Reorganize dag/gunbc files into domain-specific subdirectories - #9637

DESIGN.md conflicted because both sides changed it. It is a GENERATED projection of
gunbc.design_document, so it was not hand-merged: the merged authority was regenerated with
generated_artifact_gate main_wet and the result taken whole.

VERIFIED IN BOTH DIRECTIONS, because a regeneration that silently drops one side's authority
looks identical to a correct one:
  - 31 of 31 phrases unique to this branch (present in the branch's DESIGN.md, absent from main)
    are in the regenerated file.
  - every sampled phrase unique to main (present on main, absent from the merge base) is also
    present.
  - 162456 -> 165458 bytes, consistent with adding this branch's rows rather than replacing.

Regeneration churn OUTSIDE the conflicted path was deliberately NOT taken: .gitattributes,
.gitignore, .githooks and the stage0 generated .dag files are drifted on main for an unrelated
reason (#9637 moved two artifacts without updating their registry rows), and converging them
belongs to #9644, not to this PR.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Also carries the same two rustfmt reflows as #9644 (cli_run.rs, line-length only, caused by #9637
lengthening the roadmap authority paths). They are pre-existing on main, arrive here via the
merge, and the generated pre-commit hook refuses without them. Identical content to #9644, so the
two merge cleanly.

Two generated mirrors conflicted: v1_compiler_infer.rs and v1_compiler_infer_types.rs. The
generated-artifact merge driver refused them by design - it leaves the ours side in the worktree
with NO conflict markers and marks the path unmerged, because neither side's bytes are the
projection of the MERGED authorities and picking a side drops the other's authority-derived
content.

So they were NOT hand-resolved. They are the output of claim_executor --required-regen over the
merged .dag tree, installed from target/stage0-regen-candidate/src, and verified byte-identical to
that candidate.

CHECKED, because a regeneration that silently drops one side looks exactly like a correct one:
this branch's subject is occurrence identity, and the regenerated mirrors carry 148 and 31
references to NodeOccurrenceIdentity/occurrence_identity respectively. No .dag file conflicted, so
the authority merged cleanly and only its projection needed rebuilding.

Carries the same two rustfmt reflows as #9644 (cli_run.rs, line-length only, from #9637
lengthening the roadmap authority paths): pre-existing on main, arriving here via the merge, and
the generated pre-commit hook refuses without them.

NOT INCLUDED, deliberately: main also carries generated-surface drift in v1_rt.rs and four drifted
generated artifacts. Those are main's, not this branch's, and converging them here would hide them
inside an unrelated PR. #9644 covers the artifact drift; v1_rt.rs is separate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…s were MOVED not deleted, and four projections predate the reorg (#9647)

`claim_executor --required-ci --required-lane build` fails its `generated-artifact`
phase on origin/main with `matches=23 drifted=4 absent=2`, so no open pull request
can reach green: a pull_request run compiles refs/pull/N/merge, which carries
main's tree.

THE TWO ABSENT ARTIFACTS WERE NEVER MISSING, AND REGENERATING THEM WOULD HAVE BEEN
WORSE THAN THE RED. #9637's reorganisation moved
`stage0_crate_layout_generated.dag` and `stage0_crate_partition_generated.dag`
into `dag/gunbc/stage0/`, while `gunbc.generated_artifact` still named
`directory: "dag/gunbc"`. Both files exist and both declare their modules. Writing
them at the registry's stale path would have produced a SECOND file declaring
`gunbc.stage0_crate_layout_generated`, trading this red for a DUPLICATE-MODULE
finding and burying two live files under stale copies.

DESIGN records this exact trap on this exact gate: a drift gate makes what it
adjudicates binding, so an absent artifact can be one that was removed on purpose,
and "the stale half is the REGISTRY ROW and not the missing file". Here the row is
not even wrong about existence, only about the directory. Two lanes independently
flagged the danger before touching it (bold-stag-16, sharp-crab-95); establishing
what the absence MEANT before producing anything is what this repair records.

FIX ONE, the two absent: the registry's two `ArtifactLocation` directories move to
`dag/gunbc/stage0`. No file is generated and no file is moved.

FIX TWO, the four drifted: `.gitignore`, `.gitattributes` and the two githooks are
regenerated by their own authorities via the recipe the gate itself prints
(`dag/tools/generated_artifact_gate.dag` `main_wet`), not hand-edited. The content
change is coherent and self-explaining: the githook headers pick up their emitter's
post-reorg path, and 41 `docs/plans/*.md` paths move from merge-driver-managed
generated artifacts (`.gitattributes`) to ignored (`.gitignore`) -- which is
`gunbc.plan` `PlanIsAuthorityOnly` applied, the ruling that a plan's markdown is not
a committed artifact. Checked: 0 of those 41 paths are tracked, so ignoring them is
consistent rather than a silent untracking.

VERIFIED BY EXECUTION for the half that a measurement can settle:
  main's registry  -> matches=23 drifted=4 absent=2
  with fix one     -> matches=25 drifted=4 absent=0
The four drifted are then written by their authority's own producer at exit 0.

This repairs one of four phases red on main. declarations is #9645; regen
(`v1_rt.rs`, declared_divergent=1 [main.rs]) and the floor's strict-preparation
diagnostics are untouched here.

Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ed past width (#9639)

#9637 (the 709-file dag/gunbc reorg) rewrote a path string inside the test fn
merge_base_authority_projection_matches_jsonl_carrier to
'dag/gunbc/roadmap/roadmap_authority.dag'. The longer path pushes two lines past
rustfmt's width, so main at 179d3f2 fails `cargo fmt --all --check` at
cli_run.rs:818 and :828.

This is rustfmt's own output, applied by `cargo fmt --all`. No judgment, no
semantic content, deterministic.

WHY IT MATTERS DESPITE NOT BEING A CI FAILURE. The fmt gate is on the
removed-and-not-yet-re-added list from the floor cut, so nothing downstream
catches this. The only thing that fires is the LOCAL pre-push hook, which means
it surfaces one lane at a time, at push, and only for people who still have a
working tree -- invisible to the fleet by construction. It already cost one lane
a --no-verify push, which bypasses every other hook check as a side effect.

cli_run.rs is hand-written seed Rust and NOT a generated artifact -- no generator
names it as an artifact path -- so formatting it creates no drift against any
authority.

Admitted against the v1 freeze on the purpose test: it serves the v2 self-host
program by unblocking the push path every lane in it uses. It is none of the five
refused classes -- a whitespace reflow adds no language behavior, no compatibility
obligation, no escape hatch, no seed feature, and no public surface.

Found by loyal-raven-764, who correctly declined to absorb it into their own diff.

Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

* Close the guarantee_rung_drop parse refusal and the generated-artifact drift the masked window accumulated

- guarantee_rung_drop.dag: restore the missing closing brace on the
  wall_deadline GuaranteeStall record (#9612); the unparseable module
  refused the whole module index, so both required lanes died before
  any drift adjudication could run.
- gitignore authority/model/emit: delete the seven hardcoded .py
  allowlist variants whose subjects the measurement bankruptcy and the
  plan-markdown cut deleted; drop the gate test fn that pinned those
  literal rows (a tree-copied oracle).
- generated_artifact.dag: repoint the two stage0 generated .dag
  ArtifactLocation rows to dag/gunbc/stage0/, where #9637 moved the
  files; the registry still named the old directory.
- Regenerate .gitignore, .gitattributes, and .githooks via
  generated_artifact_gate main_wet: .gitattributes drops the 41
  merge-driver rows for plan markdowns #9635 deleted (verified by
  executing expected_gitattributes()); .gitignore drops the dead
  allowlist rows and gains the derived ignore rows for authority-only
  plan markdowns; hook headers pick up the post-reorg githooks/ module
  paths.
- Delete dag/config/codegen_paths.dag: an orphan module no closure
  reaches, describing a layout that no longer exists.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQPnTvxdvVjBLzjL6bcWVh

* Remodel .gitignore: producer-declared workspace footprints with typed ignore reasons

Replaces gunbc.gitignore_model + gunbc.gitignore_authority (one nullary
variant per path, patterns restated in a central emit match — the shape
that let seven dead allowlist rows emit unnoticed) with a producer-owned
derivation:

- std.workspace_artifact: the agnostic shape — WorkspaceArtifact
  {pattern, meaning, reason} with a closed IgnoreReason vocabulary, and
  WorkspaceFootprint with CitedUpstream/RepoTool provenance.
- Each extdeps product declares its own footprint beside its citation
  (cargo, cargo-tarpaulin, CPython/PEP 3147, npm, tmux, macOS Finder,
  Windows Explorer, JetBrains, VS Code, Vim, Emacs, dotenv); repo-chosen
  locations are parameters, so policy stays a workflow fact.
- gunbc.repo_workspace joins extdeps footprints with the repo's own
  tools' declarations (each naming its owner module) — onboarding a
  concept now naturally carries what files it introduces, what they
  mean, and why they are untracked.
- gunbc.gitignore_emit becomes a pure renderer: it declares no pattern
  of its own; the emitted file carries each pattern's reason and
  meaning as comments. Generated-artifact rows remain a separate arm
  derived from gunbc.generated_artifact commit policy.
- src/v1/runtime_rust.dag: align the emitted trace_mark doc comment
  with the #9635 hand-edit of the generated v1_rt.rs mirror, restoring
  regen first-generation equality (drift was masked on main by the
  guarantee_rung_drop parse refusal).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQPnTvxdvVjBLzjL6bcWVh

