diff --git a/DESIGN.md b/DESIGN.md
index 897d3aac68d..6890ffb5663 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -144,8 +144,8 @@ hollow alias (minimality ≠ grounding) · state-space conflation (an `Option`/`
 - `cargo test --workspace` · `cargo clippy --all-targets -- -D warnings` · `cargo fmt --all --check`
 - one-time per clone: `git config core.hooksPath .githooks` — the only documented manual seed; generated pre-commit/pre-push hooks then idempotently converge `merge.generated-artifact.driver` and re-assert `core.hooksPath` via argv derived from `gunbc.repo_local_git_config` (clones that skip hooksPath degrade to vanilla text-merge for generated-artifact paths; drift gate still guards at CI). The driver REFUSES rather than answering `true`: git reaches a low-level merge driver only when both sides changed the path since the merge base — measured on a four-case matrix, one-sided and identical changes never reach it — and taking the ours side there dropped the other side's authority-derived bytes with no conflict, twice on #7836 against the stage0 seed. It now leaves the ours side in the worktree with no conflict markers, marks the path unmerged, and prints the regeneration recipe; the class is mechanically preventable, not structural, and its next-rung trigger is the commit-writer binding rows in `gunbc.commit_workflow`
 - explicit actuator (CI / tooling): `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/repo_local_git_config.dag --function converge`
-- CI — **RUNG DROP, DECLARED (2026-08-15, the floor cut).** WHAT WAS HERE: one composed floor pass, `claim_executor` with a `--plan-entry` naming `src/v2/workflow/ci_floor_plan.dag`, a v2 scheduler deciding batches from `gunbc.ci_spec`, a compile-clean gate ordered ahead of everything else, per-PR discovery over `CiSpec.discovery_scan_dirs`, and a 4-hourly `affected-set-falsifier` cadence carrying the whole-tree cold controls. **ALL OF IT IS DELETED** — the workflows (`ci.yml`, `falsifier.yml`, `falsifier-alert.yml`), their `.dag` authorities, and ~30 witness modules. This paragraph previously recited that invocation in the present tense; it was false the moment the cut landed, and a knowingly-false recital in the canonical authority is premise contamination — every session reading it plans against a command that does not exist. WHAT RUNS NOW: one emission, `gunbc.witness_floor_workflow` → `.github/workflows/witnesses.yml`, invoking our own binary once PER LANE — `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` and `... --required-lane witnesses`, in TWO PARALLEL JOBS (the 2026-08-25 split described below; the invocation named `--required-floor` until the 2026-08-20 consolidation, also described below, and that flag still exists and still runs the fold alone, it is simply no longer what CI calls) — whose floor phase folds every discovered witness through one prepared subject via `v1_compiler.cli_run` `run_required_floor`, whose admission, cost-line and preparation-safety policy is owned by `v2.workflow.required_floor` (this clause named that module as the symbol home until 2026-08-26; the module is real and the symbol does not resolve there, which is exactly the §3 defect the `--required-cited-symbol` census would have refused before its 2026-08-23 drop). No plan entry, no plan function, no batch id, no worker role, no selection flag: the fold has no such concepts to configure — which PRESERVES the 2026-08-13 operator directive that no SELECTION shrinks the roster, by construction rather than by a flag someone must remember to set. **That directive is about selection, and an earlier revision of this clause stated it as `the whole discovered roster runs unshrunk`, which is false of the DISCOVERED roster and true only of the ROUTED one.** Measured on main run `32553487573` (`967b5bc1b92`, 2026-08-22T05:06Z): `offered=11812 routed=10439 declined_long=543 declined_live=830`. 1373 discovered sites — 11.6% — are declined by HOME POLICY before the fold sees them, so `planned` is the routed roster and never the discovered one. The floor's own line is honest about this (`every discovered site is exactly one of these`); only this document overclaimed, and the overclaim is the load-bearing kind, because a reader who takes `the whole discovered roster runs` literally will conclude that authoring a witness is sufficient for it to execute. It is not: a witness under a long or live home is discovered, counted, and never run. The decline mechanism is not a selection flag and the directive is not violated by it — the two are different questions, and conflating them is what made one true sentence and one false sentence read as the same claim. That directive's own carrier (`corpus_selection_off_note`) died with the floor; `gunbc.ci_spec` retains the history and now points here. **THE FOLD NOW EXECUTES, measured 2026-08-19.** Green on main, the latest measured `32553487573` (`967b5bc1b92`, 2026-08-22T05:06Z): `planned=10439 executed=10439 terminal=10439 passed=10132 known_red_held=206 failed=0 stale_quarantine=0 route_gap_held=101 over_cost_line_diagnostic=35`, ~30 min wall. The counts previously cited here were run `32515441229` of 2026-08-21 (`offered=11615 routed=10253 … passed=9946`) and had gone stale by 197 offered sites in under twelve hours; they are replaced rather than annotated, because two count sets in one clause is two accounts of one fact. That this clause has now been re-pointed twice in three days is itself the measurement: a transcribed receipt line is a *positional* citation of a run's output — §3's rule reaches it, since no edit here invalidates it and it rots anyway — so the standing question is now DECIDED (operator ruling, 2026-08-24): **name the instrument, never transcribe its output.** A measurement is cited by naming the producer that re-derives it — the run, the flag, the committed script — and never by copying its numbers into prose, exactly as §3 requires a citation to name a symbol rather than a line, and for the same reason: a transcribed number is unreachable from the thing that owns it, so it rots without anyone touching either end. The counters above are retained under that rule as a declared exception with their producing run named, because this clause's subject IS the rung drop and a drop is unreadable without the magnitude it dropped by; every other transcription in the corpus is debt. The ruling was priced, not preferred: the parallel measurement corpus it governs was BANKRUPTED the same day — `docs/probes/` deleted whole, 195 files and 50,601 lines, boards and captures and instruments alike, leaving NO `.sh` or `.py` anywhere in the repository outside `.githooks` — after a board asserting a compiler mechanism as a live defect was found to have merged EIGHT SECONDS after the commit that fixed it, and to have named the emitter carrier when the actual repair was two lines in the model. A lane had already selected that mechanism as its next work on the board's authority. **THE INSTRUMENTS WENT WITH THE PROSE, and the reason decides what the rule means (operator ruling, 2026-08-24): an ad-hoc `.sh` or `.py` in this repository is §6 UNMODELED REALIZATION — raw shell implementing semantics already expressible in `.dag` — so if a measurement is worth re-deriving it is worth an entry point, and if it is not worth an entry point it is not an instrument but a one-off.** This was ruled against a live objection, recorded because the objection was correct on its own facts and still lost: a peer had re-run `curated_cargo_probe_one.sh` that same hour to re-derive the emission board's headline from source, so the scripts had real consumers — LANES, which a census of `.dag` consumers cannot see, and which is why an earlier revision of this clause reported them as dead. The ruling does not deny that consumer; it denies that a stray script is the right carrier for it. So `name the instrument` names a `.dag` entry point, and the rule needs no exception for a referent it deleted: what is deleted is everything that cannot be re-derived from the tree, and what re-derives it is modeled or it does not exist. That is the §2 cost of a second representation with no authority, arriving faster than it can be authored, and it is why a measurement document is presumed redundant rather than merely stale. WHAT THIS DOES NOT CLAIM: the cut leaves a named residue it does not repair — gitignore un-ignore rows for deleted paths, prose notes across ~20 modules citing them, and the witnesses above, all still green over dead names. That residue is the next cut, not a gap this one closed. **`executed` answers a narrower question than every reader asks of it: it counts a witness reaching the fold, not its assertion running.** A witness whose subject is a subprocess exit status is planned, discovered, and counted `executed` while it is REFUSED BY CONSTRUCTION at the hermetic boundary — `run_required_floor`'s hermetic envelope rejects the host effect via `shell.Test.IsExecutable` before the subprocess is reached, in about a millisecond, which also rules out a budget refusal on timing. This is CORRECT, not a gap: mocking that refusal to let such a witness run would pass it against a fabricated exit status, the exact fabricated-plausible-output failure the witness exists to catch. It is a boundary of what the hermetic floor can cover, named here beside the counters rather than left for a reader to rediscover. This clause previously read that no witness had executed and that the fold refused during preparation; that was true when written and is now false, and it is corrected in place rather than left standing until the rest of the paragraph can be rewritten — because a knowingly-false recital is premise contamination whichever direction it points, and this one had already cost real work: a session measuring the TestClaim orphan population read it, concluded the floor had never run, and raised a sequencing question about roster growth that does not exist. The rung drop below is unaffected: the fold running green establishes that the replacement executes, not that the re-add queue has closed. WHAT IS UNGUARDED IN THE MEANTIME, named rather than left to be rediscovered: the generated-artifact drift gates, heal, the seven effect gates, the fmt gate, merge-admission stamping, the falsifier cadence, and the per-witness eval deadline that `gunbc_ci_fast_lane_witness_eval_budget` used to arm (`gunbc.witness_row_cost` `gunbc_ci_fast_lane_rule_note` carries that one's own drop). Each is a separate re-add, each re-derived from its own first principles under its own operator agreement rather than restored from the deleted machinery. RESTORATION TRIGGER: this paragraph is rewritten as an ordinary present-tense description — not amended, rewritten in one pass — when the re-add queue closes. Until then it describes a rung drop, and describing the replacement as finished would be the inflation §4b names as worse than sitting low. **WHAT SURVIVES UNTOUCHED, enumerated rather than swept away with the bullet** — this paragraph replaced a longer one, and a prose row is deleted for one reason and takes everything in it unless its contents are enumerated first (the same rule that governs deleting a witness file whole): the compile-clean scope authority `tools.dag_compile_clean_scope` and its import-closure selection (`entry_file_touched_via_import_closure`) are live and unmodified by the cut — but **live is not reachable, and an earlier revision of this clause said only the first**. It read that what is gone is the CI *job* that invoked them and not the authority; both halves are true and together they license a false inference, because SURVIVING A CUT AND BEING CALLABLE ARE DIFFERENT PROPERTIES and only the first was checked. Measured 2026-08-20: `entry_file_touched_via_import_closure` and `compile_clean_scope_plan_for_ci` are private `fn`s with ZERO references anywhere under `src/v1/stage0/src/bin`, no CLI flag reaches them, and the only `pub` surfaces into that chain — `witness_layer_roots_compile_clean_check` / `_emit_check` — return `Bool`, so they answer *is it clean* and can never answer *which entries would be selected*. A reader planning against the old sentence would budget an afternoon and find no caller; that is premise contamination of the same class this paragraph already corrects itself for twice. The authority survives and the capability does not, until something exposes a counting entry point; the `regen_input_sources` import closure survives and is now read by `v1_compiler.required_regen_host` — but the `regen_stage0` binary that consumed it, and the `RegenVerifyGate` / `SelfHostStalenessGate` pair that invoked it, are DELETED at the root (the regen cut), so the self-host fixed point is answered by `claim_executor --required-regen-fixed-point` and by nothing else. **THAT FLAG IS INVOKED AGAIN AS OF 2026-08-20**, so this is one re-add off the queue below rather than a standing gap. It was re-added as two `witnesses.yml` steps ordered ahead of the floor and CONSOLIDATED the same day (operator directive: the phases belong `within the witnesses step and within the gunbc binary, not at a github actions job level`) into ONE step running the phases in ONE process. **THAT 2026-08-20 DIRECTIVE IS NOW PARTLY SUPERSEDED, BY THE SAME OPERATOR, ON 2026-08-25** — `we can add it as a parallel job in github actions - we can do the same for regen now, we have more runners` / `basically i would put regen + v2 full compile in one job, and witnesses into another one`. The stated reason is a change in supply, not a change of mind about the earlier argument: the phases are mutually independent, so composing them into one process made the required check's wall clock a SUM of things that could have been a MAX, and more runners make the MAX purchasable. **THE DIRECTIVE HAS TWO HALVES AND ONLY ONE IS SUPERSEDED, which is why this clause states both rather than replacing one ruling with another.** SURVIVES — *within the gunbc binary*: the phases still live in `claim_executor`, each job makes ONE invocation and names a LANE, and no step's precondition reads another phase's verdict. The step-ladder defect the consolidation fixed (an `if:` naming a sibling step, silently conjoined with GitHub's implicit `success()`, so a regen red disarmed the whole floor) cannot return, because no step's condition can reach another phase's outcome. SUPERSEDED — *not at a github actions job level*: PARALLELISM IS NOT EXPRESSIBLE IN THE BINARY. Two phases running concurrently means two runners, two checkouts and two toolchains, and one process on one runner can thread but cannot acquire a second machine — nor would we want it to, at the floor's measured ~9.4 GiB peak. So the lane boundary is a job boundary of necessity, and what the directive was protecting against — SEQUENCING and PRECONDITIONS leaking into YAML — is exactly what does not cross it: the two jobs carry no `needs` edge and no condition on each other, which is the whole content of running them in parallel. So the invocation named at the top of this paragraph is superseded three times over and is now, exactly: TWO LANE JOBS, `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` (regen's first-generation comparison, the v2-emission compile, the emitted-closure cargo phase and the partition-crate boundary) and the same command with `--required-lane witnesses` (the `.dag` parse sweep and the witness floor fold), plus a THIRD job that gates on both. **THAT THIRD JOB IS NOT DECORATION AND THE FIRST CUT OF THE SPLIT DID NOT HAVE IT, which is the more useful half of this entry.** A GitHub required status check is produced by the JOB, not by the workflow, and the repository's `passing CI` ruleset is active, carries NO bypass actors, and names exactly ONE required context: `witnesses`. So splitting the phases into a second job made regen and v2-emission NON-BLOCKING -- the required check would have gone green over a regen drift or a v2 emission break and the PR would have been mergeable. That is fail-open (§5), and strictly worse than the serial run it replaced, because the serial job carried every phase into the one context that gates. THE REPAIR IS AN AGGREGATION JOB RATHER THAN A RULESET EDIT: the floor lane is renamed `floor`, and the name `witnesses` moves to a job that `needs` both lanes and whose only step reads both results and exits nonzero unless both are `success`. **THE CONDITION THAT MAKES THAT JOB RUN IS AT THE JOB LEVEL, AND THE FIRST CUT OF THE AGGREGATOR PUT IT ONLY ON THE STEP** -- the same fail-open committed one level in, caught by review 55795 and independently by a peer session within minutes of each other. `needs` carries an implicit job-level condition: a job that declares `needs` and no `if` is SKIPPED when a needed job fails, a skipped job never reaches its steps, and a step-level `always()` cannot rescue a job that never started. The job therefore declares `always()`, and that is the ONE place in the emission that departs from the file's `!cancelled()` house guard, stated here because a reader who knows the convention will otherwise correct it back and reopen the hole. Every other guard decides whether a STEP runs inside a job that is already running; this one decides WHETHER THE REQUIRED CONTEXT EXISTS AT ALL, and under `!cancelled()` a cancelled run leaves it skipped rather than answered. That turns the outcome on a question about GitHub nobody here has executed -- does a skipped or cancelled required check block a merge -- and the right response is not to measure it but to make the answer not matter: under `always()` the job always runs, always reads both results, and always reports on its own terms, so SKIPPED disappears from the required context. Construction over validation (§5), at the cost that a lawfully superseded run now reports this context red rather than cancelled, which is the correct reading rather than a regression. The two lane jobs still carry no `needs` edge on each other and still start together; only the aggregator waits. A ruleset edit would have worked too and was rejected on a boundary this document already records: the ruleset is not a `.dag` fact, so landing a change whose safety depends on someone editing a setting afterwards is a coverage gap with a promise attached and a real unguarded window. Found in review of gunbc#9203, against the live ruleset rather than against the workflow -- which is the only place the fact is visible, since nothing in the emitted YAML says which of its jobs gates. The partition is total by construction — `RequiredCiPhase::lane` is an exhaustive match, so a phase belonging to no job fails to compile rather than going silently unmeasured — and the lane is the ONLY thing the transport names: which phases a lane owns is decided in the binary, never in the YAML. **THE v2-EMISSION PHASE'S SUBJECT WIDENED IN THE SAME CHANGE**, from `dag/std/abi.dag` (the smallest entry in the tree) to `src/v2/compiler/00_compile.dag` (the v2 pipeline root, the widest closure one entry names). The row is `gunbc.ci_layer_roots` `required_v2_emission_entries` and it remains a cost decision rather than a Rust edit; what changed is the denominator, since the build lane's cost is now free up to the floor's duration rather than added to it. **WHAT THE SPLIT DOES NOT DO:** it restores nothing else from the deleted floor machinery — every item on the unguarded list above is still its own re-add under its own operator agreement — and it lands NO ratchet over the v2 compile's advisory-diagnostic population. That population is real and is the natural next subject, but a merge-blocking count pinned to a number measured on the current tree is exactly the oracle §5 forbids; an identity-grain monotone debt contract is a separate construction and is not claimed here. **THE PARSE PHASE STOPPED BEING src/v1-ONLY, 2026-08-23**, and it is stated here because the previous revision named the phase by the one root it walked. It now sweeps `src/v1`, `dag` and `src/v2` from one roster (`v1_compiler.cli_run` `DAG_PARSE_SWEEP_ROOTS`), shared with the standalone bin, and it admits source annotations per file rather than parsing alone -- `tokenize` routes `//` into the annotation channel and `parse` never decides grain, so the old walk returned clean for a file carrying an in-body annotation and the §4c refusal surfaced only at the floor's strict PREPARATION, where no witness executes at all. That is not a widening of the floor's source roots, which `gunbc.ci_layer_roots` `v1_dead_witness_tree_triage_receipt_remainder` rules out on NAME RESOLUTION grounds: this walk resolves nothing across files, so that objection cannot reach it. **THE PHASE ROSTER WAS CUT TO THREE BY OPERATOR RULING, 2026-08-21, WAS FOUR AGAIN AS OF #9035, AND IS FIVE AS OF THE PARTITION-CRATE PHASE, AND IS SIX AS OF THE EMIT-COMPILE PHASE.** The count is stated in the present tense here and it has now been wrong in BOTH directions, which is the reason it is written as a measurement rather than as a recollection: an earlier revision said four while enumerating a determinism pass no required run performed, that was corrected to three, and the three then went stale when #9035 enrolled a v2-emission phase that compiles one v2 entry — landed precisely because an emission break reached main and no gate could see it. The instrument is the required mode itself, which prints its own roster before any phase runs -- one `phase <name>` line per phase the lane owns and one `ROUTED to lane <other>` line per phase it does not, then `lane=<name> phases_run=<its own count>`. Read the roster from that announcement rather than from this sentence: the count moved twice in five days, and a transcribed roster size is exactly the positional citation the ruling above forbids. The fifth phase is `partition-crates`, in the build lane, which compares the derived stage0 partition's committed `lib.rs` and `Cargo.toml` against what `v1.compiler.stage0_crates` renders from the authority -- landed because those seven crates are workspace members nothing in CI builds, so a broken one sat on main while every required lane stayed green. **THAT COUNT IS NOW A PROPERTY OF THE ROSTER AND NOT OF A RUN**, because the 2026-08-25 split partitions the four across two jobs: a lane's own summary line reports `lane=<name> phases_run=<its own count>`, and each job additionally prints a `ROUTED to lane <other>` line for every phase it does not own, so one job's log still names the whole roster and where the rest is being measured. Reading a single job's `phases_run` as the roster size is the error that line exists to prevent. The five phases the 2026-08-21 ruling deleted stay deleted and are enumerated below; neither #9035 nor the partition-crate phase restored any of them, each added a new one, so both are roster ADDITIONS and not a reversal of that ruling. Five phases were deleted from the mode: merge-admission-capture, the regen determinism (fixed-point) pass and its in-memory pass-1 digest handoff, the behavioral receipt's controlled-fixture selftest, the behavioral receipt against the authorities a diff changed, and merge-admission-stamp. They were deleted rather than left reporting SKIPPED, because a phase whose only reachable state is a non-verdict has a deficit frequency of zero by construction and still reads as coverage on the ledger (§5, the absorbing fallback). The capabilities survive at their own entry points — `--required-regen-fixed-point`, `//gunbc/instruments:behavioral-receipt-plan`, `//gunbc/instruments:behavioral-receipt-selftest`, `//gunbc/instruments:behavioral-receipt-census` — none of which any workflow invokes; what ended is their enrolment in the required run, and the three measurements they carried (regen determinism, behavioural equivalence of a changed authority against its mirror, and the receipt's own discriminating arms) are simply no longer taken. That is a declared scope narrowing, and it returns merge-admission stamping to the unguarded list above rather than removing it from it. The remaining three phases are independent — the one real data dependency left with the phase that consumed it — so every phase runs even after an earlier failure and the run reports the complete ledger instead of letting the first defect hide the rest. The line still stops on any failed phase. It is recorded here with what made the gap real, because the steps were enrolled, STRIPPED, and re-enrolled inside twelve hours and a reader who finds only the enrolment will re-derive the strip. The strip was correct when made: the admission test is whether every red is closable by the author who caused it at the moment they caused it, and it was not -- the comparator normalized BOTH sides through rustfmt while writing the single-pass form, so after any candidate install the comparison was `normalize(normalize(emitted))` against `normalize(emitted)`, an identity only if rustfmt is idempotent. It is not, so the gate refused a tree byte-identical to its own artifact, permanently, and its only reachable green was the hand-edited mirror the gate exists to refuse -- a gate whose sole closing move is the forbidden action is not strict, it launders. Repairing it by raw-comparing the single-pass bytes then put it in direct contradiction with `cargo fmt --all --check`, which re-formats what is committed and so demands the NEXT pass: two gates consuming different passes of one artifact, each breaking the other. The resolution is that the emitted artifact is now written as a FIXED POINT of the formatter (bounded, exceeding the bound is a typed refusal), which makes the contradiction unrepresentable rather than detected and makes `cargo fmt` a no-op on it by definition -- the §5 construction move, and the general lesson is that any artifact with two consumers that normalize it must be stored in the normalizer's fixed point or the two consumers cannot both be satisfied.  This clause previously read that the fixed point and its closure both survived with only their job removed; that was true when written and the regen cut falsified its first half, so it is rewritten here rather than annotated — a second sentence beside it would be two accounts of one fact; and parse remains grammar-owned — `ingest_yaml_source` (`dag/extdeps/languages/yaml/ingest.dag`), no shell or host parser — which was never a floor fact at all and is restated here so that dropping the bullet does not drop it. **TWO OPERATOR RULINGS ALSO LIVED IN THE REPLACED BULLET AND STILL HOLD**, restated because a ruling about what CI does *not* do is invisible once the paragraph describing CI is rewritten, and nothing in the new mechanism would contradict it loudly: the Rust test suite was removed from CI 2026-07-11 (operator ruling, recorded at `gunbc.commit_workflow` `commit_gate_rust_suite_removed_disposition`) and runs locally only; and clippy was removed from CI 2026-07-08, because a crate-wide `#![allow(clippy::all)]` made it zero-signal over ~44 minutes per run, leaving it a local dev check. Neither is reinstated by the replacement, and neither is the floor cut's to reverse.
