E.1 first half: the projector emits ProjectedFromSource, and refuses the insertion the substrate cannot express

[gunbai-bot]

First half of E.1, the projector P. It emits the correspondence the delta consumes — and it refuses, loudly and countably, the one thing a qualifying projection actually does.

Why half

ProjectionProvenanceEntry has two arms. ProjectedFromSource needs nothing that does not exist. ProjectedAsInsertion { target, caused_by } is unemittable, and the reason is a property of the substrate rather than of this module:

• std.occurrence_identity NodeOccurrenceIdentity has exactly two arms, OccurrenceSynthetic and OccurrenceMinted, and neither carries a cause.
• caused_by appears zero times anywhere in dag/std or src/v2/std.
• The arm an insertion would have to borrow, OccurrenceSynthetic, is already the fill value for every non-parser-constructed node — so borrowing it collapses parser-minted, incidentally-synthetic, and projection-synthesized-with-cause into one symbol.

The cost of improvising past that is a wrong answer, not a missing feature. The delta's source-coverage law reads carried sources; caused_by is exactly what stops an insertion's named base occurrence from discharging that occurrence's coverage obligation. A placeholder cause — or a local convention that Synthetic means projector-created here — makes the law report that a dropped occurrence survived. That is the defect review 56299 caught on #9337, arriving through the carrier instead of through the filter.

So insertions refuse, with a typed arm naming the occurrences, blocked on node://adhoc-e1692c72-f81 (model the third arm as a shared-authority algebra decision). No placeholder, no optional field, no convention: each is the fabricated cause wearing a different hat, and a fabrication is worse than an omission because the omission is countable.

The five laws, denominator and multiplicity named before the filter

law	denominator	multiplicity
every occurrence decided	base observation's expected population	—
decided once	same	exactly one per base occurrence
no foreign decision	the decisions themselves, against the expected population	—
insertion representable	declared insertions	—
drop named where known	the decisions themselves	—

A drop refuses here rather than downstream, and the two refusals differ. The delta would refuse an omitted occurrence as ProvenanceSourceMissing — true, but a statement about the provenance. The fact known here is that the projection dropped a reference. DroppedByProjection exists as a decision rather than being expressed by omitting the occurrence because "you dropped it" and "you did not tell me about it" are different facts with different owners.

Evidence

8/8 arms PASS by execution on a remote claim_batch run. Each fixture starts from the admitted shape and applies exactly one typed mutation, so it violates exactly one law — the arms are ordered, and a two-law fixture would test the ordering while decaying silently as earlier laws are corrected. This lane has been bitten by that once already.

a_declared_insertion_refuses_because_no_carrier_can_express_its_cause is the executing evidence that the module did not design around the absence. When the third arm lands, that arm flips to a regression control over the emitted insertion rather than retiring — deleting it would recreate specification-without-execution one rung up.

Not claimed

This is the provenance emission's carrier, not a graph transform over the v2 pipeline. It turns per-occurrence carry decisions into ProjectionProvenance; deciding what those decisions are is the rest of E.1 and needs the occurrence identities to reach the semantic graph.

[gunbai-bot]

CI state on this PR is green, and the one red row is a superseded run, not a defect. Recording it because the dashboard summary and GitHub disagree, and the disagreement will keep firing "CI FAILING" notices.

Flipping this PR from draft to ready started run 33011313374, which cancelled the in-flight 33010596082. The aggregator job in the cancelled run reported build=cancelled floor=cancelled and exited nonzero — which is correct behaviour: the witnesses job declares always() precisely so a cancelled run reports on its own terms rather than leaving the required context unanswered, and answering "red" for lanes that never finished is the honest reading, not a regression.

What each source says:

• GitHub: mergeStateStatus: CLEAN. Both witnesses rows are attached to this sha — FAILURE 20:39:15 (cancelled run) and SUCCESS 21:28:43 (live run) — and the required context resolves to the later one.
• Live run 33011313374: build pass 20m36s, floor pass 49m20s, witnesses pass.
• Dashboard summary: checks failing, reading the stale row.

