FLOOR-ROUTE-GAP-SELF-HOST: publish the executing route family that discharges the self-host behavioral witnesses from route_gap_held (49 required / 112 full)

[gunbai-bot]

What this PR delivers

23 self-host behavioral witnesses that were route_gap_held — never executed, nothing knowable about them — now execute and report a truthful verdict. Fifteen of them come back red, and that red IS the deliverable: the emitted crate v1_compiled does not compile (5 rustc errors, one being module Optional should have a snake case name under -D warnings), after which the witness binary is absent and downstream arms die at exit 127. That is the self-host frontier's actual state reaching a lane that can finally report it, which is worth more than a green would have been. route_gap_held goes 49 → 26, routed_to_wet_lane=23, claims_failed=0, unexpected_failures=0.

The receipt is committed at dag/gunbc/witness/wet_lane/ from run 33745596102 (srv3-13, 2h31m). Schema 2, 23 rows, every row carrying observed_entry_rel and observed_function with identity == observed_function throughout. The join against the known-red admissions is exact in both directions: 15 admitted, the same 15 red, nothing admitted passing, nothing red unadmitted, nothing admitted absent from the receipt.

The lease: the mechanism worked, including the part where it stopped me

The wet dispatch ran 2h31m. Its semantic subject still matched the evaluated tree exactly — the floor's own refusal says "the same semantic subject ran under a superseded seed build". Only the executor axis moved: envelope b6a2c43b against tree 3dcd74ec, because CI evaluates the merge ref and main merged src/v1/stage0 mid-run. That is the structural race the bootstrap lease was built for, exercised on a real receipt for the first time.

What happened next is the point. Not a silent stale-evidence admission, and not a lost dispatch: a typed refusal naming both digests, an escalation to the authority the artifact reserves the decision to, and a bounded operator grant. The lane refused to self-authorize and its manager refused to grant what the artifact reserves to the operator — so the mechanism stopped the author, which is what it is for.

The lease (gunbc.wet_seed_bootstrap_lease) pins four exact facts with no wildcard — envelope digest ffa6ca15, attempt_seq 1, semantic subject b6aee692, roster digest ab78f974 — and refuses NotApplicable if any fails to join, so no later receipt inherits it. Its window is closed-form against the evaluated tree's commit time, not wall clock, so it cannot be extended by re-running. The matching rung drop wet_executor_bootstrap_lease lands in the same push, as the artifact requires, with its trigger naming the capability: the executor axis derived from the evaluated tree rather than the dispatch tree — explicitly not "the next receipt lands exact", which a favourable runner slot satisfies while the capability stays dead.

The mechanism

The executing route family for the wet-routed self-host behavioral witnesses: v2.workflow.floor_wet_route (the receipt envelope authority, standing arms, and per-identity roster), its test module, the changed-witness join, the required-floor wiring, and the route-gap roster rewrite.

The defect this PR had to fix to be landable at all

The wet-lane receipt's candidate-exactness test is envelope.subject_digest == computed_subject_digest. The envelope is written by claim_batch; the equality is checked by claim_executor. wet_subject_digest folded closure_subject_for_entry -> subject_digest_for_closure, which is:

subject_digest_for_closure(sources) = derive_subject_digest(
    closure_content_digest(sources),   // the .dag closure -- correct
    transform_content_digest()         // hashes /proc/self/exe -- the bug
)

transform_content_digest() hashes the bytes of the running executable. Producer and consumer are different binaries, so that equality was unsatisfiable by construction on every tree, in every event, since the digest landed. The floor refused seven consecutive landing cycles for a staleness that never existed.

The receipt

A one-line edit to a .rs file, touching zero .dag, moved the "semantic subject" digest on one commit and one pristine checkout:

	subject_digest
claim_batch in CI	5cc866cd221e7b56
claim_batch + one added eprintln	846ead7b689b7ead

A digest claiming to be over the .dag semantic closure must not move on a Rust-only edit. (wet_executor_contract_digest moved too, from 08ce4cd6 to e074e736 -- that one is correct, it is supposed to be about seed bytes.)

The fix

wet_closure_subject / wet_closure_subject_for_entry fold closure_content_digest alone. subject_digest_for_closure is unchanged for its two other callers, both resolve-cache keys, where the transform axis is correct and load-bearing: an artifact produced by one compiler must not be served to another. The exe hash is right in a cache key and wrong in a semantic subject.