+- CI — **RUNG DROP, DECLARED (2026-08-15, the floor cut).** WHAT WAS HERE: one composed floor pass, `claim_executor` with a `--plan-entry` naming `src/v2/workflow/ci_floor_plan.dag`, a v2 scheduler deciding batches from `gunbc.ci_spec`, a compile-clean gate ordered ahead of everything else, per-PR discovery over `CiSpec.discovery_scan_dirs`, and a 4-hourly `affected-set-falsifier` cadence carrying the whole-tree cold controls. **ALL OF IT IS DELETED** — the workflows (`ci.yml`, `falsifier.yml`, `falsifier-alert.yml`), their `.dag` authorities, and ~30 witness modules. This paragraph previously recited that invocation in the present tense; it was false the moment the cut landed, and a knowingly-false recital in the canonical authority is premise contamination — every session reading it plans against a command that does not exist. WHAT RUNS NOW: one emission, `gunbc.witness_floor_workflow` → `.github/workflows/witnesses.yml`, invoking our own binary once PER LANE — `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` and `... --required-lane witnesses`, in TWO PARALLEL JOBS (the 2026-08-25 split described below; the invocation named `--required-floor` until the 2026-08-20 consolidation, also described below, and that flag still exists and still runs the fold alone, it is simply no longer what CI calls) — whose floor phase folds every discovered witness through one prepared subject via `v1_compiler.cli_run` `run_required_floor`, whose admission, cost-line and preparation-safety policy is owned by `v2.workflow.required_floor` (this clause named that module as the symbol home until 2026-08-26; the module is real and the symbol does not resolve there, which is exactly the §3 defect the `--required-cited-symbol` census would have refused before its 2026-08-23 drop). No plan entry, no plan function, no batch id, no worker role, no selection flag: the fold has no such concepts to configure — which PRESERVES the 2026-08-13 operator directive that no SELECTION shrinks the roster, by construction rather than by a flag someone must remember to set. **That directive is about selection, and an earlier revision of this clause stated it as `the whole discovered roster runs unshrunk`, which is false of the DISCOVERED roster and true only of the ROUTED one.** Measured on main run `32553487573` (`967b5bc1b92`, 2026-08-22T05:06Z): `offered=11812 routed=10439 declined_long=543 declined_live=830`. 1373 discovered sites — 11.6% — are declined by HOME POLICY before the fold sees them, so `planned` is the routed roster and never the discovered one. The floor's own line is honest about this (`every discovered site is exactly one of these`); only this document overclaimed, and the overclaim is the load-bearing kind, because a reader who takes `the whole discovered roster runs` literally will conclude that authoring a witness is sufficient for it to execute. It is not: a witness under a long or live home is discovered, counted, and never run. The decline mechanism is not a selection flag and the directive is not violated by it — the two are different questions, and conflating them is what made one true sentence and one false sentence read as the same claim. That directive's own carrier (`corpus_selection_off_note`) died with the floor; `gunbc.ci_spec` retains the history and now points here. **THE FOLD NOW EXECUTES, measured 2026-08-19.** Green on main, the latest measured `32553487573` (`967b5bc1b92`, 2026-08-22T05:06Z): `planned=10439 executed=10439 terminal=10439 passed=10132 known_red_held=206 failed=0 stale_quarantine=0 route_gap_held=101 over_cost_line_diagnostic=35`, ~30 min wall. The counts previously cited here were run `32515441229` of 2026-08-21 (`offered=11615 routed=10253 … passed=9946`) and had gone stale by 197 offered sites in under twelve hours; they are replaced rather than annotated, because two count sets in one clause is two accounts of one fact. That this clause has now been re-pointed twice in three days is itself the measurement: a transcribed receipt line is a *positional* citation of a run's output — §3's rule reaches it, since no edit here invalidates it and it rots anyway — so the standing question is now DECIDED (operator ruling, 2026-08-24): **name the instrument, never transcribe its output.** A measurement is cited by naming the producer that re-derives it — the run, the flag, the committed script — and never by copying its numbers into prose, exactly as §3 requires a citation to name a symbol rather than a line, and for the same reason: a transcribed number is unreachable from the thing that owns it, so it rots without anyone touching either end. The counters above are retained under that rule as a declared exception with their producing run named, because this clause's subject IS the rung drop and a drop is unreadable without the magnitude it dropped by; every other transcription in the corpus is debt. The ruling was priced, not preferred: the parallel measurement corpus it governs was BANKRUPTED the same day — `docs/probes/` deleted whole, 195 files and 50,601 lines, boards and captures and instruments alike, leaving NO `.sh` or `.py` anywhere in the repository outside `.githooks` — after a board asserting a compiler mechanism as a live defect was found to have merged EIGHT SECONDS after the commit that fixed it, and to have named the emitter carrier when the actual repair was two lines in the model. A lane had already selected that mechanism as its next work on the board's authority. **THE INSTRUMENTS WENT WITH THE PROSE, and the reason decides what the rule means (operator ruling, 2026-08-24): an ad-hoc `.sh` or `.py` in this repository is §6 UNMODELED REALIZATION — raw shell implementing semantics already expressible in `.dag` — so if a measurement is worth re-deriving it is worth an entry point, and if it is not worth an entry point it is not an instrument but a one-off.** This was ruled against a live objection, recorded because the objection was correct on its own facts and still lost: a peer had re-run `curated_cargo_probe_one.sh` that same hour to re-derive the emission board's headline from source, so the scripts had real consumers — LANES, which a census of `.dag` consumers cannot see, and which is why an earlier revision of this clause reported them as dead. The ruling does not deny that consumer; it denies that a stray script is the right carrier for it. So `name the instrument` names a `.dag` entry point, and the rule needs no exception for a referent it deleted: what is deleted is everything that cannot be re-derived from the tree, and what re-derives it is modeled or it does not exist. That is the §2 cost of a second representation with no authority, arriving faster than it can be authored, and it is why a measurement document is presumed redundant rather than merely stale. WHAT THIS DOES NOT CLAIM: the cut leaves a named residue it does not repair — gitignore un-ignore rows for deleted paths, prose notes across ~20 modules citing them, and the witnesses above, all still green over dead names. That residue is the next cut, not a gap this one closed. **`executed` answers a narrower question than every reader asks of it: it counts a witness reaching the fold, not its assertion running.** A witness whose subject is a subprocess exit status is planned, discovered, and counted `executed` while it is REFUSED BY CONSTRUCTION at the hermetic boundary — `run_required_floor`'s hermetic envelope rejects the host effect via `shell.Test.IsExecutable` before the subprocess is reached, in about a millisecond, which also rules out a budget refusal on timing. This is CORRECT, not a gap: mocking that refusal to let such a witness run would pass it against a fabricated exit status, the exact fabricated-plausible-output failure the witness exists to catch. It is a boundary of what the hermetic floor can cover, named here beside the counters rather than left for a reader to rediscover. This clause previously read that no witness had executed and that the fold refused during preparation; that was true when written and is now false, and it is corrected in place rather than left standing until the rest of the paragraph can be rewritten — because a knowingly-false recital is premise contamination whichever direction it points, and this one had already cost real work: a session measuring the TestClaim orphan population read it, concluded the floor had never run, and raised a sequencing question about roster growth that does not exist. The rung drop below is unaffected: the fold running green establishes that the replacement executes, not that the re-add queue has closed. WHAT IS UNGUARDED IN THE MEANTIME, named rather than left to be rediscovered: the generated-artifact drift gates, heal, the seven effect gates, the fmt gate, merge-admission stamping, the falsifier cadence, and the per-witness eval deadline that `gunbc_ci_fast_lane_witness_eval_budget` used to arm (`gunbc.witness_row_cost` `gunbc_ci_fast_lane_rule_note` carries that one's own drop). Each is a separate re-add, each re-derived from its own first principles under its own operator agreement rather than restored from the deleted machinery. RESTORATION TRIGGER: this paragraph is rewritten as an ordinary present-tense description — not amended, rewritten in one pass — when the re-add queue closes. Until then it describes a rung drop, and describing the replacement as finished would be the inflation §4b names as worse than sitting low. **WHAT SURVIVES UNTOUCHED, enumerated rather than swept away with the bullet** — this paragraph replaced a longer one, and a prose row is deleted for one reason and takes everything in it unless its contents are enumerated first (the same rule that governs deleting a witness file whole): the compile-clean scope authority `tools.dag_compile_clean_scope` and its import-closure selection (`entry_file_touched_via_import_closure`) are live and unmodified by the cut — but **live is not reachable, and an earlier revision of this clause said only the first**. It read that what is gone is the CI *job* that invoked them and not the authority; both halves are true and together they license a false inference, because SURVIVING A CUT AND BEING CALLABLE ARE DIFFERENT PROPERTIES and only the first was checked. Measured 2026-08-20: `entry_file_touched_via_import_closure` and `compile_clean_scope_plan_for_ci` are private `fn`s with ZERO references anywhere under `src/v1/stage0/src/bin`, no CLI flag reaches them, and the only `pub` surfaces into that chain — `witness_layer_roots_compile_clean_check` / `_emit_check` — return `Bool`, so they answer *is it clean* and can never answer *which entries would be selected*. A reader planning against the old sentence would budget an afternoon and find no caller; that is premise contamination of the same class this paragraph already corrects itself for twice. The authority survives and the capability does not, until something exposes a counting entry point; the `regen_input_sources` import closure survives and is now read by `v1_compiler.required_regen_host` — but the `regen_stage0` binary that consumed it, and the `RegenVerifyGate` / `SelfHostStalenessGate` pair that invoked it, are DELETED at the root (the regen cut), so the self-host fixed point is answered by `claim_executor --required-regen-fixed-point` and by nothing else. **THAT FLAG IS INVOKED AGAIN AS OF 2026-08-20**, so this is one re-add off the queue below rather than a standing gap. It was re-added as two `witnesses.yml` steps ordered ahead of the floor and CONSOLIDATED the same day (operator directive: the phases belong `within the witnesses step and within the gunbc binary, not at a github actions job level`) into ONE step running the phases in ONE process. **THAT 2026-08-20 DIRECTIVE IS NOW PARTLY SUPERSEDED, BY THE SAME OPERATOR, ON 2026-08-25** — `we can add it as a parallel job in github actions - we can do the same for regen now, we have more runners` / `basically i would put regen + v2 full compile in one job, and witnesses into another one`. The stated reason is a change in supply, not a change of mind about the earlier argument: the phases are mutually independent, so composing them into one process made the required check's wall clock a SUM of things that could have been a MAX, and more runners make the MAX purchasable. **THE DIRECTIVE HAS TWO HALVES AND ONLY ONE IS SUPERSEDED, which is why this clause states both rather than replacing one ruling with another.** SURVIVES — *within the gunbc binary*: the phases still live in `claim_executor`, each job makes ONE invocation and names a LANE, and no step's precondition reads another phase's verdict. The step-ladder defect the consolidation fixed (an `if:` naming a sibling step, silently conjoined with GitHub's implicit `success()`, so a regen red disarmed the whole floor) cannot return, because no step's condition can reach another phase's outcome. SUPERSEDED — *not at a github actions job level*: PARALLELISM IS NOT EXPRESSIBLE IN THE BINARY. Two phases running concurrently means two runners, two checkouts and two toolchains, and one process on one runner can thread but cannot acquire a second machine — nor would we want it to, at the floor's measured ~9.4 GiB peak. So the lane boundary is a job boundary of necessity, and what the directive was protecting against — SEQUENCING and PRECONDITIONS leaking into YAML — is exactly what does not cross it: the two jobs carry no `needs` edge and no condition on each other, which is the whole content of running them in parallel. So the invocation named at the top of this paragraph is superseded three times over and is now, exactly: TWO LANE JOBS, `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` (regen's first-generation comparison, the v2-emission compile, the emitted-closure cargo phase and the partition-crate boundary) and the same command with `--required-lane witnesses` (the `.dag` parse sweep and the witness floor fold), plus a THIRD job that gates on both. **THAT THIRD JOB IS NOT DECORATION AND THE FIRST CUT OF THE SPLIT DID NOT HAVE IT, which is the more useful half of this entry.** A GitHub required status check is produced by the JOB, not by the workflow, and the repository's `passing CI` ruleset is active, carries NO bypass actors, and names exactly ONE required context: `witnesses`. So splitting the phases into a second job made regen and v2-emission NON-BLOCKING -- the required check would have gone green over a regen drift or a v2 emission break and the PR would have been mergeable. That is fail-open (§5), and strictly worse than the serial run it replaced, because the serial job carried every phase into the one context that gates. THE REPAIR IS AN AGGREGATION JOB RATHER THAN A RULESET EDIT: the floor lane is renamed `floor`, and the name `witnesses` moves to a job that `needs` both lanes and whose only step reads both results and exits nonzero unless both are `success`. **THE CONDITION THAT MAKES THAT JOB RUN IS AT THE JOB LEVEL, AND THE FIRST CUT OF THE AGGREGATOR PUT IT ONLY ON THE STEP** -- the same fail-open committed one level in, caught by review 55795 and independently by a peer session within minutes of each other. `needs` carries an implicit job-level condition: a job that declares `needs` and no `if` is SKIPPED when a needed job fails, a skipped job never reaches its steps, and a step-level `always()` cannot rescue a job that never started. The job therefore declares `always()`, and that is the ONE place in the emission that departs from the file's `!cancelled()` house guard, stated here because a reader who knows the convention will otherwise correct it back and reopen the hole. Every other guard decides whether a STEP runs inside a job that is already running; this one decides WHETHER THE REQUIRED CONTEXT EXISTS AT ALL, and under `!cancelled()` a cancelled run leaves it skipped rather than answered. That turns the outcome on a question about GitHub nobody here has executed -- does a skipped or cancelled required check block a merge -- and the right response is not to measure it but to make the answer not matter: under `always()` the job always runs, always reads both results, and always reports on its own terms, so SKIPPED disappears from the required context. Construction over validation (§5), at the cost that a lawfully superseded run now reports this context red rather than cancelled, which is the correct reading rather than a regression. The two lane jobs still carry no `needs` edge on each other and still start together; only the aggregator waits. A ruleset edit would have worked too and was rejected on a boundary this document recorded at the time: the ruleset was not a `.dag` fact, so landing a change whose safety depends on someone editing a setting afterwards is a coverage gap with a promise attached and a real unguarded window. **THAT BOUNDARY MOVED, AND THE DECISION IT SUPPORTED DOES NOT.** `gunbc.repo_ruleset` now declares the desired ruleset -- enforcement, target, ref-name condition, the three rules, and the ONE required context, imported from `gunbc.witness_floor_workflow` `witness_floor_workflow_job_id` rather than spelled a second time -- observes the live one through `extdeps.github.rulesets`, reconciles the context roster through `gunbc.membership_reconcile`, applies drift with the whole-ruleset PUT, and READS BACK, claiming convergence only from the second observation and never from the apply's own 200. So the sentence in this bullet stating what the ruleset requires is no longer the only place that fact lives on our side of the boundary: `converge` actuates it and `verify` refuses on any divergence, with a typed reason per way it can diverge. WHAT DID NOT CHANGE, and why the aggregation job stays: convergence is an ACTUATION WITH A READ-BACK, not a wall. Nothing in this repository can constrain what GitHub admits to main, so an in-repo authority still cannot make a required context exist at the moment a merge is attempted -- it can only declare, apply and detect. The first cut's window argument therefore stands on its own terms; what is closed is the invisibility, not the boundary. WHAT IS NOT CLAIMED: NEITHER ENTRY POINT IS ENROLLED IN CI. `verify` is a route somebody runs, and until a required phase invokes it the class sits at *mitigatable* -- a drift is now detectable rather than detected, which is a real climb from unobservable and is not the same as a gate. Its next-rung trigger is that enrolment, which is a separate change under its own operator agreement. Found in review of gunbc#9203, against the live ruleset rather than against the workflow -- which is the only place the fact is visible, since nothing in the emitted YAML says which of its jobs gates. The partition is total by construction — `RequiredCiPhase::lane` is an exhaustive match, so a phase belonging to no job fails to compile rather than going silently unmeasured — and the lane is the ONLY thing the transport names: which phases a lane owns is decided in the binary, never in the YAML. **THE v2-EMISSION PHASE'S SUBJECT WIDENED IN THE SAME CHANGE**, from `dag/std/abi.dag` (the smallest entry in the tree) to `src/v2/compiler/00_compile.dag` (the v2 pipeline root, the widest closure one entry names). The row is `gunbc.ci_layer_roots` `required_v2_emission_entries` and it remains a cost decision rather than a Rust edit; what changed is the denominator, since the build lane's cost is now free up to the floor's duration rather than added to it. **WHAT THE SPLIT DOES NOT DO:** it restores nothing else from the deleted floor machinery — every item on the unguarded list above is still its own re-add under its own operator agreement — and it lands NO ratchet over the v2 compile's advisory-diagnostic population. That population is real and is the natural next subject, but a merge-blocking count pinned to a number measured on the current tree is exactly the oracle §5 forbids; an identity-grain monotone debt contract is a separate construction and is not claimed here. **THE PARSE PHASE STOPPED BEING src/v1-ONLY, 2026-08-23**, and it is stated here because the previous revision named the phase by the one root it walked. It now sweeps `src/v1`, `dag` and `src/v2` from one roster (`v1_compiler.cli_run` `DAG_PARSE_SWEEP_ROOTS`), shared with the standalone bin, and it admits source annotations per file rather than parsing alone -- `tokenize` routes `//` into the annotation channel and `parse` never decides grain, so the old walk returned clean for a file carrying an in-body annotation and the §4c refusal surfaced only at the floor's strict PREPARATION, where no witness executes at all. That is not a widening of the floor's source roots, which `gunbc.ci_layer_roots` `v1_dead_witness_tree_triage_receipt_remainder` rules out on NAME RESOLUTION grounds: this walk resolves nothing across files, so that objection cannot reach it. **THE PHASE ROSTER WAS CUT TO THREE BY OPERATOR RULING, 2026-08-21, WAS FOUR AGAIN AS OF #9035, AND IS FIVE AS OF THE PARTITION-CRATE PHASE, AND IS SIX AS OF THE EMIT-COMPILE PHASE.** The count is stated in the present tense here and it has now been wrong in BOTH directions, which is the reason it is written as a measurement rather than as a recollection: an earlier revision said four while enumerating a determinism pass no required run performed, that was corrected to three, and the three then went stale when #9035 enrolled a v2-emission phase that compiles one v2 entry — landed precisely because an emission break reached main and no gate could see it. The instrument is the required mode itself, which prints its own roster before any phase runs -- one `phase <name>` line per phase the lane owns and one `ROUTED to lane <other>` line per phase it does not, then `lane=<name> phases_run=<its own count>`. Read the roster from that announcement rather than from this sentence: the count moved twice in five days, and a transcribed roster size is exactly the positional citation the ruling above forbids. The fifth phase is `partition-crates`, in the build lane, which compares the derived stage0 partition's committed `lib.rs` and `Cargo.toml` against what `v1.compiler.stage0_crates` renders from the authority -- landed because those seven crates are workspace members nothing in CI builds, so a broken one sat on main while every required lane stayed green. **THAT COUNT IS NOW A PROPERTY OF THE ROSTER AND NOT OF A RUN**, because the 2026-08-25 split partitions the four across two jobs: a lane's own summary line reports `lane=<name> phases_run=<its own count>`, and each job additionally prints a `ROUTED to lane <other>` line for every phase it does not own, so one job's log still names the whole roster and where the rest is being measured. Reading a single job's `phases_run` as the roster size is the error that line exists to prevent. The five phases the 2026-08-21 ruling deleted stay deleted and are enumerated below; neither #9035 nor the partition-crate phase restored any of them, each added a new one, so both are roster ADDITIONS and not a reversal of that ruling. Five phases were deleted from the mode: merge-admission-capture, the regen determinism (fixed-point) pass and its in-memory pass-1 digest handoff, the behavioral receipt's controlled-fixture selftest, the behavioral receipt against the authorities a diff changed, and merge-admission-stamp. They were deleted rather than left reporting SKIPPED, because a phase whose only reachable state is a non-verdict has a deficit frequency of zero by construction and still reads as coverage on the ledger (§5, the absorbing fallback). The capabilities survive at their own entry points — `--required-regen-fixed-point`, `//gunbc/instruments:behavioral-receipt-plan`, `//gunbc/instruments:behavioral-receipt-selftest`, `//gunbc/instruments:behavioral-receipt-census` — none of which any workflow invokes; what ended is their enrolment in the required run, and the three measurements they carried (regen determinism, behavioural equivalence of a changed authority against its mirror, and the receipt's own discriminating arms) are simply no longer taken. That is a declared scope narrowing, and it returns merge-admission stamping to the unguarded list above rather than removing it from it. The remaining three phases are independent — the one real data dependency left with the phase that consumed it — so every phase runs even after an earlier failure and the run reports the complete ledger instead of letting the first defect hide the rest. The line still stops on any failed phase. It is recorded here with what made the gap real, because the steps were enrolled, STRIPPED, and re-enrolled inside twelve hours and a reader who finds only the enrolment will re-derive the strip. The strip was correct when made: the admission test is whether every red is closable by the author who caused it at the moment they caused it, and it was not -- the comparator normalized BOTH sides through rustfmt while writing the single-pass form, so after any candidate install the comparison was `normalize(normalize(emitted))` against `normalize(emitted)`, an identity only if rustfmt is idempotent. It is not, so the gate refused a tree byte-identical to its own artifact, permanently, and its only reachable green was the hand-edited mirror the gate exists to refuse -- a gate whose sole closing move is the forbidden action is not strict, it launders. Repairing it by raw-comparing the single-pass bytes then put it in direct contradiction with `cargo fmt --all --check`, which re-formats what is committed and so demands the NEXT pass: two gates consuming different passes of one artifact, each breaking the other. The resolution is that the emitted artifact is now written as a FIXED POINT of the formatter (bounded, exceeding the bound is a typed refusal), which makes the contradiction unrepresentable rather than detected and makes `cargo fmt` a no-op on it by definition -- the §5 construction move, and the general lesson is that any artifact with two consumers that normalize it must be stored in the normalizer's fixed point or the two consumers cannot both be satisfied.  This clause previously read that the fixed point and its closure both survived with only their job removed; that was true when written and the regen cut falsified its first half, so it is rewritten here rather than annotated — a second sentence beside it would be two accounts of one fact; and parse remains grammar-owned — `ingest_yaml_source` (`dag/extdeps/languages/yaml/ingest.dag`), no shell or host parser — which was never a floor fact at all and is restated here so that dropping the bullet does not drop it. **TWO OPERATOR RULINGS ALSO LIVED IN THE REPLACED BULLET AND STILL HOLD**, restated because a ruling about what CI does *not* do is invisible once the paragraph describing CI is rewritten, and nothing in the new mechanism would contradict it loudly: the Rust test suite was removed from CI 2026-07-11 (operator ruling, recorded at `gunbc.commit_workflow` `commit_gate_rust_suite_removed_disposition`) and runs locally only; and clippy was removed from CI 2026-07-08, because a crate-wide `#![allow(clippy::all)]` made it zero-signal over ~44 minutes per run, leaving it a local dev check. Neither is reinstated by the replacement, and neither is the floor cut's to reverse.
