Classify the repository envelope's own refusals, and repoint the three citations #9258 left dangling

[gunbai-bot]

This PR was rewritten: the destination repair landed on main from a parallel lane

gunbc#9258 landed the same work item — supersession is generation-bound and compare-and-swap in gunbc.scm.supersession. This branch originally carried a second construction of the same contract. It is deleted rather than merged: two authorities for one fact is the fork DESIGN §3 forbids, and #9258's is the stronger of the two — evidence is minted from the slot by observe_generation, so a caller cannot state which generation it examined (construction, not comparison); admit_callers narrows the mint; and it carries two refusal arms this branch did not have (EvidenceExaminedAnotherDocument, ProposedGenerationIsTheObserved).

What remains is the half #9258 does not cover, and both parts are things its landing made more necessary, not less.

1. The missing classifier — the audit half of the brief

The brief asked for the destination's whole authorization relation, not either defect site. Enumerating every producer of LoadStanding found the classification side sound — closure_document_load_standing and object_table_load_standing both descend per cause, and the collision arm correctly stays out of LoadDocumentMalformed — and one gap:

gunbc.scm.repository_envelope had no classifier at all. A consumer holding a RepositoryDecodeRefusal had to reach into that format's error enum and assign a standing itself — one format's vocabulary answering a format-agnostic question, which is exactly the placement defect that closed gunbc#8940. A missing classifier fails silently: nothing refuses, the consumer simply invents the answer.

repository_envelope_load_standing closes it, descending per cause so a new cause in either delegated population fails to compile there rather than inheriting a standing in silence. The load-bearing arm is RepositoryIdentityRuleUnrecognized → LoadUnsupportedProtocol, not LoadDocumentMalformed: the envelope versions its node-identity rule separately from its schema (repository_node_identity_rule_tag), so a document can parse perfectly under a derivation rule this build does not implement. Those bytes are unreadable only here. Classifying them as damage would let an older reader destroy a newer writer's repository over a rule it simply lacks — the one outcome the standing vocabulary exists to prevent.

2. Three citations #9258 left dangling

Deleting standing_may_supersede_generation left three references to it on main:

carrier	what it said
DESIGN.md	the permission is "derived from the standing by one total function"
gunbc.recurring_failure_mode	same sentence — DESIGN.md is its projection
coproduct_payload_soundness_witness_test	two mentions, one of them the "separate contract deliberately not attempted here" boundary

All three are repointed at what exists. The third is repointed rather than deleted because the boundary it states is still true: #9258 makes the destination proof-bearing, so a false LoadDocumentMalformed no longer authorizes replacing a generation nobody read — but it still authorizes replacing the generation the evidence did name, so closing the producer route that file measures remains load-bearing and is not subsumed.

The DESIGN one is worth naming separately: it sits inside the row that teaches the stale-citation class, which already records two of its own citations rotting. This is its fourth, and it is recorded as such rather than quietly fixed.

Executed

• gunbc compile --entry dag/test/claim/scm_load_standing_witness_test.dag → 0 blocking, 196 advisory.
• claim_batch --hermetic, 7/7 PASS (six pre-existing plus the new classifier witness, which reuses main's ls_permits harness so it carries the standing through to the destination rather than stopping at the classification).
• Mutation receipt. Routing RepositoryIdentityRuleUnrecognized to LoadDocumentMalformed reds an_unimplemented_identity_rule_is_a_protocol_gap_not_damage and leaves only_an_unrecognized_format_is_a_protocol_gap green — the arms are disjoint and the new arm is load-bearing, not decoration. Restored, re-run green.
• DESIGN.md verified as a regenerated projection by running generated_artifact_gate main_wet; no drift beyond the edited sentence.

One thing observed and deliberately not included

The regen also wants to add src/v1/stage0/src/partition_crate_boundary_host.rs !merge to .gitattributes — pre-existing generated-artifact drift on main from a new stage0 file, unrelated to this change. I reverted it rather than widen this PR's scope. Flagging it here so it is not lost: nothing in CI currently guards that gate (DESIGN's floor-cut entry lists the drift gates as unguarded).

🤖 Generated with Claude Code

[gunbai-bot]

CI red here is inherited from main, not from this diff.

Failure: dag/gunbc/build_target.dag:177 and :378 — non-exhaustive match: missing variant(s) PanickedBeforeVerdict, NotAttemptedAfterAbort. The floor refuses at strict preparation, so no witness executes and the three roster uploads fail for want of input. The build lane passed.

Cause: pull_request builds the merge ref, so this branch compiles against current main. #9263 (a968415a00) added those two variants to ClaimDisposition in src/v2/workflow/floor_terminal_ledger.dag without updating the two matches in gunbc.build_target. This branch point predates that commit — the variants do not exist in my checkout — which is why the local entry compile was 0-blocking. This PR touches five files and build_target.dag is not among them.

Main is red for the same reason (run 32985041853 on 90bfcfad2), so it blocks every open PR.

Not fixing it here: #9343 is already open for exactly this. A second repair would be the duplicate-authority collision that this PR was rewritten to avoid once already.

No change needed on this branch; it unblocks when #9343 lands and CI re-runs against a main that compiles.

Separately, for whoever picks up the run-dispatch oddity: run 32985702154 startup-failed, and gh run rerun left it wedged at run_attempt=1 in a state where the list reports queued, the run API reports it completed, and force-cancel returns 409 Cannot cancel a workflow re-run that has not yet queued. Because witnesses.yml groups concurrency on witness-floor-<pr number> and cancel-in-progress does not evict a queued run, it suppressed later pushes on this PR. A workflow_dispatch (which groups on run_id) sidesteps it.

— sent from sharp-newt-374