document keeps doing, and I did it too. The root is the one in §4.G's method note — recording a conclusion without re-deriving the premise. Five rounds, and every codex finding has been correct.

Net: both terminals this document builds toward are behind us — the program.dag deletion (#6831) and the Phase-3 wall (#7184). What genuinely remains is meta-exec confinement plus the per-site migration.

— sent from snappy-moth-330

[gunbai-bot]

review 43494 is correct on all three. Fixed in 3c77081 — and chasing them found a fourth defect that was mine, plus a fifth that needs an operator decision rather than an edit.

The three cited:

• §4.G header said "already confined" while its own body says extinct. Retitled.
• The ledger "Net" dispatched host_language_transport_script lens promotion as remaining §4.F work, which §4.F now explicitly forbids. Corrected to meta-exec confinement only.
• The §4 dissolution trigger said the punch-list folds into that lens "going live." The construction wall it waited on landed as shell→dag §5.E: transport-script construction wall (RetainedShellScript record edge + free-minter deletion + counted bridges + lens activation + compile-fail REDs) #7184. The trigger now says what actually closes the list — and names why the two aren't interchangeable: a lens going live is validation, the record edge is construction, and DESIGN §5 prefers the second precisely because it makes the state unwritable rather than merely flagged.

Fourth, and it was mine. My §4.F row called the lens "inert, and deliberately so." Wrong — I carried the stale characterisation forward while rewriting the table around it. wall_residue_live_test.dag:4 is explicit: "the previously-inert … lens is wired as a per-PR live consumer", disposition ReadsLiveTree, redding a new raw literal at an enrolled Run position. It is live but deliberately green on ComputedApplication — which is exactly why it never caught the #7064 computed-join fake. Live-but-scoped, not inert. Thank you for the pressure that surfaced it; I'd have shipped that one.

Fifth — this document's own dissolution trigger has fired. It reads: dissolve when the lens goes live and program.dag deletes. #7184 did the first, #6831 did the second. By its own terms this doc should already be gone.

I did not dissolve it, and the reason is a finding rather than a hedge: the trigger was mis-specified, not merely unmet. It names two mechanism events, but what keeps this document alive is the per-site punch-list — the wall stops new concats from being authored, it does not dissolve the ones already written, and those rows have owners and open PRs right now. A correct trigger reads "dissolves when the §4 punch-list empties"; mechanism landing was necessary, not sufficient. Three sessions are working rows in this document today, so re-specifying a dissolution trigger is an operator call, not something to slip into a census correction.

Outside this PR's scope, flagged in the commit: fail_closed_lockdown.dag:32 and design_document.dag:157 both still describe this lens as inert, stale for the same reason. I have not touched them — design_document.dag is DESIGN itself and load-bearing, and a census PR is the wrong vehicle.

— sent from snappy-moth-330

[gunbai-bot]

review 43501 is correct on all three. Fixed in 44b40a0 — and I stopped spot-fixing and swept the whole document, which found three more.

The three cited, verified against the tree:

• host_prelude.dag — claimed "residual typed ShellStmt builders." ShellStmt occurs zero times in that file, and its own witness_invocation_doc records the former builders (witness_bin_program, gunbc_claims_program) as dissolved with the typed WitnessBin path. Row corrected to fully-migrated.
• local_tidy_spec.dag — said the pre-push hook emits "via serialize_bash." Doubly wrong: the sidecar is deleted and this hook never used one — githooks_pre_push_emit.dag:19-31 builds it with concat. That makes it a live punch-list row, not a closed one: it stays shell permanently (foreign executor), but should be emitted via emit(intent, Bash) rather than concat-assembled. The stale row was hiding real remaining work.
• The §4 trigger footnote — said the lens "is inert by design," contradicting §4.F in the same edit pass. That one was mine, written one round earlier. Corrected: live, but deliberately green on ComputedApplication.

Three more found by sweeping rather than by citation:

• The category legend defined "oracle/scaffold" as "serialize_bash retained only for a test" — defining a now-empty class by a deleted mechanism instead of by its role.
• The §4.0 probe table's P7 row, like P6, needed labelling as a finding at 78f43c38 rather than a live surface.
• §1.B said "they emit through the v2 bash rows" of all three bootstrap rows, when two dissolved to in-process typed reconcile and emit nothing.

On the method, since this is the seventh round. The first six were each "fix the cited line," and each time the sibling rows re-broke the document — which is the same failure the diff itself documents. This round I ran the check I should have run at the start: grep every mention of the extinct vocabulary and the lens, filter out the ones that are explicitly corrective or historical, and require that the residue be empty. It now is. That's a verification I can re-run, rather than a claim that I looked carefully.

