Latent destructive install hazard: the installer has no extension guard and the only thing keeping the emitted 17-line Cargo.toml off the hand-maintained stage0 manifest is the upstream .rs-only comparison denominator

DESIGN.md

@@ -222,6 +222,7 @@ One row per class, each carrying its recognition rule and its receipts, in [docs
 - `restored_bytes_reviewed_as_authorship`
 - `review_summary_inverts_roles_and_affirms_the_join`
 - `accepted_source_emits_uncompilable_target`
+- `incidental_denominator_as_wall`
 
 ## Building & checks
 

dag/gunbc/recurring_failure_mode.dag

@@ -168,6 +168,7 @@ data sealing_property_erases_structure: RecurringFailureMode = RecurringFailureM
 }
 
 data restoration_promise_names_a_route_that_does_not_exist: RecurringFailureMode = RecurringFailureMode { identity: "restoration_promise_names_a_route_that_does_not_exist" as NonEmptyStr, authored: "**a restoration promise names a route that does not exist** (a mechanism withholds, defers or dormant-marks a population and tells the reader it becomes observable again under some named condition — and that condition names a RUN, LANE, CADENCE OR SWEEP the tree does not contain. Nothing refuses, because the promise is a string in a diagnostic rather than a citation anything resolves; the population is not silently dropped, which is what makes the class survive review — it is dropped WITH A RECEIPT, and the receipt is what stops anyone looking. **THE BOUNDARY AGAINST `unbacked_execution_claim` IS THE TENSE AND IT DECIDES THE REMEDY.** That class is prose asserting a relation that RUNS NOW; this is prose asserting a relation that WILL run — a future condition, so `git log --all -S` over the declaration form finds nothing to past-tense and the origin arms there do not apply. It is also not `absorbing_fallback`: nothing widens, the withhold is precise and correctly counted. It is 4b(3)'s trigger trap with the polarity inverted — there a trigger names LESS than the capability it restores and gets satisfied while the capability stays dead; here the trigger names a capability whose PRECONDITION IS ALREADY FALSE, so it can never be satisfied at all and the row waits forever in a state that reads as temporary. **SPECIMEN WITH A RECEIPT, measured 2026-09-01 on head 4c6c509e and unrepaired at authoring.** `v1_compiler.cli_run.required_floor_runner` `suppress_withheld` removes enrolled expected-red identities whose module sits outside the required gate, printing that their enrolment `becomes observable again when the gate roster admits the module or in the whole-corpus receipts run`. THAT RUN DOES NOT EXIST: the phrase occurs exactly once in the tree, inside the message that promises it, and the repository carries three workflows of which none is it. 39 identities across 23 modules sit under that promise. Each is enrolled on `v2.workflow.floor_expected_red`, whose own header states what an enrolment asserts — that the identity REACHES ITS SUBJECT AND ANSWERS, and that a row belongs there only while someone is fixing it — so every one of the 39 asserts `runs, fails, someone is fixing it` about a row no run reaches. The only surviving route by which one executes is the changed-witness override, i.e. somebody editing it. **THE POPULATION IS DERIVABLE AND IS DELIBERATELY NOT TRANSCRIBED HERE**: it is `v2.workflow.floor_expected_red` `floor_expected_red_roster` minus the identities whose module matches `v2.workflow.required_floor` `required_gate_prefixes` — two authorities and a set difference, so it re-derives instead of rotting. **THE SAME ROSTER'S HEADER ALREADY RECORDS THE ANCESTOR OF THIS MISTAKE**, which is why it is a class: 101 rows were held there as agreement while never reaching their subject, and were reclassified into `v2.workflow.floor_route_gap` on 2026-08-20 once `ExpectedRedArm` was taught to refuse `HostEffectRefused`, `HostToolUnresolved` and an interrupted budget. That repair closed the arm where a NON-VERDICT was read as agreement; this class is the same harm one step earlier, where a row never reaches an arm at all and a sentence promises it will. **RECOGNITION RULE: whenever a diagnostic says a withheld thing becomes observable again `in`/`under`/`by` some named run, grep the tree for that name and require an executing consumer — a workflow job, a scheduled entry point, an actuator argv. If the only occurrence is the promise itself, the population is dormant forever and the honest states are two: admit the row cannot be observed on any cadence, or delete the enrolment. **RUNG: 1 (mitigatable) — the withhold is counted and located, which is the whole of what holds. CEILING: 3, since `whether a named route exists` is decidable from the workflow and entry-point authorities the tree already carries. NEXT-RUNG TRIGGER, a CAPABILITY and not an artifact: restoration conditions expressed as a resolvable citation to an executing consumer rather than as prose, so a promise naming no route fails to compile — writing this particular sentence better retires nothing.)" as NonEmptyStr, evidence: [] }