* Install the stage0 mirror for std.workspace_artifact

The new module entered the v1 seed closure, so --required-regen refused
with 'emitted surface has no committed mirror'; this installs the
candidate the regen run produced (std_workspace_artifact.rs plus its
lib.rs module line), unmodified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQPnTvxdvVjBLzjL6bcWVh

* Install the regen-produced stage0 mirrors the remodel drifted

--required-regen names four drifted surfaces, each a direct consequence
of this branch's edits: extdeps_cargo.rs (cargo.dag gained its workspace
footprint), v1_compiler_runtime_rust.rs and v1_rt.rs (the trace_mark doc
comment realignment), and emitted_population.rs (the population gained
std_workspace_artifact). All four installed from the regen candidate
tree unmodified.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQPnTvxdvVjBLzjL6bcWVh

* Use concat, not append, for the cargo footprint list join

The emitted v1_rt::append takes (list, one item) while the interpreter's
append(list, items:) concatenates lists — cargo.dag is the first
mirrored seed module to hit that divergence, so its emitted mirror
failed to compile (E0308 at extdeps_cargo.rs:277). concat has the same
list-concatenation meaning in both realizations. The regenerated mirror
follows in the next commit once the fixed-point verification completes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQPnTvxdvVjBLzjL6bcWVh

* Install the second-generation mirrors: concat-form extdeps_cargo, corrected v1_rt

extdeps_cargo.rs is the regenerated mirror of the concat fix (compiles
clean; verified by cargo locally). v1_rt.rs corrects a first-generation
install in the previous mirror commit: that candidate was emitted by the
pre-fix binary, so it reverted the trace_mark doc comment while the
generator mirror in the same commit moved forward; this is the second
generation's output, matching what the current generator emits.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQPnTvxdvVjBLzjL6bcWVh

* Port two masked-window main defects this branch unblocked CI into: frontier fixture exemptions, BMC demand-curve type error

Both pre-date this branch and were invisible while #9612's parse refusal
kept every required phase from running; this branch's head is the first
to reach the declarations census and the floor's strict preparation, so
they surfaced here.

- declaration_index.rs FIXTURE_CARRIER_CITATION_EXEMPTIONS: #9607
  re-pointed test.claim.annotation_carrier's planted rows at the
  deliberately-fictional test.fixture.frontier without updating the
  exemption roster. Add the four rows for the new deliberately-absent
  citations and delete the spent extdeps.network.mac row the census
  itself demands removed.
- extdeps/bmc/pid_control_program.dag curve_points_agree: the output
  half compared a ZoneDemandValue where decimal_measures_agree declares
  a Measure; compare the ExactDecimal magnitudes directly (verified: the
  entry now compiles with 0 blocking diagnostics).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQPnTvxdvVjBLzjL6bcWVh

* Close the remaining eleven strict-preparation diagnostics blocking every PR's floor

All landed on main inside the masked window (#9612's parse refusal kept
the floor from typechecking anything); this branch is the first head to
reach strict preparation, so they surface here. Seven are ported
verbatim from #9646 (capacity_class on the training fixtures, value
CustomerExecutableCapacity per that PR's model reading — it no-ops when
that PR merges); four are fixed here:

- source_integration_landing_spine: the Optional-receiver '|> map' at
  the additional-continuation arm becomes a match (the module's own
  idiom two arms up), and the module's unresolved-method frontier row in
  v1/04_infer.dag is deleted per the diagnostic's own prescription — the
  deficit fully dissolves, so the row must not keep its ground.
- fabric_terminal_contract_witness_test: the positive-control receipt is
  bound as Receipt<NonEmptyStr> before the call, so the payload's P no
  longer infers String against the NonEmptyStr grant.
- repository_convergence_placement: drop the primary_path argument;
  repository_converge_wet derives it internally and no longer declares
  the parameter.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQPnTvxdvVjBLzjL6bcWVh

* Resolve the three remaining audit leftovers: delete the import-strip dumps, register js_site's generated pages, keep the bound probe receipt

- docs/plans/import-strip-measurement/ and import-strip-residual-ledger.tsv:
  deleted as unconsumed transcription per the measurement-bankruptcy
  principle (unconsumed transcription disappears; consumed evidence stays
  attached to its consumer). Neither is bound in gunbc.doc_graph_roots —
  the bound import-strip doc is a different, surviving plan markdown. The
  citing plan's prose now records the deletion.
- dag/examples/js_site/generated/: the six committed generated files were
  produced by examples.js_site_emit and adjudicated by nothing. They are
  now JsSitePageArtifact rows in gunbc.generated_artifact (derived from
  the page roster, not hand-listed), located by js_site_emit's own path
  fns and generated through its pure per-page projections, so the
  generated-artifact drift phase adjudicates them like every other
  committed generated artifact.
- docs/probes/leading_minus_continuation_silently_truncates_2026-08-23.md:
  no change, deliberately — gunbc.doc_graph_roots already binds it as
  consumed evidence under an operator ruling that reverted its deletion.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQPnTvxdvVjBLzjL6bcWVh

* Install the infer mirror for the frontier-row deletion; adjudicate js_site under the drift gate

- src/v1/stage0/src/v1_compiler_infer.rs: regenerated mirror of the
  04_infer.dag frontier-row deletion; --required-regen reports
  first_generation_equal=true on this tree after one rebuild, and the
  landing_spine entry now compiles with 0 blocking diagnostics.
- generated_artifact_emit: the extra-validation match gains its
  JsSitePageArtifact arm (main_wet's fail-closed non-exhaustive refusal
  caught the omission).
- .gitattributes: regenerated; the six js_site pages join the derived
  merge-driver population. main_wet regenerates the pages byte-identical
  to what was committed, so registration changes no page content.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQPnTvxdvVjBLzjL6bcWVh

* Converge v1_rt on the authority's citation text after the merge of main

Main closed the v1_rt drift by restoring the mirror to the old
docs/plans/ci-floor-fractal-gantt.md citation; this branch had moved the
authority to 'ci-floor-fractal-gantt (plan doc deleted 2026-08-28)'.
Both were internally consistent and disagreed. The deciding fact: the
plan doc does not exist on the merged tree (#9635 deleted it;
gunbc.plans.ci_floor_fractal_gantt is authority-only), so main's
direction re-landed a citation to a nonexistent file — the §3
stale-citation class. The authority-side text survives the merge in
runtime_rust.dag and its generator mirror; this installs the emitted
v1_rt.rs so the pair agrees, verified by --required-regen on this tree.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CQPnTvxdvVjBLzjL6bcWVh

---------

Co-authored-by: Claude <noreply@anthropic.com>

…o of them and the registry still named the old directory (#9644)

* Generated artifacts converge with their authority: the reorg moved two of them and the registry still named the old directory

#9637 moved stage0_crate_layout_generated.dag and stage0_crate_partition_generated.dag into
dag/gunbc/stage0/ and did not update their ArtifactLocation rows, which still declared
directory: "dag/gunbc".

MEASURED, NOT INFERRED. Running the recipe the generated-artifact merge driver itself prints
(generated_artifact_gate main_wet) on current main WRITES A FLAT DUPLICATE beside each real file,
because the generator writes where the registry says. With the two rows corrected, the same
command writes to dag/gunbc/stage0/ and produces no duplicate - verified by execution on a clean
main worktree, both arms.

WHY THIS IS NOT COSMETIC. Following the printed recipe on current main also rewrites
.gitattributes down to the stale roster, deleting 43 rows including live merge=generated-artifact
registrations. Anyone resolving a generated-artifact conflict right now silently drops that
config. Three PRs are blocked behind exactly this.

THREE PRE-EXISTING DRIFTS CONVERGE IN THE SAME COMMIT, because the generated-artifact phase
adjudicates every rostered member and leaving any drifted keeps the lane red:

- .gitattributes -41 rows. Every removed row names a file that DOES NOT EXIST, checked one by one:
  zero of 41 present. They are stale rows for authority-only plans whose markdown was deliberately
  deleted.
- .gitignore +41 rows, the same 41 plans, ignored rather than expected on disk.
- .githooks/pre-commit and .githooks/pre-push: the "GENERATED by" header now cites the post-reorg
  authority path.

No hand-edited generated bytes: every artifact here is the generator's own output.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ALSO: rustfmt drift on main, confirmed PRE-EXISTING and not caused by this change (this PR touches
no .rs semantically). `cargo fmt --all --check` on a clean origin/main worktree fails at
cli_run.rs:818 and :828 - two line-length reflows caused by #9637 lengthening the roadmap authority
path strings. It is fixed here because the generated pre-push hook runs the fmt check and refuses,
so this blocks EVERY push from a hooks-configured clone, not just this one.

* Close the regen phase too: the authority cited a deleted plan doc while its mirror had been hand-edited

main's build lane had TWO failing phases. The first commit closed generated-artifact
(rostered=29 matches=29 drifted=0 absent=0, confirmed by CI on this PR). This closes the other:
`regen FAIL generated surface drift: v1_rt.rs`.