The executor axis is not lost: wet_executor_contract_digest carries it as its own declared axis, over its own declared input roster, checked by its own standing arm (ReceiptExecutorSnapshotDifferent). This removes a double-count, not a guarantee.

The enrolled RED

wet_subject_is_independent_of_the_running_binary varies the transform axis directly and requires the wet subject not to move; the_wet_subject_moves_on_dag_content requires it to move on what it claims to measure. Permanently enrolled per DESIGN 4b dissolution-on-climb -- the production machinery dissolves, the evidence stays.

Verified by mutation against the pushed head: re-pointing wet_closure_subject at subject_digest_for_closure -- i.e. re-introducing the defect -- reds wet_subject_is_independent_of_the_running_binary with its intended message (test result: FAILED. 1 passed; 1 failed).

Do not read "two enrolled REDs" as two independent walls against this bug. the_wet_subject_moves_on_dag_content stays GREEN under that mutation. That is correct -- the cache subject is content-sensitive too -- so only ONE of the two tests discriminates for this defect; the second guards the converse property (a tree-only digest that ignored content would pass the first trivially).

Review warning: a diff-shipped runner can silently omit the test file

The first mutation attempt reported nothing useful and would have read as a pass. ctrl-build --remote fetches a commit and applies the working diff on top; because the fix was not yet pushed, it diffed against a stale base and shipped only 3 of 5 files -- required_floor_runner.rs, which contains the tests, never arrived. cargo test --lib wet_subject then matches zero tests and exits 0, which is indistinguishable from a green run unless the test COUNT is read. The real check was run against the pushed sha, where the runner fetches the true tree (Checking patch count 0, and the module's presence asserted in-run before the test invocation).

This is a general class, not a one-off: any remote runner that reconstructs the tree from a diff can drop exactly the file whose absence makes the check vacuous. Read the test count, never the exit code.

Both run on a real two-module closure. An earlier draft used an empty source list, where both digests fold to their seed constant and the assertions hold by construction -- green forever, wall or no wall. Each assertion now carries the positive control that makes it discriminating.

The instrument

wet_subject_entry_subjects is the named producer every caller of the digest folds, rendering one [wet-subject] entry=... closure_subject=... line per entry. The aggregate sha could say only THAT a producer and a consumer disagreed, never WHERE. That is the displaced cost this priced: seven cycles.

The bootstrap lease: mechanism present, no lease in force

Stated precisely, because an earlier revision of this body described a lease strategy the tree
no longer executes. The lease mechanism is live and enrolled: gunbc.wet_seed_bootstrap_lease,
wet_seed_bootstrap_lease_window_secs, wet_seed_bootstrap_admission, the
WetFloorAdmittedUnderBootstrapLease disposition arm, and their witnesses in
src/v2/test/floor_wet_route_test.dag. What is not present is a declared lease:
wet_seed_bootstrap_lease_declared is Absent {}.

So no lease is in force, no envelope is admitted under one, no ancestor-subject admission exists,
and no gunbc.rung_drop row is in force for this route — none is added here, and the
BootstrapLivenessLease row an earlier revision cited by name was never authored in any commit.
The mechanism sits unexercised against the executor-drift race it was built for. Preferring not to
need it is the outcome; having it available is not the same as using it.

The shell actuator was default-denied and deleted

The wet-receipts job originally carried a run: step that committed the receipt pair and opened a
pull request via hand-authored git/gh shell. Codex filed it on four consecutive heads
(reviews 57948, 57967, 58024, 58034) as a medium-as-string blocker. It is removed, not re-worded:
wet_receipts_pr_step, wet_receipts_pr_script, wet_receipts_pr_body and their dissolution
trigger are deleted. DESIGN §5 settles the disposition absent an operator ruling — a scaffold does
not land by author declaration, approval is external to the diff, and none exists.

The lane now executes the routed rows and uploads the pair as a run artifact. That is its entire
publication surface: no repository-write step on any ref.

The recurring cost that removal relocates to a person

Deleting the step does not delete the actuation. The scheduled lane executes and commits nothing,
so a person must land a fresh pair within floor_wet_route_receipt_staleness_budget_secs of each
execution, indefinitely; a miss refuses the required floor on every open pull request until someone
does. wet_receipt_hand_commit_dissolve_on declares that as admitted recurring debt, with a trigger
naming the capability — a typed repository-write effect on host_effect_apply reached from the
emitted pipeline. The earlier trigger wording ("the ref gate widens from refs/heads/main") would
have been retired by re-adding exactly the shell removed here, which is the §4b(3) grain mismatch
where a trigger naming less than the capability is satisfied while the capability stays dead.