+data incidental_denominator_as_wall: RecurringFailureMode = RecurringFailureMode { identity: "incidental_denominator_as_wall" as NonEmptyStr, authored: "**incidental denominator as a wall** (a destructive operation is safe only because an upstream filter written to answer a DIFFERENT question happens never to hand it the dangerous input. Nothing is wrong today and nothing declares why, so the safety is a coincidence with no authority, no diagnostic and no test — and it dissolves silently the moment the upstream question changes, which is a change nobody reads as touching safety. Distinct from `authority_substitution`, where PROSE invents an A-to-B arrow: here the CODE leans on an arrow that genuinely holds and that neither carrier claims, so grepping the guarded operation finds no guard to have gotten wrong. Receipt (2026-09-01): `v1_compiler.required_regen_host` `install_convergence_stage_with_backend` copies `candidate_src/<basename>` over `stage0_src/<basename>` for whatever roster it is handed, asking nothing about the artifact. The emitter really produces a bare `Cargo.toml` (`v1.compiler.emit_rust`); `write_emitted_tree` writes it into the candidate tree verbatim because it is not rustfmt-normalizable; `produce_candidate_manifest` rows it as a `GeneratedSurface` declared by that emitter. Every stage between the emitter and the copy admits it. The sole reason it never became an install target was `is_compared_generated_basename`, whose job is to denominate the DRIFT COMPARISON. **THE HARM CLAIM IS THE PART THIS ROW GOT WRONG FIRST, and the correction is the instructive half.** The finding was briefed, amplified through a manager and written into a work-item title as a destructive overwrite of the 172-line hand-maintained `src/v1/stage0/Cargo.toml`. It is not: the installer joins destinations under `stage0_src = workspace/src/v1/stage0/src`, so a bare `Cargo.toml` basename resolves one directory BELOW the manifest, to a path that does not exist. Widening the population alone writes debris rather than destruction ONLY IF the join is the whole story, and THAT CLAIM WAS ITSELF AN UNDER-ENUMERATION, caught in review of the repair: `fs::copy` follows the DESTINATION link, git tracks symlinks, so a committed stage0 entry that is a symlink reaches any path in the tree with the join untouched. The lesson generalizes past this row: a harm correction that names ONE mechanism and treats it as the requirement is the same coincidence-as-wall shape turned on the analysis -- the honest form enumerates the ROUTES to the destination and says which are closed, since `resolves outside X` is a property of the filesystem and not of the path expression. Two readers reached the destructive reading independently and agreement read as confirmation, which is why the deciding observation is a JOIN EXPRESSION and not a semantic comparison of the two files — the artifacts genuinely differ, and that true fact was fused with a destination claim it never established. **The surviving harm is exemption, not destruction, and it is the one worth naming:** a declared `GeneratedSurface` that the comparison filter hides is invisible to the fixed point (`first_generation_equal`, `changed_paths`) and unreachable by the one authority that would force its gap to be counted — `v2.compiler.self_host.stage0_crate_layout` `emitter_produced_divergent_registrations`, which already enforces in three directions and holds `main.rs` for exactly this relation. So the filter did not accidentally PROTECT the artifact; it accidentally EXEMPTED it. Beside it sat a second, CALLER-LESS installer, `install_candidate_paths`, equally unguarded and invisible to review because a crate-wide dead-code allow kept it compiling: an unguarded operation with no consumer still reads as sanctioned precedent for the next author. **Recognition rule: for every operation that mutates authoritative bytes, ask what it would do if handed the worst member of the population its input is DRAWN FROM — not the population it is called with today — then name the function that forbids that member and the question that function was written to answer. If those two questions differ, the wall is incidental and the operation has none.** The remedy is an admission at the mutation boundary itself, over the whole roster before the first byte moves and refusing rather than skipping, since a per-item skip re-exports the same silence one layer in; and it is honestly a mechanically-preventable rung, whose ceiling is structural impossibility once the plan projects a typed surface identity instead of a `List<String>`. **THE REMEDY HAS ITS OWN TRAP, AND THIS ROW WALKED INTO IT BEFORE CATCHING IT: restating the incidental denominator as the guard's own rule.** The first repair refused every non-`.rs` install target, which reads as a wall and is the SAME defect dualised — the accidental denominator promoted from coincidence to policy, in a second location, now refusing the correct end state by construction, since the emitted manifest is stage0's own and is supposed to converge. **Recognition rule for the repair: state the arm's reason, and check whether it forbids the state the system is trying to REACH.** If it does, the guard has ratified the coincidence instead of replacing it, and the honest arms are the ones the boundary can answer from its own facts — here a path that cannot address its own destination, and a hand-authored mirror — while the artifact-kind question goes back to the authority that owns dispositions.)", evidence: [] }
 
