From 2bfd37a29457fb7de570bf1234cb0f263fe83c12 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Tue, 1 Sep 2026 17:12:18 +0000 Subject: [PATCH 1/3] File unlanded_citation_indistinguishable_at_the_citing_end: two lanes, one hour, converged remedy A canonical row cites an identity that exists only in an open PR, so on main -- the tree the row lands in -- the citation resolves to nothing. The mechanism is that THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END: a name that resolves and a name that will resolve are the same text in the same position, so reading more carefully does not find it. The check that discriminates is a lookup against main; the check an author naturally performs is a lookup against their own context, where the symbol is vividly present because they or a peer just wrote it. Both receipts were caught by CI and neither by review, which is what that asymmetry predicts. A vocabulary defect carries it between lanes, and that half makes the class preventable rather than merely detectable: "filed" is true the moment a row is authored in a branch and is heard as "the tree carries it". Never say filed without saying filed WHERE. Two independent receipts an hour apart, different lanes, different carriers, each caught by codex, each repaired the same way without knowledge of the other. Three admissible citation forms are ranked by DECAY rather than correctness: name the PR and its openness (stays true after the sibling lands and tightens to the bare identity), boundary by description (correct but must be rewritten), never a bare unresolving identity. The rule forbids stacking the citing PR behind the cited one: that satisfies "resolves eventually" and fails "resolves at landing". Credit: the mechanism sentence, the transport half and the PR-plus-openness form are wise-carp-844's, supplied for this row. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01XpYuLQ4AwfSJmcFk26aPap --- DESIGN.md | 1 + dag/gunbc/recurring_failure_mode.dag | 3 +++ docs/design-ledgers.md | 1 + 3 files changed, 5 insertions(+) diff --git a/DESIGN.md b/DESIGN.md index 874d6a86eeb..3871aa2171a 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -184,6 +184,7 @@ The payoff is that **language design itself opens up.** It is normally locked by One row per class, each carrying its recognition rule and its receipts, in [docs/design-ledgers.md](docs/design-ledgers.md) — authority `gunbc.recurring_failure_mode`. They are rostered there rather than here because they are a LEDGER and not a consequence: every lane that finds a new class appends one, so the section grows without bound while this document's sections are fixed by §1. The index below is the classes; the ledger is the content. +- `unlanded_citation_indistinguishable_at_the_citing_end` - `hollow_alias` - `state_space_conflation` - `absorbing_fallback` diff --git a/dag/gunbc/recurring_failure_mode.dag b/dag/gunbc/recurring_failure_mode.dag index fdd2a964c0d..69bfe836b23 100644 --- a/dag/gunbc/recurring_failure_mode.dag +++ b/dag/gunbc/recurring_failure_mode.dag @@ -178,7 +178,10 @@ data admitted_module_without_judged_standing: RecurringFailureMode = RecurringFa evidence: [], } +data unlanded_citation_indistinguishable_at_the_citing_end: RecurringFailureMode = RecurringFailureMode { identity: "unlanded_citation_indistinguishable_at_the_citing_end" as NonEmptyStr, authored: "**a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, RANKED, AND THE RANKING IS ABOUT DECAY RATHER THAN CORRECTNESS. Best where the identity is stable and a future reader should be able to find it: NAME THE PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. Second: BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol; correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.)", evidence: [] } + data recurring_failure_mode_roster: List = [ + unlanded_citation_indistinguishable_at_the_citing_end, hollow_alias, state_space_conflation, absorbing_fallback, diff --git a/docs/design-ledgers.md b/docs/design-ledgers.md index 7dccbaae4d9..132e8627edf 100644 --- a/docs/design-ledgers.md +++ b/docs/design-ledgers.md @@ -12,6 +12,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit **THE THIRD EMIT-STAGE ESCAPE MODE NOW HAS A MEASURED POPULATION (2026-08-27), AND THE NUMBER IS 31, NOT THE 39 A TEXT SCAN SUGGESTED.** `v1_compiler.declaration_index` already derives each module's imports and typed-literal `DeclarationRef` citations from the parse sweep. Its one ingestion-derived join now reports every distinct non-fixture module cited by a different non-fixture module and reached by no import edge, with all 31 RETAINED IDENTITIES beside the count on the required parse phase. Fixture citers and targets are evidence carriers, not production authority demand; self-citation creates no consumer; both are excluded by construction. The earlier regex figure 39 was an instrument result, never an oracle: on the tree measured here its comparable scan returned 38, including six `module_path` fields that are not `DeclarationRef`s at all, while one real citation routed through the local `wet_surface_ref` wrapper lies outside the index's declared extraction boundary. Neither discrepancy is smoothed away. This bounds mode three at the exact grain the parser-backed instrument can establish; it does not bound mode one, all emit-stage diagnostics, or every possible citation spelling. **THE DISCRIMINATING EXECUTION EXISTS AND THE REQUIRED PHASE DOES NOT.** Compiling the retained `gunbc.auth.credentials` entry refused on its four known hard diagnostics in 87.712s; compiling the clean orphan control `extdeps.vendor.arm` passed in 85.119s. That pair proves entry compilation detects the class without making every legitimate orphan red. It also refuses enrollment of a serial 31-entry phase: these subjects cost about 85s each, with 21–24s (about 27%) in reconcile, not the neighbouring emit-compile row's 40–50s and ~85% reconcile over a different roster. Both measurements stand; neither is generalized across the other population. At this cost shape a whole-population serial wall is outside the admitted runner envelope, so mode three remains unprevented while its exact parser-visible remainder is now bounded and named. The construction-side candidate is citation-derived dependency edges, which would make a cited authority enter its citer's closure instead of adding a second compile; it is NOT claimed here because qualified references already prove import closure under-approximates dependency, the index deliberately does not resolve every wrapper-produced `DeclarationRef`, and the closure-growth and historical/quarantined-citation semantics have not been bounded. Its next decision requires those measurements, not a second edge authority improvised in the census. +- **a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, RANKED, AND THE RANKING IS ABOUT DECAY RATHER THAN CORRECTNESS. Best where the identity is stable and a future reader should be able to find it: NAME THE PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. Second: BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol; correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.) - hollow alias (minimality ≠ grounding) - state-space conflation (an `Option`/`None` meaning >2 things — split into named variants; its most-repeated form here is **not-applicable rendered as malformed** — one reason symbol over "the input is wrong" and "this strategy had nothing to say about it", which have opposite owners and opposite repairs. Found three times in three stages by one lane (#8801 and #8828 in body lowering, `parse_g0_tokens_remain` in parse), always by reading the producer and never from the message. Recognition rule: if the arm sits downstream of a search, lookup or alternative that returned `Absent`, it is not-applicable and needs its own reason. A SECOND FORM, which does not match that shape and is the same class: **a dichotomy stated over a domain with three states.** Specimen (gunbc#9324): the `floor_resource_sample` comment documented `pswpin` rising with `pgmajfault` as swap and `pgmajfault` rising with `pswpin` flat as mapping churn — two arms over three states, since BOTH FLAT is quiet. Churn is a defect this lane owns and quiet is the absence of one, so the missing arm inverts the verdict. The mechanism of the misread is what the recognition rule keys on: `pgmajfault rises` and `pswpin flat` are two conditions and only their CONJUNCTION is churn, so a reader matching on the cheaper condition alone selects churn for a state that satisfies `pswpin flat` and nothing else — which zero-and-zero does. **Recognition rule for this form: for every arm of a stated dichotomy, enumerate the domain and check that each arm's conditions are required jointly.