THE DRIFT WAS ONE DOC-COMMENT LINE, AND THE MECHANICAL FIX WOULD HAVE BEEN WRONG.

  committed mirror:  per `ci-floor-fractal-gantt (plan doc deleted 2026-08-28)`
  authority emits:   per `docs/plans/ci-floor-fractal-gantt.md`

docs/plans/ci-floor-fractal-gantt.md does NOT exist on main. So a generated mirror had been
hand-edited to record the deletion while src/v1/runtime_rust.dag kept emitting a citation to the
deleted file. Installing the regen candidate - the obvious move, and what the merge driver's
recipe leads you to - would have REVERTED that note and restored a citation to a file that is not
there. The drift was the symptom; the hand-edit was the defect.

So the repair is at the authority, and v1_rt.rs is NOT touched by this commit: once runtime_rust.dag
emits the committed text, the mirror is already correct.

TWO GENERATIONS, because runtime_rust.dag is itself mirrored: editing it drifts
v1_compiler_runtime_rust.rs (1 line), and v1_rt.rs is emitted BY that mirror once compiled. So the
first rebuild still emitted the old string. Installing the emitter mirror and re-running converges:
first_generation_equal=true, no drift.

VERIFIED: regen over the fixed tree reports first_generation_equal=true with no drift line, and the
only paths changed are the authority and its own mirror.

NOT DONE HERE, deliberately: DESIGN 3 would prefer citing the surviving plan carrier
(gunbc.plans.ci_floor_fractal_gantt) over embedding a date in source. That is the better citation
and it changes mirror bytes, so it is a separate judgment rather than part of a repair.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Brian Searls <searlsbrian@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com>

…prepare or build over the live tree carry a live-corpus ignore reason and leave the required run, and the rot the first-ever `cargo test` exposed is repaired at its authorities, not hidden

`cargo test -p v1-compiler --lib` had never run in CI. Its first run (33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, because ~126 of the "unit" tests each build a fresh multi-entry index over `src/v2`+`dag` (4,260 modules; ~197 single-thread minutes on srv2 under nextest, 97 tests over 60 s, `self_compile_all_modules` alone 505 s), and the runner executes them serially. Those tests now carry `#[ignore = "live-corpus: ..."]` — the crate's existing `manual:` convention, one class, declared on the carrier — and the rung-drop row `required_gate_bankruptcy` names them by their instrument (`cargo test -p v1-compiler --lib -- --ignored --list`). The unit population runs in ~10 s after the compile (srv2: 537 passed / 136 ignored).

Of the 44 failures the full run exposed, the 15 in the unit population are repaired where the fact lives:
- REAL DEFECTS (two): `try_index_source_root_into_module_index` keyed files by their walked path, absolute since #9548 anchored the root, while the strict builder keys through `module_index_path_key` — the primary-precedence index disagreed with the strict one on every path; keyed through the same authority now. `try_build_module_index` carried `if root_idx > 0 { continue; }` before its collision refusal (from #7791), so a module declared in two roots shadowed silently in the builder named strict; the guard is gone and overlay callers have `build_module_index_primary_precedence`.
- v1 TYPECHECK DEFECT: `declared_type_inhabitance` reads `params` as generic type parameters, which is exactly what a callable formal carries, so every higher-order call produced a counted advisory with a false reason (#9194); `direct_call_argument_inhabitance_diags` now excludes callable formals like its sibling `direct_call_arg_type_mismatch`. Mirror regenerated (two passes: the test blob lives inside the emitter).
- STALE AUTHORITY ROWS after the #9637 reorg: 12 entry literals in `gunbc.ci_layer_roots` and 2 in `gunbc.offline_local_recipe` repointed; the two long-lane rows and one freeze row whose subjects 611fd02 and #9206 deleted are gone; the three freeze rows for relocated witnesses are DELETED rather than repointed, because the freeze gate defines relocation as growth and the roster may only shrink. `gunbc.non_fold_residue` receives the 22 sites it lacked and loses the 4 whose subjects moved or greened; its .dag twin therefore leaves floor_expected_red (it passes) and joins cost-debt chunk 12 (629 ms against the 500 ms ceiling, its whole cost the corpus scan it checks).
- DELETED SUBJECTS: `cli_run::floor_witness_a_prove` (its runner, prove test and fixtures went with the FLOOR-Y cutover); the census pin tests and helpers for `docs/probes/census_extra_excludes.txt` (#9132 deleted every transcription).
- EARLY ABORTS: three witness-admission tests and the roadmap jsonl-carrier test were "fast" only because they failed before their expensive step; with their inputs repaired they read the live tree for 2-4 minutes each and join the live-corpus class.
- TEST ROT: the reorg rewrote a revision-addressed literal (`9ce6526c528:dag/gunbc/roadmap/...`) that must name the pre-reorg path; the method-existence witness anchored on a `Primitive()` row the frontier no longer holds.

Not done here, receipts-lane rot for follow-ups: `test.claim.expectation_frontier_witness_test` names the deleted long-lane file; the affected-set kernel (`floor_diff_edits_from_diff_text`, `rerun_frontier_nodes_for_entry`, …) has no production consumer since FLOOR-Y and should go with its remaining fixture-dependent tests; the roadmap jsonl-carrier test takes 453 s and fails after its expensive step.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

…e prepares the roster's closure, not the tree; rust unit tests in their own job; the un-required phases declared as a rung drop (#9663)

* Unbreak main: drop the JsSite artifact rows whose authority #9641 deleted, and give the six witness-bin TypeEnv initializers the unit_variant_index #9656 added

Two integration collisions between independently green PRs:
- #9641 deleted dag/examples/js_site but gunbc.generated_artifact and
  gunbc.generated_artifact_emit still imported it, so the whole-tree
  strict resolve refused and every floor on main has been red since.
- #9656 added TypeEnv.unit_variant_index; infer_semantics_witness.rs
  builds six TypeEnvs by hand and none carried it, so --bins failed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* The lib's own unit tests build one more TypeEnv by hand; give it unit_variant_index too

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* Required CI is the compiler floor: a static gate roster, prepared as its own import closure, with the other four phases and the product witnesses moved off the merge path

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* Drop the six duplicate unit_variant_index initializers the merge with #9648 produced

* Drop the six duplicate unit_variant_index initializers the merge with #9648 produced

* Regenerate .gitattributes: the six js_site rows projected from the deleted artifact registry entries go with them

* Regenerate the four projections of this change: witnesses.yml (probe and all-bins steps gone, rust-unit-tests job added), DESIGN.md and design-ledgers.md (the rung-drop row), .gitattributes (js_site rows gone)

* Restore the lib-test TypeEnv initializer's unit_variant_index (lost when the merge took main's cli_run.rs wholesale)

* The gate closure is the loader's both-closure (imports + reference edges to a fixpoint), not the import headers: stripped modules reach their providers by reference, and the header walk left 1,190 names unresolved

* Shrink the namespace transition roster: the 314 std->extdeps consolidation rows landed with #9641 and now refuse every PR as stale

* Build the entry index once for both gate closures (it is the expensive part: ~75-110s per build on the corpus)

* Gate closure includes containment ancestors to a fixpoint: a module importing only a child of the declaring module still binds the parent's declarations

* The floor's policy module is always a closure seed: its rosters are evaluated in a frame over the prepared subject

* The reference-closure index is keyed by the prepared subject's digest, bounded to the two subjects a floor process prepares by design — the gate's policy-closure preparation and the gate closure are two subjects in one process, and a once-per-process index refused the second (ReferenceIndexSubjectChanged built_for_modules=47 observed_modules=1952, CI and srv2 at 066725c)

The old check keyed on module COUNT: two subjects of equal size would have
shared one index silently. The new one keys on `subject_digest`, so the
index a scope consults was built from the graph that scope is over, by
construction. The population is bounded by
FLOOR_PREPARED_SUBJECTS_PER_PROCESS = 2 (policy closure, gate closure) — a
third distinct subject still refuses with the same cause, because a
subject per claim is the corpus walk per row the index exists to avoid.

Evidence: srv2 rerun of `claim_executor --required-ci --required-lane
witnesses` at this tree builds the 47-module policy index
(subject=09966adcd218af0e) and proceeds into the 1,954-module gate
preparation instead of refusing at claim scope.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* The floor's own runtime authorities are explicit closure seeds: the gate-bounded subject refused at output-policy install because resolve_channel_policy had only ever resolved by pool-membership coincidence — the flat bare-name channel found gunbc.output_policy because the whole corpus was loaded, not because the policy closure references it

REQUIRED_FLOOR_RUNTIME_AUTHORITY_MODULES names every module the floor's
Rust evaluates by name outside the gate roster: the policy module (its
rosters), v2.workflow.floor_naming_hygiene (qualified evaluations), and
gunbc.output_policy (bare, from install_output_policy_in). All three are
seeds of the gate closure; a new by-name evaluation adds its module here
or refuses at its own call site.

Measured: the first gate-bounded run (srv2, at 2d5502a) got past both
reference-closure indexes and refused with "no declaration named
'resolve_channel_policy' in this execution's loaded index".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* A by-name evaluation of a module's declaration runs in THAT module's scope: the floor installed the output policy and the naming-hygiene predicates from the policy module's frame, which reached gunbc.output_policy only by the accident of the whole-tree reference closure — under the gate-bounded subject the module was loaded and the name still refused

floor_authority_frame(prepared, module) builds a hermetic frame over one
module's exact claim scope. install_output_policy_in now receives the
frame over gunbc.output_policy; floor_barren_test_sidecars the one over
v2.workflow.floor_naming_hygiene. The policy module's frame keeps only
the policy module's own rosters.

