The status carrier says a whole-corpus compile is REFUSED on host memory; three runs on an admitting host say otherwise

[gunbai-bot]

The WholeCorpusEmissionBoard obstacle row asserted RefusedByAuthority and named the one thing that would settle it, in its own words:

the predicate is a function of the HOST, it refused on the hosts its receipts were taken on, and it has not been attempted on one whose budget it admits ... THE FALSIFICATION MUST RECORD EXIT STATUS AND PEAK RESIDENT SET TOGETHER ... Three milestones wait on that one measurement.

That falsification has been performed, on exactly those terms

srv1 (502 GiB total, ~334 GiB available, aarch64 — a host the predicate admits by three orders of magnitude), three whole-corpus runs under /usr/bin/time -v with the exit status captured beside the peak:

run	exit	peak	wall
--target dag	1	13,008,052 kB	25:04
--target rust	1	13,005,964 kB	27:44
--target rust, parameter-default gate cleared	1	12,986,524 kB	25:05

None was SIGKILLed and none was refused by admission. Each ran frontend, normalize and reconcile, reached emit, and refused on diagnostics. The refusal this row carried does not hold — and a status carrier asserting a false explanation in the reassuring direction is precisely the rung inflation DESIGN §4b names as worse than sitting low: RefusedByAuthority reads as "correctly blocked" when the block is gone.

A third arm, not a collapse to NotBuilt

NotBuilt is correct about the remedy and would erase the execution that established it. The row would render identically to the seven instruments nobody has ever attempted, and the next reader would have no way to tell a tested refusal from a forgotten one. So the state gets its own arm — still unbuilt, but unbuilt for a measured reason.

And it is explicitly not progress

Falsifying an obstacle removes an explanation; it does not produce a board. The milestone stays NotDerivable with cause: needs(WholeCorpusEmissionBoard), untouched by this PR. That is why the obstacle axis and the standing axis are separate: a carrier where clearing an obstacle moved a milestone would let the removal of an excuse render as the delivery of an instrument.

What is still missing, stated so this is not read as wider than it is:

• No completing rust-route run exists. Clearing the three parameter-default sites revealed eight anonymous-record refusals behind them, reproducing the three-then-eight prefix gunbc.emit_stage_blocking_population_census already records. The blocking population is still unbounded.
• Nothing is persisted where a consumer can read it, which is the condition milestone_status states in its own words. The remedy is now to write the instrument and its carrier — two constructions — rather than to find a bigger machine.

Evidence, executed rather than asserted

claim_batch over the witness entry: 24/24 pass.

The new arm's coverage is discriminating by mutation, not by inspection. Collapsing its label to "UNBUILT" fails the_obstacle_axis_renders_its_three_arms_distinguishably alone — 23 pass, 1 fail — and restoring the byte gives 24 back. One arm failing alone, with a restore between.

The citation test is repaired, not re-pinned

the_refused_instrument_cites_the_authority_that_refuses_it matched RefusedByAuthority alone, so a legitimate state change turned it red and its closing move would have been to edit the expectation — the backward contract this file has been corrected for before. It now asks across both citing arms (the_board_obstacle_cites_the_authority_it_is_about), which is the property it was always about and survives the row moving in either direction, including back. NotBuilt still answers false: a row with no citation cannot satisfy a claim about which authority it names.

Note on CI

Main has been red for hours on a single over-cost row (failed=0, unexpected_failures=0) owned by #9517. Checks here will stay red until that lands; it is not this diff.

The three receipts above are the same runs recorded in #9545, which raises the admission threshold those measurements bound. This PR is independent of it — it corrects what the status carrier says, not what the threshold is — and it branches from main rather than from that PR.