** What made it invisible rather than merely wrong is that BOTH readers landed on the same arm — 26 intervals so classified by one and 6 by another, neither having compared notes — and agreement reads as confirmation. THAT IS A PROMPT TO RE-DERIVE, NOT A DIAGNOSTIC, and the distinction is load-bearing: convergent readings are equally produced by shared assumptions, a common heuristic, ambiguity in the subject, or one reader having anchored on the other, and n=2 on one specimen cannot separate those from a defect in the rule. What survives is only the weaker direction — agreement between readers of one rule is not independent evidence about that rule, because the shared input is a shared potential defect, so it licenses re-deriving from the domain and never a conclusion about which cause produced it.) **A THIRD FORM, and the one that is hardest to rank because nothing is wrong today: A STATE THAT IS ALREADY LOAD-BEARING AND CARRIED AS AN AD-HOC SPELLING RATHER THAN A CONSTRUCTOR.** Specimen (2026-09-01): the identity key threaded through v1.compiler.coercion has THREE inhabitants -- a real declaring module path, the synthetic that v1.std.core kernel_span mints for kernel nodes, and the empty string meaning unknown -- while every consumer discriminates only empty from non-empty. lookup_checkpoint and type_realization_decision therefore read as a KNOWN declaration and proceed to the spelling-keyed arm; decl_file_declares_structurally compares that synthetic identity against a roster of real paths with contains, which no can ever match, so the structural gate is unreachable for a kernel-resolved reference BY CONSTRUCTION rather than by decision. The key reaches those gates with exactly that value through type_reference_decl_file, from v1.compiler.emit coerce_primitive_type and v1.compiler.emit_rust rust_named_type_base and rust_applied_type_base. **What makes this the third form rather than an instance of the first two is the evidence that the state is REAL: the tree already handles it, three times, by string prefix.** numeric_realization_declaring_modules carries the literal " Date: Tue, 1 Sep 2026 17:31:57 +0000 Subject: [PATCH 2/3] Complete the row's 4b schema and hedge the ranking its own author withdrew (review 58266) Two changes, one from review and one from the peer who supplied half the row. REVIEW 58266: the row carried mechanism, receipts and remedy but no rung, ceiling or trigger, and its receipts were not identified at checkable grain. Now stated: - RUNG MITIGATABLE. The required cited-symbol resolution check is LIVE -- its rung drop cited_symbol_census is Retired -- and did not fire, because both citations were prose inside an authored: String rather than typed references. A prose name is not reachable from the namespace tree the check walks, so the check was not weak, it was not applicable. A review bot caught both, which is containment, not prevention. - CEILING is NOT structural while the citation stays prose: deciding whether an identity-shaped token in a paragraph is a citation or a mention is not decidable, so a prose scanner would be a heuristic dressed as a wall. The class sits in the outside-the-modeled-guarantee column, the same standing unbacked_execution_claim records for the same reason. - TRIGGER is a typed row-to-row citation carrier. The moment such a citation is typed, the EXISTING required check covers it and the class climbs in one step with no new gate. The evidence: List field is named as the nearest carrier and explicitly NOT that capability. - evidence stays empty and the row says why: both receipts are PRs and review artifacts, not declarations, so padding the field would fake a DeclarationRef that does not exist. Receipts are gunbc#9946 review 58237 and gunbc#9949 review 58260. RANKING HEDGE, from wise-carp-844 correcting their own contribution: name- the-PR-and-its-openness ranks first only while the cited identity is STABLE. If the cited PR renames its row before landing -- under review pressure, or when two lanes converge and merge their classes -- that form points at a real PR carrying a row that no longer has the name, and it fails WHILE STILL LOOKING RESOLVABLE, because the PR number resolves and the identity does not. Description survives a rename; it does not name the thing that changed. An identity in an open PR under active review is precisely the unstable case. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01XpYuLQ4AwfSJmcFk26aPap --- dag/gunbc/recurring_failure_mode.dag | 2 +- docs/design-ledgers.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dag/gunbc/recurring_failure_mode.dag b/dag/gunbc/recurring_failure_mode.dag index 69bfe836b23..50d09fd8590 100644 --- a/dag/gunbc/recurring_failure_mode.dag +++ b/dag/gunbc/recurring_failure_mode.dag @@ -178,7 +178,7 @@ data admitted_module_without_judged_standing: RecurringFailureMode = RecurringFa evidence: [], } -data unlanded_citation_indistinguishable_at_the_citing_end: RecurringFailureMode = RecurringFailureMode { identity: "unlanded_citation_indistinguishable_at_the_citing_end" as NonEmptyStr, authored: "**a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, RANKED, AND THE RANKING IS ABOUT DECAY RATHER THAN CORRECTNESS. Best where the identity is stable and a future reader should be able to find it: NAME THE PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. Second: BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol; correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.)", evidence: [] } +data unlanded_citation_indistinguishable_at_the_citing_end: RecurringFailureMode = RecurringFailureMode { identity: "unlanded_citation_indistinguishable_at_the_citing_end" as NonEmptyStr, authored: "**a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, AND THE RANKING BETWEEN THE FIRST TWO IS CONDITIONAL ON WHETHER THE CITED IDENTITY IS STABLE -- an unconditional ranking was proposed, and withdrawn by its own author on the argument below. WHERE THE CITED IDENTITY IS STABLE, name the PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. **WHERE THE CITED IDENTITY IS NOT STABLE, BOUNDARY BY DESCRIPTION RANKS FIRST INSTEAD, AND AN IDENTITY IN AN OPEN PR UNDER ACTIVE REVIEW IS PRECISELY THE UNSTABLE CASE.** If the cited PR RENAMES its row before landing -- under review pressure, or because two lanes converge and merge their classes -- the PR-naming form points at a real PR carrying a row that no longer has that name, AND IT FAILS WHILE STILL LOOKING RESOLVABLE: the PR number resolves, the identity does not, and the sentence reads as correct. A description survives that, because it does not name the thing that changed. So: PR-plus-openness when the identity is settled, description when it is in motion. BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol -- is otherwise second: correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. RUNG, CEILING AND TRIGGER, per DESIGN section 4b. RUNG FOUND AT: MITIGATABLE. The repository already runs a required cited-symbol resolution check -- its rung drop `cited_symbol_census` is RETIRED, so the capability is live -- and it did not fire on either receipt, because BOTH CITATIONS WERE PROSE INSIDE AN `authored: String`, not typed references. A prose name is not reachable from the namespace tree the check walks, so the check was not weak here; it was not applicable. What caught both was a review bot reading the text, which is containment after the fact and not prevention. ATTAINABLE CEILING, AND IT IS NOT STRUCTURAL WHILE THE CITATION STAYS PROSE: deciding whether an identity-shaped token inside a paragraph is a CITATION or merely a mention is not decidable, so a scanner over prose would be a heuristic, and DESIGN section 5 forbids dressing one as a wall. This class therefore sits in the *outside the modeled guarantee* column for as long as row-to-row citation is prose -- observed and repaired by reading, never gated -- which is the same standing `unbacked_execution_claim` records for the same