 - **THE MEASUREMENT BANKRUPTCY DELETED A CAPABILITY, NOT ONLY ARTIFACTS, AND THIS ROW IS THAT DECLARATION (2026-08-24).** The bankruptcy above removed `docs/probes/` whole. Deleting the boards removes TRANSCRIPTIONS, which is the point; deleting the instruments removes a ROUTE, which is a different fact and is the one §4b(3) obliges a cut to declare. WHAT IS GONE: the only executable route to a self-host emission board measurement. PREVIOUS STATE — any lane could re-derive a per-entry board by running the committed probe script, last exercised 2026-08-24 against the then-current main, and that reading is what answered the operator when they asked what the emission trajectory was doing. TEMPORARY STATE — no route exists; the emission trajectory is not measurable from the tree, and a board figure quoted from here on names nothing that can produce it. BOUNDED POPULATION: one capability, the per-entry emission board. RESTORATION TRIGGER: a `.dag` entry point that emits, assembles and compiles one entry and returns the coded-diagnostic population, cited by name wherever a board figure is quoted — at which point the same figures become legitimate again unchanged, because the rule forbids transcribing output INSTEAD OF naming an instrument, and the defect today is that there is no instrument to name. **WHY THIS ROW EXISTS AT ALL, and it is the same reason the regen row beneath it does:** no dependent could refuse. The corpus contains nothing that breaks when the board becomes unmeasurable, because the consumers are LANES rather than modules — the identical blind spot that made a `.dag`-consumer census report the instruments as dead a few hours before this cut. So delete-first's census, which is normally the thing that surfaces a load-bearing deletion loudly, is structurally silent here, and a declared row is the only mechanism left.  **THE TRIGGER HAS FIRED, AND THE ROW STAYS RATHER THAN RETIRING ON ITS AUTHOR'S SAY-SO.** The instrument is `tools.emission_entry_instrument` `measure_entry_emission`, invoked as `gunbc run --source-root dag --source-root src/v2 --entry dag/tools/emission_entry_instrument.dag --function measure --arg entry=<repo-relative .dag path> --arg report=<path>`. It runs the same spine the deleted probe script ran — emit one entry's closure, assemble it with `cssl_assemble`, build the assembled crate under cargo's JSON message format — and returns a TYPED measurement rather than a row of text: the emit-stage population from `gunbc.emit_diagnostic_observation` and the rustc coded-diagnostic population from `extdeps.cargo_diagnostic`, each member carrying its own identity and location, so two runs can be JOINED rather than only differenced. **WHAT THE CARRIER FIXES THAT THE SCRIPT DID NOT:** `EmissionMeasurement` has no spelling in which a stage that never ran renders as a stage that ran and found nothing — an unreached stage is its own variant naming the stage — and the emit decode REFUSES when the population it recovered disagrees with the compiler's own declared total, so an unrecognised diagnostic shape stops the line instead of quietly shrinking the answer. That is the execution-provenance-loss row applied to the instrument that most needed it. **WHAT IS NOT CLAIMED.** It is a measurement route and NOT a gate: no workflow invokes it, no phase enrols it, and its exit status reports whether the INSTRUMENT completed, never whether the subject was clean. The whole-corpus route is still refused by `gunbc.whole_corpus_compile_admission` and this does not change that; it is the per-entry route that module's own scope note says fits. Every other clause of the bankruptcy above stands unchanged, including that a figure copied into prose is debt whether or not a producer exists for it.
 - **THE REGEN CUT DELETED A PRODUCER ALONG WITH ITS BINARY, DECLARED NOTHING, AND THIS ROW IS THAT DECLARATION (2026-08-20).** It sits beside the CI entry above rather than inside it, because the two are different facts on different clocks — that paragraph narrates what the floor and regen cuts removed, this row declares one capability the regen cut removed in silence — and because a declaration wedged into the repository's most-edited paragraph collides with every unrelated edit to it (three merge conflicts in two hours, each one re-resolving prose neither side had touched). The regen cut re-derived the deleted binary's VERIFIER half — `claim_executor --required-regen`, which compares the committed stage0 mirror against a fresh emit — and did not re-derive its PRODUCER half: writing the emitted tree to disk unconditionally, whatever the comparison then says about it. `run_required_regen` did write a candidate tree, but only on the path where the emitted and committed populations already agreed; every refusal arm returned ahead of the write. The one population asymmetry an author can actually cause is adding a module to the v1 seed closure — its mirror is emitted-not-committed by construction on the first commit that introduces it — so from the cut until this entry, that change refused while naming a file no sanctioned route in the repository produced, and its only reachable green was a hand-authored mirror. That is the same laundering the fixed-point repair above closed one gate over, arrived at from the other direction: there, the gate's only closing move was forbidden; here, the gate's only closing move did not exist. WHAT THE RUNG DROP IS, stated at the honest grain: the class is not a compiler guarantee that fell a rung, it is an OPERATION that lost its only route, so it sat outside the ladder entirely — nothing to mitigate, because nothing could be attempted. Naming it as a declared drop rather than a defect is the point of the entry: the regen cut owed one under §4b(3) and filed none, and a capability deleted in silence is exactly what §3's delete-first doctrine says the census is supposed to surface loudly. It did not surface because no dependent could refuse — the author who needed the producer was outside the tree. THE RESTORATION, and its rung: production now precedes adjudication. `v2.workflow.required_regen` `required_regen_run` is the authority, and it holds the ordering by construction rather than by check — every arm that reports a verdict carries the `CandidateTree` the verdict was computed against, so refused-with-no-tree has no spelling once emit succeeded, and the one tree-less arm is reachable only where emit produced nothing at all (*structurally guaranteed*, §4b). The host `v1_compiler.required_regen_host` `run_required_regen` mirrors that ordering by hand and is therefore only *mitigatable*; its next-rung trigger is the host being derived from the carrier rather than written beside it. The gate did not weaken: it refuses the same populations with the same typed causes, and the refusal now names the directory holding the first mirror the author must install.
 - **THE CITED-SYMBOL CENSUS IS NO LONGER A REQUIRED CHECK, AND THIS ROW DECLARES THE RUNG IT DROPS (2026-08-23).** It sits beside the CI entry above rather than inside it, for the reason the regen row already gives: that paragraph narrates the floor and regen cuts, this is a third drop on its own clock, and a declaration wedged into the repository's most-edited prose collides with every unrelated edit to it. WHAT WAS HERE: a second `witnesses.yml` job, `cited-symbol`, running `claim_executor --required-cited-symbol --source-root dag --source-root src/v2` and stopping the line when any authored `DeclarationRef` named a symbol that does not resolve — the executing half of §3's cite-the-symbol-not-the-position rule. **IT IS DELETED** — the job, its command authority (`gunbc.fabric_witness_run` `cited_symbol_run_command`), the job row and capability wiring in `gunbc.witness_floor_workflow`, and the closure witness that covered it. REASON: operator directive, 2026-08-23. This is not a defect finding and the mechanism was not failing; it was executing and green, and the directive is that it does not belong in CI as a separate corpus-wide job. PREVIOUS RUNG: *mechanically preventable* — a real wall, armed on every push, measured green at `checked=390` on run `32664434197` (`f49886339a5`, 2026-08-23T20:26Z). TEMPORARY RUNG: *mitigatable* — the rule survives as review diligence, which is strictly weaker in the exact way §6 already records for the deleted inert-lens census: a newly authored citation naming a symbol that does not exist is writable again, and nothing detects it. MEASURED POPULATION AT THE CUT: 390 authored references, on the last green run of the job. FUTURE EXPOSURE, STATED AS A SECOND FACT BECAUSE JOINING THE TWO IS THE DENOMINATOR ERROR THIS DOCUMENT KEEPS FINDING: unbounded. Nothing counts a citation authored after the cut and nothing refuses one, so §4b(3)'s BOUNDED-POPULATION REQUIREMENT IS NOT SATISFIED HERE, and this row does not pretend otherwise — the drop is an operator-approved exception to that clause rather than an instance of it, and saying so is the whole point of writing the row down. An earlier revision of this row read *the 390 references, plus every citation authored after it* and called that the bounded population; an exact measurement joined to an open future set is not bounded, and calling it so is the same move §5 forbids when a count copied from the current tree is asked to serve as an oracle. The measured half also rots the way §3 says positional citations do: it is the population's size AT THE MOMENT OF THE DROP, never a standing figure. WHAT WAS NOT CLAIMED WHILE THE DROP STOOD: the capability survived at its own entry point — `--required-cited-symbol` was still a flag on `claim_executor` — but a mode no workflow invokes guards nothing, and calling the surviving flag a mitigation would have been exactly the inflation §4b(1) forbids. **THE RESTORATION TRIGGER FIRED ON 2026-08-25 AND THIS ROW IS RETIRED AS A DROP, WITH ITS EXPOSURE CLOSED RATHER THAN RE-DECLARED.** The trigger read: this row retires when the citation wall is re-derived where the operator's own framing puts it — *you would just make them a normal compiler error* — checked at ingestion, on the module whose source carries the citation, from that module's own text, rather than reconstructed corpus-wide by a second job; and it named §6's module-authorship trigger as the same rung, to be landed together rather than each rebuilding a corpus walk. Both landed on one construction, `v1_compiler.declaration_index`, inside the `parse` phase of `claim_executor --required-ci`: the sweep that already parses every authored module now derives one record per module and resolves every authored `DeclarationRef` against it by keyed lookup. `--required-cited-symbol` is DELETED with the same change, so there is one route and not two. RUNG: back to *mechanically preventable*, and STRICTLY WIDER than what was dropped — the enrolled population is every authored citation in a non-fixture module (measured 1441 authored, 161 in fixture carriers, 79 naming namespaces no `.dag` module declares), not the five carriers the deleted lens's population named, and test modules are INDEXED, so the outside-index disposition those exclusions forced is not needed. WHAT THE FIRST EXECUTION FOUND, because a wall that lands green over a corpus nobody checked for two days would be the more suspicious result: 46 sites over 38 distinct targets, every one a citation naming a declaration that does not exist — the exact class this rule names, accumulated in the unguarded window this row declared unbounded. They are NOT repaired here and NOT silently excluded: they are enumerated at identity grain in `PRE_EXISTING_CITATION_DEBT` as a §5 monotone debt contract whose universe is discovered by the index itself and whose rows REFUSE once their citation stops refusing, so the roster can only shrink. WHAT IS STILL OPEN, stated so this retirement is not read as wider than it is: `v2.lens.cited_symbol_resolution` is DELETED as of 2026-08-26, and the disposition was three-way rather than the two this row admitted. The count was stale on arrival — sixteen was the file's size at #7707 and it had grown to 27 `test fn` identities by the time this sentence was written — and "dead" was true of the lens and false of a third of its witnesses. Measured against the seven symbols that file imported FROM the lens, only 6 of the 27 touch one; those 6 died with it. Six more call `resolve_declaration_ref`, which lives in `v2.std.decl_ref_resolution` and SURVIVES with four other consumers, so they are the only executing evidence for a live authority's five-arm refusal and §4b(4) rehomed them to `test.claim.long.decl_ref_resolution_witness_test` rather than deleting them with the machinery that climbed. The remaining 15 are population and projection claims about the carriers that PROJECT `DeclarationRef`s and moved to `test.claim.long.carrier_reference_integrity_witness_test`. What the corpus-wide census subsumes is TYPED-LITERAL citations specifically — `DeclarationRef` record literals and the `decl_ref`/`decl_field_ref` constructors — not "citations" in general; a prose reference inside a `String` is covered by nothing, before or after. The per-PR witness that survives was renamed `test.claim.doc_graph_reference_partition_witness_test`, because its subject is a bucket partition over `gunbc.doc_graph_roots` and never was resolution, and under the old name it would have been the only cited-symbol-named thing left in the tree — a misreading two readers made independently from exactly that surface; and the wall is host Rust rather than a modeled ingestion operation, declared as seed growth in `gunbc.declaration_index_seed_growth`.
-- **A BLOCKING EMIT-STAGE DIAGNOSTIC CAN SIT ON MAIN INDEFINITELY WITH NO REQUIRED PHASE THAT FAILS, AND THIS ROW DECLARES THAT RUNG (2026-08-25).** It sits beside the CI entry above for the reason the regen and cited-symbol rows already give: that paragraph narrates the floor and regen cuts, this is a fourth drop on its own clock, and a declaration wedged into the repository's most-edited prose collides with every unrelated edit to it. **THE CLASS IS NOT ONE OPERATION.** It is any BLOCKING diagnostic produced at the EMIT stage, and the escape surface is Rust-target emission specifically: `v1.05_emit` `file_binding_refusal` returns a `FileEmissionRefusal`, and `file_emission_target_is_modeled` answers `Rust => true` with Python, Go and Dag all false, so the refusal exists only on the path that emits Rust. A parse phase cannot reach it and a typecheck cannot reach it; only a phase that EMITS over a closure containing the offending CALL SITE can. **HALF OF THIS IS ALREADY ON THE RECORD AND IS NOT CLAIMED AS NEW.** The CI entry above already declares, measured 2026-08-20, that `entry_file_touched_via_import_closure` and `compile_clean_scope_plan_for_ci` have zero references under `src/v1/stage0/src/bin`, that no CLI flag reaches them, and that the only `pub` surfaces into that chain return `Bool` — the authority survives and the capability does not. That is the missing compile capability, and it was declared five days before this row. **WHAT IS NEW IS THE SECOND HALF, AND IT IS WORSE: THE WITNESS FAMILY THAT APPEARS TO COMPENSATE IS ALSO INERT.** Measured on main run `32778026868` (`08488aee2`), nine identities named for compile-clean, and not one of them compiles anything. `compile_clean_shard_a_exemplar_compile_green`, `cross_shard_seam_preservation_holds_on_live_tree`, `perturb_fixture_green_holds`, `perturb_optional_skew_fixture_red_holds` and `perturb_unresolved_import_fixture_red_holds` are all NO-ROUTE — refused at the hermetic boundary, discovered and counted and answering nothing. `dag_compile_clean_scope_witness` and `dag_compile_clean_shard_totality_witness` declare `ReadsLiveTree`, so they are DeclinedLiveTree and never run. `compile_clean_shard_entry_paths_fast_hand_rust_witness` declares no disposition at all, so the fail-closed default makes it ReadsLiveTree and it is declined too. The single member that PASSES is `dag_compile_clean_cli_floor_agreement`, and it is `SubstrateInputsOnly`: it checks that two realizations AGREE ABOUT A POLICY ROW, never that anything is clean. **AND THE COVERAGE WOULD NOT HAVE HELPED EVEN HAD IT ROUTED**, which is what makes the pair a stronger claim than either half: `tools.dag_compile_clean_shard_transport` `shard_a_exemplar_entry_path` is `dag/std/logic.dag`. At full strength the family compiles ONE MODULE. So a reader counting witnesses named compile-clean concludes the corpus is compile-checked, and the corpus is not compile-checked and would not have been. That is §4b's worse-than-absent decoration, arrived at not by a check whose RED is unauthorable but by a family whose every member is routed away from its subject. PREVIOUS RUNG: *mechanically preventable* — the compile-clean gate ran ahead of everything else in the required run until the 2026-08-15 floor cut deleted it. TEMPORARY RUNG: **outside the ladder, not mitigatable.** This is the shape the regen row names: an operation that lost its only route has nothing to mitigate, because nothing can be attempted. Review diligence is not a fallback here in the way it is for the cited-symbol drop — a reviewer reads a diff and does not run an emitter, so no human process substitutes for the missing phase. **POPULATION: UNCOUNTED AND UNBOUNDED.** §4b(3) requires a bounded population and this row does not have one and does not pretend to. Two specimens are named below, escaping by three distinct modes; how many other blocking diagnostics stand on main today is unmeasured, and it is unmeasured by a deliberate scope decision rather than because the census is hard — the finding is the missing phase, and a specimen count would have been mistaken for the bound. Anyone who takes the named specimens as the population has made the denominator error this document keeps recording. **AND THIS ROW CLAIMS NO OPERATOR APPROVAL FOR THAT, WHICH IS WHERE IT DIFFERS FROM THE CITED-SYMBOL ROW ABOVE AND MUST NOT BE READ AS MATCHING IT.** That row's unbounded exposure is an operator-approved exception to §4b(3); this row's is simply an unmet requirement, declared as unmet. The distinction is the difference between a clause someone with the authority to waive it waived, and a clause this row does not satisfy — and reading the second as the first would manufacture an approval nobody gave, which is the authority-substitution failure this document names. THE NAMED SPECIMEN, WITH ITS PROVENANCE STATED HONESTLY BECAUSE THE TWO HALVES WERE MEASURED BY DIFFERENT PEOPLE ON DIFFERENT INSTRUMENTS: `extdeps.cloud.gcp.gcp` `ReadADC` DECLARED three structured output keys — `client_id`, `client_secret`, `refresh_token` — over a `transport file` that carries bytes, with nothing stating how a JSON document became those fields, and the compiler said so (`file transport output key client_id has no modeled channel`). **THAT SPECIMEN IS REPAIRED AS OF 2026-08-25 AND THE OPERATION NO LONGER EXISTS**, repaired ALONG THE LINE THIS ROW PRESCRIBED: `extdeps.cloud.gcp.adc_document` reads the document and decodes it through `extdeps.languages.json.parse`, so the read-then-decode seam this row ruled for is the seam that landed, and the `Secret`/`String` distinction a bytes channel could not carry is carried by a typed record. A row whose prescribed fix was implemented is evidence the prescription was right. The specimen is kept in the past tense rather than deleted because the CLASS claim below does not depend on it — and because nothing re-derives this sentence, which is why it stood stale until a session tripped over it. It was found cold and measured as the SOLE blocking diagnostic of a whole-census entry compile at `63501ff7e0`, from `--entry dag/gunbc/systemctl_show_read.dag` — a measurement this row's author did not take and does not restate as their own. **A SECOND COMPILE FROM A DIFFERENT ENTRY IS NOT A FAILED REPRODUCTION OF IT, AND THE DIFFERENCE IS THE CLASS DEFINITION DOING WORK.** Compiling `gunbc.auth.credentials` — the module that CONTAINS the call site — as its own entry refuses earlier, at typecheck, with four unrelated hard diagnostics, so that compile never reaches the stage where the channel refusal is produced. Nothing is contradicted: the two entries have different closures and stop at different phases. What the pair establishes is sharper than either alone — **the refusal is reachable from an entry whose closure INCLUDES the call site and unreachable from the file that HOLDS it**, so an emit-stage diagnostic is a property of a CLOSURE, not of a file. A per-file or per-module check would therefore not have caught this either, which is why the restoration trigger below names a phase over closures and not a linter. **A SECOND AND INDEPENDENT ESCAPE MODE, FOUND BY ACCIDENT WHILE MEASURING THE FIRST.** Those four typecheck diagnostics are not an incidental specimen of the same route — they escape a different way. `gunbc.auth.credentials` has ZERO IMPORT EDGES anywhere in `dag/` or `src/v2/`: it is an orphan, so no closure reaches it and nothing typechecks it, and its four hard errors (two `undefined variable shell`, two unresolved `AuthPrintAccessToken`) stand on main for a reason that has nothing to do with which phases emit. The first mode is *no required phase emits over this closure*; the second is *no closure reaches this module at all*. **AND A THIRD, WHICH IS THE WORST OF THEM, because it is the only one that misleads a reader rather than merely hiding from a checker.** The orphan is NOT unreferenced: `gunbc.tailscale_acl_phase2_credential` carries two `DeclarationRef` rows naming `gunbc.auth.credentials` as its credential authority — `gcp_secret_credential` and `gcp_oauth_access_token_via_adc_refresh`. So the module is CLAIMED AS AN AUTHORITY by a carrier that depends on it being correct, while no import edge reaches it and nothing typechecks it. An unreferenced orphan misleads nobody; a cited one asserts that a fact has a home, and the home does not compile. **THE THIRD MODE IS WHERE TWO DECLARED DROPS COMPOSE, AND NEITHER ROW ALONE PREDICTS IT.** The cited-symbol row above declares, from 2026-08-23, that nothing checks whether an authored citation resolves; this row declares that nothing emits over the closure a citation names. These two `DeclarationRef` rows were authored into exactly that window. A citation to a module that typechecks nowhere is invisible to both mechanisms at once — the first stopped asking *does this symbol exist*, the second stopped asking *does this module compile* — and the composition is not a complaint about either operator decision, it is what makes the population claim below concrete rather than rhetorical. Neither of the three modes was found by searching. All three were tripped over while measuring something else, which is the strongest available argument that the population below is not two or three. ONE MEASUREMENT THAT CORRECTS THE OBVIOUS ASSUMPTION, recorded so the next reader does not repeat it: compiling `extdeps/cloud/gcp/gcp.dag` AS AN ENTRY returns **0 blocking, 79 advisory**. The declaration alone does not refuse. The operation looks self-evidently broken and compiles clean in isolation, so an entry-grain check over extdeps would not have caught it either — it takes an entry whose closure reaches the call site. RESTORATION TRIGGER: this row retires when a required phase EMITS over a closure that reaches call sites — the compile re-add on the queue the floor cut created — and not when the gcp operation is repaired. Fixing the specimen closes the specimen; only the phase closes the class. The gcp repair is separately ruled: `extdeps.filesystem.filesystem_io` `Read` already models file-read with a `content` channel and `extdeps.languages.json` already models decode, so the seam is read-then-decode over two authorities that exist, and minting a gcp-specific channel would be the §3 nicknaming violation — it would additionally flatten the distinction that `client_secret` and `refresh_token` are `Secret` while `client_id` is `String`, which a bytes channel cannot carry and a typed record can. **A REQUIRED PHASE NOW COMPILES AN EMITTED CLOSURE, AND THIS ROW IS NARROWED RATHER THAN RETIRED (2026-08-26).** The trigger above says the row retires when a required phase emits over a closure that reaches call sites; a phase that emits and compiles one now exists, and it does not reach every closure, so what changes is the SIZE of the exposure and not its existence. WHAT LANDED: a fifth required phase, `emit-compile`, in the `build` lane — the same producer the `v2-emission` phase calls (`compile_entry_emission`), its emitted files written as a crate whose manifest is RENDERED from the modeled cargo authorities rather than authored as markup, and `cargo` run over it. Its subject is `gunbc.ci_layer_roots` `required_emit_compile_entries`, a bounded roster, bounded deliberately: `gunbc.whole_corpus_compile_admission` refuses a whole-bundle compile on the default runner and carries two `EXIT=137` kills behind that refusal, so a whole-corpus required compile is the one form measurement already rules out. **THE PHASE ESTABLISHES ITS OWN RED BY MUTATION, ON EVERY RUN, AND THAT IS THE POINT OF IT RATHER THAN A FLOURISH.** A cargo phase that is green because nothing was measured is exactly the decoration §4b calls worse than absent, and the compile-clean family this row already indicts is what that looks like at nine identities. So a green baseline alone is NOT a pass: `v1_compiler.emitted_closure_compile_host` `establish_discriminating_red` injects ONE type error into ONE emitted file, requires cargo to fail ALONE on it, restores the bytes byte-exactly and requires the green back — and every non-discriminating arm (`NotAttempted`, `NotDiscriminating`, `RestoreFailed`) stops the line with its own typed cause. The restore is as much of the evidence as the failure: without it a red could be residue from the emission rather than from the fault. **WHAT IS STILL OPEN, AND THE ROW STAYS FOR IT.** Escape mode one is narrowed, not closed — a blocking emit-stage diagnostic in a closure no rostered entry reaches still fails no phase, and the population of such closures remains uncounted. Escape modes two and three are UNTOUCHED: an orphan module no closure reaches is still typechecked by nothing, and a `DeclarationRef` naming it still asserts a home that does not compile. The phase carries no diagnostic count, no baseline and no ratchet — a merge-blocking comparison against a population measured on the current tree is the tree-copied oracle §5 rejects — so it answers *does the emitted tree compile*, never *how clean is it*. **THE COVER IS NOT THE CORPUS, AND THE PHASE'S OWN OUTPUT SAYS SO**, because the failure this row already indicts is exactly a reader counting compile-clean-named things and concluding the tree is compile-checked. The summary line reports the covered entries beside the count of authored `.dag` modules under the source roots, so the misreading is unavailable from the log rather than merely avoidable by anyone who goes and reads the roster. **WHAT THE COVER'S SIZE IS ACTUALLY BOUNDED BY, MEASURED RATHER THAN ASSUMED:** an entry costs ~40–50s wall and ~85% of that is `compile.reconcile`, paid INDEPENDENTLY PER ENTRY over closures that overlap heavily — most of `dag/std` sits in nearly every closure. That is a §2 cost-shape defect, not a budget fact: the same modules are reconciled tens of times in one run, and §6's bare-minimum-cost rule says a proven cost-shape defect is fixed regardless of the realized n. So the honest reading is not *the ceiling is forty entries* but *the per-entry cover is the wrong unit, and forty is what the wrong unit buys*. THE ROW RETIRES on the CAPABILITY, not on the cover's size: when required emission coverage reaches every closure the corpus has, by whatever construction, AND THAT INSTRUMENT IS SUFFICIENT TO COMPLETE AND PERSIST THE WHOLE-ROSTER TRANSACTION WITHIN THE ADMITTED RUNNER ENVELOPE. The sufficiency clause is not belt-and-braces: without it the trigger fires the moment a phase named for whole-roster coverage is ENROLLED, which a partial phase satisfies while the capability is still absent — the same defect one level in from the roster-size version, since the roster can be whole while the run that walks it cannot finish or cannot keep what it observed. AND THE NAME CARRIES THE SAME BURDEN: this phase's required context is a SELECTED emission observation, never a whole one, and its success means THE SELECTED OBSERVATION WAS TAKEN AND PERSISTED — never THE CORPUS IS CLEAN. A partial phase is a legitimate wall for an exact selected subject and zero wall for its complement; it becomes decoration only when its name, its trigger, or its consumers let the selected proposition stand in for the exhaustive one, which is why the remainder is reported as RETAINED IDENTITIES rather than as a percentage. A fraction says how much is unobserved and never which, so it is not the bounded population §4b(3) asks for; it may stand as context and may never be the gap's identity or its dissolution trigger. A trigger reading *grow the roster* would be satisfied at forty-one while the corpus stayed unmeasured, which is why it is not written that way. Its named dependency is the reconcile sharing above — a cover whose unit is the entry cannot reach the corpus at any budget, so the unblocking work is making one run reconcile a shared closure once, and that is a separate lane this row does not claim.