Measured (srv2, lanes 5 and 6): with gunbc.output_policy present in the
1,954-module subject — the seeds changed the seed count 906 -> 908 and
the closure not at all — resolve_channel_policy still refused as "no
declaration named ... in this execution's loaded index". The scope, not
the subject, was the coincidence.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* The floor's rosters are joined only over identities inside the required gate — an enrolled identity whose module the gate never loads is withheld with the same accounting as cost-debt withholding, not refused as stale; and two modules that reached rust_target_model_staging by bare reference now import it, because the loader follows bare references only for import-free modules while the claim scope follows all of them

Measured on the first gate-bounded fold (srv2 lane 7, CI at 006b0ef):
ExpectedRedIdentityDidNotExecute count=39, every row in a module outside
the gate roster; and v2.test.lens_vacuity.vacuity_test x5 ERROR
no-such-function `rust_target_model_staging`, reproduced standalone with
`gunbc run --entry src/v2/test/lens_vacuity/vacuity_test.dag`. The
loader's both-closure (build_both_closure_edge_index) skips the bare
scan for any source that declares import lines, so rung_3_4_common
(one import) and leaf_model_verification's bare edge to
v2.extdeps.languages.rust was never followed; under the whole-tree
subject the flat channel found it anyway. The import is the form 10 of
the 12 sibling callers already use; the loader/scope divergence is
recorded in the PR.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* The gate closure follows bare cross-module references from EVERY module, with the loader's own scanner, to a joint fixpoint with containment ancestors — the loader's both-closure bare-scans only import-free sources, while the claim scope the fold builds over the subject follows bare references from all of them; and route-gap expectations located outside the gate are withheld like the roster rows they join

Measured 2026-08-29 on srv2: with the gate subject, `gunbc run` of
v2.test.lens_vacuity.vacuity_test refused no-such-function
`rust_target_model_staging`, then `eval_context` after the first was
imported — one absent module per run, because rung_3_4_common (one
import line) and leaf_model_verification reach them by bare reference
and build_both_closure_edge_index skips the bare scan for any source
that declares an import. The fixpoint reuses
bare_reference_pull_paths_for_source, so the relation is the loader's
and not a second scanner; the count of modules pulled this way is
printed on the gate-closure line.

Lane 8 (srv2) then refused `floor_route_gap_expectations: located
identity is absent from derived roster` for an identity whose module is
outside the gate: the roster had its outside-gate rows withheld and the
expectations had not. Both sides now withhold by the same predicate,
counted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* Cost-debt rows outside the required gate are withheld from the staleness join, route-gap expectations honour cost-debt withholding, and emit_on_demand_classical_not_native_one_build_holds moves to the cost-debt roster — it is budget-refused before it reaches the host effect its route-gap enrollment expects, on both hosts

Measured on the first complete gate-bounded fold (srv2 lane 10 and CI at
e8effe8, identical): verdict=FloorRefused with unexpected_failures=0 —
no claim inside the gate fails — and two bookkeeping refusals: 122
STALE-COST-DEBT rows, every one in a module the gate never loads, and
one STALE-ROUTE-GAP row whose claim ran past its CPU ceiling before
reaching the effect. The first is the same out-of-scope population the
expected-red and route-gap joins already withhold, now counted the same
way. The second is a real cost debt (floor_cost_debt already records
this claim at 502 -> 2374 ms), and cost debt wins over route-gap
enrollment by the roster's own rule; the expectations decode now treats
a cost-debt-withheld identity as dormant rather than absent.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* Two lens_module_gate_witness rows leave the expected-red roster: under the gate-bounded subject both PASS on CI and on srv2, and the floor refuses a passing enrollment as STALE-QUARANTINE

Measured at 1f4bda9 (CI) and srv2 lane 12: verdict=FloorRefused with
unexpected_failures=0 and exactly these two STALE-QUARANTINE rows on
CI. Both are "live" claims whose question ranges over the loaded
corpus; under the gate closure that corpus is 2,021 modules rather
than 4,260, and the population they were red on is outside it. That
is a narrowing of what the claim observes, stated here rather than
hidden: the whole-corpus receipts run is where the wider question is
asked again. srv2 additionally passes four emit_host_* rows that stay
red on the required host; those stay enrolled — CI is the oracle for
the required gate.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* Eleven claims interrupted before verdict on the gate-bounded subject join the cost-debt roster as proven chunk 12 — the same eleven on the GitHub runner and on srv2, run after run

At 92cc92e the floor reports verdict=FloorRefused with
unexpected_failures=0, no stale rows, no now-passing rows, and eleven
INTERRUPTED-BEFORE-VERDICT identities (cost_coverage_witness x3,
loaded_carrier_receipts x3, lens_closure_question_zero_holds_live,
green_control_sanctioned_reader_body_not_flagged,
same_grammar_parse_ingest_bridge_holds, kotlin_grammar_parse_accepted,
nominal_distinct_control_compiles_ok). The set is identical at e8effe8
and 1f4bda9 on CI and in srv2 lane 12, so it is a property of the
subject, not of host load: on the gate closure these claims first-touch
artifacts the whole-tree fold had warmed before reaching them. Declared
here as the roster's own containment for a cost the ceiling cannot
hold; the exit is the warm, as the roster's header states.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* lens_module_gate_holds_live joins cost-debt chunk 12: it was interrupted at 1076ms the run after its sibling was withheld, because the 1.07s pool-root module_path_index fill is billed to whichever consumer runs first

CI 0829ad8: verdict=FloorRefused, unexpected_failures=0, one
INTERRUPTED-BEFORE-VERDICT row. The claim-cost receipt reads
budget_interrupted 1076ms for it and
`[floor-shared-fill] cache=module_path_index key=.../src/v2/lens
fill_ms=1070 paid_by=...lens_module_gate_holds_live consumer_claims=1`;
at 92cc92e the same fill was paid by lens_closure_question_zero_holds_live
(consumer_claims=2) and this claim passed. The index is keyed on a pool
root the decl_facts seam asks for at claim time, so preparation cannot
warm it ahead; with both consumers withheld nothing pays it. The
roster's own header names the warm as the exit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* The pool-root module_path_index for src/v2/lens is warmed in preparation by evaluating the declared producer once in its own module's scope — the 1.07s fill was a positional bill that interrupted a different lens_module_gate_witness live claim in each of three consecutive runs — and the two fill-only rows leave cost-debt chunk 12

CI 92cc92e, 0829ad8, 154fb1f: each run's single INTERRUPTED-BEFORE-VERDICT
row was the next `lens_module_gate_witness` live claim in evaluation
order, at 1068–1252ms, with the claim-cost receipt and
`[floor-shared-fill] cache=module_path_index key=.../src/v2/lens`
naming that claim as the payer. The witness-roots warm cannot reach a
per-pool-root key; this warm evaluates
`v2.lens.registry.completeness.lens_registry_completeness_live_facts`
in that module's frame, so the root comes from
`lens_registry_completeness_pool_roots` and the key is the consumers'
by construction. Adjudicated with the other preparation warms as
`ModulePathIndexBuild/lens-pool-roots`; skipped (printed) when the
subject does not carry the producer; a producer that fails to evaluate
refuses. The two rows whose entire cost was this fill leave chunk 12,
as the roster header says they must once the warm exists.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* lens_closure_question_zero_holds_live leaves the expected-red roster: with the src/v2/lens pool-root index warmed in preparation it passes, as its two siblings did once they stopped paying that fill

srv2 lane 13 at 8ad4091: `[floor-shared-fill] cache=module_path_index
key=.../src/v2/lens paid_by=<outside-fold> consumer_claims=3`, no lens
claim interrupted, and STALE-QUARANTINE for this row — the same row
that was red only while it paid the fill (CI 92cc92e).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* The four bootstrap_footprint_anchor claims join cost-debt chunk 12: 474–505ms CPU on three consecutive CI runs with no fill billed to them, so the 500ms ceiling decides them run by run

CI f462bc9: planned=executed=2834, passed=2754, known_red_held=27,
failed=0, no stale rows, interrupted_before_verdict=4 — these four, at
502–505ms. At 154fb1f the same four completed at 487–504ms and at
0829ad8 at 474–485ms; the run-to-run spread is the runner slot, not the
claim. The gate did not change their cost — nothing in the shared-fill
attribution names them — so the disposition is the roster's, not a
ceiling change: withheld as declared debt until the host-load row
lands.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* The rust-unit-tests job runs the unit population: the lib tests that prepare or build over the live tree carry a live-corpus ignore reason and leave the required run, and the rot the first-ever `cargo test` exposed is repaired at its authorities, not hidden

`cargo test -p v1-compiler --lib` had never run in CI. Its first run (33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, because ~126 of the "unit" tests each build a fresh multi-entry index over `src/v2`+`dag` (4,260 modules; ~197 single-thread minutes on srv2 under nextest, 97 tests over 60 s, `self_compile_all_modules` alone 505 s), and the runner executes them serially. Those tests now carry `#[ignore = "live-corpus: ..."]` — the crate's existing `manual:` convention, one class, declared on the carrier — and the rung-drop row `required_gate_bankruptcy` names them by their instrument (`cargo test -p v1-compiler --lib -- --ignored --list`). The unit population runs in ~10 s after the compile (srv2: 537 passed / 136 ignored).