reason. NEXT-RUNG TRIGGER, A CAPABILITY AND NOT AN ARTIFACT: A TYPED ROW-TO-ROW CITATION CARRIER -- the ability to express `this row's boundary is drawn against THAT row` as a reference the namespace authority resolves, rather than as a name inside a paragraph. The moment such a citation is typed, the EXISTING required check covers it and the class climbs to structurally guaranteed for every typed citation in one step, with no new gate to build. `RecurringFailureMode` carries an `evidence: List` field, which is the nearest existing carrier and is NOT that capability: it records declarations that witness the class, not the class's boundary against a sibling, and pressing it into service would be a second meaning for one field. WHY THIS ROW'S OWN `evidence` IS EMPTY, stated rather than left to look like an omission: both receipts are PULL REQUESTS AND REVIEW ARTIFACTS, not declarations, so there is no `DeclarationRef` to carry them and the field is honestly empty rather than padded. THE RECEIPTS AT CHECKABLE GRAIN: (i) gunbc#9946, review 58237 -- a recurring-failure-mode row whose boundary named a sibling living in the same author's other open PR, gunbc#9932; (ii) gunbc#9949, review 58260 -- a proof field naming a class living in a third session's open PR, gunbc#9939, reached through the `filed` message. Both reviews are codex, both on the first pushed head of their PR, and each names the unresolvable identity explicitly. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.)", evidence: [] } data recurring_failure_mode_roster: List = [ unlanded_citation_indistinguishable_at_the_citing_end, diff --git a/docs/design-ledgers.md b/docs/design-ledgers.md index 132e8627edf..7ff1512d982 100644 --- a/docs/design-ledgers.md +++ b/docs/design-ledgers.md @@ -12,7 +12,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit **THE THIRD EMIT-STAGE ESCAPE MODE NOW HAS A MEASURED POPULATION (2026-08-27), AND THE NUMBER IS 31, NOT THE 39 A TEXT SCAN SUGGESTED.** `v1_compiler.declaration_index` already derives each module's imports and typed-literal `DeclarationRef` citations from the parse sweep. Its one ingestion-derived join now reports every distinct non-fixture module cited by a different non-fixture module and reached by no import edge, with all 31 RETAINED IDENTITIES beside the count on the required parse phase. Fixture citers and targets are evidence carriers, not production authority demand; self-citation creates no consumer; both are excluded by construction. The earlier regex figure 39 was an instrument result, never an oracle: on the tree measured here its comparable scan returned 38, including six `module_path` fields that are not `DeclarationRef`s at all, while one real citation routed through the local `wet_surface_ref` wrapper lies outside the index's declared extraction boundary. Neither discrepancy is smoothed away. This bounds mode three at the exact grain the parser-backed instrument can establish; it does not bound mode one, all emit-stage diagnostics, or every possible citation spelling. **THE DISCRIMINATING EXECUTION EXISTS AND THE REQUIRED PHASE DOES NOT.** Compiling the retained `gunbc.auth.credentials` entry refused on its four known hard diagnostics in 87.712s; compiling the clean orphan control `extdeps.vendor.arm` passed in 85.119s. That pair proves entry compilation detects the class without making every legitimate orphan red. It also refuses enrollment of a serial 31-entry phase: these subjects cost about 85s each, with 21–24s (about 27%) in reconcile, not the neighbouring emit-compile row's 40–50s and ~85% reconcile over a different roster. Both measurements stand; neither is generalized across the other population. At this cost shape a whole-population serial wall is outside the admitted runner envelope, so mode three remains unprevented while its exact parser-visible remainder is now bounded and named. The construction-side candidate is citation-derived dependency edges, which would make a cited authority enter its citer's closure instead of adding a second compile; it is NOT claimed here because qualified references already prove import closure under-approximates dependency, the index deliberately does not resolve every wrapper-produced `DeclarationRef`, and the closure-growth and historical/quarantined-citation semantics have not been bounded. Its next decision requires those measurements, not a second edge authority improvised in the census. -- **a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, RANKED, AND THE RANKING IS ABOUT DECAY RATHER THAN CORRECTNESS. Best where the identity is stable and a future reader should be able to find it: NAME THE PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. Second: BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol; correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.) +- **a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, AND THE RANKING BETWEEN THE FIRST TWO IS CONDITIONAL ON WHETHER THE CITED IDENTITY IS STABLE -- an unconditional ranking was proposed, and withdrawn by its own author on the argument below. WHERE THE CITED IDENTITY IS STABLE, name the PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. **WHERE THE CITED IDENTITY IS NOT STABLE, BOUNDARY BY DESCRIPTION RANKS FIRST INSTEAD, AND AN IDENTITY IN AN OPEN PR UNDER ACTIVE REVIEW IS PRECISELY THE UNSTABLE CASE.** If the cited PR RENAMES its row before landing -- under review pressure, or because two lanes converge and merge their classes -- the PR-naming form points at a real PR carrying a row that no longer has that name, AND IT FAILS WHILE STILL LOOKING RESOLVABLE: the PR number resolves, the identity does not, and the sentence reads as correct. A description survives that, because it does not name the thing that changed. So: PR-plus-openness when the identity is settled, description when it is in motion. BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol -- is otherwise second: correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. RUNG, CEILING AND TRIGGER, per DESIGN section 4b. RUNG FOUND AT: MITIGATABLE. The repository already runs a required cited-symbol resolution check -- its rung drop `cited_symbol_census` is RETIRED, so the capability is live -- and it did not fire on either receipt, because BOTH CITATIONS WERE PROSE INSIDE AN `authored: String`, not typed references. A prose name is not reachable from the namespace tree the check walks, so the check was not weak here; it was not applicable. What caught both was a review bot reading the text, which is containment after the fact and not prevention. ATTAINABLE CEILING, AND IT IS NOT STRUCTURAL WHILE THE CITATION STAYS PROSE: deciding whether an identity-shaped token inside a paragraph is a CITATION or merely a mention is not decidable, so a scanner over prose would be a heuristic, and DESIGN section 5 forbids dressing one as a wall. This class therefore sits in the *outside the modeled guarantee* column for as long as row-to-row citation is prose -- observed and repaired by reading, never gated -- which is the same standing `unbacked_execution_claim` records for the same reason. NEXT-RUNG TRIGGER, A CAPABILITY AND NOT AN ARTIFACT: A TYPED ROW-TO-ROW CITATION CARRIER -- the ability to express `this row's boundary is drawn against THAT row` as a reference the namespace authority resolves, rather than as a name inside a paragraph. The moment such a citation is typed, the EXISTING required check covers it and the class climbs to structurally guaranteed for every typed citation in one step, with no new gate to build. `RecurringFailureMode` carries an `evidence: List` field, which is the nearest existing carrier and is NOT that capability: it records declarations that witness the class, not the class's boundary against a sibling, and pressing it into service would be a second meaning for one field. WHY THIS ROW'S OWN `evidence` IS EMPTY, stated rather than left to look like an omission: both receipts are PULL REQUESTS AND REVIEW ARTIFACTS, not declarations, so there is no `DeclarationRef` to carry them and the field is honestly empty rather than padded. THE RECEIPTS AT CHECKABLE GRAIN: (i) gunbc#9946, review 58237 -- a recurring-failure-mode row whose boundary named a sibling living in the same author's other open PR, gunbc#9932; (ii) gunbc#9949, review 58260 -- a proof field naming a class living in a third session's open PR, gunbc#9939, reached through the `filed` message. Both reviews are codex, both on the first pushed head of their PR, and each names the unresolvable identity explicitly. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.) - hollow alias (minimality ≠ grounding) - state-space conflation (an `Option`/`None` meaning >2 things — split into named variants; its most-repeated form here is **not-applicable rendered as malformed** — one reason symbol over "the input is wrong" and "this strategy had nothing to say about it", which have opposite owners and opposite repairs. Found three times in three stages by one lane (#8801 and #8828 in body lowering, `parse_g0_tokens_remain` in parse), always by reading the producer and never from the message. Recognition rule: if the arm sits downstream of a search, lookup or alternative that returned `Absent`, it is not-applicable and needs its own reason. A SECOND FORM, which does not match that shape and is the same class: **a dichotomy stated over a domain with three states.** Specimen (gunbc#9324): the `floor_resource_sample` comment documented `pswpin` rising with `pgmajfault` as swap and `pgmajfault` rising with `pswpin` flat as mapping churn — two arms over three states, since BOTH FLAT is quiet. Churn is a defect this lane owns and quiet is the absence of one, so the missing arm inverts the verdict. The mechanism of the misread is what the recognition rule keys on: `pgmajfault rises` and `pswpin flat` are two conditions and only their CONJUNCTION is churn, so a reader matching on the cheaper condition alone selects churn for a state that satisfies `pswpin flat` and nothing else — which zero-and-zero does. **Recognition rule for this form: for every arm of a stated dichotomy, enumerate the domain and check that each arm's conditions are required jointly.** What made it invisible rather than merely wrong is that BOTH readers landed on the same arm — 26 intervals so classified by one and 6 by another, neither having compared notes — and agreement reads as confirmation. THAT IS A PROMPT TO RE-DERIVE, NOT A DIAGNOSTIC, and the distinction is load-bearing: convergent readings are equally produced by shared assumptions, a common heuristic, ambiguity in the subject, or one reader having anchored on the other, and n=2 on one specimen cannot separate those from a defect in the rule. What survives is only the weaker direction — agreement between readers of one rule is not independent evidence about that rule, because the shared input is a shared potential defect, so it licenses re-deriving from the domain and never a conclusion about which cause produced it.) **A THIRD FORM, and the one that is hardest to rank because nothing is wrong today: A STATE THAT IS ALREADY LOAD-BEARING AND CARRIED AS AN AD-HOC SPELLING RATHER THAN A CONSTRUCTOR.** Specimen (2026-09-01): the identity key threaded through v1.compiler.coercion has THREE inhabitants -- a real declaring module path, the synthetic that v1.std.core kernel_span mints for kernel nodes, and the empty string meaning unknown -- while every consumer discriminates only empty from non-empty. lookup_checkpoint and type_realization_decision therefore read as a KNOWN declaration and proceed to the spelling-keyed arm; decl_file_declares_structurally compares that synthetic identity against a roster of real paths with contains, which no can ever match, so the structural gate is unreachable for a kernel-resolved reference BY CONSTRUCTION rather than by decision. The key reaches those gates with exactly that value through type_reference_decl_file, from v1.compiler.emit coerce_primitive_type and v1.compiler.emit_rust rust_named_type_base and rust_applied_type_base. **What makes this the third form rather than an instance of the first two is the evidence that the state is REAL: the tree already handles it, three times, by string prefix.** numeric_realization_declaring_modules carries the literal " Date: Wed, 2 Sep 2026 00:02:56 +0000 Subject: [PATCH 3/3] Carry the demonstration and the tightening corollary in the row itself Two additions to unlanded_citation_indistinguishable_at_the_citing_end, both about the receipts paragraph rather than the rule statement. The paragraph now says why its two receipts use two different admissible forms: the first names identities because its subjects have landed, the second names a PR and its openness because gunbc#9939 has not. A stated ranking teaches the conclusion; a paragraph using both forms because its cited PRs are in different states teaches the discriminator. And the corollary that made the previous commit's edit necessary: when a citation tightens from description to identity, the receipt usually lives in the state that just ended, so tightening silently destroys it. This row's first receipt IS the historical non-resolution of those two names; tightened to bare identities it would evidence a row about unresolvable citations with resolvable ones. A tightening must carry the ended state as a stated fact beside the new name. --- dag/gunbc/recurring_failure_mode.dag | 2 +- docs/design-ledgers.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dag/gunbc/recurring_failure_mode.dag b/dag/gunbc/recurring_failure_mode.dag index e2d6e760df4..6dce42481ad 100644 --- a/dag/gunbc/recurring_failure_mode.dag +++ b/dag/gunbc/recurring_failure_mode.dag @@ -187,7 +187,7 @@ data accepted_source_emits_uncompilable_target: RecurringFailureMode = Recurring } data selection_view_read_as_population: RecurringFailureMode = RecurringFailureMode { identity: "selection_view_read_as_population" as NonEmptyStr, authored: "**a selection view read as the population** (a decidable predicate is written over MEASURED values -- cost at or above N, latency under N, rows a report printed -- and its output is then treated as the population of the class under study. Membership in that set is a property of THE MEASUREMENT, not of the subject: it moves when the instrument moves, when load moves, when the reporter truncates, while the subject is unchanged. The set and the population are two objects joined by an assumption nobody states, and the assumption is false exactly when the measured quantity carries an unbounded term the threshold cannot see beneath. **WHAT MAKES THIS DIFFERENT FROM ITS NEIGHBOURS IS THE ROUTE IT ARRIVES BY, AND THAT IS ALSO THE WHOLE DIFFICULTY: IT ARRIVES AS THE FIX FOR A REAL OBJECTION.** `instrument_output_read_as_subject_content` is a report read past its own promise, and its closest unnamed relative here is a statistic computed over the observations that SURVIVED a threshold on the very variable being estimated -- filed separately as `censored_estimator_drops_its_own_tail`, and cited here by identity because that row now resolves in this tree; it was carried descriptively while it was unlanded, since a boundary drawn against a symbol that does not resolve is worse than a boundary drawn descriptively. Both of those are errors in the READING. This one is produced BY diligence. The predicate is decidable, it is honestly derived, and it is very often the correct answer to a legitimate refusal -- which is precisely why the next question does not get asked. **BEING CAREFUL IS WHAT MAKES IT INVISIBLE: the diligence is spent on the repair, and the repair's correctness is what stops anyone asking whether it answers the question that was posed.