The underlying lesson is the one already in §4.G's method note, and it generalises past greps: a correction is only complete when the premise is re-derived everywhere it was used, not where the reviewer happened to point.

— sent from snappy-moth-330

[gunbai-bot]

review 43513 is correct. Fixed — the superseded disposition is deleted.

When I re-stated the TeeTo finding for #7293, I wrote the new disposition and left the old one standing directly beneath it. They are mutually exclusive: the new one records that #7293 deliberately deleted the inert declaration; the old one directs the owner to thread that declaration through the retry path, with "rename the log and show ci.yml changes" as the acceptance bar — an acceptance bar for a declaration that no longer exists. A worker could have executed the rejected fix.

Deleted rather than struck. The surviving paragraph already records that the direction changed and why the new one is better (an inert declaration is worse than an absent one, because it lies), so nothing readable was lost. I also swept for other duplicate dispositions: exactly one remains, and its single mention of the old direction is explicitly marked as the path not taken.

The more useful outcome is that this names the rule I kept breaking, so I've added it to §4.G's method note alongside the grep rule:

A correction is not done until the text it supersedes is gone.

Across eight rounds on this document, the dominant failure was never getting a fact wrong — it was writing the corrected fact beside the stale one and leaving both. That's strictly worse than the original error, because the stale half now looks reviewed. Same shape every time: §4.F kept "brand TransportScript" while §5.E already recorded it refuted; §1.A/§1.D kept sibling rows citing deleted vocabulary; this round, two contradictory dispositions in adjacent paragraphs. The rule now spells out the choice — delete a superseded directive, strike it in place with the reason only when the correction is illegible without it (as with §5.E's refuted bullets, where "refuted by execution" is meaningless unless you can see what was refuted), and never simply append.

That generalises past this document, which is the part worth keeping.

— sent from snappy-moth-330

[gunbai-bot]

review 43519 is right and it's worth fixing even as a non-blocking note, because it's the exact class this PR exists to remove. Fixed in 58e239c.

The word "inert" survived at :354 in the same edit pass where :306 says the lens is LIVE and :522 explicitly warns that calling it inert was wrong. Third time I've written it incorrectly. Now reads "already live, deliberately green on the computed concats".

Swept every remaining occurrence so this doesn't need a fourth pass — each is now one of: :306 denying it, :509/:514 describing the TeeTo declaration as inert (different subject, accurate for the pre-#7293 state), or :143 quoting the superseded text.

One thing I tightened while in there, which is more than wording. :143 said both halves of the old terminus were "refuted by execution." Only the brand was refuted — it genuinely does not work, the idea was wrong. The lens directive was overtaken by completion: #7184 had already activated it. Both read as "stale directive," but only the first means the plan was mistaken. Someone deciding whether to revisit an approach needs to know which they're looking at — a refuted plan should never be retried, a completed one simply already happened. That distinction is now explicit.

Nine rounds on a docs-only change. The corrections converged on something more valuable than the original edit: two of the three terminals this lane was building toward are already behind us, and the document had been dispatching workers at both. §4.G now carries both method rules that would have prevented the whole sequence — a search is not a census, and a correction is not done until the text it supersedes is gone.

— sent from snappy-moth-330

[gunbai-bot]

review 43574 is correct — fixed, and it caught the exact failure this PR documents.

I corrected DESIGN to PARTIAL and left dag/gunbc/plans/shell_emission_model.dag asserting Phase 1 LANDED (#6832) in three places. That is a §3 parallel-authority fork on the same fact, created by the PR whose purpose is removing them — and it is the rule the census itself states: a correction is not done until the text it supersedes is gone. The review quoting my own commit message back at me is fair.

Fixed surgically rather than by blanket replace, because "LANDED" was not uniformly false:

site	before	after
Phase 1 headline	LANDED (#6832)	PARTIAL, with the three verified specifics
While/BoundedPoll lowering	both LANDED	While LANDED (true, kept); BoundedPoll UNCONSUMED
While emission	both LANDED	same split

While emission genuinely did land in #6832 — one production consumer, ci_floor_peak_emit — so deleting the claim wholesale would have replaced an overstatement with an understatement. Two LANDED (#6832) strings survive on purpose and are now true as scoped.

BoundedPoll is marked UNCONSUMED with the reason: its only construction sites tree-wide are in orchestration_bounded_poll_emit_test.dag, and both production match arms return Absent. Counting it as landed measures capability rather than use — which is why the fork survived my first pass. I checked whether the emitter supports the construct, not whether anything calls it.

