`data <name>: <Type> =` followed by a newline before the expression is a parse error
in .dag -- "expected expression, found Newline" -- and three rows in the new carrier
were wrapped that way. Measured, not guessed: the module index refused the file with
that diagnostic on a remote dispatch, and with the rows unwrapped all three witness
functions evaluate and return true.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…position was below floor

RULING (operator, relayed via the dispatching session): the observation arm is not
the defect. known_red_runtime_errored and known_red_observation_unreadable say
something TRUE -- this enrolled claim produced no Boolean verdict. What was wrong is
the COMPOSITION: required_floor_outcome_is_clean consulted neither, so the floor
returned CLEAN while an enrolled expected-red assertion had ceased to assert anything.
A diagnostic can describe the evidence truthfully while the gate draws a false
conclusion from it. Per seam: routing is mitigatable, printing the count is
mitigatable, printing failed=0 without distinguishing verdict incompleteness is a
misleading projection, and returning clean over an enrolled claim that produced no
verdict is BELOW FLOOR. Below floor is not a rung, so this could not wait on the
population being repaid, and the previous revision's 4b(2) row understated it.

WHAT ENROLMENT ADMITS: a known SEMANTIC VERDICT, not permission for the subject to
stop evaluating. Without a wall the expected-red arm absorbs an arbitrary regression
strictly INSIDE the enrolled population -- yesterday the witness answered false, today
it throws before reaching its assertion, no verdict exists, floor stays clean. An
UNENROLLED witness that throws already gates through the ordinary failure path, so the
absorption was never repo-wide and this commit does not claim it was.

THE WALL IS A GROWTH FREEZE, NOT A GATE ON THE POPULATION. v2.workflow.floor_non_verdict
carries the 142 identities; admission is that ADDED is empty. 142 -> 43 -> 0 is
admitted in any order; 142 -> 143 refuses; and a swap that repairs one identity while
a different one begins throwing refuses even though the count never moves. That last
case is why both sides are compared as IDENTITY SETS -- a count cannot see a swap, and
a repaired witness must not buy permission for an unrelated witness to lose its
verdict. It has its own witness, asserting the length equality beside the refusal so
the discrimination cannot be read as an artifact of differing sizes.

TWO DESIGN DECISIONS THAT ARE NOT ARBITRARY. The polarity is unenrolled-blocks, so an
EMPTY roster is the strictest state and a roster read failure cannot flatter a run --
the opposite polarity rebuilds the absorbing-fallback shape inside the mechanism
written to close one. And repaid does NOT gate, deliberately breaking symmetry with
floor_route_gap's stale-row refusal: copying it would red the floor on the merge that
repairs 99 of these (gunbc#9020), which is how a repository teaches people not to
repair debt. Added is walled; repaid is announced per identity with its remedy.

A non-verdict row not also in floor_expected_red is REFUSED, not warned. Only enrolled
identities reach these arms, so such a row can never fire -- unreachable, not empty --
and DESIGN is explicit that a check whose red cannot be authored is a decoration,
worse than absent because it is cited as coverage.

FloorAdmittedWithNonVerdictDebt separates unexpected_failures from verdict_incomplete
on the top line. `failed=0` is a sentence a reader can finish alone and finishes
wrongly; that misreading is what dispatched this whole lane against a regression that
did not exist.

Evidence: cargo check clean; four admission witnesses return true by execution
(unchanged admitted, repayment admitted with repaid=2/added=0, growth refused with
added=1, and the equal-count swap refused with added=1 and repaid=1); the roster
evaluates.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

… on the seed path

The decision was taken INLINE IN TWO ARMS, which is two places one rule could drift
from the modeled admission it mirrors. It is now taken once, after the fold, over two
identity sets: the arms only RECORD what they observed. That was prompted as a way to
make the seed testable and turned out to remove a real second-representation seam.

THE SEED PATH NOW HAS A DISCRIMINATING RED, which the previous commit did not have --
its four witnesses exercised the MODELED admission, and a mirror can be wrong in ways
its carrier cannot see. Five unit tests drive growth, repayment, the equal-count swap,
and the empty roster through the Rust that actually gates.