** A defect arriving inside a correct fix is not caught by the diligence that produced the fix. SPECIMEN, WITH BOTH ENDS BELONGING TO THE SAME AUTHOR THREE HOURS APART, which is why it is filed rather than blamed. (i) A peer lane computed a median and p95 over the rows a required-floor run's `[over-cost]` listing PRINTED -- an instrument that ranks by cost and truncates to a fixed head, and whose own closing line says so and names the per-claim cost artifact the run uploads as the complete population. This author correctly told them an order statistic of a truncated tail describes nothing, because the truncation is a property of the REPORTER. THE TWO PRODUCERS ARE NAMED RATHER THAN THEIR OUTPUTS TRANSCRIBED, per DESIGN section 6: the truncated view is that `[over-cost]` listing, and the population is `required_floor_claim_cost.tsv` as uploaded by the same run -- either is re-derivable from any floor run, and no count here needs to be trusted. (ii) The same author then had a declared drop refused for defining its population as `every required row whose headroom is smaller than the observed inflation` while calling that inflation censored with no upper bound -- an undecidable membership predicate, correctly refused under DESIGN section 4b(3). The fix was a decidable admission rule over each run's own per-claim cost artifact, which was the right repair for the refusal, and its output was then written into the row AS THE POPULATION. With an unbounded contention term, no lower threshold can prove the rows beneath it unaffected, so the set was a view the whole time. REPAIR: name the closed subject universe from the SUBJECT rather than from any measurement -- for the specimen, every required identity for which the cpu deadline is armed while it executes under the uncontrolled shared-runner envelope -- and keep the threshold set, which is genuinely useful, under an honest name: an EXPOSED ATTENTION SUBSET for prioritising work. A COROLLARY WORTH CARRYING SEPARATELY, because conflating the two hides the seam: the evidence floor behind such a threshold may be MONOTONE while the membership set is NOT. An observed floor only rises, so a constant derived from it only falls; individual identities still enter and leave the subset as their measured values vary. Monotonicity of the bound says nothing about stability of the set. **RECOGNITION RULE: when a set is produced by comparing a MEASURED value against a threshold, ask what the set would contain if the measurement were taken again under different conditions -- and ask it hardest when the predicate was just written to satisfy a reviewer, because that is the moment the answer feels settled.**)", evidence: [] } -data unlanded_citation_indistinguishable_at_the_citing_end: RecurringFailureMode = RecurringFailureMode { identity: "unlanded_citation_indistinguishable_at_the_citing_end" as NonEmptyStr, authored: "**a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, AND THE RANKING BETWEEN THE FIRST TWO IS CONDITIONAL ON WHETHER THE CITED IDENTITY IS STABLE -- an unconditional ranking was proposed, and withdrawn by its own author on the argument below. WHERE THE CITED IDENTITY IS STABLE, name the PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. **WHERE THE CITED IDENTITY IS NOT STABLE, BOUNDARY BY DESCRIPTION RANKS FIRST INSTEAD, AND AN IDENTITY IN AN OPEN PR UNDER ACTIVE REVIEW IS PRECISELY THE UNSTABLE CASE.** If the cited PR RENAMES its row before landing -- under review pressure, or because two lanes converge and merge their classes -- the PR-naming form points at a real PR carrying a row that no longer has that name, AND IT FAILS WHILE STILL LOOKING RESOLVABLE: the PR number resolves, the identity does not, and the sentence reads as correct. A description survives that, because it does not name the thing that changed. So: PR-plus-openness when the identity is settled, description when it is in motion. BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol -- is otherwise second: correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. RUNG, CEILING AND TRIGGER, per DESIGN section 4b. RUNG FOUND AT: MITIGATABLE. The repository already runs a required cited-symbol resolution check -- its rung drop `cited_symbol_census` is RETIRED, so the capability is live -- and it did not fire on either receipt, because BOTH CITATIONS WERE PROSE INSIDE AN `authored: String`, not typed references. A prose name is not reachable from the namespace tree the check walks, so the check was not weak here; it was not applicable. What caught both was a review bot reading the text, which is containment after the fact and not prevention. ATTAINABLE CEILING, AND IT IS NOT STRUCTURAL WHILE THE CITATION STAYS PROSE: deciding whether an identity-shaped token inside a paragraph is a CITATION or merely a mention is not decidable, so a scanner over prose would be a heuristic, and DESIGN section 5 forbids dressing one as a wall. This class therefore sits in the *outside the modeled guarantee* column for as long as row-to-row citation is prose -- observed and repaired by reading, never gated -- which is the same standing `unbacked_execution_claim` records for the same reason. NEXT-RUNG TRIGGER, A CAPABILITY AND NOT AN ARTIFACT: A TYPED ROW-TO-ROW CITATION CARRIER -- the ability to express `this row's boundary is drawn against THAT row` as a reference the namespace authority resolves, rather than as a name inside a paragraph. The moment such a citation is typed, the EXISTING required check covers it and the class climbs to structurally guaranteed for every typed citation in one step, with no new gate to build. `RecurringFailureMode` carries an `evidence: List` field, which is the nearest existing carrier and is NOT that capability: it records declarations that witness the class, not the class's boundary against a sibling, and pressing it into service would be a second meaning for one field. WHY THIS ROW'S OWN `evidence` IS EMPTY, stated rather than left to look like an omission: both receipts are PULL REQUESTS AND REVIEW ARTIFACTS, not declarations, so there is no `DeclarationRef` to carry them and the field is honestly empty rather than padded. THE RECEIPTS AT CHECKABLE GRAIN: (i) gunbc#9946, review 58237 -- the boundary clause of `selection_view_read_as_population` named `censored_estimator_drops_its_own_tail`, which at that moment lived only in the same author's other open PR, gunbc#9932. BOTH IDENTITIES RESOLVE IN THIS TREE NOW, which is why they are named here rather than described: the receipt is that they did NOT resolve when the citation was written, and the repair the citing row carries is the descriptive-then-tightened form this row ranks second; (ii) gunbc#9949, review 58260 -- a proof field naming a class living in a third session's open PR, gunbc#9939, reached through the `filed` message. Both reviews are codex, both on the first pushed head of their PR, and each names the unresolvable identity explicitly. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.)", evidence: [] } +data unlanded_citation_indistinguishable_at_the_citing_end: RecurringFailureMode = RecurringFailureMode { identity: "unlanded_citation_indistinguishable_at_the_citing_end" as NonEmptyStr, authored: "**a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, AND THE RANKING BETWEEN THE FIRST TWO IS CONDITIONAL ON WHETHER THE CITED IDENTITY IS STABLE -- an unconditional ranking was proposed, and withdrawn by its own author on the argument below. WHERE THE CITED IDENTITY IS STABLE, name the PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. **WHERE THE CITED IDENTITY IS NOT STABLE, BOUNDARY BY DESCRIPTION RANKS FIRST INSTEAD, AND AN IDENTITY IN AN OPEN PR UNDER ACTIVE REVIEW IS PRECISELY THE UNSTABLE CASE.** If the cited PR RENAMES its row before landing -- under review pressure, or because two lanes converge and merge their classes -- the PR-naming form points at a real PR carrying a row that no longer has that name, AND IT FAILS WHILE STILL LOOKING RESOLVABLE: the PR number resolves, the identity does not, and the sentence reads as correct. A description survives that, because it does not name the thing that changed. So: PR-plus-openness when the identity is settled, description when it is in motion. BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol -- is otherwise second: correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. RUNG, CEILING AND TRIGGER, per DESIGN section 4b. RUNG FOUND AT: MITIGATABLE. The repository already runs a required cited-symbol resolution check -- its rung drop `cited_symbol_census` is RETIRED, so the capability is live -- and it did not fire on either receipt, because BOTH CITATIONS WERE PROSE INSIDE AN `authored: String`, not typed references. A prose name is not reachable from the namespace tree the check walks, so the check was not weak here; it was not applicable. What caught both was a review bot reading the text, which is containment after the fact and not prevention. ATTAINABLE CEILING, AND IT IS NOT STRUCTURAL WHILE THE CITATION STAYS PROSE: deciding whether an identity-shaped token inside a paragraph is a CITATION or merely a mention is not decidable, so a scanner over prose would be a heuristic, and DESIGN section 5 forbids dressing one as a wall. This class therefore sits in the *outside the modeled guarantee* column for as long as row-to-row citation is prose -- observed