TRUNK: docs/design-ledgers.md on main is stale against main's own .dag sources (at least one subsection, projection of self_host_compile_phase_frontier.dag) — measure full drift extent via pristine-main regen (LOCAL capped run: ~10min, 8.3GiB exceeds BuildBuddy VM), and answer whether the drift gate

dag/gunbc/rung_drop.dag

@@ -83,7 +83,7 @@ data required_gate_bankruptcy: RungDrop = RungDrop {
   identity: "required_gate_bankruptcy" as NonEmptyStr,
   subject: "Required gate reduced to the compiler floor",
   declared: "2026-08-29",
-  authored: "**RUNG DROP, DECLARED (2026-08-29, the CI bankruptcy, operator ruling in session neat-tern-658).** PREVIOUS RUNG: mechanically preventable for every class the required run carried -- eight phases over two lanes, the floor folding every discovered witness (11,996 on the last green run) through a whole-corpus strict preparation, plus v2-emission, emit-compile, partition-crates and generated-artifact drift. TEMPORARY RUNG: mechanically preventable ONLY for what the static gate names -- parse, namespace-wave-admission, regen, and a floor over `v2.workflow.required_floor` `required_gate_prefixes` prepared as that roster's import closure -- and MITIGATABLE for everything else: those witnesses and phases are still runnable (the floor with the gate widened, `claim_executor --required-v2-emission`, `--required-emit-compile`, `--required-partition-crates`, `--required-generated-artifact`) and their receipts are produced only when someone runs them, so a regression there is caught at the next manual run, not at merge. REASON: the last green run was 87 wall minutes (`gh run view 33140387402`), strict preparation alone 27 of them on one core, against ~50 squash-merges a day; main sat red for fifteen consecutive runs on two integration collisions no PR could have seen (#9662), and the CI-cost lane's change-denominated selection did not land in time to prevent it. A gate no merge can wait for validates nothing, which is a lower rung than a small gate that runs. POPULATION: every witness outside the roster (reported per run as `declined_outside_required_gate` in the disposition TSV), the four deleted required phases, and the v1-compiler lib tests that carry the `live-corpus` ignore reason -- enumerated by `cargo test -p v1-compiler --lib -- --ignored --list` -- each of which prepares or builds over the live tree and is run only by the receipts lane; the first-ever CI run of `cargo test -p v1-compiler --lib` (run 33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, which is how that class was measured into existence. The workflow's two-lane shape, the aggregate context, and the per-claim cost receipt are unchanged, and the drop is countable from that receipt every run. RESTORATION TRIGGER: the CAPABILITY of a required run whose population is DERIVED from the change -- the roadmap's 'decide what matters before paying to prepare everything' -- executing on the required path with the whole corpus as its universe; a widening of the static roster does not retire this row, it only moves the population. Widening the roster is a wall-clock decision priced by the cost receipt and recorded on the roster's own header."
+  authored: "**RUNG DROP, DECLARED (2026-08-29, the CI bankruptcy, operator ruling in session neat-tern-658).** PREVIOUS RUNG: mechanically preventable for every class the required run carried -- eight phases over two lanes, the floor folding every discovered witness (11,996 on the last green run) through a whole-corpus strict preparation, plus v2-emission, emit-compile, partition-crates and generated-artifact drift. TEMPORARY RUNG: mechanically preventable ONLY for what the static gate names -- parse, namespace-wave-admission, regen, and a floor over `v2.workflow.required_floor` `required_gate_prefixes` prepared as that roster's import closure -- and MITIGATABLE for everything else: those witnesses and phases are still runnable (the floor with the gate widened, `claim_executor --required-v2-emission`, `--required-emit-compile`, `--required-partition-crates`, `--required-generated-artifact`) and their receipts are produced only when someone runs them, so a regression there is caught at the next manual run, not at merge. REASON: the last green run was 87 wall minutes (`gh run view 33140387402`), strict preparation alone 27 of them on one core, against ~50 squash-merges a day; main sat red for fifteen consecutive runs on two integration collisions no PR could have seen (#9662), and the CI-cost lane's change-denominated selection did not land in time to prevent it. A gate no merge can wait for validates nothing, which is a lower rung than a small gate that runs. POPULATION: every witness outside the roster (reported per run as `declined_outside_required_gate` in the disposition TSV), the four deleted required phases, and the v1-compiler lib tests that carry the `live-corpus` ignore reason -- enumerated by `cargo test -p v1-compiler --lib -- --ignored --list` -- each of which prepares or builds over the live tree and is run only by the receipts lane; the first-ever CI run of `cargo test -p v1-compiler --lib` (run 33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, which is how that class was measured into existence. The workflow's two-lane shape, the aggregate context, and the per-claim cost receipt are unchanged, and the drop is countable from that receipt every run. RESTORATION TRIGGER: the CAPABILITY of a required run whose population is DERIVED from the change -- the roadmap's 'decide what matters before paying to prepare everything' -- executing on the required path with the whole corpus as its universe; a widening of the static roster does not retire this row, it only moves the population. Widening the roster is a wall-clock decision priced by the cost receipt and recorded on the roster's own header. INCIDENT RECEIPT (2026-08-31), recorded because a drop whose population has demonstrably fired ranks differently for restoration than one that never has: the generated-artifact drift member produced a real stale artifact on main -- two correct regens composed a `docs/design-ledgers.md` missing the frontier-receipts projection of `gunbc.self_host_compile_phase_frontier`, with no conflict and no author error -- detected only sideways by an adjacent-diff review question, and bounded to exactly one file by a dispatched whole-population `main_wet` regen on pristine main (repair and measurement: PR #9804). The window between drift landing and detection is the cost this row's REASON accepted, now materialized once."
 }
 