+- **A BLOCKING EMIT-STAGE DIAGNOSTIC CAN SIT ON MAIN INDEFINITELY WITH NO REQUIRED PHASE THAT FAILS, AND THIS ROW DECLARES THAT RUNG (2026-08-25).** It sits beside the CI entry above for the reason the regen and cited-symbol rows already give: that paragraph narrates the floor and regen cuts, this is a fourth drop on its own clock, and a declaration wedged into the repository's most-edited prose collides with every unrelated edit to it. **THE CLASS IS NOT ONE OPERATION.** It is any BLOCKING diagnostic produced at the EMIT stage, and the escape surface is Rust-target emission specifically: `v1.05_emit` `file_binding_refusal` returns a `FileEmissionRefusal`, and `file_emission_target_is_modeled` answers `Rust => true` with Python, Go and Dag all false, so the refusal exists only on the path that emits Rust. A parse phase cannot reach it and a typecheck cannot reach it; only a phase that EMITS over a closure containing the offending CALL SITE can. **HALF OF THIS IS ALREADY ON THE RECORD AND IS NOT CLAIMED AS NEW.** The CI entry above already declares, measured 2026-08-20, that `entry_file_touched_via_import_closure` and `compile_clean_scope_plan_for_ci` have zero references under `src/v1/stage0/src/bin`, that no CLI flag reaches them, and that the only `pub` surfaces into that chain return `Bool` — the authority survives and the capability does not. That is the missing compile capability, and it was declared five days before this row. **WHAT IS NEW IS THE SECOND HALF, AND IT IS WORSE: THE WITNESS FAMILY THAT APPEARS TO COMPENSATE IS ALSO INERT.** Measured on main run `32778026868` (`08488aee2`), nine identities named for compile-clean, and not one of them compiles anything. `compile_clean_shard_a_exemplar_compile_green`, `cross_shard_seam_preservation_holds_on_live_tree`, `perturb_fixture_green_holds`, `perturb_optional_skew_fixture_red_holds` and `perturb_unresolved_import_fixture_red_holds` are all NO-ROUTE — refused at the hermetic boundary, discovered and counted and answering nothing. `dag_compile_clean_scope_witness` and `dag_compile_clean_shard_totality_witness` declare `ReadsLiveTree`, so they are DeclinedLiveTree and never run. `compile_clean_shard_entry_paths_fast_hand_rust_witness` declares no disposition at all, so the fail-closed default makes it ReadsLiveTree and it is declined too. The single member that PASSES is `dag_compile_clean_cli_floor_agreement`, and it is `SubstrateInputsOnly`: it checks that two realizations AGREE ABOUT A POLICY ROW, never that anything is clean. **AND THE COVERAGE WOULD NOT HAVE HELPED EVEN HAD IT ROUTED**, which is what makes the pair a stronger claim than either half: `tools.dag_compile_clean_shard_transport` `shard_a_exemplar_entry_path` is `dag/std/logic.dag`. At full strength the family compiles ONE MODULE. So a reader counting witnesses named compile-clean concludes the corpus is compile-checked, and the corpus is not compile-checked and would not have been. That is §4b's worse-than-absent decoration, arrived at not by a check whose RED is unauthorable but by a family whose every member is routed away from its subject. PREVIOUS RUNG: *mechanically preventable* — the compile-clean gate ran ahead of everything else in the required run until the 2026-08-15 floor cut deleted it. TEMPORARY RUNG: **outside the ladder, not mitigatable.** This is the shape the regen row names: an operation that lost its only route has nothing to mitigate, because nothing can be attempted. Review diligence is not a fallback here in the way it is for the cited-symbol drop — a reviewer reads a diff and does not run an emitter, so no human process substitutes for the missing phase. **POPULATION: COUNTED 2026-08-27, STILL UNBOUNDED, AND THE SHAPE OF THAT RESULT IS THE FINDING.** This row read UNCOUNTED AND UNBOUNDED until a whole-root `--target rust` census was taken; the receipt is `gunbc.emit_stage_blocking_population_census` — a receipt and explicitly not an instrument, since no `.dag` entry point produces this measurement and the compiler's own CLI was driven by hand, which is a gap this row records rather than papers over. What the receipt does carry is the invocation as a DERIVATION rather than as prose: `census_run_invocation` renders each run's argv from that run's own fields, so the command is reachable from the fact it produced instead of sitting in a `//` annotation no `Accepted` program can read. The run's exit status and peak residency sit inside the same record as every count it carries, because a SIGKILL prints nothing and a harness reading only stdout reads a fabricated zero. **WHAT THE CENSUS ANSWERS: three, and three is not the population.** `v1.compiler.emit_rust` `emit_rust` returns with no files at its FIRST gate, so the three parameter-default refusals it reports were MASKING eight anonymous-record ones that had been standing all along — the same prefix-of-the-truth shape `gunbc.emit_diagnostic_observation` already records, reproduced on the live corpus. Clearing a gate in the working tree to see past it is a measurement of what the NEXT gate would report, never a measurement of main, and the receipt says so on every row that used one. **AND THE UPPER BOUND IS UNREACHABLE BY THIS ROUTE, FOR A REASON THAT IS NOT ABOUT DIAGNOSTICS AT ALL:** with both gates clear, emit reaches its code-generation body and does not return — stopped at a declared five-hour budget, still computing, no tree written, so it has no exit status to record and no population to read. **SO §4b(3) IS STILL NOT SATISFIED AND THIS ROW DOES NOT CLAIM IT IS.** What moved is the word UNCOUNTED: the observable population is three, the latent population is at least eleven, and the missing upper bound now has a named cause instead of no measurement. The rung does not move, the restoration trigger does not move, and a census is not the required phase that trigger names. Anyone who takes the named specimens, or these figures, as the population has made the denominator error this document keeps recording — the second root measured (`src/v2` as primary, its own subject, unioned with nothing) carries twenty hard diagnostics at its emit refusal of which ZERO were produced by emit. **AND THIS ROW CLAIMS NO OPERATOR APPROVAL FOR THAT, WHICH IS WHERE IT DIFFERS FROM THE CITED-SYMBOL ROW ABOVE AND MUST NOT BE READ AS MATCHING IT.** That row's unbounded exposure is an operator-approved exception to §4b(3); this row's is simply an unmet requirement, declared as unmet. The distinction is the difference between a clause someone with the authority to waive it waived, and a clause this row does not satisfy — and reading the second as the first would manufacture an approval nobody gave, which is the authority-substitution failure this document names. THE NAMED SPECIMEN, WITH ITS PROVENANCE STATED HONESTLY BECAUSE THE TWO HALVES WERE MEASURED BY DIFFERENT PEOPLE ON DIFFERENT INSTRUMENTS: `extdeps.cloud.gcp.gcp` `ReadADC` DECLARED three structured output keys — `client_id`, `client_secret`, `refresh_token` — over a `transport file` that carries bytes, with nothing stating how a JSON document became those fields, and the compiler said so (`file transport output key client_id has no modeled channel`). **THAT SPECIMEN IS REPAIRED AS OF 2026-08-25 AND THE OPERATION NO LONGER EXISTS**, repaired ALONG THE LINE THIS ROW PRESCRIBED: `extdeps.cloud.gcp.adc_document` reads the document and decodes it through `extdeps.languages.json.parse`, so the read-then-decode seam this row ruled for is the seam that landed, and the `Secret`/`String` distinction a bytes channel could not carry is carried by a typed record. A row whose prescribed fix was implemented is evidence the prescription was right. The specimen is kept in the past tense rather than deleted because the CLASS claim below does not depend on it — and because nothing re-derives this sentence, which is why it stood stale until a session tripped over it. It was found cold and measured as the SOLE blocking diagnostic of a whole-census entry compile at `63501ff7e0`, from `--entry dag/gunbc/systemctl_show_read.dag` — a measurement this row's author did not take and does not restate as their own. **A SECOND COMPILE FROM A DIFFERENT ENTRY IS NOT A FAILED REPRODUCTION OF IT, AND THE DIFFERENCE IS THE CLASS DEFINITION DOING WORK.** Compiling `gunbc.auth.credentials` — the module that CONTAINS the call site — as its own entry refuses earlier, at typecheck, with four unrelated hard diagnostics, so that compile never reaches the stage where the channel refusal is produced. Nothing is contradicted: the two entries have different closures and stop at different phases. What the pair establishes is sharper than either alone — **the refusal is reachable from an entry whose closure INCLUDES the call site and unreachable from the file that HOLDS it**, so an emit-stage diagnostic is a property of a CLOSURE, not of a file. A per-file or per-module check would therefore not have caught this either, which is why the restoration trigger below names a phase over closures and not a linter. **A SECOND AND INDEPENDENT ESCAPE MODE, FOUND BY ACCIDENT WHILE MEASURING THE FIRST.** Those four typecheck diagnostics are not an incidental specimen of the same route — they escape a different way. `gunbc.auth.credentials` has ZERO IMPORT EDGES anywhere in `dag/` or `src/v2/`: it is an orphan, so no closure reaches it and nothing typechecks it, and its four hard errors (two `undefined variable shell`, two unresolved `AuthPrintAccessToken`) stand on main for a reason that has nothing to do with which phases emit. The first mode is *no required phase emits over this closure*; the second is *no closure reaches this module at all*. **AND A THIRD, WHICH IS THE WORST OF THEM, because it is the only one that misleads a reader rather than merely hiding from a checker.** The orphan is NOT unreferenced: `gunbc.tailscale_acl_phase2_credential` carries two `DeclarationRef` rows naming `gunbc.auth.credentials` as its credential authority — `gcp_secret_credential` and `gcp_oauth_access_token_via_adc_refresh`. So the module is CLAIMED AS AN AUTHORITY by a carrier that depends on it being correct, while no import edge reaches it and nothing typechecks it. An unreferenced orphan misleads nobody; a cited one asserts that a fact has a home, and the home does not compile. **THE THIRD MODE IS WHERE TWO DECLARED DROPS COMPOSE, AND NEITHER ROW ALONE PREDICTS IT.** The cited-symbol row above declares, from 2026-08-23, that nothing checks whether an authored citation resolves; this row declares that nothing emits over the closure a citation names. These two `DeclarationRef` rows were authored into exactly that window. A citation to a module that typechecks nowhere is invisible to both mechanisms at once — the first stopped asking *does this symbol exist*, the second stopped asking *does this module compile* — and the composition is not a complaint about either operator decision, it is what makes the population claim below concrete rather than rhetorical. Neither of the three modes was found by searching. All three were tripped over while measuring something else, which is the strongest available argument that the population below is not two or three. ONE MEASUREMENT THAT CORRECTS THE OBVIOUS ASSUMPTION, recorded so the next reader does not repeat it: compiling `extdeps/cloud/gcp/gcp.dag` AS AN ENTRY returns **0 blocking, 79 advisory**. The declaration alone does not refuse. The operation looks self-evidently broken and compiles clean in isolation, so an entry-grain check over extdeps would not have caught it either — it takes an entry whose closure reaches the call site. RESTORATION TRIGGER: this row retires when a required phase EMITS over a closure that reaches call sites — the compile re-add on the queue the floor cut created — and not when the gcp operation is repaired. Fixing the specimen closes the specimen; only the phase closes the class. The gcp repair is separately ruled: `extdeps.filesystem.filesystem_io` `Read` already models file-read with a `content` channel and `extdeps.languages.json` already models decode, so the seam is read-then-decode over two authorities that exist, and minting a gcp-specific channel would be the §3 nicknaming violation — it would additionally flatten the distinction that `client_secret` and `refresh_token` are `Secret` while `client_id` is `String`, which a bytes channel cannot carry and a typed record can. **A REQUIRED PHASE NOW COMPILES AN EMITTED CLOSURE, AND THIS ROW IS NARROWED RATHER THAN RETIRED (2026-08-26).** The trigger above says the row retires when a required phase emits over a closure that reaches call sites; a phase that emits and compiles one now exists, and it does not reach every closure, so what changes is the SIZE of the exposure and not its existence. WHAT LANDED: a fifth required phase, `emit-compile`, in the `build` lane — the same producer the `v2-emission` phase calls (`compile_entry_emission`), its emitted files written as a crate whose manifest is RENDERED from the modeled cargo authorities rather than authored as markup, and `cargo` run over it. Its subject is `gunbc.ci_layer_roots` `required_emit_compile_entries`, a bounded roster, bounded deliberately: `gunbc.whole_corpus_compile_admission` refuses a whole-bundle compile on the default runner and carries two `EXIT=137` kills behind that refusal, so a whole-corpus required compile is the one form measurement already rules out. **THE PHASE ESTABLISHES ITS OWN RED BY MUTATION, ON EVERY RUN, AND THAT IS THE POINT OF IT RATHER THAN A FLOURISH.** A cargo phase that is green because nothing was measured is exactly the decoration §4b calls worse than absent, and the compile-clean family this row already indicts is what that looks like at nine identities. So a green baseline alone is NOT a pass: `v1_compiler.emitted_closure_compile_host` `establish_discriminating_red` injects ONE type error into ONE emitted file, requires cargo to fail ALONE on it, restores the bytes byte-exactly and requires the green back — and every non-discriminating arm (`NotAttempted`, `NotDiscriminating`, `RestoreFailed`) stops the line with its own typed cause. The restore is as much of the evidence as the failure: without it a red could be residue from the emission rather than from the fault. **WHAT IS STILL OPEN, AND THE ROW STAYS FOR IT.** Escape mode one is narrowed, not closed — a blocking emit-stage diagnostic in a closure no rostered entry reaches still fails no phase, and the population of such closures remains uncounted. THAT IS A DIFFERENT DENOMINATOR FROM THE CENSUS ABOVE AND NEITHER ANSWERS THE OTHER: the census counts BLOCKING DIAGNOSTICS reachable from a whole-root emit, this clause counts CLOSURES NO ROSTERED ENTRY REACHES, and a diagnostic can be counted while the closure carrying it is unrostered. The two clauses were written a day apart by authors who could not see each other, and stating the denominators is what stops the later count from reading as a refutation of the earlier gap. Escape modes two and three are UNTOUCHED: an orphan module no closure reaches is still typechecked by nothing, and a `DeclarationRef` naming it still asserts a home that does not compile. The phase carries no diagnostic count, no baseline and no ratchet — a merge-blocking comparison against a population measured on the current tree is the tree-copied oracle §5 rejects — so it answers *does the emitted tree compile*, never *how clean is it*. **THE COVER IS NOT THE CORPUS, AND THE PHASE'S OWN OUTPUT SAYS SO**, because the failure this row already indicts is exactly a reader counting compile-clean-named things and concluding the tree is compile-checked. The summary line reports the covered entries beside the count of authored `.dag` modules under the source roots, so the misreading is unavailable from the log rather than merely avoidable by anyone who goes and reads the roster. **WHAT THE COVER'S SIZE IS ACTUALLY BOUNDED BY, MEASURED RATHER THAN ASSUMED:** an entry costs ~40–50s wall and ~85% of that is `compile.reconcile`, paid INDEPENDENTLY PER ENTRY over closures that overlap heavily — most of `dag/std` sits in nearly every closure. That is a §2 cost-shape defect, not a budget fact: the same modules are reconciled tens of times in one run, and §6's bare-minimum-cost rule says a proven cost-shape defect is fixed regardless of the realized n. So the honest reading is not *the ceiling is forty entries* but *the per-entry cover is the wrong unit, and forty is what the wrong unit buys*. THE ROW RETIRES on the CAPABILITY, not on the cover's size: when required emission coverage reaches every closure the corpus has, by whatever construction, AND THAT INSTRUMENT IS SUFFICIENT TO COMPLETE AND PERSIST THE WHOLE-ROSTER TRANSACTION WITHIN THE ADMITTED RUNNER ENVELOPE. The sufficiency clause is not belt-and-braces: without it the trigger fires the moment a phase named for whole-roster coverage is ENROLLED, which a partial phase satisfies while the capability is still absent — the same defect one level in from the roster-size version, since the roster can be whole while the run that walks it cannot finish or cannot keep what it observed. AND THE NAME CARRIES THE SAME BURDEN: this phase's required context is a SELECTED emission observation, never a whole one, and its success means THE SELECTED OBSERVATION WAS TAKEN AND PERSISTED — never THE CORPUS IS CLEAN. A partial phase is a legitimate wall for an exact selected subject and zero wall for its complement; it becomes decoration only when its name, its trigger, or its consumers let the selected proposition stand in for the exhaustive one, which is why the remainder is reported as RETAINED IDENTITIES rather than as a percentage. A fraction says how much is unobserved and never which, so it is not the bounded population §4b(3) asks for; it may stand as context and may never be the gap's identity or its dissolution trigger. A trigger reading *grow the roster* would be satisfied at forty-one while the corpus stayed unmeasured, which is why it is not written that way. Its named dependency is the reconcile sharing above — a cover whose unit is the entry cannot reach the corpus at any budget, so the unblocking work is making one run reconcile a shared closure once, and that is a separate lane this row does not claim.