Of the 44 failures the full run exposed, the 15 in the unit population are repaired where the fact lives:
- REAL DEFECTS (two): `try_index_source_root_into_module_index` keyed files by their walked path, absolute since #9548 anchored the root, while the strict builder keys through `module_index_path_key` — the primary-precedence index disagreed with the strict one on every path; keyed through the same authority now. `try_build_module_index` carried `if root_idx > 0 { continue; }` before its collision refusal (from #7791), so a module declared in two roots shadowed silently in the builder named strict; the guard is gone and overlay callers have `build_module_index_primary_precedence`.
- v1 TYPECHECK DEFECT: `declared_type_inhabitance` reads `params` as generic type parameters, which is exactly what a callable formal carries, so every higher-order call produced a counted advisory with a false reason (#9194); `direct_call_argument_inhabitance_diags` now excludes callable formals like its sibling `direct_call_arg_type_mismatch`. Mirror regenerated (two passes: the test blob lives inside the emitter).
- STALE AUTHORITY ROWS after the #9637 reorg: 12 entry literals in `gunbc.ci_layer_roots` and 2 in `gunbc.offline_local_recipe` repointed; the two long-lane rows and one freeze row whose subjects 611fd02 and #9206 deleted are gone; the three freeze rows for relocated witnesses are DELETED rather than repointed, because the freeze gate defines relocation as growth and the roster may only shrink. `gunbc.non_fold_residue` receives the 22 sites it lacked and loses the 4 whose subjects moved or greened; its .dag twin therefore leaves floor_expected_red (it passes) and joins cost-debt chunk 12 (629 ms against the 500 ms ceiling, its whole cost the corpus scan it checks).
- DELETED SUBJECTS: `cli_run::floor_witness_a_prove` (its runner, prove test and fixtures went with the FLOOR-Y cutover); the census pin tests and helpers for `docs/probes/census_extra_excludes.txt` (#9132 deleted every transcription).
- EARLY ABORTS: three witness-admission tests and the roadmap jsonl-carrier test were "fast" only because they failed before their expensive step; with their inputs repaired they read the live tree for 2-4 minutes each and join the live-corpus class.
- TEST ROT: the reorg rewrote a revision-addressed literal (`9ce6526c528:dag/gunbc/roadmap/...`) that must name the pre-reorg path; the method-existence witness anchored on a `Primitive()` row the frontier no longer holds.

Not done here, receipts-lane rot for follow-ups: `test.claim.expectation_frontier_witness_test` names the deleted long-lane file; the affected-set kernel (`floor_diff_edits_from_diff_text`, `rerun_frontier_nodes_for_entry`, …) has no production consumer since FLOOR-Y and should go with its remaining fixture-dependent tests; the roadmap jsonl-carrier test takes 453 s and fails after its expensive step.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

* The host-tool probe root carries the process id: temp_dir() is the host's shared /tmp on a self-hosted runner, and a fixed directory name collided with one another runner slot's uid left behind — PermissionDenied on two tests that had never run in CI before

Found by the first green-by-duration run of the unit population (dc3ca52: 533 passed, 2 failed, 9.59s). The same class as the shared-/tmp emit_on_demand collision on srv2: a test that writes a fixed path into a location the process does not own.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013G3t66QwKJFK5w8jXxMXP2

---------

Co-authored-by: Brian Searls <briansearls1@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…al test, a cited module, and three rosters

CI found what my own dangling-import sweep could not, because that sweep only
asked about the modules I had listed rather than about every module the deletion
removed.

1. dag/test/manual/git_upstream_model_execution_test.dag imported the deleted
   test.claim.git_upstream_model_witness. I removed the Mercurial and Pijul
   manual execution tests and left the Git one, which produced ten
   NewUnresolvedness bindings at the wave-admission wall. It is R0 SCM and goes
   with its siblings. A sweep over EVERY deleted module's declared name now
   reports zero dangling importers.

2. dag/extdeps/git/versioning.dag is RESTORED. I deleted it as zero-importer, but
   gunbc.emit_stage_blocking_population_census CITES it by DeclarationRef --
   citations are a reference channel distinct from imports, and I measured only
   imports. It therefore has a real non-SCM consumer and survives under the same
   reachability rule that kept extdeps.git. A DeclarationRef sweep over every
   other deleted module reports no further citations.

3. Three rosters carried entries for deleted subjects: gunbc.non_fold_residue
   held two SCM rows (the nfr_roster_receipt staleness panic), src/v2/workflow/
   floor_route_gap held expectation rows for all three manual execution tests,
   and gunbc.prose_row_frontier listed four SCM files.

4. src/v2/lens/reference_deps carried a closure observation whose entry file this
   change deletes. It has no consumer anywhere, so the subject is gone and
   nothing reads the result; repointing it would keep counts measured against a
   different file, so it is deleted rather than re-aimed.

NOT TOUCHED, deliberately: prose_row_frontier holds ~27 further entries naming
files that do not exist, left over from the #9637 directory reorganisation. An
existence-based filter would have swept them all, which is unrelated scope this
transaction has no business taking. Only the four SCM paths are removed. The
continuity fixture's references to deleted SCM artifacts are historical receipt
text and stay exactly as written.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UyXPXQkPB9wisCVyyBJrhE

…tier ledger entries that were never mine to remove

TWO AMENDMENTS, both correcting my own errors rather than the excision.

THE BRACE EDIT WAS WRONG IN A WAY MY CHECK COULD NOT SEE. Removing three Cons
rows from floor_route_gap required removing three closing braces from
chunk_03's trailing pile. I anchored a regex on 'Empty {}' and re.search takes
the FIRST match -- the file has several chunks, so the braces came out of an
unrelated structure: 129 parse errors, floor refused, the whole witnesses lane
down. Brace count stayed balanced at 416/416, which is exactly why I cleared it:
I verified the one invariant the bug preserved and reported the file sound. The
redo locates chunk_03 by name, asserts all six target lines by content before
deleting, and takes braces only from lines containing nothing but braces.

PROSE_ROW_FRONTIER IS RESTORED TO BASE, BYTE-IDENTICAL. I removed four SCM paths
on the theory that it is a roster of existing files. It is not: it is a MONOTONE
DISSOLUTION LEDGER of migration work already performed, and the gate prefix-
matches FUTURE introduced prose rows against it. A deleted path's entry is inert
while the file is absent and prevents fresh prose debt if that path ever returns,
so removing the string buys no import, typecheck or closure reduction and only
narrows a generic safety policy. These four strings are not surviving SCM product
authorities; they are safety history, exactly like the acceptance events that
correctly retain the names of deleted SCM artifacts.

The ~27 further entries naming files moved by #9637 stay untouched, and the
likely defect there is the opposite of staleness: their NEW paths were probably
never enrolled, so an existence filter would delete the remaining historical
scope without restoring the current scope. That repair needs a measured
old-path to current-path relation, and it is not this transaction's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UyXPXQkPB9wisCVyyBJrhE

…tead of aborting

The copied-accumulator lens could already decide a real module; what it could not
do was say which modules it had asked. Its population was nine hand-authored
paths, so "no suspects" meant "none among those nine" and the rest of the corpus
was not clean but unasked.

v2.lens.complexity_accumulator_copy.corpus_gate takes the subject universe from
module_declaration_facts_live -- the producer the module graph already resolves
the corpus with -- and carries suspects and unreadable subjects at identity
grain, with the Unclassifiable causes counted per cause rather than summed. It
consumes the same accumulator_copy_findings authority the compile gate runs; the
ingest chain is factored to source_tree so findings and tree are two consumers of
one chain rather than two spellings of it.

Three failure arms found by executing it, all the same class -- a failure that
absorbs or aborts instead of refusing:

  * The roster named src/v2/workflow/glob_discovery_law.dag, moved to
    src/v2/test/workflow/ by the #9637 reorganisation. The row was never
    repointed and, the gate being offline, nothing ran it to notice.
  * That missing path did not fail the gate, it ENDED THE PROCESS: the subject
    read used the filesystem_read intrinsic, whose result carries content and no
    success channel. At corpus grain every subject after the missing one is never
    asked. The read now folds through filesystem_read_outcome and the analysis
    standing gains a SourceUnreadable arm; the same defect in
    v2.lens.identity_captured_navigation.roster_gate is fixed with it.
  * module_declaration_facts panics on an absent pool root, so the below-floor
    arm's red is only authorable from a directory that exists and holds no
    modules. That refusal is correct; the witness is repointed rather than the
    host changed.

Executed evidence, all green by execution with its control:

  * an_unreadable_subject_is_refused_with_its_cause + a_readable_subject_still_
    reaches_the_lens. The red control is measured, not asserted: against the
    pre-fix filesystem_read spelling the first fails with a runtime type error
    and the second never runs at all.
  * a_planted_copied_accumulator_is_caught_through_the_corpus_path + a_clean_
    accumulating_fold_stays_clean_through_the_corpus_path, over two fixtures
    differing in exactly one construction and read from disk, so the corpus path
    is what discriminates rather than the detector alone.
  * corpus_subtree_gate_reports_its_unreadable_population and
    an_empty_population_is_below_floor_rather_than_clean.