MUTATION-CONTROLLED, because five green tests establish nothing on their own:

  stuck-admit (always true)                     -> 3 of 5 FAIL
  count-based (added.len() <= repaid.len())     -> 4 PASS, 1 FAILS
  restored                                      -> 5 pass

The second mutant is the load-bearing measurement. A count-based admission passes
every test except the swap, which is exactly the claim the design rests on: a count
cannot see one identity repaired while a different one begins producing no verdict,
and only the identity-grain comparison refuses that trade. Without that single case
the mutant ships green.

THE MIRROR'S RUNG IS NAMED rather than left implicit. There are now two
implementations of one rule -- v2.workflow.floor_non_verdict_admission and
v1_compiler.cli_run non_verdict_admission -- so the carrier records the seed half as
MITIGATABLE with its next-rung trigger being derivation from the carrier, the same
framing v1_compiler.required_regen_host already carries for its hand-mirrored
ordering. The class rung is the minimum across paths, so it is mitigatable.

RESIDUAL GAP, NAMED: none of this reaches the wiring from a real thrown witness into
the observed set. That path is still unexercised. It is narrower than "the seed wall
is untested" and it is not zero.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…pared against the base

The dispatching session, relaying its second reader, asked whether R (subset of) B is
enforced. Checked against the implementation rather than my description of it: it is
not. non_verdict_admission takes observed and roster-at-head, and no base reference
exists anywhere in that path. So a change that makes a NEW identity stop producing a
verdict may add its row IN THE SAME CHANGE, satisfy both executing arms, and be
admitted — the roster legalising the regression it exists to bound. That is review
55361's finding (the row becomes the permission) reached through authorship instead of
through survival.

NO MECHANISM CHANGES HERE. The wall does exactly what it did when CI went green. What
was defective was the CLAIM: the module was named a growth freeze and the title said
"frozen against growth at identity grain", from which a reader concludes growth is
refused. That is rung inflation in DESIGN 4b(1)'s exact sense — worse than sitting
low, because an inflated class never ranks for climbing — and it was false in the
artifact independent of whether the conjunct ever lands. So the header now opens with
what is confined and what is not, BEFORE it describes the admission, and the title
says confines rather than freezes.

TWO AXES, ONE EXECUTES. Observed-vs-roster is walled by execution every run: growth
refuses, stale exemptions refuse, both at identity grain. Roster-vs-base-roster is not
walled at all — mitigatable, confined by review diligence, which is strictly weaker.
The class rung stays the minimum across axes and paths.

NEXT-RUNG TRIGGER, and it is specified at identity grain for the same reason the
executing arm is: the floor reads the roster at the merge base and refuses when the
head roster is not a subset of it, established against a discriminating red. Not
satisfied by counting rows — an addition and a deletion in one change leave every
count unmoved.

WHY THE CONJUNCT IS NOT IN THIS PR: reading the base roster means evaluating a .dag
module out of a git blob in a separate resolve context. That is real machinery
deserving its own discriminating red, not a paragraph bolted onto a change already at
full approval with green CI.

AND THE HONEST ACCOUNT OF WHY THE HOLE EXISTS, which is the reader's framing and
better than mine: the admission was SPECIFIED against a base OBSERVATION, and
substituting the roster for it is what makes the wall runnable in a single pass. The
substitution is sound exactly to the degree the roster cannot be grown freely, so
R (subset of) B is the condition that makes the cheap design safe rather than a nicety
on top of it.

Evidence: required_floor's closure compiles at 0 blocking errors (126 advisory); the
carrier's closure at 0 blocking errors (276 advisory).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

A precisely-wrong trigger is worse than a vague one, because someone implements
exactly what it says. The previous text named the MERGE BASE as the future authority
for the roster-growth law. It is the wrong baseline, and the failure is an admission
rather than a spelling.

EXEMPTION RESURRECTION. M = {a} at the merge base. Main later repairs `a` and deletes
its row, so the current base tip carries B = {}. A stale branch reintroduces `a` and it
throws: H = {a}, O = {a}. Then O = H passes and H subset-of M PASSES — readmitting an
exemption main has already paid off. H subset-of B fails, which is the law actually
wanted. The mirror is a false red: a row main legitimately adds after the fork sits in
B and in the composed result but not in M, so a subset-of-M rule refuses a branch that
did nothing wrong.