diff --git a/dag/gunbc/design_document.dag b/dag/gunbc/design_document.dag
index 6d57aa7edfd..49ef9c94f29 100644
--- a/dag/gunbc/design_document.dag
+++ b/dag/gunbc/design_document.dag
@@ -180,11 +180,11 @@ fn building_checks_blocks() -> List<MarkdownBlock> {
       li(text: "`cargo test --workspace` · `cargo clippy --all-targets -- -D warnings` · `cargo fmt --all --check`"),
       li(text: "one-time per clone: `git config core.hooksPath .githooks` — the only documented manual seed; generated pre-commit/pre-push hooks then idempotently converge `merge.generated-artifact.driver` and re-assert `core.hooksPath` via argv derived from `gunbc.repo_local_git_config` (clones that skip hooksPath degrade to vanilla text-merge for generated-artifact paths; drift gate still guards at CI). The driver REFUSES rather than answering `true`: git reaches a low-level merge driver only when both sides changed the path since the merge base — measured on a four-case matrix, one-sided and identical changes never reach it — and taking the ours side there dropped the other side's authority-derived bytes with no conflict, twice on #7836 against the stage0 seed. It now leaves the ours side in the worktree with no conflict markers, marks the path unmerged, and prints the regeneration recipe; the class is mechanically preventable, not structural, and its next-rung trigger is the commit-writer binding rows in `gunbc.commit_workflow`"),
       li(text: "explicit actuator (CI / tooling): `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/repo_local_git_config.dag --function converge`"),
-      li(text: "CI — **RUNG DROP, DECLARED (2026-08-15, the floor cut).** WHAT WAS HERE: one composed floor pass, `claim_executor` with a `--plan-entry` naming `src/v2/workflow/ci_floor_plan.dag`, a v2 scheduler deciding batches from `gunbc.ci_spec`, a compile-clean gate ordered ahead of everything else, per-PR discovery over `CiSpec.discovery_scan_dirs`, and a 4-hourly `affected-set-falsifier` cadence carrying the whole-tree cold controls. **ALL OF IT IS DELETED** — the workflows (`ci.yml`, `falsifier.yml`, `falsifier-alert.yml`), their `.dag` authorities, and ~30 witness modules. This paragraph previously recited that invocation in the present tense; it was false the moment the cut landed, and a knowingly-false recital in the canonical authority is premise contamination — every session reading it plans against a command that does not exist. WHAT RUNS NOW: one emission, `gunbc.witness_floor_workflow` → `.github/workflows/witnesses.yml`, invoking our own binary once PER LANE — `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` and `... --required-lane witnesses`, in TWO PARALLEL JOBS (the 2026-08-25 split described below; the invocation named `--required-floor` until the 2026-08-20 consolidation, also described below, and that flag still exists and still runs the fold alone, it is simply no longer what CI calls) — whose floor phase folds every discovered witness through one prepared subject via `v1_compiler.cli_run` `run_required_floor`, whose admission, cost-line and preparation-safety policy is owned by `v2.workflow.required_floor` (this clause named that module as the symbol home until 2026-08-26; the module is real and the symbol does not resolve there, which is exactly the §3 defect the `--required-cited-symbol` census would have refused before its 2026-08-23 drop). No plan entry, no plan function, no batch id, no worker role, no selection flag: the fold has no such concepts to configure — which PRESERVES the 2026-08-13 operator directive that no SELECTION shrinks the roster, by construction rather than by a flag someone must remember to set. **That directive is about selection, and an earlier revision of this clause stated it as `the whole discovered roster runs unshrunk`, which is false of the DISCOVERED roster and true only of the ROUTED one.** Measured on main run `32553487573` (`967b5bc1b92`, 2026-08-22T05:06Z): `offered=11812 routed=10439 declined_long=543 declined_live=830`. 1373 discovered sites — 11.6% — are declined by HOME POLICY before the fold sees them, so `planned` is the routed roster and never the discovered one. The floor's own line is honest about this (`every discovered site is exactly one of these`); only this document overclaimed, and the overclaim is the load-bearing kind, because a reader who takes `the whole discovered roster runs` literally will conclude that authoring a witness is sufficient for it to execute. It is not: a witness under a long or live home is discovered, counted, and never run. The decline mechanism is not a selection flag and the directive is not violated by it — the two are different questions, and conflating them is what made one true sentence and one false sentence read as the same claim. That directive's own carrier (`corpus_selection_off_note`) died with the floor; `gunbc.ci_spec` retains the history and now points here. **THE FOLD NOW EXECUTES, measured 2026-08-19.** Green on main, the latest measured `32553487573` (`967b5bc1b92`, 2026-08-22T05:06Z): `planned=10439 executed=10439 terminal=10439 passed=10132 known_red_held=206 failed=0 stale_quarantine=0 route_gap_held=101 over_cost_line_diagnostic=35`, ~30 min wall. The counts previously cited here were run `32515441229` of 2026-08-21 (`offered=11615 routed=10253 … passed=9946`) and had gone stale by 197 offered sites in under twelve hours; they are replaced rather than annotated, because two count sets in one clause is two accounts of one fact. That this clause has now been re-pointed twice in three days is itself the measurement: a transcribed receipt line is a *positional* citation of a run's output — §3's rule reaches it, since no edit here invalidates it and it rots anyway — so the standing question is now DECIDED (operator ruling, 2026-08-24): **name the instrument, never transcribe its output.** A measurement is cited by naming the producer that re-derives it — the run, the flag, the committed script — and never by copying its numbers into prose, exactly as §3 requires a citation to name a symbol rather than a line, and for the same reason: a transcribed number is unreachable from the thing that owns it, so it rots without anyone touching either end. The counters above are retained under that rule as a declared exception with their producing run named, because this clause's subject IS the rung drop and a drop is unreadable without the magnitude it dropped by; every other transcription in the corpus is debt. The ruling was priced, not preferred: the parallel measurement corpus it governs was BANKRUPTED the same day — `docs/probes/` deleted whole, 195 files and 50,601 lines, boards and captures and instruments alike, leaving NO `.sh` or `.py` anywhere in the repository outside `.githooks` — after a board asserting a compiler mechanism as a live defect was found to have merged EIGHT SECONDS after the commit that fixed it, and to have named the emitter carrier when the actual repair was two lines in the model. A lane had already selected that mechanism as its next work on the board's authority. **THE INSTRUMENTS WENT WITH THE PROSE, and the reason decides what the rule means (operator ruling, 2026-08-24): an ad-hoc `.sh` or `.py` in this repository is §6 UNMODELED REALIZATION — raw shell implementing semantics already expressible in `.dag` — so if a measurement is worth re-deriving it is worth an entry point, and if it is not worth an entry point it is not an instrument but a one-off.** This was ruled against a live objection, recorded because the objection was correct on its own facts and still lost: a peer had re-run `curated_cargo_probe_one.sh` that same hour to re-derive the emission board's headline from source, so the scripts had real consumers — LANES, which a census of `.dag` consumers cannot see, and which is why an earlier revision of this clause reported them as dead. The ruling does not deny that consumer; it denies that a stray script is the right carrier for it. So `name the instrument` names a `.dag` entry point, and the rule needs no exception for a referent it deleted: what is deleted is everything that cannot be re-derived from the tree, and what re-derives it is modeled or it does not exist. That is the §2 cost of a second representation with no authority, arriving faster than it can be authored, and it is why a measurement document is presumed redundant rather than merely stale. WHAT THIS DOES NOT CLAIM: the cut leaves a named residue it does not repair — gitignore un-ignore rows for deleted paths, prose notes across ~20 modules citing them, and the witnesses above, all still green over dead names. That residue is the next cut, not a gap this one closed. **`executed` answers a narrower question than every reader asks of it: it counts a witness reaching the fold, not its assertion running.** A witness whose subject is a subprocess exit status is planned, discovered, and counted `executed` while it is REFUSED BY CONSTRUCTION at the hermetic boundary — `run_required_floor`'s hermetic envelope rejects the host effect via `shell.Test.IsExecutable` before the subprocess is reached, in about a millisecond, which also rules out a budget refusal on timing. This is CORRECT, not a gap: mocking that refusal to let such a witness run would pass it against a fabricated exit status, the exact fabricated-plausible-output failure the witness exists to catch. It is a boundary of what the hermetic floor can cover, named here beside the counters rather than left for a reader to rediscover. This clause previously read that no witness had executed and that the fold refused during preparation; that was true when written and is now false, and it is corrected in place rather than left standing until the rest of the paragraph can be rewritten — because a knowingly-false recital is premise contamination whichever direction it points, and this one had already cost real work: a session measuring the TestClaim orphan population read it, concluded the floor had never run, and raised a sequencing question about roster growth that does not exist. The rung drop below is unaffected: the fold running green establishes that the replacement executes, not that the re-add queue has closed. WHAT IS UNGUARDED IN THE MEANTIME, named rather than left to be rediscovered: the generated-artifact drift gates, heal, the seven effect gates, the fmt gate, merge-admission stamping, the falsifier cadence, and the per-witness eval deadline that `gunbc_ci_fast_lane_witness_eval_budget` used to arm (`gunbc.witness_row_cost` `gunbc_ci_fast_lane_rule_note` carries that one's own drop). Each is a separate re-add, each re-derived from its own first principles under its own operator agreement rather than restored from the deleted machinery. RESTORATION TRIGGER: this paragraph is rewritten as an ordinary present-tense description — not amended, rewritten in one pass — when the re-add queue closes. Until then it describes a rung drop, and describing the replacement as finished would be the inflation §4b names as worse than sitting low. **WHAT SURVIVES UNTOUCHED, enumerated rather than swept away with the bullet** — this paragraph replaced a longer one, and a prose row is deleted for one reason and takes everything in it unless its contents are enumerated first (the same rule that governs deleting a witness file whole): the compile-clean scope authority `tools.dag_compile_clean_scope` and its import-closure selection (`entry_file_touched_via_import_closure`) are live and unmodified by the cut — but **live is not reachable, and an earlier revision of this clause said only the first**. It read that what is gone is the CI *job* that invoked them and not the authority; both halves are true and together they license a false inference, because SURVIVING A CUT AND BEING CALLABLE ARE DIFFERENT PROPERTIES and only the first was checked. Measured 2026-08-20: `entry_file_touched_via_import_closure` and `compile_clean_scope_plan_for_ci` are private `fn`s with ZERO references anywhere under `src/v1/stage0/src/bin`, no CLI flag reaches them, and the only `pub` surfaces into that chain — `witness_layer_roots_compile_clean_check` / `_emit_check` — return `Bool`, so they answer *is it clean* and can never answer *which entries would be selected*. A reader planning against the old sentence would budget an afternoon and find no caller; that is premise contamination of the same class this paragraph already corrects itself for twice. The authority survives and the capability does not, until something exposes a counting entry point; the `regen_input_sources` import closure survives and is now read by `v1_compiler.required_regen_host` — but the `regen_stage0` binary that consumed it, and the `RegenVerifyGate` / `SelfHostStalenessGate` pair that invoked it, are DELETED at the root (the regen cut), so the self-host fixed point is answered by `claim_executor --required-regen-fixed-point` and by nothing else. **THAT FLAG IS INVOKED AGAIN AS OF 2026-08-20**, so this is one re-add off the queue below rather than a standing gap. It was re-added as two `witnesses.yml` steps ordered ahead of the floor and CONSOLIDATED the same day (operator directive: the phases belong `within the witnesses step and within the gunbc binary, not at a github actions job level`) into ONE step running the phases in ONE process. **THAT 2026-08-20 DIRECTIVE IS NOW PARTLY SUPERSEDED, BY THE SAME OPERATOR, ON 2026-08-25** — `we can add it as a parallel job in github actions - we can do the same for regen now, we have more runners` / `basically i would put regen + v2 full compile in one job, and witnesses into another one`. The stated reason is a change in supply, not a change of mind about the earlier argument: the phases are mutually independent, so composing them into one process made the required check's wall clock a SUM of things that could have been a MAX, and more runners make the MAX purchasable. **THE DIRECTIVE HAS TWO HALVES AND ONLY ONE IS SUPERSEDED, which is why this clause states both rather than replacing one ruling with another.** SURVIVES — *within the gunbc binary*: the phases still live in `claim_executor`, each job makes ONE invocation and names a LANE, and no step's precondition reads another phase's verdict. The step-ladder defect the consolidation fixed (an `if:` naming a sibling step, silently conjoined with GitHub's implicit `success()`, so a regen red disarmed the whole floor) cannot return, because no step's condition can reach another phase's outcome. SUPERSEDED — *not at a github actions job level*: PARALLELISM IS NOT EXPRESSIBLE IN THE BINARY. Two phases running concurrently means two runners, two checkouts and two toolchains, and one process on one runner can thread but cannot acquire a second machine — nor would we want it to, at the floor's measured ~9.4 GiB peak. So the lane boundary is a job boundary of necessity, and what the directive was protecting against — SEQUENCING and PRECONDITIONS leaking into YAML — is exactly what does not cross it: the two jobs carry no `needs` edge and no condition on each other, which is the whole content of running them in parallel. So the invocation named at the top of this paragraph is superseded three times over and is now, exactly: TWO LANE JOBS, `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` (regen's first-generation comparison, the v2-emission compile, the emitted-closure cargo phase and the partition-crate boundary) and the same command with `--required-lane witnesses` (the `.dag` parse sweep and the witness floor fold), plus a THIRD job that gates on both. **THAT THIRD JOB IS NOT DECORATION AND THE FIRST CUT OF THE SPLIT DID NOT HAVE IT, which is the more useful half of this entry.** A GitHub required status check is produced by the JOB, not by the workflow, and the repository's `passing CI` ruleset is active, carries NO bypass actors, and names exactly ONE required context: `witnesses`. So splitting the phases into a second job made regen and v2-emission NON-BLOCKING -- the required check would have gone green over a regen drift or a v2 emission break and the PR would have been mergeable. That is fail-open (§5), and strictly worse than the serial run it replaced, because the serial job carried every phase into the one context that gates. THE REPAIR IS AN AGGREGATION JOB RATHER THAN A RULESET EDIT: the floor lane is renamed `floor`, and the name `witnesses` moves to a job that `needs` both lanes and whose only step reads both results and exits nonzero unless both are `success`. **THE CONDITION THAT MAKES THAT JOB RUN IS AT THE JOB LEVEL, AND THE FIRST CUT OF THE AGGREGATOR PUT IT ONLY ON THE STEP** -- the same fail-open committed one level in, caught by review 55795 and independently by a peer session within minutes of each other. `needs` carries an implicit job-level condition: a job that declares `needs` and no `if` is SKIPPED when a needed job fails, a skipped job never reaches its steps, and a step-level `always()` cannot rescue a job that never started. The job therefore declares `always()`, and that is the ONE place in the emission that departs from the file's `!cancelled()` house guard, stated here because a reader who knows the convention will otherwise correct it back and reopen the hole. Every other guard decides whether a STEP runs inside a job that is already running; this one decides WHETHER THE REQUIRED CONTEXT EXISTS AT ALL, and under `!cancelled()` a cancelled run leaves it skipped rather than answered. That turns the outcome on a question about GitHub nobody here has executed -- does a skipped or cancelled required check block a merge -- and the right response is not to measure it but to make the answer not matter: under `always()` the job always runs, always reads both results, and always reports on its own terms, so SKIPPED disappears from the required context. Construction over validation (§5), at the cost that a lawfully superseded run now reports this context red rather than cancelled, which is the correct reading rather than a regression. The two lane jobs still carry no `needs` edge on each other and still start together; only the aggregator waits. A ruleset edit would have worked too and was rejected on a boundary this document already records: the ruleset is not a `.dag` fact, so landing a change whose safety depends on someone editing a setting afterwards is a coverage gap with a promise attached and a real unguarded window. Found in review of gunbc#9203, against the live ruleset rather than against the workflow -- which is the only place the fact is visible, since nothing in the emitted YAML says which of its jobs gates. The partition is total by construction — `RequiredCiPhase::lane` is an exhaustive match, so a phase belonging to no job fails to compile rather than going silently unmeasured — and the lane is the ONLY thing the transport names: which phases a lane owns is decided in the binary, never in the YAML. **THE v2-EMISSION PHASE'S SUBJECT WIDENED IN THE SAME CHANGE**, from `dag/std/abi.dag` (the smallest entry in the tree) to `src/v2/compiler/00_compile.dag` (the v2 pipeline root, the widest closure one entry names). The row is `gunbc.ci_layer_roots` `required_v2_emission_entries` and it remains a cost decision rather than a Rust edit; what changed is the denominator, since the build lane's cost is now free up to the floor's duration rather than added to it. **WHAT THE SPLIT DOES NOT DO:** it restores nothing else from the deleted floor machinery — every item on the unguarded list above is still its own re-add under its own operator agreement — and it lands NO ratchet over the v2 compile's advisory-diagnostic population. That population is real and is the natural next subject, but a merge-blocking count pinned to a number measured on the current tree is exactly the oracle §5 forbids; an identity-grain monotone debt contract is a separate construction and is not claimed here. **THE PARSE PHASE STOPPED BEING src/v1-ONLY, 2026-08-23**, and it is stated here because the previous revision named the phase by the one root it walked. It now sweeps `src/v1`, `dag` and `src/v2` from one roster (`v1_compiler.cli_run` `DAG_PARSE_SWEEP_ROOTS`), shared with the standalone bin, and it admits source annotations per file rather than parsing alone -- `tokenize` routes `//` into the annotation channel and `parse` never decides grain, so the old walk returned clean for a file carrying an in-body annotation and the §4c refusal surfaced only at the floor's strict PREPARATION, where no witness executes at all. That is not a widening of the floor's source roots, which `gunbc.ci_layer_roots` `v1_dead_witness_tree_triage_receipt_remainder` rules out on NAME RESOLUTION grounds: this walk resolves nothing across files, so that objection cannot reach it. **THE PHASE ROSTER WAS CUT TO THREE BY OPERATOR RULING, 2026-08-21, WAS FOUR AGAIN AS OF #9035, AND IS FIVE AS OF THE PARTITION-CRATE PHASE, AND IS SIX AS OF THE EMIT-COMPILE PHASE.** The count is stated in the present tense here and it has now been wrong in BOTH directions, which is the reason it is written as a measurement rather than as a recollection: an earlier revision said four while enumerating a determinism pass no required run performed, that was corrected to three, and the three then went stale when #9035 enrolled a v2-emission phase that compiles one v2 entry — landed precisely because an emission break reached main and no gate could see it. The instrument is the required mode itself, which prints its own roster before any phase runs -- one `phase <name>` line per phase the lane owns and one `ROUTED to lane <other>` line per phase it does not, then `lane=<name> phases_run=<its own count>`. Read the roster from that announcement rather than from this sentence: the count moved twice in five days, and a transcribed roster size is exactly the positional citation the ruling above forbids. The fifth phase is `partition-crates`, in the build lane, which compares the derived stage0 partition's committed `lib.rs` and `Cargo.toml` against what `v1.compiler.stage0_crates` renders from the authority -- landed because those seven crates are workspace members nothing in CI builds, so a broken one sat on main while every required lane stayed green. **THAT COUNT IS NOW A PROPERTY OF THE ROSTER AND NOT OF A RUN**, because the 2026-08-25 split partitions the four across two jobs: a lane's own summary line reports `lane=<name> phases_run=<its own count>`, and each job additionally prints a `ROUTED to lane <other>` line for every phase it does not own, so one job's log still names the whole roster and where the rest is being measured. Reading a single job's `phases_run` as the roster size is the error that line exists to prevent. The five phases the 2026-08-21 ruling deleted stay deleted and are enumerated below; neither #9035 nor the partition-crate phase restored any of them, each added a new one, so both are roster ADDITIONS and not a reversal of that ruling. Five phases were deleted from the mode: merge-admission-capture, the regen determinism (fixed-point) pass and its in-memory pass-1 digest handoff, the behavioral receipt's controlled-fixture selftest, the behavioral receipt against the authorities a diff changed, and merge-admission-stamp. They were deleted rather than left reporting SKIPPED, because a phase whose only reachable state is a non-verdict has a deficit frequency of zero by construction and still reads as coverage on the ledger (§5, the absorbing fallback). The capabilities survive at their own entry points — `--required-regen-fixed-point`, `//gunbc/instruments:behavioral-receipt-plan`, `//gunbc/instruments:behavioral-receipt-selftest`, `//gunbc/instruments:behavioral-receipt-census` — none of which any workflow invokes; what ended is their enrolment in the required run, and the three measurements they carried (regen determinism, behavioural equivalence of a changed authority against its mirror, and the receipt's own discriminating arms) are simply no longer taken. That is a declared scope narrowing, and it returns merge-admission stamping to the unguarded list above rather than removing it from it. The remaining three phases are independent — the one real data dependency left with the phase that consumed it — so every phase runs even after an earlier failure and the run reports the complete ledger instead of letting the first defect hide the rest. The line still stops on any failed phase. It is recorded here with what made the gap real, because the steps were enrolled, STRIPPED, and re-enrolled inside twelve hours and a reader who finds only the enrolment will re-derive the strip. The strip was correct when made: the admission test is whether every red is closable by the author who caused it at the moment they caused it, and it was not -- the comparator normalized BOTH sides through rustfmt while writing the single-pass form, so after any candidate install the comparison was `normalize(normalize(emitted))` against `normalize(emitted)`, an identity only if rustfmt is idempotent. It is not, so the gate refused a tree byte-identical to its own artifact, permanently, and its only reachable green was the hand-edited mirror the gate exists to refuse -- a gate whose sole closing move is the forbidden action is not strict, it launders. Repairing it by raw-comparing the single-pass bytes then put it in direct contradiction with `cargo fmt --all --check`, which re-formats what is committed and so demands the NEXT pass: two gates consuming different passes of one artifact, each breaking the other. The resolution is that the emitted artifact is now written as a FIXED POINT of the formatter (bounded, exceeding the bound is a typed refusal), which makes the contradiction unrepresentable rather than detected and makes `cargo fmt` a no-op on it by definition -- the §5 construction move, and the general lesson is that any artifact with two consumers that normalize it must be stored in the normalizer's fixed point or the two consumers cannot both be satisfied.  This clause previously read that the fixed point and its closure both survived with only their job removed; that was true when written and the regen cut falsified its first half, so it is rewritten here rather than annotated — a second sentence beside it would be two accounts of one fact; and parse remains grammar-owned — `ingest_yaml_source` (`dag/extdeps/languages/yaml/ingest.dag`), no shell or host parser — which was never a floor fact at all and is restated here so that dropping the bullet does not drop it. **TWO OPERATOR RULINGS ALSO LIVED IN THE REPLACED BULLET AND STILL HOLD**, restated because a ruling about what CI does *not* do is invisible once the paragraph describing CI is rewritten, and nothing in the new mechanism would contradict it loudly: the Rust test suite was removed from CI 2026-07-11 (operator ruling, recorded at `gunbc.commit_workflow` `commit_gate_rust_suite_removed_disposition`) and runs locally only; and clippy was removed from CI 2026-07-08, because a crate-wide `#![allow(clippy::all)]` made it zero-signal over ~44 minutes per run, leaving it a local dev check. Neither is reinstated by the replacement, and neither is the floor cut's to reverse."),