What the census says, and it relocates the lane's blocker. Re-derive with
census_for_paths / census_for_root in
v2.test.claim.long.accumulator_copy_corpus_census_test; the numbers are in the
pull request rather than transcribed here. Reach is bounded first by INGEST
COVERAGE -- most sampled subjects are refused by the v2 grammar before any lens
runs -- then by cost, then by a process-lifetime segfault. Roster policy is
nowhere on that list, and neither is decl_facts.

The asymptotic half is separately answered, negatively, and the instruments that
answered it are kept because the evidence reads the wrong way at first glance:
the ingest yields a grammar production tree encoded in kernel nodes, so cost_lens
folds over it and returns a class for the PARSE SHAPE, not the program. The
budget gate's subjects are semantic Arrows; bridging needs lowering. The shape
detector needs only the production tree, which is why it walks real modules
today.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

…tead of aborting (#10645)

* Walk the real corpus with the copied-accumulator lens, and refuse instead of aborting

The copied-accumulator lens could already decide a real module; what it could not
do was say which modules it had asked. Its population was nine hand-authored
paths, so "no suspects" meant "none among those nine" and the rest of the corpus
was not clean but unasked.

v2.lens.complexity_accumulator_copy.corpus_gate takes the subject universe from
module_declaration_facts_live -- the producer the module graph already resolves
the corpus with -- and carries suspects and unreadable subjects at identity
grain, with the Unclassifiable causes counted per cause rather than summed. It
consumes the same accumulator_copy_findings authority the compile gate runs; the
ingest chain is factored to source_tree so findings and tree are two consumers of
one chain rather than two spellings of it.

Three failure arms found by executing it, all the same class -- a failure that
absorbs or aborts instead of refusing:

  * The roster named src/v2/workflow/glob_discovery_law.dag, moved to
    src/v2/test/workflow/ by the #9637 reorganisation. The row was never
    repointed and, the gate being offline, nothing ran it to notice.
  * That missing path did not fail the gate, it ENDED THE PROCESS: the subject
    read used the filesystem_read intrinsic, whose result carries content and no
    success channel. At corpus grain every subject after the missing one is never
    asked. The read now folds through filesystem_read_outcome and the analysis
    standing gains a SourceUnreadable arm; the same defect in
    v2.lens.identity_captured_navigation.roster_gate is fixed with it.
  * module_declaration_facts panics on an absent pool root, so the below-floor
    arm's red is only authorable from a directory that exists and holds no
    modules. That refusal is correct; the witness is repointed rather than the
    host changed.

Executed evidence, all green by execution with its control:

  * an_unreadable_subject_is_refused_with_its_cause + a_readable_subject_still_
    reaches_the_lens. The red control is measured, not asserted: against the
    pre-fix filesystem_read spelling the first fails with a runtime type error
    and the second never runs at all.
  * a_planted_copied_accumulator_is_caught_through_the_corpus_path + a_clean_
    accumulating_fold_stays_clean_through_the_corpus_path, over two fixtures
    differing in exactly one construction and read from disk, so the corpus path
    is what discriminates rather than the detector alone.
  * corpus_subtree_gate_reports_its_unreadable_population and
    an_empty_population_is_below_floor_rather_than_clean.

What the census says, and it relocates the lane's blocker. Re-derive with
census_for_paths / census_for_root in
v2.test.claim.long.accumulator_copy_corpus_census_test; the numbers are in the
pull request rather than transcribed here. Reach is bounded first by INGEST
COVERAGE -- most sampled subjects are refused by the v2 grammar before any lens
runs -- then by cost, then by a process-lifetime segfault. Roster policy is
nowhere on that list, and neither is decl_facts.

The asymptotic half is separately answered, negatively, and the instruments that
answered it are kept because the evidence reads the wrong way at first glance:
the ingest yields a grammar production tree encoded in kernel nodes, so cost_lens
folds over it and returns a class for the PARSE SHAPE, not the program. The
budget gate's subjects are semantic Arrows; bridging needs lowering. The shape
detector needs only the production tree, which is why it walks real modules
today.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* Answer the fixture rows with two predicates, not a sentinel packed into an Int

Review remark on #10645: the -1 returned for a not-established subject was
"unlovely but deliberate". The reasoning behind it was right -- an unreadable
fixture must fail BOTH witnesses rather than satisfying the clean one -- and the
carrier was wrong. A sentinel in an Int is the same collapse of a typed standing
onto a scalar that the rest of this change exists to undo, and it is safe only
while every caller remembers what -1 means.

row_has_suspect and row_scanned_without_suspect each answer their own question
and each answer false for a not-established subject, so an unreadable fixture is
neither suspect nor clean and fails both witnesses by construction rather than by
arithmetic.

The guarantee is re-established by execution, not by inspection: pointing
fixture_rows at two absent paths turns BOTH witnesses red, and they are green
again on the real fixtures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* chore: regenerate drifted generated artifacts (ci auto-heal)

Ledger-Repair-Judged: docs/design-failure-modes.md
Ledger-Rows-Repaired: docs/design-failure-modes.md roster_is_its_own_denominator
Ledger-Repair-Judged: docs/design-rung-drops.md

* Write the SourceUnreadable arm at the one consumer that matches the cause totally

Floor blocker on #10645, and it is the class this branch keeps finding, turned
on the branch itself: widening a coproduct is defeated at the CONSUMER, not at
the declaration. I grepped for total matches before adding SourceUnreadable and
concluded there were none. The grep looked for the cause variants; this match is
over the OUTER SourceFindingsStanding with the cause nested inside the pattern,
so it never appeared in the results.

  accumulator_copy_roster_standing_test.dag:72:3: error: non-exhaustive match:
    missing variant(s) SourceFindingsNotEstablished { cause: SourceUnreadable }

The wall caught what the search missed, which is the whole argument for the match
being total with no wildcard: a catch-all there would have absorbed the new
variant silently and the widening would have shipped looking complete.

SourceUnreadable is unreachable on that call -- source_findings takes the text it
is handed and never reads a file -- so the arm answers false, and the annotation
explaining why sits ABOVE the declaration: the first cut put it inside the match
body, which §4c refuses at module-item grain (six blocking errors, caught by the
same local check).

Verified under the gate-equivalent tree view rather than a plain resolve, because
a plain resolve does not decide exhaustiveness: gunbc compile
--dependency-pool-index primary-precedence over this entry and the three other
entries the widening reaches -- 0 blocking errors on all four.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* Split the lens witnesses by measured cost, and carry the refusal census into the verdict

Two things, both found by CI rather than by reading, and both about a verdict
that said less than it knew.

REVIEW 61280 (REQUEST_CHANGES) IS HALF RIGHT, AND THE HALF IT IS RIGHT ABOUT IS
REAL. It reported that the no-suspect arm discarded refusal_sites and
refusal_causes, and it did: corpus_report computed both and the disposition threw
them away, so a caller reading the disposition could not tell a population with
no refusals from one with hundreds. That is the collapse of a typed standing this
branch exists to stop, committed at its own last step. The arm now carries the
census and is renamed CorpusNoSuspectsObserved, because "clean" asserted more
than was established.

The other half is declined, and by a standing ruling rather than by preference.
The review asked for a refusal disposition BEFORE the corpus may be declared
clean -- that is, for refusals to gate. The operator ruling of 2026-07-13,
carried in this lens's own compile_gate_law, splits the Finding coproduct so that
a Poly2Suspect rejects while Unclassifiable causes ride the accepted channel
"typed per-cause, located, counted, NEVER GATING AND NEVER SILENTLY DROPPED".
Gating would also be wrong on the facts: refusals are the EXPECTED state of a
real subject -- the sibling roster budgets them per file with ceilings -- so an
arm refusing on refusal_sites > 0 would refuse essentially every real population
and convey nothing by doing it. The new witness asserts the payload, not the arm
name, on a real subject whose residue the roster already budgets.

THE FLOOR BLOCKED FIVE WITNESSES WITH interrupted_before_verdict, AND THE CAUSE
IS PRICE, NOT CORRECTNESS. Measured per witness: a five-line fixture ~4.7s, a
186-line module ~50s, the 874-line analyze.dag ~1272s -- ingest cost scales with
subject size and does so superlinearly. The floor budgets an ENTRY rather than a
witness, so one twenty-minute member reported every sibling in its file as
interrupted, taking cheap evidence down with it.

So the witnesses are split by cost, not by importance. Every discriminating
control -- the typed-read pair, the corpus-path planted/clean pair, the
population-floor red -- now sits in claim/complexity/ entries that run in seconds
and stay ON the floor; the positive control was repointed from a 186-line module
to the five-line fixture, which establishes the identical claim at 2.8s instead
of fifty. Only the corpus-grain witnesses, whose price is the corpus, move behind
a floor exclusion.

AND THE EXCLUSION HAD TO GO WHERE THE FLOOR ACTUALLY LOOKS. The ci_layer_roots
row added earlier governs DISCOVERY only; run_required_floor consults
floor_prepared_subject_exclusions and nothing else, as that list's own note
records. The roster-gate entry is the sharper case: it is operator-ruled OFFLINE
by its own note and had NO floor exclusion at all -- it stayed off the floor only
because nobody edited it, and repointing its stale row was the first edit. "Nobody
has touched it lately" is not an exclusion.