So the law is H subset-of B — the roster in the COMPOSED RESULT is a subset of the
roster at that result's CURRENT TARGET-BASE PARENT — and the trigger now says so, in
both the carrier and the roster header, with the counterexample beside it so the next
author cannot re-derive the weaker rule from the stronger sentence.

CONSEQUENCE FOR THE CUT'S SHAPE, recorded because it changes how the follow-up is
scoped: a BRANCH-HEAD-ONLY RUN CANNOT ESTABLISH THIS LAW. It needs the composed result
AND that result's base parent, which is strictly stronger than "read the roster at
another commit". The trigger also pins the receipt the cut must carry —
target_base_sha, composed_result_sha, base_roster_identity_set,
result_roster_identity_set, added_exemptions = result - base — and requires the same
read-failure polarity the executing arms already have.

NO MECHANISM CHANGES. The two executing axes are untouched and the "confined at
identity grain" claim is unaffected; only the future authority named in the trigger was
wrong. Amended in this PR rather than deferred to the follow-up because the head had
already moved for the main integration, so the approval cycle was already reset and the
marginal cost was zero.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

… are inside it

An independent census (valiant-lynx-227, run 32743601436) partitions the erroring
modules 53 declaring NO import against 8 that declare imports and error anyway.
Cross-joining that against this carrier's own cause census — which neither lane had
done — puts SIX of those eight inside the `no declaration named` bucket. The bucket is
not homogeneous, and §5's four hand-checked names, all lacking imports, leave the
impression that it is.

ONE OF THE SIX READ IN FULL, so the second shape is evidence and not inference:
v2.lens.vacuity_test fails on `nat_add_left_identity_input` while declaring ten
imports, among them v2.test.nat_semiring.rung_5 — a module that REFERENCES that name
but is not the module that DECLARES it (v2.std.algebra_laws.nat_semiring). Importing a
module does not transitively supply the names its own declarations reach for. So the
second shape is an INCOMPLETE import set, not an absent one.

THE CONCLUSION IS UNCHANGED AND SLIGHTLY STRENGTHENED: both shapes are authored
defects, both repaired by adding the import that declares the referenced name, neither
is a floor scope defect. "Widen the scope" is still the wrong trigger. What moves is
the repairer's expectation, which matters to the lane inheriting the backlog. The
remaining five are established only as "declares imports AND lands in this bucket";
their specific missing imports are unread, and the row says so.

ALSO RECORDED: the census reached me first as "142 rows but 133 distinct, 9 appearing
twice" — which would have meant this roster carried nine stale exemptions. False, and
instructively so: the floor COLUMN-PADS the identity, so short names are followed by
spaces before `ERROR in`, and an extraction using `[^ ]*` cannot cross that padding.
The pattern silently selected for long identifiers and dropped exactly nine rows. The
nine were MISSED, not duplicated — sign inverted, the same shape as the brief this
document exists to correct. Two independent diagnoses converged on the padding cause.
The durable rule: a distinct-vs-total discrepancy is a tell about the READER before it
is a tell about the population, and the control is to count with a different pattern
than the one that extracts.

AND THE CAUSE CENSUS IS DECLARED A CLAIM, NOT A RECEIPT. The floor log carries no cause
text beside the ERROR row, so the 119/13/9/1 partition cannot be checked by anyone
unwilling to re-run a floor that OOMs in a session container — unverifiable by
construction. Printing the cause beside the identity is a smaller change than this
wall and would have made the false alarm impossible; it is a separate subject, and
until it lands the partition is a claim.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

# Conflicts:
#	dag/gunbc/seed_growth_admission.dag

…swers

Review 55515, correct. When stale_non_verdict was flipped to gating after review
55361, the reversal reached the roster header, the seed's field doc and the gate
conjunct — and missed the docstring on v2.workflow.floor_non_verdict_admission
non_verdict_repaid, which went on saying "Reported, never gating: a repaid row must not
red the run that repaid it".

