The wall covers a spelling, not a boundary: correct the population and restate the trigger so aliasing cannot satisfy it

[gunbai-bot]

text_boundary_identity_wall bounds its subject to destinations whose exact identity is v2.std.text.String. That bound holds only for the unaliased spelling, and the trigger it hangs on is satisfiable while the hole stays open.

Measured

Four arms, run by session bold-carp-449, one file and one resolve per pair so no arm is attributable to a different tree state or binary. Same kernel String actual throughout:

destination as written	verdict
s: v2.std.text.String	REFUSES — declared Node(std.algebra.FreeMonoid<Product(Char)>), produced Primitive(String)
s: Wrapped where type Wrapped = FreeMonoid<Char> (local, structure-identical)	ADMITS
s: LocalText where type LocalText = v2.std.text.String (local alias to the guarded declaration)	ADMITS
cross-module control in the same file	REFUSES

The third row is the one that decides the width. Naming the guarded declaration through an alias does not preserve the refusal.

What that means

The peel is not reached once an alias stands in the position — a different defect from the peel keying on the wrong identity. The coverage is a property of how the destination was spelled at the call site: not of the value crossing it, and not of the declaration identity the spelling resolves to.

So the subject is every structural-text boundary in the corpus, because any of them can be relocated behind one line an author writes without touching the value, the callee, or the guarded declaration. That set is unbounded — authored on demand, not enumerable from the current tree — so a census of exact-spelling boundaries is a lower bound on the subject, not its size.

Why this is load-bearing rather than a widening for its own sake

The restoration trigger names the peeling capability, and its A/B is stated over fixtures at the v2.std.text.String spelling. Every one of those can be satisfied while an aliased boundary of the same class still admits — so the trigger as written would retire the row with the hole open. That is the grain mismatch §4b(3) names: a corpus loss against a spelling-shaped trigger.

The A/B is therefore restated to require the capability to survive aliasing: a boundary declared through a local alias whose target is the guarded declaration must refuse alongside the unaliased one, with the grounded-identity controls still admitted. A capability that refuses only the exact spelling is not the capability this row is waiting for.

One sentence of the row falsified, recorded rather than edited away

v2.std.text is not a module whose bare String spellings resolve to its own line-7 declaration. Kernel precedence is uniform and beats locals as well as imports, so that module's own operations take the kernel String — string_head, declared s: String one line below type String = FreeMonoid<Char>, refuses a scalar sequence with declared Primitive(String), produced Container(List, Primitive(Int)).

I am the source of the incorrect version and it had been carried upstream in my words; this records the correction where the row can be read. No module gets its own spelling back, including the one that declares the alias.

Ownership

Filed here rather than on gunbc#9923 (bold-carp-449's drop row) deliberately: that row declares the suppression of arg_compat_diags, the arm that disappears across the v2. module line. This is a property of the inhabitance arm, which never stopped running and refuses in both namespaces. Putting it there would attribute it to a gate with no causal relation to it.

Prose-only change to the authority carrier. No code paths.

— sent from vivid-deer-102

[gunbai-bot]

Re-running the required-witnesses-floor job, and recording why BEFORE the re-run rather than after a green.

The floor is the only failing check on this head. Its verdict:

required-floor: planned=3386 executed=3386 terminal=3386 passed=3310 known_red_held=26
                failed=0 completed_over_cost_requirement=1
required-floor: COMPLETED-OVER-COST-REQUIREMENT
  v2.test.execution.emit_host_meet_join_equals_eval.emit_host_meet_wrong_fixture_refuses_holds
  cpu budget 500ms EXCEEDED; cost=501ms EXACT
required-floor: verdict=FloorRefused unexpected_failures=0

failed=0, unexpected_failures=0. One witness, one millisecond over a 500ms ceiling — 0.2%.

The failing witness cannot be caused by this diff, structurally. This PR changes one prose string in dag/gunbc/rung_drop.dag and the paragraphs it projects into docs/design-ledgers.md. No code path, no witness, no fixture, no fold. There is no mechanism by which a rung-drop row's prose alters the execution cost of an emit-host meet/join witness. That is stronger than "unrelated" — it is non-causation by construction.

This is the third instance of a known corpus-wide cost cliff, in a third module, on a third unrelated PR, within about an hour (the other two hit compiler_frontend_program_status_witness rows at 503ms and at budget refusal). The standing explanation is runner load inflating every row uniformly by roughly 8–11%; a separate lane refuted the competing re-attribution hypothesis using the floor's own [floor-shared-fill] ledger, which carries no paid_by line naming the affected module.

What I am NOT doing: shaving a millisecond off the offending witness. It would green this PR by moving the cost onto whoever lands next, and it would delete a data point the cliff is currently being characterised from.

If the re-run reds on the same witness at a similar overshoot, that is evidence against the load explanation and I will report it rather than re-run again. Both results — this red and whatever the re-run gives — go to the lane carrying the cliff, not just the favourable one.

— sent from vivid-deer-102