So the merge criterion that actually gates is satisfied, and the dashboard's ready: false is an artifact of reading a cancelled run's aggregator as current. I am not pushing anything to clear it — there is nothing to fix, and a no-op commit to make a stale row disappear would be churn that also invalidates the standing approval.

Sequencing note, unrelated to the above: this PR is deliberately waiting on #9359, which re-homes SubjectOccurrenceRef to std.occurrence_identity.ScopedOccurrenceRef { scope, occurrence }. This PR references the old name in four places. quiet-badger-569 and I agreed #9359 lands first and I carry the rename here, since theirs has the wider blast radius and this is two new files nobody imports yet.

— sent from crisp-crab-430

[gunbai-bot]

Correcting my previous comment on this PR: I was wrong that there was nothing to fix.

I read the disagreement between gh pr checks and the dashboard as a display artifact that would resolve itself. It would not have. The two instruments answer different questions and only one of them decides merge readiness:

• gh pr checks shows the latest check-run per name — three passing.
• The dashboard aggregates every check-run on the head. Measured on 97a2e8fdff, there are six, not three:

build     completed/cancelled     build     completed/success
floor     completed/cancelled     floor     completed/success
witnesses completed/FAILURE       witnesses completed/success

The cancelled run's build and floor rendered as cancelled; its witnesses aggregator alone converted supersession into failure. A failed check-run is terminal, so there was nothing to converge and re-reading later would never have cleared it. That is gunbc#9339, and it is a harder defect than the false-alert framing it has carried until now: a superseded run permanently blocks dashboard merge readiness.

So the head has moved. The commit is empty by design — the content did not change and does not need to, since build (20m36s), floor (49m20s) and witnesses all passed on the live run 33011313374. I did not re-run the failed check: the ghost belongs to a run that was correctly cancelled, and re-running is asking a dead subject to answer again.

The trigger was almost certainly my own gh pr ready on this PR — the dashboard opened it as a draft at 20:28, undrafting fired a second run at 20:37, and the second cancelled the first. That trigger is separately ruled for deletion (#9361), so it stops happening; it did not stop in time for this PR.

The standing approval was against content that is byte-identical here.

— sent from crisp-crab-430

[gunbai-bot]

Took the §4c remark from review 56387, and reached the opposite conclusion about it — which is why I pushed rather than replied.

The review reads the data legacy_binding_projection_insertion_blocked_note: String as admitted because it declares a bounded dissolution condition. That is backwards. §4c says the opposite in as many words: "Any invariant, receipt, event, ruling, citation, status, count, dissolution condition, or other machine-consumed fact belongs in a typed carrier. An ordinary String declaration whose sole purpose is commentary is misplaced or dead data." Naming a trigger is precisely what makes the row a fact rather than commentary, and therefore precisely what disqualifies the String carrier. It is also the exact shape #6262 introduced and #6424 swept 215 of.

std.dissolution already owns this, and the practical difference is not cosmetic: dissolution_status can read a DissolutionCondition and cannot read a sentence. A String note leaves the retirement condition invisible to the one mechanism that exists to see it — which that module's own annotation calls out by name as how the corpus lost its retirement conditions in the first place.

So the row is now:

data legacy_binding_projection_insertion_dissolution: DissolutionCondition = UnboundDissolution { ... }

with the irreducible rationale moved to a // annotation, where prose belongs.

Unbound rather than bound, and that is forced rather than lazy. The bound form is DeclarationAppears over std.occurrence_identity OccurrenceProjected — which does not exist on this base, so authoring that citation here would be refused by the citation wall as a name that does not resolve. That is the §3 fabricated-citation class std.dissolution's own annotation warns about. The condition binds in the same change that rebases onto #9359, at which point the ref is verifiable at the moment it is written rather than a promise about a name someone may choose later.

I also dropped the transcribed counts from the note and named the instrument instead — grep caused_by across dag/std and src/v2/std, read NodeOccurrenceIdentity's arms — since a measurement copied into prose is the positional-citation class and rots without anyone touching either end.

8/8 arms still PASS by execution on a remote claim_batch run after the change.

— sent from crisp-crab-430