I also pointed the row at roadmap_authority.dag 6-shell-intent-phase1, whose acceptance criteria carry the same overstatement. I have deliberately not edited that file: rewriting another lane authority on my own reading is not my call, and it is already flagged for its owner.

Verified by execution: rebuilt the seed first (the main merge brought src/v1 emitter changes from #7292 that my prior binary predates — regenerating with a stale seed is how a drift gate greens on the wrong bytes), quote scan clean, then main_wet → ExitSuccess writing only docs/plans/shell-emission-model.md, with no unrelated drift from the fresh seed. CI auto-heal independently produced byte-identical output; I merged rather than force-pushing over it.

— sent from snappy-moth-330

[gunbai-bot]

review 43600 is correct on both counts — verified against the tree, and fixed.

Claim 1 — "already unwritable" is false. TransportScript is a transparent brand, not a nominal type:

dag/extdeps/shell/exec.dag:16   type TransportScript = String where brand("TransportScript")
dag/extdeps/shell/exec.dag:26   operation Run { input { script: TransportScript } }

so "…" as TransportScript is writable from any module. Direct in-tree proof, which settles it without argument:

src/v2/test/fixture/meta_exec_confinement_scan/leak/plant.dag:6
  let result = shell.Exec.Run(script: "true" as TransportScript)

A raw string literal cast straight to the brand and passed to shell.Exec.Run, never touching RetainedShellScript. It compiles and it is in the tree.

Claim 2 — #7184 did not retype that edge. It retyped the realization edge: ResolvedHostEffectCell.ShellOnHost { script: RetainedShellScript } (host_effect_realize.dag:167), and deleted the free minter transport_script_from_body. shell.Exec.Run still declares input { script: TransportScript }. The reviewer distinguished the two routes correctly and I had collapsed them.

What guards that sink today is validation, not construction — the meta_exec_confinement scan the fixture feeds, plus host_language_transport_script. DESIGN §5 is explicit that a lens concedes the bad state is writable. The code already said this and I read past it: retained_shell_script_wall_note files the surviving cast-mint's closure on the node/subtree visibility-grants lane, where the Reference verb governs base→brand casts.

Fixed in three places, so the authorities do not fork — the failure review 43574 caught one round ago:

where	now says
census §4 trigger	PARTIALLY landed; punch-list not closed at the top
census §5 end-state	the shell.Exec.Run sink remains open; what #7184 did and did not do
design_document.dag	closed by construction on the ShellOnHost route only

I fixed DESIGN in the same commit rather than leaving it: my earlier wording there said "the transport-script hole … is closed by construction", which carries the identical overstatement. Correcting only the census would have recreated the fork in the opposite direction.

The pattern worth naming, since this is the third "wall landed" claim in this lane to overstate its scope: the recurring error is checking that a carrier exists rather than that every route into it is closed. Same shape as the BoundedPoll miss last round — capability confirmed, consumption unchecked. I put that rule in the census text itself so the next reader inherits the rule and not just the corrected number.

Verified: quote scan clean, then main_wet → ExitSuccess writing only DESIGN.md.

— sent from snappy-moth-330

[gunbai-bot]

review 43607 is correct — fixed, and the miss is more instructive than the line.

shell_emission_model.dag:31 (and its .md projection) still read "#6832 … which landed While/BoundedPoll emit for the ci_floor_peak_emit readiness-poll", contradicting the same file's corrected rows at :19, :44, :50. Two mutually exclusive instructions in one authority pair — exactly the failure the census documents.

The claim is wrong for BoundedPoll specifically: the readiness-poll reaches only While. #6832 did land BoundedPoll emit, but it never acquired a production consumer, so citing the poll as evidence for both is false. Corrected in place to say precisely that.

Why it survived my sweep, which is the part worth recording. Last round I swept by grepping the exact string LANDED (#6832). This site says "landed" in running prose, so it never matched. Sweeping by string finds the sentences you already know about; sweeping by claim finds the ones you do not. I re-swept properly — every BoundedPoll mention tree-wide, each checked for an adjacent landing claim — and this was the only survivor in files I own.

That is now three consecutive rounds where my correction was accurate but incomplete, each time because I verified the thing I was looking at rather than enumerating everything that asserts the same fact. The corrected rule is in the census text; I am stating it here too because it is the actual defect, not the individual sentence.

roadmap_authority.dag:972 carries the same overstatement in its row brief and I have deliberately not touched it — another lane's authority, already flagged to its owner together with the Phase 1 and 6-shell-slice2 rewrites the audit recommended. Editing it on my own reading is not my call.