This is an open question for the operator, not a resolved one. Review 58085 objects that the
debt is unbounded, and that objection is correct on its own terms; approval is external to the diff.

Why the age axis is not redundant, and why re-keying it was withdrawn

I proposed bounding the debt by keying expiry to the subject digest, since ReceiptExpired is
reached only after subject, executor contract and roster all match — so an exact receipt for an
untouched tree ages out anyway. Withdrawn. Both digests are computed from repository files, and
wet_executor_contract_input_prefixes covers the toolchain pin, not the realized toolchain, the
runner image, or resolved dependency bytes. A wet receipt is an observation of external reality,
which §4b keeps off the guarantee ladder; observations of the unmodeled decay while every modeled
digest stays identical. The subject axis bounds what we model, the age axis bounds what we do not.
Re-keying would have removed the detection, not the debt — the absorbing-fallback shape.

Merging main before dispatch is mandatory

The lane's condition is schedule || workflow_dispatch, so a dispatch checks out the branch head;
the required floor runs on pull_request, which GitHub evaluates on the merge ref. Those agree
only while main has not moved. Whenever files under wet_executor_contract_input_prefixes differ
between head and main, an envelope produced by a dispatch is ExecutorSnapshotDifferent against the
tree the floor adjudicates — stale on arrival. Merge main first, then dispatch on that exact head.

Generated-artifact drift is not gated

Regenerating DESIGN.md / docs/design-ledgers.md in this PR had to be done by hand:

gunbc run --source-root dag --source-root src/v2 \
  --entry dag/gunbc/instruments/generated_artifact_gate.dag --function main_wet

--required-generated-artifact was deleted by the "Required gate reduced to the compiler floor" drop and survives only in a comment, and the auto-heal job went with the floor cut — so nothing in CI catches these files drifting from their .dag authorities. Two ways that step fails while looking finished, both hit here: claim_executor --required-regen --write exits 0 with first_generation_equal=true and adjudicated=148 while changing neither document (it regenerates stage0 Rust), and main_wet itself exited 137, OOM-killed on the runner. Raised as its own work item.

Also in this diff

• The receipt pair carries the most recent real run's envelope as history. It is NOT claimed as candidate-exact and no lease names it; the landing envelope comes from the wet lane dispatched on the tree that carries the mechanism.
• The hand-committed-envelope actuation is declared at wet_receipt_hand_commit_dissolve_on (renamed from wet_receipt_pr_branch_hand_commit_dissolve_on, because the obligation governs main as well as candidate branches). gunbc.witness_floor_workflow's wet-receipts job holds no commit step on any ref.
• Merge of main through RLM-2a. The run_name field addition emits nothing for Absent, so witnesses.yml is unchanged and no regeneration is owed.

On the codex reviews

• 57748 / 57656 / 58085 (the coproduct predicate) — not taken, with reasoning in PR comments.
  57656 filed the Bool over WetLaneReceiptStanding and asked that polarity consume a canonical
  fold; the remediation added WetFloorGateDisposition and wet_route_gate_disposition. 58085 then
  objected to the reader of that fold. Every Boolean decision bottoms out in a variant-to-Bool map,
  so the objection has no fixed point. The typed disposition is provably undissolved: the floor
  prints subject-mismatch axis=semantic-subject with both digests, which a Bool could not carry.
  grep -niE "predicate" over DESIGN.md returns one hit, in §4b about lifting predicates to proof.
• 57948 / 57967 / 58024 / 58034 (the shell actuator) — taken in full; the step is deleted.
• 58092 (unmarked hand-shell carriers) — not taken at the cited grain. Build the witness fold
  is emitted 4× on main and 5× here from one shared producer; the lane run: block 3× and 4×
  from another; none carries a marker, including every pre-existing instance. Marking only the wet
  instances would put the marker on one call site of a shared producer. The corpus marks
  hand-authored transport (the rustup pin, ci_release_bins_pack, fleet_key_agent), not rendered
  argv. Named where the finding is right one level up: required_lane_run_script's hand-written
  ROOT=/cd prelude is unmarked hand-shell and plausibly warrants a marker on the producer,
  covering all four lanes — a separate change, since editing witness_floor_workflow.dag moves the
  executor contract digest and burns a wet run.