and repaired by reading, never gated -- which is the same standing `unbacked_execution_claim` records for the same reason. NEXT-RUNG TRIGGER, A CAPABILITY AND NOT AN ARTIFACT: A TYPED ROW-TO-ROW CITATION CARRIER -- the ability to express `this row's boundary is drawn against THAT row` as a reference the namespace authority resolves, rather than as a name inside a paragraph. The moment such a citation is typed, the EXISTING required check covers it and the class climbs to structurally guaranteed for every typed citation in one step, with no new gate to build. `RecurringFailureMode` carries an `evidence: List` field, which is the nearest existing carrier and is NOT that capability: it records declarations that witness the class, not the class's boundary against a sibling, and pressing it into service would be a second meaning for one field. WHY THIS ROW'S OWN `evidence` IS EMPTY, stated rather than left to look like an omission: both receipts are PULL REQUESTS AND REVIEW ARTIFACTS, not declarations, so there is no `DeclarationRef` to carry them and the field is honestly empty rather than padded. THE RECEIPTS AT CHECKABLE GRAIN: (i) gunbc#9946, review 58237 -- the boundary clause of `selection_view_read_as_population` named `censored_estimator_drops_its_own_tail`, which at that moment lived only in the same author's other open PR, gunbc#9932. BOTH IDENTITIES RESOLVE IN THIS TREE NOW, which is why they are named here rather than described: the receipt is that they did NOT resolve when the citation was written, and the repair the citing row carries is the descriptive-then-tightened form this row ranks second; (ii) gunbc#9949, review 58260 -- a proof field naming a class living in a third session's open PR, gunbc#9939, reached through the `filed` message. Both reviews are codex, both on the first pushed head of their PR, and each names the unresolvable identity explicitly. **THE TWO RECEIPTS ARE CARRIED IN TWO DIFFERENT ADMISSIBLE FORMS, AND THAT IS DELIBERATE: the first names identities because its two subjects have since landed, the second names a PR and its openness because gunbc#9939 has not. A reader who sees the ranking stated learns the conclusion; a reader who sees one paragraph use both forms because its two cited PRs are in different states learns the DISCRIMINATOR.** A COROLLARY THAT THIS ROW ITSELF DEMONSTRATES, and it is the reason the first receipt does not read as two bare names: WHEN A CITATION TIGHTENS FROM DESCRIPTION TO IDENTITY, THE RECEIPT USUALLY LIVES IN THE STATE THAT JUST ENDED, so tightening SILENTLY DESTROYS IT. This row's first receipt is the historical NON-RESOLUTION of those two names, not the names; tightened to identities alone it would show a reader two symbols that resolve and no evidence the class ever occurred -- a row about unresolvable citations, evidenced by resolvable ones. So a tightening must carry the ended state as a stated fact beside the new name, never merely replace it. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.)", evidence: [] } data recurring_failure_mode_roster: List = [ censored_estimator_drops_its_own_tail, diff --git a/docs/design-ledgers.md b/docs/design-ledgers.md index 31d47441a19..23dd4e81aac 100644 --- a/docs/design-ledgers.md +++ b/docs/design-ledgers.md @@ -14,7 +14,7 @@ The landing measurement partitions the 31 parser-visible identities into **2 cit - **censored estimator drops its own tail** (an estimate of a variable is computed over the observations that SURVIVED a threshold on that same variable, so the sample structurally excludes its own extreme and the estimate is biased low with no bound. It is the neighbour of `instrument_output_read_as_subject_content` moved one step earlier: there a REPORT is complete for the reporter and read as complete for the consumer; here the truncation is in the ESTIMATOR'S OWN DOMAIN, and no amount of reading the instrument's output correctly recovers what the filter removed. SPECIMEN, both directions, 2026-09-01: the required floor's per-run cost inflation was estimated by pairing every claim that reported a cost in BOTH attempts of one tree -- median 1.053, p90 1.107. A claim that exceeds the cpu ceiling goes INTERRUPTED-BEFORE-VERDICT AND REPORTS NO COST, so the pairing dropped exactly the two most inflated observations; recovered from the ceiling itself, their inflation was at least 500/418 = 1.196, censored from above. THE SECOND HALF IS WHY THE ROW EXISTS: a peer lane, correcting a DIFFERENT defect in the same measurement, took the biased p90 by relay and derived an at-risk population of ONE -- an understatement arriving with the credibility of a retraction, which is the artifact nobody re-audits. Both counts were lower bounds and neither was labelled as one. RECOGNITION RULE: whenever an estimate is computed over rows that COMPLETED, RETURNED, PASSED, or were OBSERVED, ask what the incomplete rows would have contributed -- and if the incompleteness is caused by the very variable being estimated, the statistic is a floor and must be reported as one. The tell is a filter and an estimand naming the same quantity: cost estimated over rows that finished, latency over requests that did not time out, size over responses that were not truncated. REMEDY: report the censored bound rather than the sample statistic, and recover the excluded observations from the THRESHOLD they crossed, which is a real datum -- a row killed at 500ms is not missing, it is known to be above 500.) - **a selection view read as the population** (a decidable predicate is written over MEASURED values -- cost at or above N, latency under N, rows a report printed -- and its output is then treated as the population of the class under study. Membership in that set is a property of THE MEASUREMENT, not of the subject: it moves when the instrument moves, when load moves, when the reporter truncates, while the subject is unchanged. The set and the population are two objects joined by an assumption nobody states, and the assumption is false exactly when the measured quantity carries an unbounded term the threshold cannot see beneath. **WHAT MAKES THIS DIFFERENT FROM ITS NEIGHBOURS IS THE ROUTE IT ARRIVES BY, AND THAT IS ALSO THE WHOLE DIFFICULTY: IT ARRIVES AS THE FIX FOR A REAL OBJECTION.** `instrument_output_read_as_subject_content` is a report read past its own promise, and its closest unnamed relative here is a statistic computed over the observations that SURVIVED a threshold on the very variable being estimated -- filed separately as `censored_estimator_drops_its_own_tail`, and cited here by identity because that row now resolves in this tree; it was carried descriptively while it was unlanded, since a boundary drawn against a symbol that does not resolve is worse than a boundary drawn descriptively. Both of those are errors in the READING. This one is produced BY diligence. The predicate is decidable, it is honestly derived, and it is very often the correct answer to a legitimate refusal -- which is precisely why the next question does not get asked. **BEING CAREFUL IS WHAT MAKES IT INVISIBLE: the diligence is spent on the repair, and the repair's correctness is what stops anyone asking whether it answers the question that was posed.