floor_cut's trigger was a prose edit against a six-capability loss — five capability-grain rows, and the trigger now points at them

[gunbai-bot]

The defect

gunbc.rung_drop floor_cut declared six lost capabilities under one restoration trigger:

this paragraph is rewritten as an ordinary present-tense description … when the re-add queue closes

That is §4b(3)'s grain mismatch in its plainest form — a plural loss with a singular trigger whose actuation is a prose edit.

And the predicate has no truth conditions. "the re-add queue" has exactly one referent in the tree: a numbered list under Step 3 of docs/plans/floor-cut-replacement-plan.md, which gunbc.doc_graph_roots registers as a HandAuthoredDocBind — a hand-authored document, so no .dag authority carries its contents. No membership object, no per-item disposition, no closure predicate (searched .dag, .rs, .md). Its own item 8 proposes the falsifier cadence never returns, and an item that never returns cannot close by returning — so closure would need a per-item disposition nothing records.

Five rows, not six — the arithmetic is shown

Two of the six were already dispositioned; rows for them would have been fabricated debt:

• generated-artifact drift is RESTORED (Nothing verifies the match: enrol the generated-artifact boundary as a required CI phase — the writer exists and is run by hand, so the gap is enrolment, not a missing regenerator #9415 enrolled the required generated-artifact phase). The effect-gates row therefore states the fraction: 1 of 7 discharged, 6 outstanding — a population that shrinks silently cannot be checked.
• the per-witness eval deadline already carries its own drop at gunbc.witness_row_cost gunbc_ci_fast_lane_rule_note; it is cited, never re-declared (a second row is the §3 fork).

What the five measured, from the tree rather than from the paragraph under suspicion

row	measured fact
floor_cut_fmt_gate	neither required lane runs cargo fmt; commit_workflow already carries it as an Uncovered residual; hook is opt-in and bypassable (#6658 landed unformatted .rs)
floor_cut_merge_admission_stamping	the receipt's producer is deleted — a live consumer with no input
floor_cut_heal	gunbc.ci_heal_credential survives and still cites gunbc.ci_workflow ci_heal_generated_artifacts_job; that module does not exist
floor_cut_falsifier_cadence	no workflow runs a cold comparison; v2.std.live_tree records two carriers whose enforcement claim died with it
floor_cut_effect_gates	six of seven have no required consumer

Each trigger names a capability and refuses the artifact that would look like one: repairing heal's dangling citations heals nothing; a gate that reports without refusing is the inert tier; re-adding a merge_admission_gate that reads a receipt nobody writes reproduces today's state with more code; strengthening the pre-push hook re-imports the pressure that converts honest reds into workaround greens.

The falsifier cadence's disposition is open, and says so

"Proposed: never returns" is a proposal in a hand-authored plan, not a ruling — and a capability deliberately not returning is a scope removal, which is the operator's call. The row retires either by the capability returning or by an operator ruling it withdrawn; in the second case the carriers that named the cadence as their enforcement must be corrected in the same change.

floor_cut itself changes in this diff

Otherwise the fork would be this repair's own product — two authorities answering "what retires this exposure", one naming an object proven not to exist. Its trigger sentence now names the five rows and states it retires when all five retire and by nothing else. Each of the five carries the same constraint from its own end, so the reading where someone retires floor_cut having read one sibling is closed. The narrative paragraph is untouched; splitting the 31,681-character blob remains its own item.

Filed

gunbc.recurring_failure_mode → fabricated_debt: a declaration authored for an exposure that does not exist or is already declared elsewhere, whose trigger cannot fire because there is nothing to restore. The two catches above are its receipts; its recognition rule is that the population was read from a paragraph rather than measured from the tree.

Executed: projections regenerated from the authority; DESIGN.md and docs/design-ledgers.md carry all five rows and the new class; test.claim.rung_drop_standing_partition_witness passes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WJ1bx2PttQ55XYhFqt3HUx

[gunbai-bot]

How this merge was resolved, and why the obvious check was not the one relied on

This branch integrates main at d11d66be85a. Four paths conflicted: the two roster authorities gunbc.recurring_failure_mode and gunbc.rung_drop, plus their generated projections DESIGN.md and docs/design-ledgers.md. The authorities were union-resolved by hand; the projections were regenerated, never hand-picked, via gunbc.instruments.generated_artifact_gate main_wet.

The check that would have passed while the file was broken

gunbc.recurring_failure_mode merge_region_excludes_shared_tail landed on main while this branch was held, and it describes this exact resolution shape: two lanes appending to one roster carrier whose rows share a trailing evidence: [], and closing brace. A three-way merge factors that shared suffix out of the conflict region, so the purely additive resolution — correct when the appended rows are independent — can leave the first row's closing lines belonging to the second. The class records that the natural verification, declared names against rostered names, still passes on the severed file, because both lists stay complete.

So that check was not treated as evidence. Two things were used instead.

1. Execution, not inspection. Regenerating the projections requires the instrument to parse both authorities and render both new classes. A severed row is a parse refusal at the module index (expected expression, found Eq), so a projection carrying fabricated_debt and main's accepted_source_emits_uncompilable_target could not have been produced from a fused file. The regeneration is the discriminating execution; the identity join is a convenience beside it.

2. A join that can distinguish a duplicate from a set. vivid-deer hit the mirror-image failure tonight: an identity join returning 46/46/46 clean while a duplicate sat in the file, because sets are idempotent. The join here is therefore multiset-based and additionally checks that each declaring symbol equals its own identity: string — which is what the shared-tail fusion actually breaks.

Measured on this head:

authority	decl symbols	identity strings	roster entries	dupes	symbol≠identity
recurring_failure_mode	47	47	47	none	none
rung_drop	17	17	17	none	none

Rostered-not-declared and declared-not-rostered are both empty for each.

The check was shown capable of going red

A green from a check nobody has seen fail is not evidence. Against three injected faults on rung_drop, with the unmodified file as positive control:

case	verdict
unmodified (control)	PASS
duplicated roster entry (the idempotent-set shape)	RED
rostered row with its declaration removed	RED
identity: string donated to the wrong declaring symbol (the fusion shape)	RED

Both sides of the merge survive: this branch's fabricated_debt and five floor_cut_* rows, alongside main's accepted_source_emits_uncompilable_target, one_refusal_two_destinations, and floor_cost_contention_verdict. All five mutual-lock clauses are present in the authority and in the projection.

— sent from neat-hawk-884