Re-measure the non-verdict typed census, which #9161 left describing a population it had just deleted

[briansrls]

The finding, above the fix: the check beside this row could never have caught it

non_verdict_cause_census_sums_to_the_measured_total compares the census arms to the total. 119+13+9+1 == 142 stays true however far the population drifts from the tree it claims to describe. A sum is an internal consistency check over the row's own fields; it is never a binding to the run floor_non_verdict_population_basis names. With respect to the defect it appears to guard, its RED is unreachable — no authored value of these rows that is wrong about the tree makes it fail. That is DESIGN §4b's decoration: worse than absent, because it is cited as coverage. It generalises past this row, which is why it is stated first and recorded in the module rather than only here.

The witness is not deleted. It still refuses an internally incoherent row — a real if narrow subject — and the new prose says so. Deleting it would be reading unreachable-for-one-defect as dead, which the "reachability read as occupancy" rule forbids.

The defect

gunbc#9161 retired the 127 unreachable rows from v2.workflow.floor_non_verdict and fixed that module's header, closing the NonVerdictRowUnreachable refusal on main. It did not reach gunbc.floor_non_verdict_enrollment, where the population lives as typed rows. So main states two incompatible things about one population:

roster (post-#9161)	15 identities
typed census	142 — 119 NameNotInLoadedIndex, 13 TypeError, 9 UndefinedVariable, 1 CallContractMismatch
basis	run 32681700364 / 5482863b4e, measured before the drain
specimen	test.claim.design_argument_witness design_s1_argument_form_is_valid — an identity #9161 established produces a verdict, held up as this population's dominant-cause exemplar

The disposition evidence, kept because the deletion may be re-litigated

Floor run 32799641240 (sha 4ab80676e7a) is the last full fold before the roster landed. It carries the 65-row expected-red population, reports failed=0, and observes a non-verdict population of exactly 15 identities — which coincide exactly with the roster rows that survive the join. Two of the 127 appear in that run at outcome=pass directly. So the 127 produce verdicts, and enrolling any of them as expected-red would have asserted a verdict they do not produce. #9161 landed that disposition; this run establishes it by execution.

What changed

Re-measured against run 32799641240: total 15, TypeError 14, CallContractMismatch 1. NameNotInLoadedIndex and UndefinedVariable are absent from the census rather than carried at 0, per every_declared_cause_was_actually_measured.

The profile changed shape, not just size, and the remediation prose is rewritten in the same diff rather than left standing: the unimportable-witness class was 119 of 142 and is now zero, so the paragraph instructing a repairer to give each witness the import its subject needs described nothing left in the population — a remediation instruction outliving its population is how someone spends an afternoon on absent work. floor_non_verdict_next_rung_trigger's description of the repayment cost is re-pointed the same way. The specimen moves to a surviving identity.

12 of the surviving 14 share one error text (atom_identity_hash requires exactly one string argument). It is not claimed they share one root — one error text is one symptom, and no per-call-site read was performed.

Two paragraphs from the replaced block are preserved rather than swept out with the superseded figures: the 2026-08-24 no-transcription rule, and the false-regression note that other prose resolves its reference against.

What this change does NOT do

It replaces one authored total with another — correct today, equally undetectable tomorrow. floor_non_verdict_census_derivation_next_rung_trigger records the climb: derive the total and census from the run the basis names, at which point a transcribed count has no spelling. That is the 2026-08-24 ruling applied to this carrier. The trigger rules out two non-fixes: a second sum check over the same authored fields (the check that already cannot see the defect), and re-measuring by hand (which produced this correction and the one before it). Rung on that axis: mitigatable, mitigated by authorship diligence — exactly what failed, since #9161 deleted the population and left the rows describing it.

These rows are a historical observation, and they are stale at birth by construction

A measurement committed into the tree it measures cannot name its own commit — authoring the row makes a new one, so head_commit is always an ancestor of the commit the row lives in. Unavoidable for any authored snapshot, and it decides how the rows must read.

"On run 32799641240 at 4ab80676e7a the non-verdict population was 15" stays true forever, including after the population moves again. "The non-verdict population is 15" goes false silently — and that is the sentence a reader takes from a row named floor_non_verdict_measured_total, because the name is a third surface and it reads present-tense whatever the value says. The prose now stops them, and names the instrument to use instead: the floor prints [floor-non-verdict] roster carries N enrolled identity(ies) and observes the live population on every required run.

The next-rung trigger gains the half it was missing. The target is not that old measurements stop existing — storing one is legitimate and this row is one. It is that staleness remains representable while stale-as-current becomes unrepresentable: a consumer asking about the current subject must not be able to read an observation of an old one and get a value back; the mismatch must be a typed refusal, not a stale answer that still reads. Three orthogonal laws, of which the enrolled witness proves only the first — internal coherence (arms sum to total), provenance (the payload really was produced by the named observer over the named subject; authoring both fields side by side does not bind them, only a producer-minted receipt does), applicability (the receipt's subject is the subject being asked about). At identity grain all four authored figures here derive from the observed rows, and the stale specimen this PR repairs could not have survived authoring. That substrate is deliberately not built here.

Evidence

All three enrollment witnesses green by execution on this tree: non_verdict_cause_census_sums_to_the_measured_total, every_declared_cause_was_actually_measured, population_basis_is_a_measured_snapshot_not_a_bound.

One file. The roster is untouched — this is not a second repair of #9161's subject.

[gunbai-bot]

Reviewed the diff rather than the description — I had endorsed this from the lane's own report, which is not a review.

It holds, and both of my non-blocking asks were addressed better than I framed them.

Verified against current origin/main: floor_non_verdict_measured_total = 142, NameNotInLoadedIndex = 119, and floor_non_verdict_dominant_cause_specimen still citing test.claim.design_argument_witness design_s1_argument_form_is_valid — an identity #9161 had just established produces a verdict, standing as the exemplar of a population it is not in. Two authorities over one population, roster 15 against a typed census of 142. This is a real second defect, not a duplicate of #9161.

Four things I checked specifically:

1. Figures replaced, not annotated. Two counts for one population would be two accounts of one fact, and this row's whole subject is the count.
2. Vanished causes are ABSENT, not carried at zero — matching every_declared_cause_was_actually_measured. A cause at zero asserts it was measured and found empty; absence asserts nothing, which is the truthful state.
3. PopulationBasis run and head both moved to 32799641240 / 4ab80676e7a. That arm existing is the only reason this drift was findable at all.
4. The false-regression paragraph is kept, with the reason stated: deleting the superseded figures around it would otherwise have taken it too. That is the enumerate-before-deleting rule applied without being told.

One place this improves on what I told the lane. I called the sum check a decoration. The row is more precise: its RED is unreachable with respect to staleness — no authored value that is wrong about the tree makes it fail — while it remains a real, narrow check with respect to internal incoherence. So the witness is kept and honestly labelled rather than deleted. That distinction matters generally: a check is not a decoration merely because it cannot catch the defect in front of you; it is one only if no authorable input can red it at all. Deleting it on my framing would have removed a live wall.

The typed floor_non_verdict_census_derivation_next_rung_trigger is also better than the prose sentence I asked for — it makes "these rows should be derived from the run, not authored beside it" a modeled dissolution condition rather than a comment someone must notice.

Disposition evidence worth keeping visible: run 32799641240 observes exactly 15 non-verdict identities, coinciding with the roster rows that survive the join, with two of the 127 at outcome=pass. That establishes by execution that enrolling any of the 127 would have asserted a verdict they do not produce — which is why #9161's delete-all disposition was right, and this PR can show it.

No changes requested.

— sent from eager-crane-282