+      li(text: "CI — **RUNG DROP, DECLARED (2026-08-15, the floor cut).** WHAT WAS HERE: one composed floor pass, `claim_executor` with a `--plan-entry` naming `src/v2/workflow/ci_floor_plan.dag`, a v2 scheduler deciding batches from `gunbc.ci_spec`, a compile-clean gate ordered ahead of everything else, per-PR discovery over `CiSpec.discovery_scan_dirs`, and a 4-hourly `affected-set-falsifier` cadence carrying the whole-tree cold controls. **ALL OF IT IS DELETED** — the workflows (`ci.yml`, `falsifier.yml`, `falsifier-alert.yml`), their `.dag` authorities, and ~30 witness modules. This paragraph previously recited that invocation in the present tense; it was false the moment the cut landed, and a knowingly-false recital in the canonical authority is premise contamination — every session reading it plans against a command that does not exist. WHAT RUNS NOW: one emission, `gunbc.witness_floor_workflow` → `.github/workflows/witnesses.yml`, invoking our own binary once PER LANE — `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` and `... --required-lane witnesses`, in TWO PARALLEL JOBS (the 2026-08-25 split described below; the invocation named `--required-floor` until the 2026-08-20 consolidation, also described below, and that flag still exists and still runs the fold alone, it is simply no longer what CI calls) — whose floor phase folds every discovered witness through one prepared subject via `v1_compiler.cli_run` `run_required_floor`, whose admission, cost-line and preparation-safety policy is owned by `v2.workflow.required_floor` (this clause named that module as the symbol home until 2026-08-26; the module is real and the symbol does not resolve there, which is exactly the §3 defect the `--required-cited-symbol` census would have refused before its 2026-08-23 drop). No plan entry, no plan function, no batch id, no worker role, no selection flag: the fold has no such concepts to configure — which PRESERVES the 2026-08-13 operator directive that no SELECTION shrinks the roster, by construction rather than by a flag someone must remember to set. **That directive is about selection, and an earlier revision of this clause stated it as `the whole discovered roster runs unshrunk`, which is false of the DISCOVERED roster and true only of the ROUTED one.** Measured on main run `32553487573` (`967b5bc1b92`, 2026-08-22T05:06Z): `offered=11812 routed=10439 declined_long=543 declined_live=830`. 1373 discovered sites — 11.6% — are declined by HOME POLICY before the fold sees them, so `planned` is the routed roster and never the discovered one. The floor's own line is honest about this (`every discovered site is exactly one of these`); only this document overclaimed, and the overclaim is the load-bearing kind, because a reader who takes `the whole discovered roster runs` literally will conclude that authoring a witness is sufficient for it to execute. It is not: a witness under a long or live home is discovered, counted, and never run. The decline mechanism is not a selection flag and the directive is not violated by it — the two are different questions, and conflating them is what made one true sentence and one false sentence read as the same claim. That directive's own carrier (`corpus_selection_off_note`) died with the floor; `gunbc.ci_spec` retains the history and now points here. **THE FOLD NOW EXECUTES, measured 2026-08-19.** Green on main, the latest measured `32553487573` (`967b5bc1b92`, 2026-08-22T05:06Z): `planned=10439 executed=10439 terminal=10439 passed=10132 known_red_held=206 failed=0 stale_quarantine=0 route_gap_held=101 over_cost_line_diagnostic=35`, ~30 min wall. The counts previously cited here were run `32515441229` of 2026-08-21 (`offered=11615 routed=10253 … passed=9946`) and had gone stale by 197 offered sites in under twelve hours; they are replaced rather than annotated, because two count sets in one clause is two accounts of one fact. That this clause has now been re-pointed twice in three days is itself the measurement: a transcribed receipt line is a *positional* citation of a run's output — §3's rule reaches it, since no edit here invalidates it and it rots anyway — so the standing question is now DECIDED (operator ruling, 2026-08-24): **name the instrument, never transcribe its output.** A measurement is cited by naming the producer that re-derives it — the run, the flag, the committed script — and never by copying its numbers into prose, exactly as §3 requires a citation to name a symbol rather than a line, and for the same reason: a transcribed number is unreachable from the thing that owns it, so it rots without anyone touching either end. The counters above are retained under that rule as a declared exception with their producing run named, because this clause's subject IS the rung drop and a drop is unreadable without the magnitude it dropped by; every other transcription in the corpus is debt. The ruling was priced, not preferred: the parallel measurement corpus it governs was BANKRUPTED the same day — `docs/probes/` deleted whole, 195 files and 50,601 lines, boards and captures and instruments alike, leaving NO `.sh` or `.py` anywhere in the repository outside `.githooks` — after a board asserting a compiler mechanism as a live defect was found to have merged EIGHT SECONDS after the commit that fixed it, and to have named the emitter carrier when the actual repair was two lines in the model. A lane had already selected that mechanism as its next work on the board's authority. **THE INSTRUMENTS WENT WITH THE PROSE, and the reason decides what the rule means (operator ruling, 2026-08-24): an ad-hoc `.sh` or `.py` in this repository is §6 UNMODELED REALIZATION — raw shell implementing semantics already expressible in `.dag` — so if a measurement is worth re-deriving it is worth an entry point, and if it is not worth an entry point it is not an instrument but a one-off.** This was ruled against a live objection, recorded because the objection was correct on its own facts and still lost: a peer had re-run `curated_cargo_probe_one.sh` that same hour to re-derive the emission board's headline from source, so the scripts had real consumers — LANES, which a census of `.dag` consumers cannot see, and which is why an earlier revision of this clause reported them as dead. The ruling does not deny that consumer; it denies that a stray script is the right carrier for it. So `name the instrument` names a `.dag` entry point, and the rule needs no exception for a referent it deleted: what is deleted is everything that cannot be re-derived from the tree, and what re-derives it is modeled or it does not exist. That is the §2 cost of a second representation with no authority, arriving faster than it can be authored, and it is why a measurement document is presumed redundant rather than merely stale. WHAT THIS DOES NOT CLAIM: the cut leaves a named residue it does not repair — gitignore un-ignore rows for deleted paths, prose notes across ~20 modules citing them, and the witnesses above, all still green over dead names. That residue is the next cut, not a gap this one closed. **`executed` answers a narrower question than every reader asks of it: it counts a witness reaching the fold, not its assertion running.** A witness whose subject is a subprocess exit status is planned, discovered, and counted `executed` while it is REFUSED BY CONSTRUCTION at the hermetic boundary — `run_required_floor`'s hermetic envelope rejects the host effect via `shell.Test.IsExecutable` before the subprocess is reached, in about a millisecond, which also rules out a budget refusal on timing. This is CORRECT, not a gap: mocking that refusal to let such a witness run would pass it against a fabricated exit status, the exact fabricated-plausible-output failure the witness exists to catch. It is a boundary of what the hermetic floor can cover, named here beside the counters rather than left for a reader to rediscover. This clause previously read that no witness had executed and that the fold refused during preparation; that was true when written and is now false, and it is corrected in place rather than left standing until the rest of the paragraph can be rewritten — because a knowingly-false recital is premise contamination whichever direction it points, and this one had already cost real work: a session measuring the TestClaim orphan population read it, concluded the floor had never run, and raised a sequencing question about roster growth that does not exist. The rung drop below is unaffected: the fold running green establishes that the replacement executes, not that the re-add queue has closed. WHAT IS UNGUARDED IN THE MEANTIME, named rather than left to be rediscovered: the generated-artifact drift gates, heal, the seven effect gates, the fmt gate, merge-admission stamping, the falsifier cadence, and the per-witness eval deadline that `gunbc_ci_fast_lane_witness_eval_budget` used to arm (`gunbc.witness_row_cost` `gunbc_ci_fast_lane_rule_note` carries that one's own drop). Each is a separate re-add, each re-derived from its own first principles under its own operator agreement rather than restored from the deleted machinery. RESTORATION TRIGGER: this paragraph is rewritten as an ordinary present-tense description — not amended, rewritten in one pass — when the re-add queue closes. Until then it describes a rung drop, and describing the replacement as finished would be the inflation §4b names as worse than sitting low. **WHAT SURVIVES UNTOUCHED, enumerated rather than swept away with the bullet** — this paragraph replaced a longer one, and a prose row is deleted for one reason and takes everything in it unless its contents are enumerated first (the same rule that governs deleting a witness file whole): the compile-clean scope authority `tools.dag_compile_clean_scope` and its import-closure selection (`entry_file_touched_via_import_closure`) are live and unmodified by the cut — but **live is not reachable, and an earlier revision of this clause said only the first**. It read that what is gone is the CI *job* that invoked them and not the authority; both halves are true and together they license a false inference, because SURVIVING A CUT AND BEING CALLABLE ARE DIFFERENT PROPERTIES and only the first was checked. Measured 2026-08-20: `entry_file_touched_via_import_closure` and `compile_clean_scope_plan_for_ci` are private `fn`s with ZERO references anywhere under `src/v1/stage0/src/bin`, no CLI flag reaches them, and the only `pub` surfaces into that chain — `witness_layer_roots_compile_clean_check` / `_emit_check` — return `Bool`, so they answer *is it clean* and can never answer *which entries would be selected*. A reader planning against the old sentence would budget an afternoon and find no caller; that is premise contamination of the same class this paragraph already corrects itself for twice. The authority survives and the capability does not, until something exposes a counting entry point; the `regen_input_sources` import closure survives and is now read by `v1_compiler.required_regen_host` — but the `regen_stage0` binary that consumed it, and the `RegenVerifyGate` / `SelfHostStalenessGate` pair that invoked it, are DELETED at the root (the regen cut), so the self-host fixed point is answered by `claim_executor --required-regen-fixed-point` and by nothing else. **THAT FLAG IS INVOKED AGAIN AS OF 2026-08-20**, so this is one re-add off the queue below rather than a standing gap. It was re-added as two `witnesses.yml` steps ordered ahead of the floor and CONSOLIDATED the same day (operator directive: the phases belong `within the witnesses step and within the gunbc binary, not at a github actions job level`) into ONE step running the phases in ONE process. **THAT 2026-08-20 DIRECTIVE IS NOW PARTLY SUPERSEDED, BY THE SAME OPERATOR, ON 2026-08-25** — `we can add it as a parallel job in github actions - we can do the same for regen now, we have more runners` / `basically i would put regen + v2 full compile in one job, and witnesses into another one`. The stated reason is a change in supply, not a change of mind about the earlier argument: the phases are mutually independent, so composing them into one process made the required check's wall clock a SUM of things that could have been a MAX, and more runners make the MAX purchasable. **THE DIRECTIVE HAS TWO HALVES AND ONLY ONE IS SUPERSEDED, which is why this clause states both rather than replacing one ruling with another.** SURVIVES — *within the gunbc binary*: the phases still live in `claim_executor`, each job makes ONE invocation and names a LANE, and no step's precondition reads another phase's verdict. The step-ladder defect the consolidation fixed (an `if:` naming a sibling step, silently conjoined with GitHub's implicit `success()`, so a regen red disarmed the whole floor) cannot return, because no step's condition can reach another phase's outcome. SUPERSEDED — *not at a github actions job level*: PARALLELISM IS NOT EXPRESSIBLE IN THE BINARY. Two phases running concurrently means two runners, two checkouts and two toolchains, and one process on one runner can thread but cannot acquire a second machine — nor would we want it to, at the floor's measured ~9.4 GiB peak. So the lane boundary is a job boundary of necessity, and what the directive was protecting against — SEQUENCING and PRECONDITIONS leaking into YAML — is exactly what does not cross it: the two jobs carry no `needs` edge and no condition on each other, which is the whole content of running them in parallel. So the invocation named at the top of this paragraph is superseded three times over and is now, exactly: TWO LANE JOBS, `claim_executor --required-ci --source-root dag --source-root src/v2 --required-lane build` (regen's first-generation comparison, the v2-emission compile, the emitted-closure cargo phase and the partition-crate boundary) and the same command with `--required-lane witnesses` (the `.dag` parse sweep and the witness floor fold), plus a THIRD job that gates on both. **THAT THIRD JOB IS NOT DECORATION AND THE FIRST CUT OF THE SPLIT DID NOT HAVE IT, which is the more useful half of this entry.** A GitHub required status check is produced by the JOB, not by the workflow, and the repository's `passing CI` ruleset is active, carries NO bypass actors, and names exactly ONE required context: `witnesses`. So splitting the phases into a second job made regen and v2-emission NON-BLOCKING -- the required check would have gone green over a regen drift or a v2 emission break and the PR would have been mergeable. That is fail-open (§5), and strictly worse than the serial run it replaced, because the serial job carried every phase into the one context that gates. THE REPAIR IS AN AGGREGATION JOB RATHER THAN A RULESET EDIT: the floor lane is renamed `floor`, and the name `witnesses` moves to a job that `needs` both lanes and whose only step reads both results and exits nonzero unless both are `success`. **THE CONDITION THAT MAKES THAT JOB RUN IS AT THE JOB LEVEL, AND THE FIRST CUT OF THE AGGREGATOR PUT IT ONLY ON THE STEP** -- the same fail-open committed one level in, caught by review 55795 and independently by a peer session within minutes of each other. `needs` carries an implicit job-level condition: a job that declares `needs` and no `if` is SKIPPED when a needed job fails, a skipped job never reaches its steps, and a step-level `always()` cannot rescue a job that never started. The job therefore declares `always()`, and that is the ONE place in the emission that departs from the file's `!cancelled()` house guard, stated here because a reader who knows the convention will otherwise correct it back and reopen the hole. Every other guard decides whether a STEP runs inside a job that is already running; this one decides WHETHER THE REQUIRED CONTEXT EXISTS AT ALL, and under `!cancelled()` a cancelled run leaves it skipped rather than answered. That turns the outcome on a question about GitHub nobody here has executed -- does a skipped or cancelled required check block a merge -- and the right response is not to measure it but to make the answer not matter: under `always()` the job always runs, always reads both results, and always reports on its own terms, so SKIPPED disappears from the required context. Construction over validation (§5), at the cost that a lawfully superseded run now reports this context red rather than cancelled, which is the correct reading rather than a regression. The two lane jobs still carry no `needs` edge on each other and still start together; only the aggregator waits. A ruleset edit would have worked too and was rejected on a boundary this document recorded at the time: the ruleset was not a `.dag` fact, so landing a change whose safety depends on someone editing a setting afterwards is a coverage gap with a promise attached and a real unguarded window. **THAT BOUNDARY MOVED, AND THE DECISION IT SUPPORTED DOES NOT.** `gunbc.repo_ruleset` now declares the desired ruleset -- enforcement, target, ref-name condition, the three rules, and the ONE required context, imported from `gunbc.witness_floor_workflow` `witness_floor_workflow_job_id` rather than spelled a second time -- observes the live one through `extdeps.github.rulesets`, reconciles the context roster through `gunbc.membership_reconcile`, applies drift with the whole-ruleset PUT, and READS BACK, claiming convergence only from the second observation and never from the apply's own 200. So the sentence in this bullet stating what the ruleset requires is no longer the only place that fact lives on our side of the boundary: `converge` actuates it and `verify` refuses on any divergence, with a typed reason per way it can diverge. WHAT DID NOT CHANGE, and why the aggregation job stays: convergence is an ACTUATION WITH A READ-BACK, not a wall. Nothing in this repository can constrain what GitHub admits to main, so an in-repo authority still cannot make a required context exist at the moment a merge is attempted -- it can only declare, apply and detect. The first cut's window argument therefore stands on its own terms; what is closed is the invisibility, not the boundary. WHAT IS NOT CLAIMED: NEITHER ENTRY POINT IS ENROLLED IN CI. `verify` is a route somebody runs, and until a required phase invokes it the class sits at *mitigatable* -- a drift is now detectable rather than detected, which is a real climb from unobservable and is not the same as a gate. Its next-rung trigger is that enrolment, which is a separate change under its own operator agreement. Found in review of gunbc#9203, against the live ruleset rather than against the workflow -- which is the only place the fact is visible, since nothing in the emitted YAML says which of its jobs gates. The partition is total by construction — `RequiredCiPhase::lane` is an exhaustive match, so a phase belonging to no job fails to compile rather than going silently unmeasured — and the lane is the ONLY thing the transport names: which phases a lane owns is decided in the binary, never in the YAML. **THE v2-EMISSION PHASE'S SUBJECT WIDENED IN THE SAME CHANGE**, from `dag/std/abi.dag` (the smallest entry in the tree) to `src/v2/compiler/00_compile.dag` (the v2 pipeline root, the widest closure one entry names). The row is `gunbc.ci_layer_roots` `required_v2_emission_entries` and it remains a cost decision rather than a Rust edit; what changed is the denominator, since the build lane's cost is now free up to the floor's duration rather than added to it. **WHAT THE SPLIT DOES NOT DO:** it restores nothing else from the deleted floor machinery — every item on the unguarded list above is still its own re-add under its own operator agreement — and it lands NO ratchet over the v2 compile's advisory-diagnostic population. That population is real and is the natural next subject, but a merge-blocking count pinned to a number measured on the current tree is exactly the oracle §5 forbids; an identity-grain monotone debt contract is a separate construction and is not claimed here. **THE PARSE PHASE STOPPED BEING src/v1-ONLY, 2026-08-23**, and it is stated here because the previous revision named the phase by the one root it walked. It now sweeps `src/v1`, `dag` and `src/v2` from one roster (`v1_compiler.cli_run` `DAG_PARSE_SWEEP_ROOTS`), shared with the standalone bin, and it admits source annotations per file rather than parsing alone -- `tokenize` routes `//` into the annotation channel and `parse` never decides grain, so the old walk returned clean for a file carrying an in-body annotation and the §4c refusal surfaced only at the floor's strict PREPARATION, where no witness executes at all. That is not a widening of the floor's source roots, which `gunbc.ci_layer_roots` `v1_dead_witness_tree_triage_receipt_remainder` rules out on NAME RESOLUTION grounds: this walk resolves nothing across files, so that objection cannot reach it. **THE PHASE ROSTER WAS CUT TO THREE BY OPERATOR RULING, 2026-08-21, WAS FOUR AGAIN AS OF #9035, AND IS FIVE AS OF THE PARTITION-CRATE PHASE, AND IS SIX AS OF THE EMIT-COMPILE PHASE.** The count is stated in the present tense here and it has now been wrong in BOTH directions, which is the reason it is written as a measurement rather than as a recollection: an earlier revision said four while enumerating a determinism pass no required run performed, that was corrected to three, and the three then went stale when #9035 enrolled a v2-emission phase that compiles one v2 entry — landed precisely because an emission break reached main and no gate could see it. The instrument is the required mode itself, which prints its own roster before any phase runs -- one `phase <name>` line per phase the lane owns and one `ROUTED to lane <other>` line per phase it does not, then `lane=<name> phases_run=<its own count>`. Read the roster from that announcement rather than from this sentence: the count moved twice in five days, and a transcribed roster size is exactly the positional citation the ruling above forbids. The fifth phase is `partition-crates`, in the build lane, which compares the derived stage0 partition's committed `lib.rs` and `Cargo.toml` against what `v1.compiler.stage0_crates` renders from the authority -- landed because those seven crates are workspace members nothing in CI builds, so a broken one sat on main while every required lane stayed green. **THAT COUNT IS NOW A PROPERTY OF THE ROSTER AND NOT OF A RUN**, because the 2026-08-25 split partitions the four across two jobs: a lane's own summary line reports `lane=<name> phases_run=<its own count>`, and each job additionally prints a `ROUTED to lane <other>` line for every phase it does not own, so one job's log still names the whole roster and where the rest is being measured. Reading a single job's `phases_run` as the roster size is the error that line exists to prevent. The five phases the 2026-08-21 ruling deleted stay deleted and are enumerated below; neither #9035 nor the partition-crate phase restored any of them, each added a new one, so both are roster ADDITIONS and not a reversal of that ruling. Five phases were deleted from the mode: merge-admission-capture, the regen determinism (fixed-point) pass and its in-memory pass-1 digest handoff, the behavioral receipt's controlled-fixture selftest, the behavioral receipt against the authorities a diff changed, and merge-admission-stamp. They were deleted rather than left reporting SKIPPED, because a phase whose only reachable state is a non-verdict has a deficit frequency of zero by construction and still reads as coverage on the ledger (§5, the absorbing fallback). The capabilities survive at their own entry points — `--required-regen-fixed-point`, `//gunbc/instruments:behavioral-receipt-plan`, `//gunbc/instruments:behavioral-receipt-selftest`, `//gunbc/instruments:behavioral-receipt-census` — none of which any workflow invokes; what ended is their enrolment in the required run, and the three measurements they carried (regen determinism, behavioural equivalence of a changed authority against its mirror, and the receipt's own discriminating arms) are simply no longer taken. That is a declared scope narrowing, and it returns merge-admission stamping to the unguarded list above rather than removing it from it. The remaining three phases are independent — the one real data dependency left with the phase that consumed it — so every phase runs even after an earlier failure and the run reports the complete ledger instead of letting the first defect hide the rest. The line still stops on any failed phase. It is recorded here with what made the gap real, because the steps were enrolled, STRIPPED, and re-enrolled inside twelve hours and a reader who finds only the enrolment will re-derive the strip. The strip was correct when made: the admission test is whether every red is closable by the author who caused it at the moment they caused it, and it was not -- the comparator normalized BOTH sides through rustfmt while writing the single-pass form, so after any candidate install the comparison was `normalize(normalize(emitted))` against `normalize(emitted)`, an identity only if rustfmt is idempotent. It is not, so the gate refused a tree byte-identical to its own artifact, permanently, and its only reachable green was the hand-edited mirror the gate exists to refuse -- a gate whose sole closing move is the forbidden action is not strict, it launders. Repairing it by raw-comparing the single-pass bytes then put it in direct contradiction with `cargo fmt --all --check`, which re-formats what is committed and so demands the NEXT pass: two gates consuming different passes of one artifact, each breaking the other. The resolution is that the emitted artifact is now written as a FIXED POINT of the formatter (bounded, exceeding the bound is a typed refusal), which makes the contradiction unrepresentable rather than detected and makes `cargo fmt` a no-op on it by definition -- the §5 construction move, and the general lesson is that any artifact with two consumers that normalize it must be stored in the normalizer's fixed point or the two consumers cannot both be satisfied.  This clause previously read that the fixed point and its closure both survived with only their job removed; that was true when written and the regen cut falsified its first half, so it is rewritten here rather than annotated — a second sentence beside it would be two accounts of one fact; and parse remains grammar-owned — `ingest_yaml_source` (`dag/extdeps/languages/yaml/ingest.dag`), no shell or host parser — which was never a floor fact at all and is restated here so that dropping the bullet does not drop it. **TWO OPERATOR RULINGS ALSO LIVED IN THE REPLACED BULLET AND STILL HOLD**, restated because a ruling about what CI does *not* do is invisible once the paragraph describing CI is rewritten, and nothing in the new mechanism would contradict it loudly: the Rust test suite was removed from CI 2026-07-11 (operator ruling, recorded at `gunbc.commit_workflow` `commit_gate_rust_suite_removed_disposition`) and runs locally only; and clippy was removed from CI 2026-07-08, because a crate-wide `#![allow(clippy::all)]` made it zero-signal over ~44 minutes per run, leaving it a local dev check. Neither is reinstated by the replacement, and neither is the floor cut's to reverse."),
       li(text: "**THE MEASUREMENT BANKRUPTCY DELETED A CAPABILITY, NOT ONLY ARTIFACTS, AND THIS ROW IS THAT DECLARATION (2026-08-24).** The bankruptcy above removed `docs/probes/` whole. Deleting the boards removes TRANSCRIPTIONS, which is the point; deleting the instruments removes a ROUTE, which is a different fact and is the one §4b(3) obliges a cut to declare. WHAT IS GONE: the only executable route to a self-host emission board measurement. PREVIOUS STATE — any lane could re-derive a per-entry board by running the committed probe script, last exercised 2026-08-24 against the then-current main, and that reading is what answered the operator when they asked what the emission trajectory was doing. TEMPORARY STATE — no route exists; the emission trajectory is not measurable from the tree, and a board figure quoted from here on names nothing that can produce it. BOUNDED POPULATION: one capability, the per-entry emission board. RESTORATION TRIGGER: a `.dag` entry point that emits, assembles and compiles one entry and returns the coded-diagnostic population, cited by name wherever a board figure is quoted — at which point the same figures become legitimate again unchanged, because the rule forbids transcribing output INSTEAD OF naming an instrument, and the defect today is that there is no instrument to name. **WHY THIS ROW EXISTS AT ALL, and it is the same reason the regen row beneath it does:** no dependent could refuse. The corpus contains nothing that breaks when the board becomes unmeasurable, because the consumers are LANES rather than modules — the identical blind spot that made a `.dag`-consumer census report the instruments as dead a few hours before this cut. So delete-first's census, which is normally the thing that surfaces a load-bearing deletion loudly, is structurally silent here, and a declared row is the only mechanism left.  **THE TRIGGER HAS FIRED, AND THE ROW STAYS RATHER THAN RETIRING ON ITS AUTHOR'S SAY-SO.** The instrument is `tools.emission_entry_instrument` `measure_entry_emission`, invoked as `gunbc run --source-root dag --source-root src/v2 --entry dag/tools/emission_entry_instrument.dag --function measure --arg entry=<repo-relative .dag path> --arg report=<path>`. It runs the same spine the deleted probe script ran — emit one entry's closure, assemble it with `cssl_assemble`, build the assembled crate under cargo's JSON message format — and returns a TYPED measurement rather than a row of text: the emit-stage population from `gunbc.emit_diagnostic_observation` and the rustc coded-diagnostic population from `extdeps.cargo_diagnostic`, each member carrying its own identity and location, so two runs can be JOINED rather than only differenced. **WHAT THE CARRIER FIXES THAT THE SCRIPT DID NOT:** `EmissionMeasurement` has no spelling in which a stage that never ran renders as a stage that ran and found nothing — an unreached stage is its own variant naming the stage — and the emit decode REFUSES when the population it recovered disagrees with the compiler's own declared total, so an unrecognised diagnostic shape stops the line instead of quietly shrinking the answer. That is the execution-provenance-loss row applied to the instrument that most needed it. **WHAT IS NOT CLAIMED.** It is a measurement route and NOT a gate: no workflow invokes it, no phase enrols it, and its exit status reports whether the INSTRUMENT completed, never whether the subject was clean. The whole-corpus route is still refused by `gunbc.whole_corpus_compile_admission` and this does not change that; it is the per-entry route that module's own scope note says fits. Every other clause of the bankruptcy above stands unchanged, including that a figure copied into prose is debt whether or not a producer exists for it.")