** A defect arriving inside a correct fix is not caught by the diligence that produced the fix. SPECIMEN, WITH BOTH ENDS BELONGING TO THE SAME AUTHOR THREE HOURS APART, which is why it is filed rather than blamed. (i) A peer lane computed a median and p95 over the rows a required-floor run's `[over-cost]` listing PRINTED -- an instrument that ranks by cost and truncates to a fixed head, and whose own closing line says so and names the per-claim cost artifact the run uploads as the complete population. This author correctly told them an order statistic of a truncated tail describes nothing, because the truncation is a property of the REPORTER. THE TWO PRODUCERS ARE NAMED RATHER THAN THEIR OUTPUTS TRANSCRIBED, per DESIGN section 6: the truncated view is that `[over-cost]` listing, and the population is `required_floor_claim_cost.tsv` as uploaded by the same run -- either is re-derivable from any floor run, and no count here needs to be trusted. (ii) The same author then had a declared drop refused for defining its population as `every required row whose headroom is smaller than the observed inflation` while calling that inflation censored with no upper bound -- an undecidable membership predicate, correctly refused under DESIGN section 4b(3). The fix was a decidable admission rule over each run's own per-claim cost artifact, which was the right repair for the refusal, and its output was then written into the row AS THE POPULATION. With an unbounded contention term, no lower threshold can prove the rows beneath it unaffected, so the set was a view the whole time. REPAIR: name the closed subject universe from the SUBJECT rather than from any measurement -- for the specimen, every required identity for which the cpu deadline is armed while it executes under the uncontrolled shared-runner envelope -- and keep the threshold set, which is genuinely useful, under an honest name: an EXPOSED ATTENTION SUBSET for prioritising work. A COROLLARY WORTH CARRYING SEPARATELY, because conflating the two hides the seam: the evidence floor behind such a threshold may be MONOTONE while the membership set is NOT. An observed floor only rises, so a constant derived from it only falls; individual identities still enter and leave the subset as their measured values vary. Monotonicity of the bound says nothing about stability of the set. **RECOGNITION RULE: when a set is produced by comparing a MEASURED value against a threshold, ask what the set would contain if the measurement were taken again under different conditions -- and ask it hardest when the predicate was just written to satisfy a reviewer, because that is the moment the answer feels settled.**) -- **a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, AND THE RANKING BETWEEN THE FIRST TWO IS CONDITIONAL ON WHETHER THE CITED IDENTITY IS STABLE -- an unconditional ranking was proposed, and withdrawn by its own author on the argument below. WHERE THE CITED IDENTITY IS STABLE, name the PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. **WHERE THE CITED IDENTITY IS NOT STABLE, BOUNDARY BY DESCRIPTION RANKS FIRST INSTEAD, AND AN IDENTITY IN AN OPEN PR UNDER ACTIVE REVIEW IS PRECISELY THE UNSTABLE CASE.** If the cited PR RENAMES its row before landing -- under review pressure, or because two lanes converge and merge their classes -- the PR-naming form points at a real PR carrying a row that no longer has that name, AND IT FAILS WHILE STILL LOOKING RESOLVABLE: the PR number resolves, the identity does not, and the sentence reads as correct. A description survives that, because it does not name the thing that changed. So: PR-plus-openness when the identity is settled, description when it is in motion. BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol -- is otherwise second: correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. RUNG, CEILING AND TRIGGER, per DESIGN section 4b. RUNG FOUND AT: MITIGATABLE. The repository already runs a required cited-symbol resolution check -- its rung drop `cited_symbol_census` is RETIRED, so the capability is live -- and it did not fire on either receipt, because BOTH CITATIONS WERE PROSE INSIDE AN `authored: String`, not typed references. A prose name is not reachable from the namespace tree the check walks, so the check was not weak here; it was not applicable. What caught both was a review bot reading the text, which is containment after the fact and not prevention. ATTAINABLE CEILING, AND IT IS NOT STRUCTURAL WHILE THE CITATION STAYS PROSE: deciding whether an identity-shaped token inside a paragraph is a CITATION or merely a mention is not decidable, so a scanner over prose would be a heuristic, and DESIGN section 5 forbids dressing one as a wall. This class therefore sits in the *outside the modeled guarantee* column for as long as row-to-row citation is prose -- observed and repaired by reading, never gated -- which is the same standing `unbacked_execution_claim` records for the same reason. NEXT-RUNG TRIGGER, A CAPABILITY AND NOT AN ARTIFACT: A TYPED ROW-TO-ROW CITATION CARRIER -- the ability to express `this row's boundary is drawn against THAT row` as a reference the namespace authority resolves, rather than as a name inside a paragraph. The moment such a citation is typed, the EXISTING required check covers it and the class climbs to structurally guaranteed for every typed citation in one step, with no new gate to build. `RecurringFailureMode` carries an `evidence: List` field, which is the nearest existing carrier and is NOT that capability: it records declarations that witness the class, not the class's boundary against a sibling, and pressing it into service would be a second meaning for one field. WHY THIS ROW'S OWN `evidence` IS EMPTY, stated rather than left to look like an omission: both receipts are PULL REQUESTS AND REVIEW ARTIFACTS, not declarations, so there is no `DeclarationRef` to carry them and the field is honestly empty rather than padded. THE RECEIPTS AT CHECKABLE GRAIN: (i) gunbc#9946, review 58237 -- the boundary clause of `selection_view_read_as_population` named `censored_estimator_drops_its_own_tail`, which at that moment lived only in the same author's other open PR, gunbc#9932. BOTH IDENTITIES RESOLVE IN THIS TREE NOW, which is why they are named here rather than described: the receipt is that they did NOT resolve when the citation was written, and the repair the citing row carries is the descriptive-then-tightened form this row ranks second; (ii) gunbc#9949, review 58260 -- a proof field naming a class living in a third session's open PR, gunbc#9939, reached through the `filed` message. Both reviews are codex, both on the first pushed head of their PR, and each names the unresolvable identity explicitly. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.) +- **a citation to a symbol that has not landed** (a canonical row cites an identity that exists only in an OPEN PR, so on main -- the tree the row lands in -- the citation resolves to nothing. **THE MECHANISM IS THAT THE TWO STATES ARE INDISTINGUISHABLE AT THE CITING END.** A name that resolves and a name that will resolve are the same text in the same position; nothing at the point of authorship separates them, so this is not carelessness and reading more carefully does not find it. The check that discriminates is a LOOKUP AGAINST MAIN; the check an author naturally performs is a lookup against their own context, in which the symbol is vividly present because they or a peer just wrote it. Both receipts below were caught by CI and neither by review, which is what that asymmetry predicts. **A VOCABULARY DEFECT CARRIES IT BETWEEN LANES, AND THAT HALF IS WHAT MAKES THE CLASS PREVENTABLE RATHER THAN MERELY DETECTABLE.** One receipt arrived through a MESSAGE saying a class was `filed`. That word is true the moment a row is authored in a branch and is heard as `the tree carries it`; the two states collapse into one utterance. So the rule has a speech half: never say FILED without saying filed WHERE -- `authored in gunbc#NNNN, open` or `landed on main` -- because a reader cannot recover the distinction the word destroyed. TWO INDEPENDENT RECEIPTS, ONE HOUR APART, DIFFERENT LANES AND DIFFERENT CARRIERS, EACH CAUGHT BY CI. (i) A recurring-failure-mode row drew its load-bearing boundary against a sibling class that lived in the author's own other open PR. (ii) A proof field in a separate lane cited a class living in a third session's open PR, reached through the `filed` message above. Both authors repaired it the same way without knowing of each other: DESCRIBE THE SIBLING BY SHAPE RATHER THAN NAMING IT. THE RULE, and it is stronger than it first sounds: A CANONICAL ROW MAY CITE ONLY WHAT RESOLVES ON MAIN AT THE MOMENT THE ROW LANDS. Not `resolves eventually`. **That formulation FORBIDS STACKING the citing PR behind the cited one**, which is the tempting repair precisely because it feels like it fixes the citation -- it satisfies resolves-eventually and fails resolves-at-landing, so it defers the defect rather than removing it. THREE ADMISSIBLE FORMS, AND THE RANKING BETWEEN THE FIRST TWO IS CONDITIONAL ON WHETHER THE CITED IDENTITY IS STABLE -- an unconditional ranking was proposed, and withdrawn by its own author on the argument below. WHERE THE CITED IDENTITY IS STABLE, name the PR AND ITS OPENNESS -- `authored as in gunbc#NNNN, which is open at this writing, so this points at the PR carrying the row rather than asserting an identity that does not yet resolve`. It stays TRUE after the cited PR lands and TIGHTENS to the bare identity rather than needing correction. **WHERE THE CITED IDENTITY IS NOT STABLE, BOUNDARY BY DESCRIPTION RANKS FIRST INSTEAD, AND AN IDENTITY IN AN OPEN PR UNDER ACTIVE REVIEW IS PRECISELY THE UNSTABLE CASE.