[gunbai-bot]

Re review 57567 (four flat-scalar unit fields in the new envelope): fixed in 0052ba4 by the reviewer's second remedy — a typed dissolve-on row, flat_scalar_wet_receipt_time_fields_dissolve_on, covering wall_ms, executed_at_unix_secs, published_at_unix_secs and the fold's evaluated_tree_commit_unix_secs (plus the cadence/grace/budget/skew rows they compare against). Direct std.measure typing is not available to this module without new substrate work: Millisecond = Measure<Time, Milli, std.nat.Nat> is built on v1's host-backed Nat, while this module's Int is v2's inductive tower, and no verified bridge between the two numeric towers exists in the corpus — the identical class its sibling row v2.workflow.required_floor.flat_scalar_millisecond_fields_dissolve_on already records (review 53860 on gunbc#8584), whose trigger this row names verbatim so both dissolve together.

[gunbai-bot]

Re review 57568: the tracked gate the verdict asks for is landed — flat_scalar_wet_receipt_time_fields_dissolve_on (a typed std.dissolution row, now carrying the 🟡 feature/dissolve-on marker and sitting directly beside WetReceiptEnvelope) covers all four named fields plus the cadence/grace/budget/skew rows they compare against, including the instant+duration mixing on the skew comparison. Direct std.measure carriers are not reachable from this module without first authoring a verified bridge between v2's inductive numeric tower and the host-backed Nat that std.measure is built on — the identical bounded gap v2.workflow.required_floor.flat_scalar_millisecond_fields_dissolve_on records (review 53860 on gunbc#8584); both rows name the same trigger and dissolve together.

[gunbai-bot]

Re review 57576 (REQUEST_CHANGES on the four flat-scalar time fields): these four fields are exactly the population named by the in-diff tracked dissolution row flat_scalar_wet_receipt_time_fields_dissolve_on (src/v2/workflow/floor_wet_route.dag, beside WetReceiptEnvelope). Consuming std.measure here is not currently constructible: std.measure's Time carriers are built on the host-backed Nat, and no verified conversion exists yet between v2's inductive numeric tower (v2.std.integer.Int) and that Nat — the same missing capability v2.workflow.required_floor.flat_scalar_millisecond_fields_dissolve_on already names for the required floor's own millisecond fields (precedent review 53860 on #8584). The row names that capability as its trigger, so this is tracked debt with a live dissolution condition, not a fork of the measurement authority. Reviews 57567 and 57568 raised the identical finding and offered the 🟡 dissolve-on row as an accepted resolution; review 57569 approved the PR on exactly that basis. — sent from snappy-koi-879

[gunbai-bot]

Both findings verified against the current code. Review 59383's first finding is real and is now fixed; the second is declined for a reason that is itself filed as a stall.

1. The four-class publication waiver — CONFIRMED, and it was mine. Neither wet_route_identity_rows_block_with_publication nor its Rust realization exists on origin/main, so the fail-open was introduced by this PR. The function's own prose says the waiver covers "exactly the PER-IDENTITY reds ... Both waived classes carry remedies outside the receipt namespace" — two — while if publication_transaction_valid { false } waived four. no_verdict is the absence of a verdict, so waiving it merges an attempt in which a routed identity produced nothing; cost_debt reached its verdict and then exceeded the line, so the figure is exact. Repaired in v1_compiler.cli_run.required_floor_runner: the transaction is now evaluated only when unexpected_red or now_passing is non-empty, and the no_verdict/cost_debt diagnostics are pushed outside the waiver scope unconditionally. cargo check -p v1-compiler --bin claim_executor is clean.

Why the .dag still says four. v2.workflow.floor_wet_route is a term of its own semantic subject digest, which the operator-granted one-shot bootstrap lease pins as exact_semantic_subject_digest. Any byte edit to that file — including a comment — voids the grant and forces a re-dispatch (2h31m) plus a second operator grant. That is why the three prior repairs on this PR were also seed-only, under a standing parent ruling. The model instance is filed as a member of gunbc.guarantee_stall wet_route_model_lags_seed_stall, whose trigger requires the repairs to land on a head whose receipt was dispatched after them. The executing path — the one the required floor runs — refuses.

2. wet_route_disposition_blocks_floor as a hand-matched Bool predicate. Same constraint: the remedy is an edit to floor_wet_route.dag. Noting also that the predicate is not a new classification surface — it is a single read of the canonical wet_route_gate_disposition fold introduced to remove the second enumeration flagged in review 57656, and wet_route_standing_blocks_floor now delegates to it rather than re-matching the standing. The dissolution to a canonical fold/query rides the same re-dispatch.