 data rung_drop_roster: List<RungDrop> = [

docs/design-ledgers.md

@@ -46,7 +46,21 @@ CI — **RUNG DROP, DECLARED (2026-08-15, the floor cut).** WHAT WAS HERE: one c
 
 ### Self-host emission board measurement — declared 2026-08-24
 
-**THE MEASUREMENT BANKRUPTCY DELETED A CAPABILITY, NOT ONLY ARTIFACTS, AND THIS ROW IS THAT DECLARATION (2026-08-24).** The bankruptcy above removed `docs/probes/` whole. Deleting the boards removes TRANSCRIPTIONS, which is the point; deleting the instruments removes a ROUTE, which is a different fact and is the one §4b(3) obliges a cut to declare. WHAT IS GONE: the only executable route to a self-host emission board measurement. PREVIOUS STATE — any lane could re-derive a per-entry board by running the committed probe script, last exercised 2026-08-24 against the then-current main, and that reading is what answered the operator when they asked what the emission trajectory was doing. TEMPORARY STATE — no route exists; the emission trajectory is not measurable from the tree, and a board figure quoted from here on names nothing that can produce it. BOUNDED POPULATION: one capability, the per-entry emission board. RESTORATION TRIGGER: a `.dag` entry point that emits, assembles and compiles one entry and returns the coded-diagnostic population, cited by name wherever a board figure is quoted — at which point the same figures become legitimate again unchanged, because the rule forbids transcribing output INSTEAD OF naming an instrument, and the defect today is that there is no instrument to name. **WHY THIS ROW EXISTS AT ALL, and it is the same reason the regen row beneath it does:** no dependent could refuse. The corpus contains nothing that breaks when the board becomes unmeasurable, because the consumers are LANES rather than modules — the identical blind spot that made a `.dag`-consumer census report the instruments as dead a few hours before this cut. So delete-first's census, which is normally the thing that surfaces a load-bearing deletion loudly, is structurally silent here, and a declared row is the only mechanism left.  **THE TRIGGER HAS FIRED, AND THE ROW STAYS RATHER THAN RETIRING ON ITS AUTHOR'S SAY-SO.** The instrument is `tools.emission_entry_instrument` `measure_entry_emission`, invoked as `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/instruments/emission_entry_instrument.dag --function measure --arg entry=<repo-relative .dag path> --arg report=<path>`. It runs the same spine the deleted probe script ran — emit one entry's closure, assemble it with `cssl_assemble`, build the assembled crate under cargo's JSON message format — and returns a TYPED measurement rather than a row of text: the emit-stage population from `gunbc.emit_diagnostic_observation` and the rustc coded-diagnostic population from `extdeps.cargo_diagnostic`, each member carrying its own identity and location, so two runs can be JOINED rather than only differenced. **WHAT THE CARRIER FIXES THAT THE SCRIPT DID NOT:** `EmissionMeasurement` has no spelling in which a stage that never ran renders as a stage that ran and found nothing — an unreached stage is its own variant naming the stage — and the emit decode REFUSES when the population it recovered disagrees with the compiler's own declared total, so an unrecognised diagnostic shape stops the line instead of quietly shrinking the answer. That is the execution-provenance-loss row applied to the instrument that most needed it. **WHAT IS NOT CLAIMED.** It is a measurement route and NOT a gate: no workflow invokes it, no phase enrols it, and its exit status reports whether the INSTRUMENT completed, never whether the subject was clean. The whole-corpus route is still refused by `gunbc.whole_corpus_compile_admission` and this does not change that; it is the per-entry route that module's own scope note says fits. Every other clause of the bankruptcy above stands unchanged, including that a figure copied into prose is debt whether or not a producer exists for it.