 data restored_bytes_reviewed_as_authorship: RecurringFailureMode = RecurringFailureMode { identity: "restored_bytes_reviewed_as_authorship" as NonEmptyStr, authored: "**restored bytes reviewed as authorship** (a clobber repair returns content a prior PR already merged and a prior reviewer already accepted, but a diff has no way to say so: the restored lines are ADDED LINES, so a reviewer attributes them to the repairing PR and reviews them as new work. Specimen: gunbc#9937 restored two rows that gunbc#9868 had reverted off a stale base, and review 58203 filed REQUEST_CHANGES against a DESIGN section 6 transcribed-count defect in bytes that are character-for-character gunbc#9888's merged row -- a finding correct on its merits and misaddressed by one PR. **THE SECOND-ORDER EFFECT IS WHY THIS IS A CLASS AND NOT AN ANECDOTE: it makes clobber repairs EXPENSIVE TO LAND, which biases the fleet toward leaving clobbers standing.** The repairing lane inherits review debt for content it did not write, and the only way to discharge it inside the repair is to edit another lane's cells from a base lacking their context -- which is precisely the failure the repair exists to undo, committed a second time with better manners. RECOGNITION RULE: a diff whose added lines are byte-identical to a prior merged blob. It is DECIDABLE rather than a judgement call -- `cmp` against `git show <sha>:<path>` answers it, and provenance for the whole region comes from `git log -S` naming the commit that added the text and the commit that removed it. THE REMEDY IS THE AUTHOR'S AND IT IS CHEAP: state the restoration ahead of the diff and carry the byte-identity receipt, so a reviewer meets provenance before content; without it the same finding is re-filed against the same bytes on every re-review, and the loop is paid for twice. A finding against restored bytes is well-formed and BINDS THE DESTINATION: provenance decides who answers it and in which diff, and never whether it is answered. **THE WRONG READING OF THIS ROW WAS AUTHORED AND REFUSED IN ITS OWN FILING** (review 58220): an earlier revision said such a finding 'belongs in its own diff', which reads as licence to merge a known defect behind an authorship argument -- DESIGN section 5's hard reject, and inverted, since a restoration is exactly the motion that puts the bytes back on main. What actually happened on the specimen is the rule: the reviewer's section 6 finding was correct, the repairing lane argued for routing it elsewhere, the owning manager OVERRULED that, and the defect was repaired inside the restoration under a ruling -- which is what made the edit a decision rather than one lane rewriting another's cells. Routing is a question about AUTHORITY and context, decided by whoever owns both lanes; the bytes are reviewed at their destination either way. **Rung: mitigatable** -- the author states the restoration and carries a byte-identity receipt, and a reviewer may still miss it. **Ceiling: mechanically preventable**, because the recognition rule is decidable: a tool that joins each added line against the merged blobs of the commits git log -S names can annotate a diff as restored before a human reads it. It is not structural -- nothing can make a restoration unwritable, nor should it. **Next-rung trigger, at capability grain: the review surface distinguishes restored bytes from authored bytes without the author asserting it**, since an author-supplied notice is exactly the evidence a tired or adversarial diff will omit. **THE RECEIPT MUST BE TAKEN AT THE DESTINATION AND NOT AT THE SOURCE, and that is the transferable half.** `cmp` decides the git case because it reads the bytes where they LANDED, not the bytes an author meant to send; the general shape is ANY step between assertion and delivery altering content while the delivery reports success -- and the step is not always the one a reader would blame first. Measured the same day in three places, and the THIRD one is a caution about naming the culprit too early: git's merge region dropped a row outside the conflict markers; a review read merged bytes as authored ones; and two sessions' messages arrived with a backticked identifier deleted and a dollar-variable replaced by a plausible shell path, which BOTH of them first attributed to the message transport. That attribution was wrong, and it was settled by measurement rather than by reasoning: a third session kept the local source of a sent message, read the delivered body back out of the store, and diffed them -- identical but for a trailing newline, with backticks, a backslash continuation and a dollar-brace token all intact. The corruption was in the SENDER'S OWN SHELL, expanding an inline double-quoted argument before the tool ever saw it, and the proposed remedy of banning backticks would have cost a real notation to avoid a hazard that lives in a construction nobody has to use. A deletion leaves a gap a reader might notice; a substitution leaves a syntactically fine claim that is simply false, which is why source-side confidence is not evidence at all.)", evidence: [] }
 
@@ -224,4 +225,5 @@ data recurring_failure_mode_roster: List<RecurringFailureMode> = [
   restored_bytes_reviewed_as_authorship,
   review_summary_inverts_roles_and_affirms_the_join,
   accepted_source_emits_uncompilable_target,
+  incidental_denominator_as_wall,
 ]

dag/gunbc/regen_convergence_seed_growth.dag

@@ -51,6 +51,8 @@ data regen_convergence_seed_growth_justification: SeedGrowthJustification = Seed
     DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "convergence_plan_from_model", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "install_convergence_stage", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "install_convergence_stage_with_backend", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "admit_install_target", field: WholeDeclaration },
+    DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "admit_install_destination", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "admit_stage_execution_from_model", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.required_regen_host", decl_name: "regen_generation_role_population", field: WholeDeclaration },
     DeclarationRef { module_path: "v1_compiler.cli_run", decl_name: "run_required_regen_scoped", field: WholeDeclaration }