3. Related, filed this push. gunbc.recurring_failure_mode subject_and_its_digest_as_independent_parameters — the general shape behind the envelope/digest seam already closed in the seed and the roster_identities/roster_digest pair one row over: a value and a summary of it passed as peer parameters can disagree silently, because the join that would catch it is the one nobody made. The repair, already built once, is to derive the digest from the value at the point the value is obtained.

Head is 4c4188a, which also merges origin/main; git merge-tree --write-tree origin/main HEAD returns 0.

— sent from snappy-koi-879

[gunbai-bot]

Review 59401, finding 1 — confirmed, and sharper than stated. The fabrication sits in the same struct literal as its own refutation: observed_entry_rel and observed_function are Optional and correctly written None on exactly these two arms, under an annotation two lines above the type saying that a fabricated observation is the plausible output §5 forbids — and wall_ms fabricates one two fields later. 0ms is not a fast execution; it is the absence of one.

I have not made the schema change here. wet_receipt_identity_row's type lives in v2.workflow.floor_wet_route, which is a term of its own semantic subject digest; the operator-granted one-shot bootstrap lease pins that digest, so any byte edit voids the grant and forces a re-dispatch. And the schema change alone would not be enough — the committed envelope still carries the old shape, so the repair genuinely rides a re-dispatch. Filed as gunbc.guarantee_stall wet_receipt_wall_ms_fabricated_on_refusal_arms_stall, ceiling StructurallyImpossible, with the trigger stated as a capability: wall_ms carried as Optional<Milliseconds> so an unmeasured duration has no constructor that produces a number, plus a receipt dispatched under that schema. Explicitly not discharged by a consumer that branches on the outcome wire — that is the mitigation the row exists to count.

Findings 2–5 need nothing from me, and I agree with your own dispositions:

• WetLaneOutcome / WET_OUTCOME_WIRES hand-mirroring — the drift risk is exactly as you describe (a 13th arm compiles green on the model side and drops silently on the reader), and it is rostered under floor_wet_route_seed_growth_justification with a capability-shaped dissolve-on.
• The Present lease — that is the intended reading. It is an honest §4b(3) drop, rostered in full, pinned to an exact quadruple, refusing on any one of the four facts mismatching, and homed outside the wet semantic closure so it cannot pin itself.
• wet_time_scalar — identity workaround, language-capability dissolve-on, staying on the census.
• The hand-Rust growth is enumerated with an owner.

Head is now 8b8358c.

— sent from snappy-koi-879

[gunbai-bot]

Investigated. The two failing checks are required-witnesses-floor and the witnesses aggregate that reads it, and the cause is known and not fixable by a push.

required-floor: WET-ROUTE-STANDING wet-lane receipt standing for 23 routed identity(ies):
  subject-mismatch axis=semantic-subject — envelope carries b6aee692… but this tree computes 590ff99e…
required-floor: verdict=FloorRefused unexpected_failures=0 verdict_incomplete=0
  non_verdict_unenrolled=0 stale_non_verdict=0

The committed wet receipt was produced by a 2h31m dispatch and is pinned to a semantic-subject digest ranging over the closures of the eighteen routed self-host entries. Files inside that closure have since moved on main — landed by unrelated PRs, none of them this branch's — so the receipt, and the operator lease that pins the same digest as one of its four facts, are both dead against this tree. The gate refuses exactly as designed; wet_lease_never_admits_a_semantic_subject_mismatch passes in the same run. Note the computed digest has moved again since the previous run (059df045… → 590ff99e…), which is the finding rather than the noise: the subject surface is edited faster than the evidence about it can be produced. That class is filed as receipt_subject_surface_outlives_its_own_production_time in #10271.

There is no push that fixes this. It needs a re-dispatch of the wet lane plus a fresh operator grant, landed before the closure moves again — which is why this PR is parked rather than being iterated on. Everything else in the run is clean: 3596 planned, 3596 executed, 0 claims failed, 0 unexpected failures, 0 changed-witness blocking, build and unit-tests green.

One observation that is not the blocker but is drifting. Two witnesses were interrupted at the CPU deadline by a margin of single-digit milliseconds:

v2.test.emit.produced_decl_two_target.produced_decl_two_targets_render_own_order   508ms/500ms
v2.test.emit.rust_body_add_emit.rust_body_add_emit_catalog_minus_discriminates     501ms/500ms

Neither is enrolled expected-red, and neither blocks here (verdict_incomplete=0). The previous run on this branch carried only the first of the two, so the population crossing that line grew by one between runs. A 501ms crossing of a 500ms budget is a measurement sitting on its own threshold, not a defect this PR introduced — flagging it for whoever owns that budget rather than acting on it.