+**THE MEASUREMENT BANKRUPTCY DELETED A CAPABILITY, NOT ONLY ARTIFACTS, AND THIS ROW IS THAT DECLARATION (2026-08-24).** The bankruptcy above removed `docs/probes/` whole. Deleting the boards removes TRANSCRIPTIONS, which is the point; deleting the instruments removes a ROUTE, which is a different fact and is the one §4b(3) obliges a cut to declare. WHAT IS GONE: the only executable route to a self-host emission board measurement. PREVIOUS STATE — any lane could re-derive a per-entry board by running the committed probe script, last exercised 2026-08-24 against the then-current main, and that reading is what answered the operator when they asked what the emission trajectory was doing. TEMPORARY STATE — no route exists; the emission trajectory is not measurable from the tree, and a board figure quoted from here on names nothing that can produce it. BOUNDED POPULATION: one capability, the per-entry emission board. RESTORATION TRIGGER: a `.dag` entry point that emits, assembles and compiles one entry and returns the coded-diagnostic population, cited by name wherever a board figure is quoted — at which point the same figures become legitimate again unchanged, because the rule forbids transcribing output INSTEAD OF naming an instrument, and the defect today is that there is no instrument to name. **WHY THIS ROW EXISTS AT ALL, and it is the same reason the regen row beneath it does:** no dependent could refuse. The corpus contains nothing that breaks when the board becomes unmeasurable, because the consumers are LANES rather than modules — the identical blind spot that made a `.dag`-consumer census report the instruments as dead a few hours before this cut. So delete-first's census, which is normally the thing that surfaces a load-bearing deletion loudly, is structurally silent here, and a declared row is the only mechanism left. **THE TRIGGER HAS FIRED, AND THE ROW STAYS AS HISTORICAL EVIDENCE OF THE LOST PER-ENTRY ROUTE.** The restored route is `tools.emission_entry_instrument` `measure_entry_emission`, invoked as `gunbc run --source-root dag --source-root src/v2 --entry dag/gunbc/instruments/emission_entry_instrument.dag --function measure --arg entry=<repo-relative .dag path> --arg report=<path>`. It emits one entry's closure, assembles it with `cssl_assemble`, compiles the assembled crate under cargo's JSON message format, and returns typed emit-stage and coded rustc diagnostic populations. `EmissionMeasurement` has no spelling in which an unreached stage renders as an empty reached stage, and its decode refuses inconsistent populations. **THE WHOLE-CORPUS PERSISTENCE THAT NOW CITES THIS HISTORY IS SEPARATE:** `gunbc.self_host_compile_phase_frontier` derives the compile-phase board from that instrument's `00_compile` closure observation, persists the linked identity-grain receipt series, and executes the phase/identity ratchet over its latest validated pair. Board standings quoted by the program status and design-ledger projection cite that frontier rather than this historical row. This does not turn the historical per-entry drop into the live board, and every figure copied into prose without naming its producer remains debt.
+
+### Whole-corpus compile-phase frontier receipts — latest validated row
+
+Milestones: parse PASSES / expand PASSES / resolve PASSES / typeck PASSES / borrowck PASSES
+
+Tree: `sha1:1c7c79fbc01aa488abb541513fc8ea44367406ad`
+
+Invocation: `buildbuddy-b779daaf-cefa-4379-ab27-dbea5a8d2919`
+
+Census identity digest: `ce69956ca7a9de96`
+
+Error identities: 233 total = 233 coded + 0 codeless
+
+Producer: `tools.emission_entry_instrument::measure_entry_emission`
 
 ### Regen candidate-tree producer — declared 2026-08-20
 
@@ -66,4 +80,4 @@ CI — **RUNG DROP, DECLARED (2026-08-15, the floor cut).** WHAT WAS HERE: one c
 