Verified: gunbc compile --dependency-pool-index primary-precedence over all three
entries (0 blocking errors), cargo check -p v1-compiler, and the five floor-bound
witnesses green at 29ms..3.6s.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* Stop excluding a module the corpus imports by name from the floor's prepared subject

The floor refused the WHOLE subject at run 34016411960 before any witness ran:
excluding test/claim/complexity/accumulator_copy_roster_gate_test.dag from
floor_prepared_subject_exclusions does not skip its witnesses, it drops the path
from prepare_repository_closure, so live_read_classification_test.dag:46 -- which
imports that module by name for its ReadsLiveTree classification -- refused with
`unresolved import`. Nothing in the change was measured.

The exclusion was also priced against the wrong number. Measured on this branch,
the entry's one changed witness costs 22.2s wall (22.1s of it entry resolve), not
the ~15m its own note quotes; it reported interrupted_before_verdict alongside the
two genuinely corpus-grain census witnesses and was excluded on that association.
Those two remain excluded and nothing imports them.

The standing constraint is now recorded on the list itself: a module with
importers may not be excluded here, only one nothing names.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* A corpus-priced assertion cannot be a witness: make the census entry points, and wall the exclusion list

Run 34018018622 refused with cause=ChangedWitnessOutsidePreparedSubject: the
required floor admits a CHANGED witness regardless of any exclusion, so the two
corpus-grain `test fn` rows introduced by this PR could not be excluded by the
change that introduced them. That is correct and it is the point -- an exclusion a
new witness could opt into on its own landing commit is the escape hatch DESIGN
section 5 forbids. At ~80s per subject those rows can never run, and a witness that
cannot run is roster membership standing in for a verdict.

So they stop being witnesses. claim/long/accumulator_copy_corpus_census_test.dag
moves to v2.lens.complexity_accumulator_copy.corpus_census as entry points beside
the lens (a barren *_test.dag is itself refused by floor_naming_hygiene, so the
rename is required, not cosmetic). Both exclusion rows -- the ci_layer_roots
discovery row and the floor-preparation row -- delete with them. The executing
evidence for the corpus path is unchanged and is now the whole of the claim: the
cheap planted/clean pair in claim/complexity/accumulator_copy_corpus_path_test.dag,
which runs on every push over a population corpus_gate discovers.

Second: the constraint on floor_prepared_subject_exclusions is now a wall rather
than a note. assemble_prepared_subject_closure refuses with
cause=ExclusionOrphansImporter, naming the importer, the excluded module and the
row that matched, when any retained module imports an excluded one. Previously that
situation surfaced as `unresolved import` against a file nobody had touched, which
is why its first two diagnoses both concluded the module had been moved. The import
extractor is the one `import_resolution_facts` folds, and preparation already holds
every source's bytes, so it costs no extra read.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* Name the census's next-rung trigger, and record the executed RED for the exclusion wall

DESIGN 4b(2): the corpus census is now a named entry point enrolled in nothing.
That is honest and it is also the state that decays without any red appearing, so
the class names its trigger rather than leaving it as "when someone runs it". It is
can-climb-after-one-grounding: an ingest realization that does not re-parse source
in the interpreter.

The row states what that trigger must be SUFFICIENT FOR, because the loss is
corpus-grain while the tempting trigger is per-subject: corpus_gate returning a
verdict over the DISCOVERED population, inside one required-lane budget AND inside
one process. Neither half implies the other -- a tenfold per-subject speedup leaves
the sweep hours long, and a sweep that fits the budget still dies with SIGSEGV
around the twentieth subject. An artifact delivering one half contributes to the
trigger and does not retire it. The row also states what is NOT claimed: that the
tracked corpus is free of copied accumulators.

The ExclusionOrphansImporter wall's RED was executed, not assumed: excluding
analyze.dag -- imported by three modules and changed by nobody -- refuses at
preparation and names the exclusion row beside each importer, which is the half
missing when the same situation was diagnosed twice as a module having moved. The
comment names the command rather than transcribing the run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* File the SIGSEGV as its own failure-mode class; delete the now-inert exclusion row and its figures

The census sweep dying by SIGSEGV was a subordinate clause in a message and
existed nowhere else. It is a compiler failing to fail closed: DESIGN section 5
admits succeed-fully or fail-with-a-typed-located-diagnostic, and process death is
neither -- no cause, no locus, no count, so nothing can enrol it, attribute it or
bound it, and a sweep that died at subject k presents in the same shape as one that
finished. Filed as gunbc.recurring_failure_mode
sweep_terminated_by_process_death_rather_than_a_typed_refusal, rung found at BELOW
the ladder (silent wrongness, not the bottom rung), ceiling structurally guaranteed
because the property is decidable -- an explicit stack or depth bound in the
interpreter's walk converts unbounded native recursion into a located refusal. The
trigger states its sufficiency: any traversal deep enough to exhaust the native
stack refuses, not a guard around one instrument and not a bigger stack. Fixing it
is not in this PR.

Separately, the floor exclusion row for accumulator_copy_corpus_census_test.dag was
still standing after the file moved out from under it, so it matched nothing -- an
inert row with a long justification, which is the shape the ledger warns about. It
and its comment delete. What replaces it is the pair of constraints the list
actually has, both enforced elsewhere rather than asked for in prose: a row may not
name a module anything imports (ExclusionOrphansImporter), and a row is not how a
changed witness gets out of running (ChangedWitnessOutsidePreparedSubject).

Review 61303's advisory applied: the transcribed wall-clock figures are replaced by
the entry points that re-derive them (census_for_paths, population_for_root). One
of those figures had already rotted and bought a wrong exclusion, so this is the
same lesson twice.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* Coverage is decided before every other arm: a truncated sweep refuses instead of reporting its survivors

The class filed one commit ago sits BELOW the ladder, not on its bottom rung, and
DESIGN section 5 forbids silent wrongness outright rather than admitting it as a low
rung. So it does not wait for its trigger. Getting from outside the ladder onto rung
1 is owed as soon as the class is classified honestly -- an honest classification
that changes nothing about what gets built is rung inflation in the opposite
costume.

corpus_gate_disposition_over decides coverage first, because every other arm is a
statement ABOUT a population and none of them is true of a population that was not
walked. The discovered list and the reported rows are walked in lockstep; the first
divergence, or the rows running out, ends the covered prefix and everything after it
is reported by name as CorpusCoverageIncomplete.

It is an identity join, not a count equality (DESIGN section 5). A batch re-run
after a death reports the right NUMBER of rows over the wrong subjects, and a count
comparison is green on exactly that. The lockstep walk is also why this is not
quadratic: a membership test per discovered path would be the nested fold over one
collection this lens exists to catch, and "the corpus is only a few thousand" is the
not-time-stable excuse section 6 refuses.

Three witnesses, ~3s each, on the floor: a truncated sweep refuses; a right-sized
report over the wrong subjects refuses; and a complete report over the same
population reaches its ordinary verdict -- the positive control, without which a
guard that refused everything would satisfy both reds. Verified discriminating by
mutation rather than by reading: neutering the join to answer "nothing missing"
turns both reds red and leaves the control green. They do not retire when the
depth-bounded walk lands; they become its regression control.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* chore: regenerate drifted generated artifacts (ci auto-heal)

Ledger-Repair-Judged: docs/design-failure-modes.md
Ledger-Rows-Repaired: docs/design-failure-modes.md sweep_terminated_by_process_death_rather_than_a_typed_refusal
Ledger-Repair-Judged: docs/design-rung-drops.md

* The floor's 500ms CPU line prices out every ingest-touching assertion in this lens, at any subject size

Run 34022136976 interrupted seven identities. The log discriminates the cause and
it is not a shared budget or a process death: each row reads raised_by=cpu_deadline
cpu_at_least=~506ms/500ms, and the totals are interrupted_cpu_deadline=6
interrupted_wall_deadline=1. Per witness, on the CPU clock. The local figures agree
rather than disagreeing -- a preempted row is cut just past the line and reported
UNMEASURED, so 506ms is the deadline, not the cost, and the cost is the ~3s
claim_batch measures.

The consequence is larger than these witnesses. Interpreted ingest of a FIVE-LINE
fixture measures ~3s, and a four-line String snippet with no filesystem read
measures about the same: six times the line at the smallest subject expressible. So
no assertion in this lens that reaches the ingest can be enrolled at any subject
size -- which is why every witness this lens has ever had is frozen or deferred, a
fact visible in the roster that had never been explained.

So the evidence is re-aimed rather than trimmed, and the scope is stated rather
than rounded up. The witnesses that remain touch no ingest and measure 0-1ms: the
coverage join, whose subject IS the join and whose inputs are rows, and the typed
read arm, whose subject IS the read -- the mechanism the SourceUnreadable red can
fail open into. Both are different claims from the ingest claim, not cheaper
proxies for it. The ingest-priced predicates -- planted caught, clean stays clean,
readable subject reaches the lens -- become plain fns beside the corpus census:
they pass by execution under claim_batch and are enrolled in nothing, and they
dissolve on the same trigger.

The one-line repoint of the stale glob_discovery_law row is reverted. Any edit to
that entry admits its 22s witness to the floor, so the repair is not landable until
the trigger clears; the specimen stays filed in roster_is_its_own_denominator.