       li(text: "**THE REGEN CUT DELETED A PRODUCER ALONG WITH ITS BINARY, DECLARED NOTHING, AND THIS ROW IS THAT DECLARATION (2026-08-20).** It sits beside the CI entry above rather than inside it, because the two are different facts on different clocks — that paragraph narrates what the floor and regen cuts removed, this row declares one capability the regen cut removed in silence — and because a declaration wedged into the repository's most-edited paragraph collides with every unrelated edit to it (three merge conflicts in two hours, each one re-resolving prose neither side had touched). The regen cut re-derived the deleted binary's VERIFIER half — `claim_executor --required-regen`, which compares the committed stage0 mirror against a fresh emit — and did not re-derive its PRODUCER half: writing the emitted tree to disk unconditionally, whatever the comparison then says about it. `run_required_regen` did write a candidate tree, but only on the path where the emitted and committed populations already agreed; every refusal arm returned ahead of the write. The one population asymmetry an author can actually cause is adding a module to the v1 seed closure — its mirror is emitted-not-committed by construction on the first commit that introduces it — so from the cut until this entry, that change refused while naming a file no sanctioned route in the repository produced, and its only reachable green was a hand-authored mirror. That is the same laundering the fixed-point repair above closed one gate over, arrived at from the other direction: there, the gate's only closing move was forbidden; here, the gate's only closing move did not exist. WHAT THE RUNG DROP IS, stated at the honest grain: the class is not a compiler guarantee that fell a rung, it is an OPERATION that lost its only route, so it sat outside the ladder entirely — nothing to mitigate, because nothing could be attempted. Naming it as a declared drop rather than a defect is the point of the entry: the regen cut owed one under §4b(3) and filed none, and a capability deleted in silence is exactly what §3's delete-first doctrine says the census is supposed to surface loudly. It did not surface because no dependent could refuse — the author who needed the producer was outside the tree. THE RESTORATION, and its rung: production now precedes adjudication. `v2.workflow.required_regen` `required_regen_run` is the authority, and it holds the ordering by construction rather than by check — every arm that reports a verdict carries the `CandidateTree` the verdict was computed against, so refused-with-no-tree has no spelling once emit succeeded, and the one tree-less arm is reachable only where emit produced nothing at all (*structurally guaranteed*, §4b). The host `v1_compiler.required_regen_host` `run_required_regen` mirrors that ordering by hand and is therefore only *mitigatable*; its next-rung trigger is the host being derived from the carrier rather than written beside it. The gate did not weaken: it refuses the same populations with the same typed causes, and the refusal now names the directory holding the first mirror the author must install."),
       li(text: "**THE CITED-SYMBOL CENSUS IS NO LONGER A REQUIRED CHECK, AND THIS ROW DECLARES THE RUNG IT DROPS (2026-08-23).** It sits beside the CI entry above rather than inside it, for the reason the regen row already gives: that paragraph narrates the floor and regen cuts, this is a third drop on its own clock, and a declaration wedged into the repository's most-edited prose collides with every unrelated edit to it. WHAT WAS HERE: a second `witnesses.yml` job, `cited-symbol`, running `claim_executor --required-cited-symbol --source-root dag --source-root src/v2` and stopping the line when any authored `DeclarationRef` named a symbol that does not resolve — the executing half of §3's cite-the-symbol-not-the-position rule. **IT IS DELETED** — the job, its command authority (`gunbc.fabric_witness_run` `cited_symbol_run_command`), the job row and capability wiring in `gunbc.witness_floor_workflow`, and the closure witness that covered it. REASON: operator directive, 2026-08-23. This is not a defect finding and the mechanism was not failing; it was executing and green, and the directive is that it does not belong in CI as a separate corpus-wide job. PREVIOUS RUNG: *mechanically preventable* — a real wall, armed on every push, measured green at `checked=390` on run `32664434197` (`f49886339a5`, 2026-08-23T20:26Z). TEMPORARY RUNG: *mitigatable* — the rule survives as review diligence, which is strictly weaker in the exact way §6 already records for the deleted inert-lens census: a newly authored citation naming a symbol that does not exist is writable again, and nothing detects it. MEASURED POPULATION AT THE CUT: 390 authored references, on the last green run of the job. FUTURE EXPOSURE, STATED AS A SECOND FACT BECAUSE JOINING THE TWO IS THE DENOMINATOR ERROR THIS DOCUMENT KEEPS FINDING: unbounded. Nothing counts a citation authored after the cut and nothing refuses one, so §4b(3)'s BOUNDED-POPULATION REQUIREMENT IS NOT SATISFIED HERE, and this row does not pretend otherwise — the drop is an operator-approved exception to that clause rather than an instance of it, and saying so is the whole point of writing the row down. An earlier revision of this row read *the 390 references, plus every citation authored after it* and called that the bounded population; an exact measurement joined to an open future set is not bounded, and calling it so is the same move §5 forbids when a count copied from the current tree is asked to serve as an oracle. The measured half also rots the way §3 says positional citations do: it is the population's size AT THE MOMENT OF THE DROP, never a standing figure. WHAT WAS NOT CLAIMED WHILE THE DROP STOOD: the capability survived at its own entry point — `--required-cited-symbol` was still a flag on `claim_executor` — but a mode no workflow invokes guards nothing, and calling the surviving flag a mitigation would have been exactly the inflation §4b(1) forbids. **THE RESTORATION TRIGGER FIRED ON 2026-08-25 AND THIS ROW IS RETIRED AS A DROP, WITH ITS EXPOSURE CLOSED RATHER THAN RE-DECLARED.** The trigger read: this row retires when the citation wall is re-derived where the operator's own framing puts it — *you would just make them a normal compiler error* — checked at ingestion, on the module whose source carries the citation, from that module's own text, rather than reconstructed corpus-wide by a second job; and it named §6's module-authorship trigger as the same rung, to be landed together rather than each rebuilding a corpus walk. Both landed on one construction, `v1_compiler.declaration_index`, inside the `parse` phase of `claim_executor --required-ci`: the sweep that already parses every authored module now derives one record per module and resolves every authored `DeclarationRef` against it by keyed lookup. `--required-cited-symbol` is DELETED with the same change, so there is one route and not two. RUNG: back to *mechanically preventable*, and STRICTLY WIDER than what was dropped — the enrolled population is every authored citation in a non-fixture module (measured 1441 authored, 161 in fixture carriers, 79 naming namespaces no `.dag` module declares), not the five carriers the deleted lens's population named, and test modules are INDEXED, so the outside-index disposition those exclusions forced is not needed. WHAT THE FIRST EXECUTION FOUND, because a wall that lands green over a corpus nobody checked for two days would be the more suspicious result: 46 sites over 38 distinct targets, every one a citation naming a declaration that does not exist — the exact class this rule names, accumulated in the unguarded window this row declared unbounded. They are NOT repaired here and NOT silently excluded: they are enumerated at identity grain in `PRE_EXISTING_CITATION_DEBT` as a §5 monotone debt contract whose universe is discovered by the index itself and whose rows REFUSE once their citation stops refusing, so the roster can only shrink. WHAT IS STILL OPEN, stated so this retirement is not read as wider than it is: `v2.lens.cited_symbol_resolution` is DELETED as of 2026-08-26, and the disposition was three-way rather than the two this row admitted. The count was stale on arrival — sixteen was the file's size at #7707 and it had grown to 27 `test fn` identities by the time this sentence was written — and \"dead\" was true of the lens and false of a third of its witnesses. Measured against the seven symbols that file imported FROM the lens, only 6 of the 27 touch one; those 6 died with it. Six more call `resolve_declaration_ref`, which lives in `v2.std.decl_ref_resolution` and SURVIVES with four other consumers, so they are the only executing evidence for a live authority's five-arm refusal and §4b(4) rehomed them to `test.claim.long.decl_ref_resolution_witness_test` rather than deleting them with the machinery that climbed. The remaining 15 are population and projection claims about the carriers that PROJECT `DeclarationRef`s and moved to `test.claim.long.carrier_reference_integrity_witness_test`. What the corpus-wide census subsumes is TYPED-LITERAL citations specifically — `DeclarationRef` record literals and the `decl_ref`/`decl_field_ref` constructors — not \"citations\" in general; a prose reference inside a `String` is covered by nothing, before or after. The per-PR witness that survives was renamed `test.claim.doc_graph_reference_partition_witness_test`, because its subject is a bucket partition over `gunbc.doc_graph_roots` and never was resolution, and under the old name it would have been the only cited-symbol-named thing left in the tree — a misreading two readers made independently from exactly that surface; and the wall is host Rust rather than a modeled ingestion operation, declared as seed growth in `gunbc.declaration_index_seed_growth`."),
-      li(text: "**A BLOCKING EMIT-STAGE DIAGNOSTIC CAN SIT ON MAIN INDEFINITELY WITH NO REQUIRED PHASE THAT FAILS, AND THIS ROW DECLARES THAT RUNG (2026-08-25).** It sits beside the CI entry above for the reason the regen and cited-symbol rows already give: that paragraph narrates the floor and regen cuts, this is a fourth drop on its own clock, and a declaration wedged into the repository's most-edited prose collides with every unrelated edit to it. **THE CLASS IS NOT ONE OPERATION.** It is any BLOCKING diagnostic produced at the EMIT stage, and the escape surface is Rust-target emission specifically: `v1.05_emit` `file_binding_refusal` returns a `FileEmissionRefusal`, and `file_emission_target_is_modeled` answers `Rust => true` with Python, Go and Dag all false, so the refusal exists only on the path that emits Rust. A parse phase cannot reach it and a typecheck cannot reach it; only a phase that EMITS over a closure containing the offending CALL SITE can. **HALF OF THIS IS ALREADY ON THE RECORD AND IS NOT CLAIMED AS NEW.** The CI entry above already declares, measured 2026-08-20, that `entry_file_touched_via_import_closure` and `compile_clean_scope_plan_for_ci` have zero references under `src/v1/stage0/src/bin`, that no CLI flag reaches them, and that the only `pub` surfaces into that chain return `Bool` — the authority survives and the capability does not. That is the missing compile capability, and it was declared five days before this row. **WHAT IS NEW IS THE SECOND HALF, AND IT IS WORSE: THE WITNESS FAMILY THAT APPEARS TO COMPENSATE IS ALSO INERT.** Measured on main run `32778026868` (`08488aee2`), nine identities named for compile-clean, and not one of them compiles anything. `compile_clean_shard_a_exemplar_compile_green`, `cross_shard_seam_preservation_holds_on_live_tree`, `perturb_fixture_green_holds`, `perturb_optional_skew_fixture_red_holds` and `perturb_unresolved_import_fixture_red_holds` are all NO-ROUTE — refused at the hermetic boundary, discovered and counted and answering nothing. `dag_compile_clean_scope_witness` and `dag_compile_clean_shard_totality_witness` declare `ReadsLiveTree`, so they are DeclinedLiveTree and never run. `compile_clean_shard_entry_paths_fast_hand_rust_witness` declares no disposition at all, so the fail-closed default makes it ReadsLiveTree and it is declined too. The single member that PASSES is `dag_compile_clean_cli_floor_agreement`, and it is `SubstrateInputsOnly`: it checks that two realizations AGREE ABOUT A POLICY ROW, never that anything is clean. **AND THE COVERAGE WOULD NOT HAVE HELPED EVEN HAD IT ROUTED**, which is what makes the pair a stronger claim than either half: `tools.dag_compile_clean_shard_transport` `shard_a_exemplar_entry_path` is `dag/std/logic.dag`. At full strength the family compiles ONE MODULE. So a reader counting witnesses named compile-clean concludes the corpus is compile-checked, and the corpus is not compile-checked and would not have been. That is §4b's worse-than-absent decoration, arrived at not by a check whose RED is unauthorable but by a family whose every member is routed away from its subject. PREVIOUS RUNG: *mechanically preventable* — the compile-clean gate ran ahead of everything else in the required run until the 2026-08-15 floor cut deleted it. TEMPORARY RUNG: **outside the ladder, not mitigatable.** This is the shape the regen row names: an operation that lost its only route has nothing to mitigate, because nothing can be attempted. Review diligence is not a fallback here in the way it is for the cited-symbol drop — a reviewer reads a diff and does not run an emitter, so no human process substitutes for the missing phase. **POPULATION: UNCOUNTED AND UNBOUNDED.** §4b(3) requires a bounded population and this row does not have one and does not pretend to. Two specimens are named below, escaping by three distinct modes; how many other blocking diagnostics stand on main today is unmeasured, and it is unmeasured by a deliberate scope decision rather than because the census is hard — the finding is the missing phase, and a specimen count would have been mistaken for the bound. Anyone who takes the named specimens as the population has made the denominator error this document keeps recording. **AND THIS ROW CLAIMS NO OPERATOR APPROVAL FOR THAT, WHICH IS WHERE IT DIFFERS FROM THE CITED-SYMBOL ROW ABOVE AND MUST NOT BE READ AS MATCHING IT.** That row's unbounded exposure is an operator-approved exception to §4b(3); this row's is simply an unmet requirement, declared as unmet. The distinction is the difference between a clause someone with the authority to waive it waived, and a clause this row does not satisfy — and reading the second as the first would manufacture an approval nobody gave, which is the authority-substitution failure this document names. THE NAMED SPECIMEN, WITH ITS PROVENANCE STATED HONESTLY BECAUSE THE TWO HALVES WERE MEASURED BY DIFFERENT PEOPLE ON DIFFERENT INSTRUMENTS: `extdeps.cloud.gcp.gcp` `ReadADC` DECLARED three structured output keys — `client_id`, `client_secret`, `refresh_token` — over a `transport file` that carries bytes, with nothing stating how a JSON document became those fields, and the compiler said so (`file transport output key client_id has no modeled channel`). **THAT SPECIMEN IS REPAIRED AS OF 2026-08-25 AND THE OPERATION NO LONGER EXISTS**, repaired ALONG THE LINE THIS ROW PRESCRIBED: `extdeps.cloud.gcp.adc_document` reads the document and decodes it through `extdeps.languages.json.parse`, so the read-then-decode seam this row ruled for is the seam that landed, and the `Secret`/`String` distinction a bytes channel could not carry is carried by a typed record. A row whose prescribed fix was implemented is evidence the prescription was right. The specimen is kept in the past tense rather than deleted because the CLASS claim below does not depend on it — and because nothing re-derives this sentence, which is why it stood stale until a session tripped over it. It was found cold and measured as the SOLE blocking diagnostic of a whole-census entry compile at `63501ff7e0`, from `--entry dag/gunbc/systemctl_show_read.dag` — a measurement this row's author did not take and does not restate as their own. **A SECOND COMPILE FROM A DIFFERENT ENTRY IS NOT A FAILED REPRODUCTION OF IT, AND THE DIFFERENCE IS THE CLASS DEFINITION DOING WORK.** Compiling `gunbc.auth.credentials` — the module that CONTAINS the call site — as its own entry refuses earlier, at typecheck, with four unrelated hard diagnostics, so that compile never reaches the stage where the channel refusal is produced. Nothing is contradicted: the two entries have different closures and stop at different phases. What the pair establishes is sharper than either alone — **the refusal is reachable from an entry whose closure INCLUDES the call site and unreachable from the file that HOLDS it**, so an emit-stage diagnostic is a property of a CLOSURE, not of a file. A per-file or per-module check would therefore not have caught this either, which is why the restoration trigger below names a phase over closures and not a linter. **A SECOND AND INDEPENDENT ESCAPE MODE, FOUND BY ACCIDENT WHILE MEASURING THE FIRST.** Those four typecheck diagnostics are not an incidental specimen of the same route — they escape a different way. `gunbc.auth.credentials` has ZERO IMPORT EDGES anywhere in `dag/` or `src/v2/`: it is an orphan, so no closure reaches it and nothing typechecks it, and its four hard errors (two `undefined variable shell`, two unresolved `AuthPrintAccessToken`) stand on main for a reason that has nothing to do with which phases emit. The first mode is *no required phase emits over this closure*; the second is *no closure reaches this module at all*. **AND A THIRD, WHICH IS THE WORST OF THEM, because it is the only one that misleads a reader rather than merely hiding from a checker.** The orphan is NOT unreferenced: `gunbc.tailscale_acl_phase2_credential` carries two `DeclarationRef` rows naming `gunbc.auth.credentials` as its credential authority — `gcp_secret_credential` and `gcp_oauth_access_token_via_adc_refresh`. So the module is CLAIMED AS AN AUTHORITY by a carrier that depends on it being correct, while no import edge reaches it and nothing typechecks it. An unreferenced orphan misleads nobody; a cited one asserts that a fact has a home, and the home does not compile. **THE THIRD MODE IS WHERE TWO DECLARED DROPS COMPOSE, AND NEITHER ROW ALONE PREDICTS IT.** The cited-symbol row above declares, from 2026-08-23, that nothing checks whether an authored citation resolves; this row declares that nothing emits over the closure a citation names. These two `DeclarationRef` rows were authored into exactly that window. A citation to a module that typechecks nowhere is invisible to both mechanisms at once — the first stopped asking *does this symbol exist*, the second stopped asking *does this module compile* — and the composition is not a complaint about either operator decision, it is what makes the population claim below concrete rather than rhetorical. Neither of the three modes was found by searching. All three were tripped over while measuring something else, which is the strongest available argument that the population below is not two or three. ONE MEASUREMENT THAT CORRECTS THE OBVIOUS ASSUMPTION, recorded so the next reader does not repeat it: compiling `extdeps/cloud/gcp/gcp.dag` AS AN ENTRY returns **0 blocking, 79 advisory**. The declaration alone does not refuse. The operation looks self-evidently broken and compiles clean in isolation, so an entry-grain check over extdeps would not have caught it either — it takes an entry whose closure reaches the call site. RESTORATION TRIGGER: this row retires when a required phase EMITS over a closure that reaches call sites — the compile re-add on the queue the floor cut created — and not when the gcp operation is repaired. Fixing the specimen closes the specimen; only the phase closes the class. The gcp repair is separately ruled: `extdeps.filesystem.filesystem_io` `Read` already models file-read with a `content` channel and `extdeps.languages.json` already models decode, so the seam is read-then-decode over two authorities that exist, and minting a gcp-specific channel would be the §3 nicknaming violation — it would additionally flatten the distinction that `client_secret` and `refresh_token` are `Secret` while `client_id` is `String`, which a bytes channel cannot carry and a typed record can. **A REQUIRED PHASE NOW COMPILES AN EMITTED CLOSURE, AND THIS ROW IS NARROWED RATHER THAN RETIRED (2026-08-26).** The trigger above says the row retires when a required phase emits over a closure that reaches call sites; a phase that emits and compiles one now exists, and it does not reach every closure, so what changes is the SIZE of the exposure and not its existence. WHAT LANDED: a fifth required phase, `emit-compile`, in the `build` lane — the same producer the `v2-emission` phase calls (`compile_entry_emission`), its emitted files written as a crate whose manifest is RENDERED from the modeled cargo authorities rather than authored as markup, and `cargo` run over it. Its subject is `gunbc.ci_layer_roots` `required_emit_compile_entries`, a bounded roster, bounded deliberately: `gunbc.whole_corpus_compile_admission` refuses a whole-bundle compile on the default runner and carries two `EXIT=137` kills behind that refusal, so a whole-corpus required compile is the one form measurement already rules out. **THE PHASE ESTABLISHES ITS OWN RED BY MUTATION, ON EVERY RUN, AND THAT IS THE POINT OF IT RATHER THAN A FLOURISH.** A cargo phase that is green because nothing was measured is exactly the decoration §4b calls worse than absent, and the compile-clean family this row already indicts is what that looks like at nine identities. So a green baseline alone is NOT a pass: `v1_compiler.emitted_closure_compile_host` `establish_discriminating_red` injects ONE type error into ONE emitted file, requires cargo to fail ALONE on it, restores the bytes byte-exactly and requires the green back — and every non-discriminating arm (`NotAttempted`, `NotDiscriminating`, `RestoreFailed`) stops the line with its own typed cause. The restore is as much of the evidence as the failure: without it a red could be residue from the emission rather than from the fault. **WHAT IS STILL OPEN, AND THE ROW STAYS FOR IT.