That left two authorities stating OPPOSITE RULES about one admission, inside the module
whose whole subject is single authority, in a PR whose body cites review 55361 for
exactly this class. The mechanism was never wrong — the executing code has refused
stale rows since that fix — which is precisely why the sentence survived: nothing that
runs reads it.

FIXED IN BOTH PLACES, because the reviewer found one instance and there were two. The
docstring now states the rule and records that it was reversed and why. The PR body's
"repaid does not gate" paragraph carried the same stale claim and is corrected as a
struck-through amendment rather than a silent rewrite — a reader of the earlier
revision saw the reversed claim, and quietly replacing it would hide the drift instead
of recording it.

SWEPT FOR OTHERS: grepped every carrier, the seed, the probe document and the PR body
for surviving assertions that repaid or stale does not gate. The only remaining hit is
the verbatim quote of the original brief in the probe document, which is a quotation
and stays.

WHAT THIS IS AN INSTANCE OF, recorded because it is the day's recurring shape: prose
asserting more or other than the mechanism does. Every defect found in this PR has been
that — the failed=0 line, the diagnostic stale row, the growth-freeze title, the
merge-base trigger, and now a docstring left behind by its own reversal. None was a
coding error. All were caught by someone checking a claim against the tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ent corpus was bankrupted under this PR

Main landed #9132 (bankrupt the measurement corpus) while this branch was open,
under an operator ruling this change is directly subject to: name the
instrument, never transcribe its output. 164 files and 44,736 lines went out of
docs/probes/, every .sh/.py instrument kept.

docs/probes/expected_red_non_verdict_population_2026-08-24.md is a transcription
board of exactly the class that ruling deletes. After merging main it was the
ONLY file left in that directory -- one document re-establishing a corpus main
had just emptied, on the same day, which is the attractor DESIGN section 3 names
rather than a document that happened to survive. It is deleted here.

WHAT IS NOT LOST, and why the deletion is not a coverage cut. The measurement
never depended on the board: floor_non_verdict_cause_census and
floor_non_verdict_measured_total are typed rows, and
floor_non_verdict_population_basis carries MeasuredOnOneRun { run, head_commit },
so every figure names the run and head it was taken on. That is the receipt-vs-
figure distinction a markdown board structurally cannot carry, which is the
ruling's own argument for the cut.

WHAT MOVED. One irreducible fact in the board was rationale rather than
measurement and had no other home: the dispatched brief -- 99 witnesses PASSED ->
RUNTIME-ERRORED across 330f63c..5482863 with the floor reporting failed=0
-- is false in its first half, shown by an identity-set diff, because the 99 were
baselined against a branch head already carrying the fix and so were compared to
a tree they never ran in. The carrier's existing prose REFERRED to that false
regression without ever stating it; it now states it once, as a section 4c
annotation on the declaration it explains. A first draft of that annotation also
restated the fix-carrying baseline the preceding block already covers, and was
trimmed to the half that was actually missing.

RESIDUE, checked against the three classes #9132 declared for its own cut and
found empty here: no .gitignore un-ignore row, no prose note in any module, and
no witness asserting the filename. Nothing in the tree references the deleted
path, so this leaves none of the debt that commit declared for itself.

Verified: the module parses and evaluates after the annotation --
floor_non_verdict_measured_total returns 142, the host refusing only on its
exit-code contract (an Int is not a ProcessExit), which it can raise only after
computing the value.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

… the hand-Rust receipt (review 55577)

Two findings, both verified against the code before fixing.

ONE: THE MODEL DISAGREED WITH ITS ONLY CONSUMER, AND I CAUSED IT.
`non_verdict_admits` -- modeled in v2.workflow.floor_non_verdict_admission and
mirrored in v1_compiler.cli_run -- answered `added.is_empty()`. The executing
gate `required_floor_outcome_is_clean` has nine conjuncts, two of which are
`non_verdict_unenrolled.is_empty()` (the added arm) AND
`stale_non_verdict.is_empty()` (the repaid arm). So the canonical model said
ADMIT exactly where its consumer said REFUSE.