Also recorded, in the class filed this morning: a floor budget preemption is NOT
that class. It is typed, located, counted and blocking -- the arm DESIGN section 5
asks for -- and the distinguishing question is not whether a run ended early but
whether ending early produced a cause or produced silence.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* Name the discovery-to-rows seam, and put the smallest-subject measurement in the trigger

Two sentences were being carried by one. "The ingest is unenrolled" was recorded;
"the discovery-to-join seam is unverified" was not, and only the second locates
where a real defect would sit.

The executing reds prove the join is correct GIVEN well-formed rows. The unenrolled
predicates prove the lens is correct GIVEN real files. Nothing executing joins those
halves: that corpus_rows_for_paths, folded over what corpus_paths discovers, yields
rows in the same order, at the same identities, at the same arity the lockstep walk
assumes. That assumption is load-bearing and no type states it -- a producer that
reordered or dropped a path reads as a truncated sweep, the right refusal for the
wrong reason, and one that silently repaired an order mismatch would make the guard
permanently green. Recorded beside the join, with the row to write first when the
trigger clears: not another join case, but one witness that discovers a small real
population and checks the produced rows against it at identity grain.

Second, the measurement that sets the bar moves into the trigger's sufficiency
clause, because it is the finding that outlives this PR. Interpreted ingest of a
five-line fixture, and of a four-line String with no filesystem read, both measure
about six times the 500ms line -- at the smallest subject expressible. That is not a
budget that could be raised to fit the work; it is a floor no ingest-reaching
assertion can ever clear, and it retroactively explains why every witness this lens
has ever had is frozen or deferred. A trigger that made large subjects affordable
and left the smallest at six times the line would restore nothing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* chore: regenerate drifted generated artifacts (ci auto-heal)

Ledger-Repair-Judged: docs/design-failure-modes.md
Ledger-Rows-Repaired: docs/design-failure-modes.md sweep_terminated_by_process_death_rather_than_a_typed_refusal
Ledger-Repair-Judged: docs/design-rung-drops.md

* Name the CPU line rather than transcribing it, and record that the debt contract is not a door

Two corrections from reading the authority instead of the number.

The floor's per-witness CPU line is now cited as
v2.workflow.required_floor required_floor_claim_cpu_safety_limit_ms everywhere this
lane mentions it. The figure is deliberately not carried: required_floor.dag's own
prose already states a stale ten-fold value for that function in nine places, two
hundred lines from the declaration, and five files corpus-wide repeat it. Copying
the digit here would have made this lane the tenth site of the exact class it spent
the morning filing. Not fixing that prose -- not this lane -- but not inheriting it
either.

Second, the trigger was written as though the ceiling might move. It will not: the
line did not drift, gunbc#9517 RESTORED it and froze the over-cost population as a
monotone debt contract in the same change. So it is an operator ceiling with a debt
contract behind it, and the trigger now says what must become true UNDER it -- an
ingest realization whose cost at corpus grain fits inside that line -- rather than
waiting for a budget that was deliberately put back.

And the debt contract is not an admissions queue. v2.workflow.floor_cost_debt
declares itself shrink-only ("from here the direction is shrink-only in earnest"),
so it is the roster of what the restored ceiling caught. "Enrolled in nothing" is
therefore not a state these entry points can leave by asking to be excused; the only
exit is the trigger. That now stands in the file rather than in a thread.

The ledger projection is regenerated in the same commit rather than left to the heal
job, whose push has now lost a non-fast-forward race twice.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* File the repair-job red, and correct my own count: one race, one designed supersede

A repair job that MODIFIES a branch can exit non-zero for a reason belonging to its
own protocol rather than to the content under review, and the only channel most
readers have is a red square beside the pull request. The red is true about the job
and false about the change, and nothing at that grain distinguishes them. Filed as
gunbc.recurring_failure_mode
repair_job_red_is_attributed_to_the_content_it_repaired.

Two arms, and they are not one mechanism -- I reported them as one before reading
the second log, which is the co-occurrence inference this ledger already records.

ARM ONE, a genuine race (run 34026632467): heal regenerated correctly and its push
was rejected non-fast-forward because I had pushed to the same branch while it was
building.

ARM TWO, and this is the more interesting half (run 34027083483): heal SUCCEEDED --
HealProduced, prior_head fc576da, healed_head f2d00e6, artifact pushed --
and then exited 1 with SupersededByHealedHead ... revalidation-required. That is by
design: the protocol refuses to report green for a head that no longer exists. Every
step worked and the pull request shows a failing job. It cannot be fixed by
retrying, because nothing is wrong.

So the row states its population honestly rather than claiming recurrence it does
not have: recurrence for arm one is NOT established by one receipt; arm two recurs
by construction, once per heal that lands. The trigger is sufficient for both -- a
retry-with-rebase ends arm one and leaves arm two red on every successful heal, so a
fix that only handles the race does not retire the row.

Rung mitigatable, ceiling mechanically preventable and deliberately not higher: the
job knows which branch it took, so the two outcomes are decidable and separable at
the reporting boundary -- but no compiler refuses a reader who misreads a red
square, so the wall is at the boundary, not in the reader.

Not fixing heal; not this lane.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

* Both halves of review 61363: refuse surplus identities, and stop claiming the join contains the crash

Both findings are real and both are mine.

ONE, THE COVERAGE WALK ONLY CHECKED ONE END. It returned "nothing missing" as soon
as the DISCOVERED list ran out, whatever rows remained, so a report carrying
subjects the population does not contain was accepted. The degenerate shape went all
the way through: an empty discovered population, one clean reported row, floor 1
reached the no-suspect arm -- because the floor counts REPORTED ROWS, so the guard
meant to run before it defeated the floor's own red control. A surplus identity is
not a lesser problem than a missing one: it means the rows did not come from this
population, so nothing about them is a statement about it. The walk is now a typed
three-way -- aligned, missing, surplus -- and CorpusCoverageSurplus refuses with the
extra subjects named. Two new witnesses, one per finding, at the exact shapes the
review named; both verified discriminating by mutation (neutering the surplus arm
reddens both and leaves the truncation red and the positive control green).

TWO, THE MITIGATION CLAIM WAS OVERSTATED, and in the one row that may least afford
it. corpus_gate evaluates corpus_rows_for_paths to completion before the join runs,
so a SIGSEGV during collection kills the process with the join never reached. The
join does NOT contain the in-process crash and never could from that position. What
it converts is a REPORT SHORT OF ITS POPULATION -- rows assembled across batches
after a death, a truncated row set arriving from anywhere. So the row now says which
arm climbed: the assembled-report arm reached rung 1, the crash arm is untouched and
stays below the ladder, and containing it needs a surviving reporting boundary
outside the dying process, which does not exist here and is not claimed.

Filing a row about silent wrongness and then inflating its own mitigation is the
failure that row exists to name. Caught by reading the code rather than the
sentence, which is the right way to have caught it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

---------

Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

…e that keeps it false (#10694)

A witness compiles, is kept off every executing cadence by a declared exclusion,
and then the subject it names is moved by a correct edit elsewhere. Nothing
executes it, so nothing observes that it now names nothing. The roster lists it and
the exclusion row explains why it is offline -- both true -- while the assertion
itself has become false and unfalsifiable in the same moment.

That is the decoration case, with the aggravating property that being offline is
DOCUMENTED and so reads as deliberate deferral rather than as no coverage. Live
specimen on main: accumulator_copy_roster_gate roster_glob_discovery names
src/v2/workflow/glob_discovery_law.dag, which moved to src/v2/test/workflow/ in
#9637. The entry is both frozen and discovery-excluded, so the row has not run
since; before the typed-read repair it would have aborted the process, after it it
would return false, and neither has ever been observed.

The half worth recording is why it stays: the floor admits a CHANGED witness
regardless of any exclusion -- correctly, since otherwise an exclusion would be an
escape hatch a witness could opt into on the commit that touches it -- and this
entry costs several times the per-witness CPU line. So editing the row to make it
TRUE admits it, and it then blocks the lane; leaving it false costs nothing. The
lane that found this repointed the row, measured the block, and reverted. A cost
gate that prices repair above neglect turns fixable staleness into standing
staleness.

Ceiling 4 rather than a validator, because the bad state is a dangling reference and
nothing else: a witness names its subject by a path literal, which is the positional
naming section 3 already refuses for citations. Named by a resolvable reference, a
moved subject would break the naming rather than the meaning and refuse at compile
whether or not anything executes it. The trigger says so, and says the
path-existence check is the rung-2 interim rather than the ceiling.

Neighbours checked at identity grain: not witness_that_fails_to_compile_is_absent
_rather_than_red (that file cannot compile and is absent from the rosters; this one
compiles and is present), and not stale_claim_survives_its_own_correct_edit (that is
prose with no mechanism that could have caught it; this is an executable assertion
whose mechanism is deliberately switched off).


Claude-Session: https://claude.ai/code/session_01H746YJwMsd7HxnijtCFGps

Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Exclusion does not skip changed-witness, so restoring roster_glob_discovery_zero_suspects_within_ratchet as interpreted file_gate interrupted the floor with no verdict. Keep the freeze identity; the claim is a typed Filesystem.Read of the post-#9637 path. The lens walk is roster_glob_discovery_file_gate_walk on the declared drop.

Co-authored-by: Cursor <cursoragent@cursor.com>