Bind the insertion dissolution to the arm that landed: main carries a false machine-consumed fact

[gunbai-bot]

gunbc#9359 added NodeOccurrenceIdentity's OccurrenceProjected arm. Four claims in v2.workflow.legacy_binding_projection and its witness were true against the base that module was authored on, and became false the moment #9359 merged. One of them is not prose.

Main is currently wrong, and this is the disclosure

legacy_binding_projection_insertion_dissolution is an UnboundDissolution whose description reads "ProjectedAsInsertion is unemittable while std.occurrence_identity NodeOccurrenceIdentity carries no arm for a projector-created node's cause" — in the same tree where that arm is declared.

std.dissolution dissolution_status matches over DissolutionCondition, so this is a false machine-consumed fact, not a false comment: the debt reports DissolutionUnbound while its own binding declaration sits in the tree. A dissolution carrier exists precisely so that nobody has to notice this by hand, so the one interval where it was wrong belongs in the record rather than in someone's memory.

Interval: from 96e8b623dd (#9359 merged 2026-08-27T00:33:23Z) until this PR merges. The correction was written and green four minutes after that merge and was intended to land inside #9359 — a DO NOT MERGE comment went up about a minute before the merge and did not win the race. No consumer asserts this row's unboundness, so nothing depended on the false state; the exposure is that a reader or a dissolution_status fold gets a wrong answer about one debt row.

The fix

data legacy_binding_projection_insertion_dissolution: DissolutionCondition = bound_dissolution(
  ref: decl_ref(module_path: "std.occurrence_identity", decl_name: "OccurrenceProjected")
)

The row's own annotation named this trigger: "The condition binds in the same change that rebases onto the arm, at which point the ref is verifiable at the moment it is written." Merging #9359 did not weaken that argument — it removed the last reason to defer. The declaration is on main, so the citation resolves and the wall accepts it, where on the old base authoring it would have been the §3 fabricated-citation class.

The three prose claims, corrected rather than deleted

• the module preamble asserting NodeOccurrenceIdentity "has two arms", that caused_by appears zero times across dag/std and src/v2/std, and that insertions are blocked on a named work item "until it lands"
• the annotation saying the bound form's declaration "does not exist on this base"
• the witness function name a_declared_insertion_refuses_because_no_carrier_can_express_its_cause → ..._because_this_projector_is_not_wired_to_the_cause_arm. A reader trusts a name without reading the body, so a false name outranks a true comment sitting directly above it.

What did not change

The refusal. ProjectionInsertionUnrepresentable still fires and the witness still passes. What the module cannot do is no longer express an insertion's cause but emit one — nothing there allocates a projected occurrence and names what caused it. That wiring, and the flip of the refusal to a regression control, belong to the change that does the wiring and are not claimed here.

Evidence

• 4106 files parse-clean; citation debt unchanged at 42 with the new decl_ref present, so it resolves rather than joining the debt roster
• projection witnesses 8/8 PASS, including the refusal under its new name
• no consumer asserts this row's unboundness

Found by crisp-crab-430, who checked #9359 against the merged tree rather than its diff — the only read that reaches what a change makes false in files it does not touch.