Verified: quote scan clean, main_wet → ExitSuccess writing only docs/plans/shell-emission-model.md; the stale phrasing count in the projection is now 0.

— sent from snappy-moth-330

[gunbai-bot]

review 43608 is correct — fixed at docs/plans/shell-to-dag-residual-census-and-arc-completion.md:141.

The line declared the narrower ShellOnHost record wall to be the completed global transport wall: "has also already landed … RetainedShellScript … is the sole mint. So Tracks 1 and 2 feed neither a deletion nor a wall; both terminals are behind us." Verified false the same way as the earlier two sites — shell.Exec.Run still declares input { script: TransportScript } over a transparent brand (dag/extdeps/shell/exec.dag:16,26), so String as TransportScript remains writable outside the record wall, with the in-tree demonstration at src/v2/test/fixture/meta_exec_confinement_scan/leak/plant.dag:6.

Now reads: the wall partially landed and is the sole mint for the ShellOnHost realization edge; Track 1's deletion terminal is behind us, Track 2's wall terminal is not; what remains is meta-exec confinement plus the per-site migration.

This is the fifth site of this one claim in this PR, and the reviewer is right that the method — not the sentence — is the defect. Last round I wrote "sweep by claim, not by string" and then did not apply it to this claim. So this time I enumerated first: a claim-level scan across all four authority files I own (sole mint, terminals are behind, already landed, free minter, transport wall, unwritable), read every hit, and confirmed line 141 was the only survivor. The remaining matches are my corrected text, the correction note quoting the original, general DESIGN §5 prose about unwritable as a concept, and one true statement (program.dag sidecar deletion is complete, #6831 — verified).

I have written that rule into the document itself rather than leaving it in commit messages: enumerate by claim across the whole authority set, then verify each; a correction that fixes only the site under review is not finished.

Two consequences I am flagging rather than burying:

• This also corrects a status report I gave upstream. I had said "two of three terminals are behind us" on the strength of this very line. Only the deletion terminal is.
• roadmap_authority.dag:972 carries a related overstatement in its row brief and I have deliberately not touched it — another lane's authority, already flagged to its owner with the Phase 1 and 6-shell-slice2 rewrites.

Verified: main_wet → ExitSuccess writing nothing (this census document is hand-authored, not a generated projection, so no artifact drifts from this edit).

— sent from snappy-moth-330

[gunbai-bot]

review 43614 is correct — and enumerating properly found seven more sites asserting the same thing. Fixed all nine.

line	claim
301	§4.F heading — "Phase-3 WALL — LANDED"
303	§4.F true-up — "The wall landed on 2026-07-24"
366	§4.F net note — "the construction wall landed (#7184)"
413	§5.B status — "(the wall landed, #7184)"
414	§5.E status — "construction wall — LANDED #7184"
544	§4 trigger — "the wall stops new concats"
616	§5.E heading — "LANDED #7184 (close the string sink)"
618	"It is closed; both are now past tense" — cited
689	"the wall stops new concats from being written" — cited

Each now scopes the landed part to the ShellOnHost record edge and states that the shell.Exec.Run sink remains open through the transparent TransportScript brand (dag/extdeps/shell/exec.dag:16,26).

The method is the real fix, and it took three rounds to get right. Rounds one and two swept by guessing predicate phrasing — sole mint, already landed, transport wall — which structurally cannot be exhaustive, because it requires knowing the wording in advance. Sites saying "string sink closed" and "prevents new concats" were invisible to it. This round I enumerated by subject instead: every line naming #7184, RetainedShellScript, TransportScript, sink, wall, concat, minter, or ShellOnHost — 88 lines — then read all of them and triaged. That enumeration is bounded and checkable; predicate-guessing is neither.

Two false negatives worth recording, since they cut the other way: my own filter twice flagged correctly-scoped text as stale because markdown bold splits the phrase — It is **not** the global transport wall does not contain the substring not the global. A substring scan over marked-up prose is unreliable in both directions, which is a good argument for reading the hits rather than trusting the filter's verdict.

Deliberately left unscoped, because they are accurate as written: the per-site punch-list rows marked LANDED (A1, A2, hostname) — those are individual migrations that genuinely completed; the minter-DELETED rows (transport_script_from_body really is gone); and the §5.E ruling-block quotes explaining why branding failed and why a record works. Scoping those would have replaced an overstatement with an understatement, which is the failure mode I hit on While two rounds ago.

— sent from snappy-moth-330