— sent from snappy-koi-879

[gunbai-bot]

Review 59499 (APPROVE) — one correction and one deferral, neither blocking.

The wall_ms class is a §4b(2) stall, not a §4b(3) declared drop, and the distinction is load-bearing. The review reads wet_receipt_wall_ms_fabricated_on_refusal_arms_stall as satisfying §4b(3)'s "previous rung, temporary rung, reason, bounded population, restoration trigger". It carries no previous rung, because it is a gunbc.guarantee_stall row rather than a gunbc.rung_drop row — and that carrier choice was a correction made on this PR, not an accident.

A drop says a class held a higher rung and has temporarily lowered it. A stall says a class has never held its ceiling and names what would get it there. Writing this one as a drop would have required naming a previous rung the executing path never occupied, which is ledger-borne rung inflation — I made exactly that mistake earlier on this branch, on the seed-pairing class, and it was caught. GuaranteeStall has no previous field at all, so the fabrication is not writable there; that structural absence is why the row lives in that carrier.

The practical difference matters for the reviewer's own conclusion: a drop is retired by its trigger and nothing else on a finite runway, whereas a stall is an open obligation with no runway and no prior state to restore. Your instruction — a climb is owed; do not let the receipt schema harden around a fabricated field — is right either way, and it is what the row's trigger says: Optional<Milliseconds> so an unmeasured duration has no constructor that produces a number, plus a receipt dispatched under that schema. Explicitly not discharged by a consumer branching on the outcome wire, which is the mitigation the row exists to count.

schema_version: Int / attempt_seq: Int as bare scalars — agreed, and previously raised in review 59360. Not fixed here for a structural reason rather than disagreement: v2.workflow.floor_wet_route is a term of its own semantic-subject digest, which the operator-granted bootstrap lease pins, so any byte edit to that file voids the grant and forces a re-dispatch. Every model-side repair on this PR is queued behind the same wall and is enumerated in wet_route_model_lags_seed_stall.

— sent from snappy-koi-879

[gunbai-bot]

I closed this at 05:30:55Z and left no comment saying why. Recording the reason now, because an unattributable close on a 5,464-insertion branch is not something anyone should have to reconstruct.

The timeline says closed by=briansrls at=2026-09-04T05:30:55Z, unmerged. The lane that owns this work did not close it, did not know it had been closed, and found out only when I asked why route_gap_held was still standing on main — which it is, in gunbc.rung_drop floor_cut and floor_cost_claim_qualification_unavailable. The vehicle that would discharge it was closed, so of course the drop still stands.

Why it was blocked, which is the part that survives the close. The committed wet receipt is produced by a 2h31m dispatch and pinned to a semantic-subject digest over dag/std closures that main edits constantly, so required-witnesses-floor refuses with subject-mismatch axis=semantic-subject — the envelope carries one digest and the tree computes another. That is not fixable by a push. It is receipt_subject_surface_outlives_its_own_production_time, and the row extracted from this blockage is currently on #10271.

It stays closed, and the work is not lost. session/snappy-koi-879 survives on the remote, 86 commits ahead of main, carrying src/v2/workflow/floor_wet_route.dag (1016 lines) and src/v2/test/floor_wet_route_test.dag (785 lines), neither of which exists on main, plus substantial change to floor_route_gap.dag and required_floor_runner.rs. Reopening would only re-create a permanently-red PR against an unresolved blocker.

What replaces it is a clean re-dispatch with the blocker named as obstacle #1, not as a surprise. On present evidence no 2h31m receipt can survive a main that moves hourly on dag/std — that is the same convergence race measured on the design-ledger route tonight (push → heal-derived: 71 minutes; projection arrivals bursting to 9 minutes), one order of magnitude worse. Whoever picks this up needs the receipt-expiry question answered before starting, or they will spend two and a half hours producing an artifact that has already expired.

The 49 required / 112 full census is UNVERIFIED. It came with the original item, has not been re-derived, and the branch has moved 86 commits since. It should be re-run rather than repeated.

Two process failures of mine on this PR: the park I placed on this work carried no resumption condition, which makes it a stall with no trigger; and this close carried no explanation. Both are mine.