 ### Required gate reduced to the compiler floor — declared 2026-08-29
 
-**RUNG DROP, DECLARED (2026-08-29, the CI bankruptcy, operator ruling in session neat-tern-658).** PREVIOUS RUNG: mechanically preventable for every class the required run carried -- eight phases over two lanes, the floor folding every discovered witness (11,996 on the last green run) through a whole-corpus strict preparation, plus v2-emission, emit-compile, partition-crates and generated-artifact drift. TEMPORARY RUNG: mechanically preventable ONLY for what the static gate names -- parse, namespace-wave-admission, regen, and a floor over `v2.workflow.required_floor` `required_gate_prefixes` prepared as that roster's import closure -- and MITIGATABLE for everything else: those witnesses and phases are still runnable (the floor with the gate widened, `claim_executor --required-v2-emission`, `--required-emit-compile`, `--required-partition-crates`, `--required-generated-artifact`) and their receipts are produced only when someone runs them, so a regression there is caught at the next manual run, not at merge. REASON: the last green run was 87 wall minutes (`gh run view 33140387402`), strict preparation alone 27 of them on one core, against ~50 squash-merges a day; main sat red for fifteen consecutive runs on two integration collisions no PR could have seen (#9662), and the CI-cost lane's change-denominated selection did not land in time to prevent it. A gate no merge can wait for validates nothing, which is a lower rung than a small gate that runs. POPULATION: every witness outside the roster (reported per run as `declined_outside_required_gate` in the disposition TSV), the four deleted required phases, and the v1-compiler lib tests that carry the `live-corpus` ignore reason -- enumerated by `cargo test -p v1-compiler --lib -- --ignored --list` -- each of which prepares or builds over the live tree and is run only by the receipts lane; the first-ever CI run of `cargo test -p v1-compiler --lib` (run 33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, which is how that class was measured into existence. The workflow's two-lane shape, the aggregate context, and the per-claim cost receipt are unchanged, and the drop is countable from that receipt every run. RESTORATION TRIGGER: the CAPABILITY of a required run whose population is DERIVED from the change -- the roadmap's 'decide what matters before paying to prepare everything' -- executing on the required path with the whole corpus as its universe; a widening of the static roster does not retire this row, it only moves the population. Widening the roster is a wall-clock decision priced by the cost receipt and recorded on the roster's own header.
+**RUNG DROP, DECLARED (2026-08-29, the CI bankruptcy, operator ruling in session neat-tern-658).** PREVIOUS RUNG: mechanically preventable for every class the required run carried -- eight phases over two lanes, the floor folding every discovered witness (11,996 on the last green run) through a whole-corpus strict preparation, plus v2-emission, emit-compile, partition-crates and generated-artifact drift. TEMPORARY RUNG: mechanically preventable ONLY for what the static gate names -- parse, namespace-wave-admission, regen, and a floor over `v2.workflow.required_floor` `required_gate_prefixes` prepared as that roster's import closure -- and MITIGATABLE for everything else: those witnesses and phases are still runnable (the floor with the gate widened, `claim_executor --required-v2-emission`, `--required-emit-compile`, `--required-partition-crates`, `--required-generated-artifact`) and their receipts are produced only when someone runs them, so a regression there is caught at the next manual run, not at merge. REASON: the last green run was 87 wall minutes (`gh run view 33140387402`), strict preparation alone 27 of them on one core, against ~50 squash-merges a day; main sat red for fifteen consecutive runs on two integration collisions no PR could have seen (#9662), and the CI-cost lane's change-denominated selection did not land in time to prevent it. A gate no merge can wait for validates nothing, which is a lower rung than a small gate that runs. POPULATION: every witness outside the roster (reported per run as `declined_outside_required_gate` in the disposition TSV), the four deleted required phases, and the v1-compiler lib tests that carry the `live-corpus` ignore reason -- enumerated by `cargo test -p v1-compiler --lib -- --ignored --list` -- each of which prepares or builds over the live tree and is run only by the receipts lane; the first-ever CI run of `cargo test -p v1-compiler --lib` (run 33238828500) was cancelled by its own 60-minute timeout with 204 of 682 tests finished, which is how that class was measured into existence. The workflow's two-lane shape, the aggregate context, and the per-claim cost receipt are unchanged, and the drop is countable from that receipt every run. RESTORATION TRIGGER: the CAPABILITY of a required run whose population is DERIVED from the change -- the roadmap's 'decide what matters before paying to prepare everything' -- executing on the required path with the whole corpus as its universe; a widening of the static roster does not retire this row, it only moves the population. Widening the roster is a wall-clock decision priced by the cost receipt and recorded on the roster's own header. INCIDENT RECEIPT (2026-08-31), recorded because a drop whose population has demonstrably fired ranks differently for restoration than one that never has: the generated-artifact drift member produced a real stale artifact on main -- two correct regens composed a `docs/design-ledgers.md` missing the frontier-receipts projection of `gunbc.self_host_compile_phase_frontier`, with no conflict and no author error -- detected only sideways by an adjacent-diff review question, and bounded to exactly one file by a dispatched whole-population `main_wet` regen on pristine main (repair and measurement: PR #9804). The window between drift landing and detection is the cost this row's REASON accepted, now materialized once.