The provenance matters because it is not an oversight in the original design: it
is the divergence review 55361 opened. That review correctly argued stale rows
must gate, I made the GATE gate, and I did not carry the change into the model or
its tests. DESIGN section 3 is the point -- a modeled authority whose consumer
disagrees is worse than no model, because it is cited as the rule while something
else enforces a different one.

WHAT WAS RIGHT ABOUT THE OLD RULE AND WHAT WAS WRONG. The rationale for admitting
repayment was that refusing it would red the merge that repairs the population
(#9020 repays 99 in one landing). Right about the goal, wrong about the subject:
what refuses is not the repayment, it is the roster row LEFT BEHIND asserting a
debt that no longer exists. Repaying and deleting the row are one act, which is
already how the #9020 merge-order deletion was planned.

So both paths now admit iff added and repaid are BOTH empty, and both suites gain
a control -- repayment WITH the row deleted is admitted. Without that pair the
tests cannot discriminate "stale rows refuse" from "repayment refuses", which are
opposite rules; the pair fails in opposite directions if either is wrong.

TWO: THE HAND-RUST RECEIPT WAS STALE.
It read +195 in cli_run.rs and +65 in claim_executor.rs and omitted
claim_executor's deletions entirely. Measured by git diff --numstat against
origin/main at this head: +203/-0 cli_run.rs, +60/-5 claim_executor.rs, +102/-0
the test file. The forward-freeze policy exists to make hand growth checkable, and
a receipt measured once and not re-measured as the change grew is a figure rather
than a receipt -- the row now says so and says it must be re-measured on every
push touching those files.

Also removed a blank line between one annotation block and the declaration it
attaches to, matching the convention every other annotation in that file follows
(DESIGN section 4c attaches annotations to a declaration). This is NOT claimed as
a fix for anything: a discriminating control through the actual parse sweep, with
and without the blank line, produced identical output, so the form was not what
any gate was refusing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…d the citation naming a test that no longer exists (review 55591)

The reported finding, plus two of the same class the sweep for it found.

REPORTED: the `observed_repaid` fixture comment still read "Must be admitted --
refusing it would red the merge that repairs the population", directly above the
test that now asserts the opposite. Fixed, and it now says WHY the refusal is not
a penalty on repayment: what refuses is the roster row left standing, not the
repayment, and the deleted-row form is admitted by the fixture below it.

FOUND BY SWEEPING FOR THE CLASS RATHER THAN THE INSTANCE:

(1) The same defect in the Rust mirror. `non_verdict_admits`'s docstring still
described the retired asymmetry -- "so a caller cannot accidentally admit on
`repaid` -- the asymmetry between the two is the content of this wall" -- sitting
directly above a body that now refuses on both arms. Rewritten to state both
refusal reasons, with the correction dated.

(2) A STALE CITATION, and this one would have shipped silently.
`floor_non_verdict_seed_growth_justification` cited
`repayment_is_admitted_and_reported_per_identity`, which the previous commit
RENAMED. That is a DESIGN section 3 fabricated symbol -- and the mechanism that
used to catch it, the cited-symbol census, was removed from CI on 2026-08-23, so
nothing in the repository would have refused it. Verified the whole file by hand
instead: all 12 DeclarationRefs resolve to a definition in the tree. The new
control test is added as a cited row, since a hand-authored seed item that is not
enumerated is exactly what the forward-freeze policy refuses.

Receipt re-measured, as the row itself now requires on every push touching these
files: +210/-1 cli_run.rs, +60/-5 claim_executor.rs, +102/-0 the test file.

THE PATTERN, recorded because it is now four for four in this PR: every defect
found here has been PROSE CLAIMING SOMETHING OTHER THAN WHAT THE MECHANISM DOES
-- the failed=0 headline, the "diagnostic" stale row, the growth-freeze title, the
merge-base trigger, this docstring, this fixture comment, this citation. Not one
was a coding error. That is the cost DESIGN section 4c prices when it calls prose
commentary modeling debt: it cannot be mechanically joined to the code it
describes, so a reversal updates the assertion and leaves every sentence about it
standing.

Verified by execution: both witnesses return true.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>