** Escape mode one is narrowed, not closed — a blocking emit-stage diagnostic in a closure no rostered entry reaches still fails no phase, and the population of such closures remains uncounted. Escape modes two and three are UNTOUCHED: an orphan module no closure reaches is still typechecked by nothing, and a `DeclarationRef` naming it still asserts a home that does not compile. The phase carries no diagnostic count, no baseline and no ratchet — a merge-blocking comparison against a population measured on the current tree is the tree-copied oracle §5 rejects — so it answers *does the emitted tree compile*, never *how clean is it*. **THE COVER IS NOT THE CORPUS, AND THE PHASE'S OWN OUTPUT SAYS SO**, because the failure this row already indicts is exactly a reader counting compile-clean-named things and concluding the tree is compile-checked. The summary line reports the covered entries beside the count of authored `.dag` modules under the source roots, so the misreading is unavailable from the log rather than merely avoidable by anyone who goes and reads the roster. **WHAT THE COVER'S SIZE IS ACTUALLY BOUNDED BY, MEASURED RATHER THAN ASSUMED:** an entry costs ~40–50s wall and ~85% of that is `compile.reconcile`, paid INDEPENDENTLY PER ENTRY over closures that overlap heavily — most of `dag/std` sits in nearly every closure. That is a §2 cost-shape defect, not a budget fact: the same modules are reconciled tens of times in one run, and §6's bare-minimum-cost rule says a proven cost-shape defect is fixed regardless of the realized n. So the honest reading is not *the ceiling is forty entries* but *the per-entry cover is the wrong unit, and forty is what the wrong unit buys*. THE ROW RETIRES on the CAPABILITY, not on the cover's size: when required emission coverage reaches every closure the corpus has, by whatever construction, AND THAT INSTRUMENT IS SUFFICIENT TO COMPLETE AND PERSIST THE WHOLE-ROSTER TRANSACTION WITHIN THE ADMITTED RUNNER ENVELOPE. The sufficiency clause is not belt-and-braces: without it the trigger fires the moment a phase named for whole-roster coverage is ENROLLED, which a partial phase satisfies while the capability is still absent — the same defect one level in from the roster-size version, since the roster can be whole while the run that walks it cannot finish or cannot keep what it observed. AND THE NAME CARRIES THE SAME BURDEN: this phase's required context is a SELECTED emission observation, never a whole one, and its success means THE SELECTED OBSERVATION WAS TAKEN AND PERSISTED — never THE CORPUS IS CLEAN. A partial phase is a legitimate wall for an exact selected subject and zero wall for its complement; it becomes decoration only when its name, its trigger, or its consumers let the selected proposition stand in for the exhaustive one, which is why the remainder is reported as RETAINED IDENTITIES rather than as a percentage. A fraction says how much is unobserved and never which, so it is not the bounded population §4b(3) asks for; it may stand as context and may never be the gap's identity or its dissolution trigger. A trigger reading *grow the roster* would be satisfied at forty-one while the corpus stayed unmeasured, which is why it is not written that way. Its named dependency is the reconcile sharing above — a cover whose unit is the entry cannot reach the corpus at any budget, so the unblocking work is making one run reconcile a shared closure once, and that is a separate lane this row does not claim."),
+      li(text: "**A BLOCKING EMIT-STAGE DIAGNOSTIC CAN SIT ON MAIN INDEFINITELY WITH NO REQUIRED PHASE THAT FAILS, AND THIS ROW DECLARES THAT RUNG (2026-08-25).** It sits beside the CI entry above for the reason the regen and cited-symbol rows already give: that paragraph narrates the floor and regen cuts, this is a fourth drop on its own clock, and a declaration wedged into the repository's most-edited prose collides with every unrelated edit to it. **THE CLASS IS NOT ONE OPERATION.** It is any BLOCKING diagnostic produced at the EMIT stage, and the escape surface is Rust-target emission specifically: `v1.05_emit` `file_binding_refusal` returns a `FileEmissionRefusal`, and `file_emission_target_is_modeled` answers `Rust => true` with Python, Go and Dag all false, so the refusal exists only on the path that emits Rust. A parse phase cannot reach it and a typecheck cannot reach it; only a phase that EMITS over a closure containing the offending CALL SITE can. **HALF OF THIS IS ALREADY ON THE RECORD AND IS NOT CLAIMED AS NEW.** The CI entry above already declares, measured 2026-08-20, that `entry_file_touched_via_import_closure` and `compile_clean_scope_plan_for_ci` have zero references under `src/v1/stage0/src/bin`, that no CLI flag reaches them, and that the only `pub` surfaces into that chain return `Bool` — the authority survives and the capability does not. That is the missing compile capability, and it was declared five days before this row. **WHAT IS NEW IS THE SECOND HALF, AND IT IS WORSE: THE WITNESS FAMILY THAT APPEARS TO COMPENSATE IS ALSO INERT.** Measured on main run `32778026868` (`08488aee2`), nine identities named for compile-clean, and not one of them compiles anything. `compile_clean_shard_a_exemplar_compile_green`, `cross_shard_seam_preservation_holds_on_live_tree`, `perturb_fixture_green_holds`, `perturb_optional_skew_fixture_red_holds` and `perturb_unresolved_import_fixture_red_holds` are all NO-ROUTE — refused at the hermetic boundary, discovered and counted and answering nothing. `dag_compile_clean_scope_witness` and `dag_compile_clean_shard_totality_witness` declare `ReadsLiveTree`, so they are DeclinedLiveTree and never run. `compile_clean_shard_entry_paths_fast_hand_rust_witness` declares no disposition at all, so the fail-closed default makes it ReadsLiveTree and it is declined too. The single member that PASSES is `dag_compile_clean_cli_floor_agreement`, and it is `SubstrateInputsOnly`: it checks that two realizations AGREE ABOUT A POLICY ROW, never that anything is clean. **AND THE COVERAGE WOULD NOT HAVE HELPED EVEN HAD IT ROUTED**, which is what makes the pair a stronger claim than either half: `tools.dag_compile_clean_shard_transport` `shard_a_exemplar_entry_path` is `dag/std/logic.dag`. At full strength the family compiles ONE MODULE. So a reader counting witnesses named compile-clean concludes the corpus is compile-checked, and the corpus is not compile-checked and would not have been. That is §4b's worse-than-absent decoration, arrived at not by a check whose RED is unauthorable but by a family whose every member is routed away from its subject. PREVIOUS RUNG: *mechanically preventable* — the compile-clean gate ran ahead of everything else in the required run until the 2026-08-15 floor cut deleted it. TEMPORARY RUNG: **outside the ladder, not mitigatable.** This is the shape the regen row names: an operation that lost its only route has nothing to mitigate, because nothing can be attempted. Review diligence is not a fallback here in the way it is for the cited-symbol drop — a reviewer reads a diff and does not run an emitter, so no human process substitutes for the missing phase. **POPULATION: COUNTED 2026-08-27, STILL UNBOUNDED, AND THE SHAPE OF THAT RESULT IS THE FINDING.** This row read UNCOUNTED AND UNBOUNDED until a whole-root `--target rust` census was taken; the receipt is `gunbc.emit_stage_blocking_population_census` — a receipt and explicitly not an instrument, since no `.dag` entry point produces this measurement and the compiler's own CLI was driven by hand, which is a gap this row records rather than papers over. What the receipt does carry is the invocation as a DERIVATION rather than as prose: `census_run_invocation` renders each run's argv from that run's own fields, so the command is reachable from the fact it produced instead of sitting in a `//` annotation no `Accepted` program can read. The run's exit status and peak residency sit inside the same record as every count it carries, because a SIGKILL prints nothing and a harness reading only stdout reads a fabricated zero. **WHAT THE CENSUS ANSWERS: three, and three is not the population.** `v1.compiler.emit_rust` `emit_rust` returns with no files at its FIRST gate, so the three parameter-default refusals it reports were MASKING eight anonymous-record ones that had been standing all along — the same prefix-of-the-truth shape `gunbc.emit_diagnostic_observation` already records, reproduced on the live corpus. Clearing a gate in the working tree to see past it is a measurement of what the NEXT gate would report, never a measurement of main, and the receipt says so on every row that used one. **AND THE UPPER BOUND IS UNREACHABLE BY THIS ROUTE, FOR A REASON THAT IS NOT ABOUT DIAGNOSTICS AT ALL:** with both gates clear, emit reaches its code-generation body and does not return — stopped at a declared five-hour budget, still computing, no tree written, so it has no exit status to record and no population to read. **SO §4b(3) IS STILL NOT SATISFIED AND THIS ROW DOES NOT CLAIM IT IS.** What moved is the word UNCOUNTED: the observable population is three, the latent population is at least eleven, and the missing upper bound now has a named cause instead of no measurement. The rung does not move, the restoration trigger does not move, and a census is not the required phase that trigger names. Anyone who takes the named specimens, or these figures, as the population has made the denominator error this document keeps recording — the second root measured (`src/v2` as primary, its own subject, unioned with nothing) carries twenty hard diagnostics at its emit refusal of which ZERO were produced by emit. **AND THIS ROW CLAIMS NO OPERATOR APPROVAL FOR THAT, WHICH IS WHERE IT DIFFERS FROM THE CITED-SYMBOL ROW ABOVE AND MUST NOT BE READ AS MATCHING IT.** That row's unbounded exposure is an operator-approved exception to §4b(3); this row's is simply an unmet requirement, declared as unmet. The distinction is the difference between a clause someone with the authority to waive it waived, and a clause this row does not satisfy — and reading the second as the first would manufacture an approval nobody gave, which is the authority-substitution failure this document names. THE NAMED SPECIMEN, WITH ITS PROVENANCE STATED HONESTLY BECAUSE THE TWO HALVES WERE MEASURED BY DIFFERENT PEOPLE ON DIFFERENT INSTRUMENTS: `extdeps.cloud.gcp.gcp` `ReadADC` DECLARED three structured output keys — `client_id`, `client_secret`, `refresh_token` — over a `transport file` that carries bytes, with nothing stating how a JSON document became those fields, and the compiler said so (`file transport output key client_id has no modeled channel`). **THAT SPECIMEN IS REPAIRED AS OF 2026-08-25 AND THE OPERATION NO LONGER EXISTS**, repaired ALONG THE LINE THIS ROW PRESCRIBED: `extdeps.cloud.gcp.adc_document` reads the document and decodes it through `extdeps.languages.json.parse`, so the read-then-decode seam this row ruled for is the seam that landed, and the `Secret`/`String` distinction a bytes channel could not carry is carried by a typed record. A row whose prescribed fix was implemented is evidence the prescription was right. The specimen is kept in the past tense rather than deleted because the CLASS claim below does not depend on it — and because nothing re-derives this sentence, which is why it stood stale until a session tripped over it. It was found cold and measured as the SOLE blocking diagnostic of a whole-census entry compile at `63501ff7e0`, from `--entry dag/gunbc/systemctl_show_read.dag` — a measurement this row's author did not take and does not restate as their own. **A SECOND COMPILE FROM A DIFFERENT ENTRY IS NOT A FAILED REPRODUCTION OF IT, AND THE DIFFERENCE IS THE CLASS DEFINITION DOING WORK.** Compiling `gunbc.auth.credentials` — the module that CONTAINS the call site — as its own entry refuses earlier, at typecheck, with four unrelated hard diagnostics, so that compile never reaches the stage where the channel refusal is produced. Nothing is contradicted: the two entries have different closures and stop at different phases. What the pair establishes is sharper than either alone — **the refusal is reachable from an entry whose closure INCLUDES the call site and unreachable from the file that HOLDS it**, so an emit-stage diagnostic is a property of a CLOSURE, not of a file. A per-file or per-module check would therefore not have caught this either, which is why the restoration trigger below names a phase over closures and not a linter. **A SECOND AND INDEPENDENT ESCAPE MODE, FOUND BY ACCIDENT WHILE MEASURING THE FIRST.** Those four typecheck diagnostics are not an incidental specimen of the same route — they escape a different way. `gunbc.auth.credentials` has ZERO IMPORT EDGES anywhere in `dag/` or `src/v2/`: it is an orphan, so no closure reaches it and nothing typechecks it, and its four hard errors (two `undefined variable shell`, two unresolved `AuthPrintAccessToken`) stand on main for a reason that has nothing to do with which phases emit. The first mode is *no required phase emits over this closure*; the second is *no closure reaches this module at all*. **AND A THIRD, WHICH IS THE WORST OF THEM, because it is the only one that misleads a reader rather than merely hiding from a checker.** The orphan is NOT unreferenced: `gunbc.tailscale_acl_phase2_credential` carries two `DeclarationRef` rows naming `gunbc.auth.credentials` as its credential authority — `gcp_secret_credential` and `gcp_oauth_access_token_via_adc_refresh`. So the module is CLAIMED AS AN AUTHORITY by a carrier that depends on it being correct, while no import edge reaches it and nothing typechecks it. An unreferenced orphan misleads nobody; a cited one asserts that a fact has a home, and the home does not compile. **THE THIRD MODE IS WHERE TWO DECLARED DROPS COMPOSE, AND NEITHER ROW ALONE PREDICTS IT.** The cited-symbol row above declares, from 2026-08-23, that nothing checks whether an authored citation resolves; this row declares that nothing emits over the closure a citation names. These two `DeclarationRef` rows were authored into exactly that window. A citation to a module that typechecks nowhere is invisible to both mechanisms at once — the first stopped asking *does this symbol exist*, the second stopped asking *does this module compile* — and the composition is not a complaint about either operator decision, it is what makes the population claim below concrete rather than rhetorical. Neither of the three modes was found by searching. All three were tripped over while measuring something else, which is the strongest available argument that the population below is not two or three. ONE MEASUREMENT THAT CORRECTS THE OBVIOUS ASSUMPTION, recorded so the next reader does not repeat it: compiling `extdeps/cloud/gcp/gcp.dag` AS AN ENTRY returns **0 blocking, 79 advisory**. The declaration alone does not refuse. The operation looks self-evidently broken and compiles clean in isolation, so an entry-grain check over extdeps would not have caught it either — it takes an entry whose closure reaches the call site. RESTORATION TRIGGER: this row retires when a required phase EMITS over a closure that reaches call sites — the compile re-add on the queue the floor cut created — and not when the gcp operation is repaired. Fixing the specimen closes the specimen; only the phase closes the class. The gcp repair is separately ruled: `extdeps.filesystem.filesystem_io` `Read` already models file-read with a `content` channel and `extdeps.languages.json` already models decode, so the seam is read-then-decode over two authorities that exist, and minting a gcp-specific channel would be the §3 nicknaming violation — it would additionally flatten the distinction that `client_secret` and `refresh_token` are `Secret` while `client_id` is `String`, which a bytes channel cannot carry and a typed record can. **A REQUIRED PHASE NOW COMPILES AN EMITTED CLOSURE, AND THIS ROW IS NARROWED RATHER THAN RETIRED (2026-08-26).** The trigger above says the row retires when a required phase emits over a closure that reaches call sites; a phase that emits and compiles one now exists, and it does not reach every closure, so what changes is the SIZE of the exposure and not its existence. WHAT LANDED: a fifth required phase, `emit-compile`, in the `build` lane — the same producer the `v2-emission` phase calls (`compile_entry_emission`), its emitted files written as a crate whose manifest is RENDERED from the modeled cargo authorities rather than authored as markup, and `cargo` run over it. Its subject is `gunbc.ci_layer_roots` `required_emit_compile_entries`, a bounded roster, bounded deliberately: `gunbc.whole_corpus_compile_admission` refuses a whole-bundle compile on the default runner and carries two `EXIT=137` kills behind that refusal, so a whole-corpus required compile is the one form measurement already rules out. **THE PHASE ESTABLISHES ITS OWN RED BY MUTATION, ON EVERY RUN, AND THAT IS THE POINT OF IT RATHER THAN A FLOURISH.** A cargo phase that is green because nothing was measured is exactly the decoration §4b calls worse than absent, and the compile-clean family this row already indicts is what that looks like at nine identities. So a green baseline alone is NOT a pass: `v1_compiler.emitted_closure_compile_host` `establish_discriminating_red` injects ONE type error into ONE emitted file, requires cargo to fail ALONE on it, restores the bytes byte-exactly and requires the green back — and every non-discriminating arm (`NotAttempted`, `NotDiscriminating`, `RestoreFailed`) stops the line with its own typed cause. The restore is as much of the evidence as the failure: without it a red could be residue from the emission rather than from the fault. **WHAT IS STILL OPEN, AND THE ROW STAYS FOR IT.** Escape mode one is narrowed, not closed — a blocking emit-stage diagnostic in a closure no rostered entry reaches still fails no phase, and the population of such closures remains uncounted. THAT IS A DIFFERENT DENOMINATOR FROM THE CENSUS ABOVE AND NEITHER ANSWERS THE OTHER: the census counts BLOCKING DIAGNOSTICS reachable from a whole-root emit, this clause counts CLOSURES NO ROSTERED ENTRY REACHES, and a diagnostic can be counted while the closure carrying it is unrostered. The two clauses were written a day apart by authors who could not see each other, and stating the denominators is what stops the later count from reading as a refutation of the earlier gap. Escape modes two and three are UNTOUCHED: an orphan module no closure reaches is still typechecked by nothing, and a `DeclarationRef` naming it still asserts a home that does not compile. The phase carries no diagnostic count, no baseline and no ratchet — a merge-blocking comparison against a population measured on the current tree is the tree-copied oracle §5 rejects — so it answers *does the emitted tree compile*, never *how clean is it*. **THE COVER IS NOT THE CORPUS, AND THE PHASE'S OWN OUTPUT SAYS SO**, because the failure this row already indicts is exactly a reader counting compile-clean-named things and concluding the tree is compile-checked. The summary line reports the covered entries beside the count of authored `.dag` modules under the source roots, so the misreading is unavailable from the log rather than merely avoidable by anyone who goes and reads the roster. **WHAT THE COVER'S SIZE IS ACTUALLY BOUNDED BY, MEASURED RATHER THAN ASSUMED:** an entry costs ~40–50s wall and ~85% of that is `compile.reconcile`, paid INDEPENDENTLY PER ENTRY over closures that overlap heavily — most of `dag/std` sits in nearly every closure. That is a §2 cost-shape defect, not a budget fact: the same modules are reconciled tens of times in one run, and §6's bare-minimum-cost rule says a proven cost-shape defect is fixed regardless of the realized n. So the honest reading is not *the ceiling is forty entries* but *the per-entry cover is the wrong unit, and forty is what the wrong unit buys*. THE ROW RETIRES on the CAPABILITY, not on the cover's size: when required emission coverage reaches every closure the corpus has, by whatever construction, AND THAT INSTRUMENT IS SUFFICIENT TO COMPLETE AND PERSIST THE WHOLE-ROSTER TRANSACTION WITHIN THE ADMITTED RUNNER ENVELOPE. The sufficiency clause is not belt-and-braces: without it the trigger fires the moment a phase named for whole-roster coverage is ENROLLED, which a partial phase satisfies while the capability is still absent — the same defect one level in from the roster-size version, since the roster can be whole while the run that walks it cannot finish or cannot keep what it observed. AND THE NAME CARRIES THE SAME BURDEN: this phase's required context is a SELECTED emission observation, never a whole one, and its success means THE SELECTED OBSERVATION WAS TAKEN AND PERSISTED — never THE CORPUS IS CLEAN. A partial phase is a legitimate wall for an exact selected subject and zero wall for its complement; it becomes decoration only when its name, its trigger, or its consumers let the selected proposition stand in for the exhaustive one, which is why the remainder is reported as RETAINED IDENTITIES rather than as a percentage. A fraction says how much is unobserved and never which, so it is not the bounded population §4b(3) asks for; it may stand as context and may never be the gap's identity or its dissolution trigger. A trigger reading *grow the roster* would be satisfied at forty-one while the corpus stayed unmeasured, which is why it is not written that way. Its named dependency is the reconcile sharing above — a cover whose unit is the entry cannot reach the corpus at any budget, so the unblocking work is making one run reconcile a shared closure once, and that is a separate lane this row does not claim."),
     ]),
   ]
 }