Correct factual rung-drop restoration claims

[gunbai-bot]

Outcome

Corrects two factual defects found while auditing standing RungDrop restoration triggers against DESIGN §4b(3):

• demotes the already-fired, singular emit_stage_blocking condition and labels only the exhaustive whole-roster capability as the restoration trigger;
• retires regen_producer on executed evidence that candidate production is unconditional, then moves the still-mitigatable hand-maintained host mirror to its own GuaranteeStall instead of extending the retired drop with a new obligation.

Executed regen evidence

The probe lived only on closed throwaway draft PR #9919. Its deliberate drift was reverted to the exact pre-probe tree before the clean arm:

• pre-drift and clean-revert tree OID: 6beb63bc5bcea490e449371d55822238e0635daa
• drift arm: run 33498757658, job 99826921457; planned=149 executed=149 adjudicated=149, first_generation_equal=false, candidate=target/stage0-regen-candidate, then refusal on v1_std_core.rs
• clean arm: run 33500467935, job 99832373188; planned=149 executed=149 adjudicated=149, first_generation_equal=true, candidate=target/stage0-regen-candidate; required build lane passed

Together the arms establish production before adjudication on both verdict paths. The drift arm alone would only have established conditional production.

Generated projections and merge receipt

The hand projection at 330a2d7831a was byte-exact and still incomplete: CI run 33504368058, job 99844904359 examined all 35 generated artifacts, matched docs/design-ledgers.md, and identified DESIGN.md as the sole drift. The authority projects into two artifacts and only one was refreshed; the actuator writes a set, while a hand writes the member it is thinking of.

Generator idempotence was subsequently established repeatedly with byte-identical two-pass local main_wet_one runs over both paths named by the dry gate. CI's generated-artifact phase independently regenerates and compares the committed set.

Two deliberately scheduled final integration laps then measured the missing landing mechanism:

• Two-pass lap: merged main base e39d014988, regenerated and parsed both projections twice, and pushed head 0c2f2268a33. Both passes produced DESIGN.md digest b559dfc7b2cbe9bd877692059c5b81c4a387e33625eef506fc5b46d394215a43 and ledger digest 975b639e1e935b5a7237db618555bca9205a8b73799a8d4eb616e5595c74794a. Main advanced before the immediate post-push merge-tree probe.
• Single-pass lap: merged main base 4c6e5dfcd4, regenerated and parsed every named projection once, and pushed current head 0a8bf30b97c. It produced DESIGN.md digest 09a5854cbb64732e5ffacd319029d328b212606c982df641796fdb902e3f574a and ledger digest 8fc48e87576be86d54e5d54f426172ab04f42fcb4e2c0658e3a9c5d8b7e715b1. The second pass was deliberately omitted because it establishes generator idempotence, already repeatedly measured and independently backed by CI, while pass one itself is the lap-specific parse and projection. Main again advanced before the immediate post-push merge-tree probe.

The last ten observed main-merge gaps were 357, 562, 1527, 888, 2314, 285, 1099, 256, 716, and 11 seconds (median about 640 seconds; four under 400 seconds). The single-pass lap merged 4c6e5dfcd4 at 15:35:35; main advanced to 792d6e3466 at 15:41:32, a 357-second gap shorter than the reduced lap. No positive-duration regenerate/push sequence can reliably beat an 11-second short tail. Regeneration, push, and merge therefore need a serialized stale-base-refusing landing window; further unsynchronized laps are unbounded churn.

The branch tree at 0a8bf30b97c is correct against the authority it merged: recurring_failure_mode.dag has 36 declarations and 36 roster entries, declared-minus-rostered and rostered-minus-declared are empty, there are zero conflict markers, both parent-minus-result RungDrop identity joins are empty, and both projections were generated once against and parsed with the merged authority. What stands between this tree and merge is the absence of a serialized landing window, not a defect in the tree.

Checks

• source-built local main_wet_one for every path named by the dry gate
• generator idempotence established separately by repeated byte-identical two-pass runs; CI drift gate retained as independent backstop
• merged-authority projection parse successful
• identity-set union and declaration/roster joins empty in both directions
• git diff --check
• pre-commit and pre-push cargo fmt --all --check