** If the cited PR RENAMES its row before landing -- under review pressure, or because two lanes converge and merge their classes -- the PR-naming form points at a real PR carrying a row that no longer has that name, AND IT FAILS WHILE STILL LOOKING RESOLVABLE: the PR number resolves, the identity does not, and the sentence reads as correct. A description survives that, because it does not name the thing that changed. So: PR-plus-openness when the identity is settled, description when it is in motion. BOUNDARY BY DESCRIPTION -- name the sibling's shape and not its symbol -- is otherwise second: correct, but it must be REWRITTEN once the sibling lands, and a rewrite is where a citation quietly stops matching the row it describes. Never: a bare identity that does not resolve on main today, which is worse than no citation at all because a reader takes the name as established and stops checking. RUNG, CEILING AND TRIGGER, per DESIGN section 4b. RUNG FOUND AT: MITIGATABLE. The repository already runs a required cited-symbol resolution check -- its rung drop `cited_symbol_census` is RETIRED, so the capability is live -- and it did not fire on either receipt, because BOTH CITATIONS WERE PROSE INSIDE AN `authored: String`, not typed references. A prose name is not reachable from the namespace tree the check walks, so the check was not weak here; it was not applicable. What caught both was a review bot reading the text, which is containment after the fact and not prevention. ATTAINABLE CEILING, AND IT IS NOT STRUCTURAL WHILE THE CITATION STAYS PROSE: deciding whether an identity-shaped token inside a paragraph is a CITATION or merely a mention is not decidable, so a scanner over prose would be a heuristic, and DESIGN section 5 forbids dressing one as a wall. This class therefore sits in the *outside the modeled guarantee* column for as long as row-to-row citation is prose -- observed and repaired by reading, never gated -- which is the same standing `unbacked_execution_claim` records for the same reason. NEXT-RUNG TRIGGER, A CAPABILITY AND NOT AN ARTIFACT: A TYPED ROW-TO-ROW CITATION CARRIER -- the ability to express `this row's boundary is drawn against THAT row` as a reference the namespace authority resolves, rather than as a name inside a paragraph. The moment such a citation is typed, the EXISTING required check covers it and the class climbs to structurally guaranteed for every typed citation in one step, with no new gate to build. `RecurringFailureMode` carries an `evidence: List` field, which is the nearest existing carrier and is NOT that capability: it records declarations that witness the class, not the class's boundary against a sibling, and pressing it into service would be a second meaning for one field. WHY THIS ROW'S OWN `evidence` IS EMPTY, stated rather than left to look like an omission: both receipts are PULL REQUESTS AND REVIEW ARTIFACTS, not declarations, so there is no `DeclarationRef` to carry them and the field is honestly empty rather than padded. THE RECEIPTS AT CHECKABLE GRAIN: (i) gunbc#9946, review 58237 -- the boundary clause of `selection_view_read_as_population` named `censored_estimator_drops_its_own_tail`, which at that moment lived only in the same author's other open PR, gunbc#9932. BOTH IDENTITIES RESOLVE IN THIS TREE NOW, which is why they are named here rather than described: the receipt is that they did NOT resolve when the citation was written, and the repair the citing row carries is the descriptive-then-tightened form this row ranks second; (ii) gunbc#9949, review 58260 -- a proof field naming a class living in a third session's open PR, gunbc#9939, reached through the `filed` message. Both reviews are codex, both on the first pushed head of their PR, and each names the unresolvable identity explicitly. **THE TWO RECEIPTS ARE CARRIED IN TWO DIFFERENT ADMISSIBLE FORMS, AND THAT IS DELIBERATE: the first names identities because its two subjects have since landed, the second names a PR and its openness because gunbc#9939 has not. A reader who sees the ranking stated learns the conclusion; a reader who sees one paragraph use both forms because its two cited PRs are in different states learns the DISCRIMINATOR.** A COROLLARY THAT THIS ROW ITSELF DEMONSTRATES, and it is the reason the first receipt does not read as two bare names: WHEN A CITATION TIGHTENS FROM DESCRIPTION TO IDENTITY, THE RECEIPT USUALLY LIVES IN THE STATE THAT JUST ENDED, so tightening SILENTLY DESTROYS IT. This row's first receipt is the historical NON-RESOLUTION of those two names, not the names; tightened to identities alone it would show a reader two symbols that resolve and no evidence the class ever occurred -- a row about unresolvable citations, evidenced by resolvable ones. So a tightening must carry the ended state as a stated fact beside the new name, never merely replace it. THE CAUSE IS A SEPARATE SHAPE AND IS DELIBERATELY NOT FOLDED IN HERE: a correct decomposition -- splitting two classes into two PRs because a rider in a large PR gets skimmed rather than read -- is often what SEVERS the citation path between the pieces. That is a cause held at one receipt and not yet filed; this row is about why the severance is invisible from the citing end, which is a different question with a different repair. If both are ever filed, the causal link is named rather than merged.) - hollow alias (minimality ≠ grounding) - state-space conflation (an `Option`/`None` meaning >2 things — split into named variants; its most-repeated form here is **not-applicable rendered as malformed** — one reason symbol over "the input is wrong" and "this strategy had nothing to say about it", which have opposite owners and opposite repairs. Found three times in three stages by one lane (#8801 and #8828 in body lowering, `parse_g0_tokens_remain` in parse), always by reading the producer and never from the message. Recognition rule: if the arm sits downstream of a search, lookup or alternative that returned `Absent`, it is not-applicable and needs its own reason. A SECOND FORM, which does not match that shape and is the same class: **a dichotomy stated over a domain with three states.** Specimen (gunbc#9324): the `floor_resource_sample` comment documented `pswpin` rising with `pgmajfault` as swap and `pgmajfault` rising with `pswpin` flat as mapping churn — two arms over three states, since BOTH FLAT is quiet. Churn is a defect this lane owns and quiet is the absence of one, so the missing arm inverts the verdict. The mechanism of the misread is what the recognition rule keys on: `pgmajfault rises` and `pswpin flat` are two conditions and only their CONJUNCTION is churn, so a reader matching on the cheaper condition alone selects churn for a state that satisfies `pswpin flat` and nothing else — which zero-and-zero does. **Recognition rule for this form: for every arm of a stated dichotomy, enumerate the domain and check that each arm's conditions are required jointly.** What made it invisible rather than merely wrong is that BOTH readers landed on the same arm — 26 intervals so classified by one and 6 by another, neither having compared notes — and agreement reads as confirmation. THAT IS A PROMPT TO RE-DERIVE, NOT A DIAGNOSTIC, and the distinction is load-bearing: convergent readings are equally produced by shared assumptions, a common heuristic, ambiguity in the subject, or one reader having anchored on the other, and n=2 on one specimen cannot separate those from a defect in the rule. What survives is only the weaker direction — agreement between readers of one rule is not independent evidence about that rule, because the shared input is a shared potential defect, so it licenses re-deriving from the domain and never a conclusion about which cause produced it.) **A THIRD FORM, and the one that is hardest to rank because nothing is wrong today: A STATE THAT IS ALREADY LOAD-BEARING AND CARRIED AS AN AD-HOC SPELLING RATHER THAN A CONSTRUCTOR.** Specimen (2026-09-01): the identity key threaded through v1.compiler.coercion has THREE inhabitants -- a real declaring module path, the synthetic that v1.std.core kernel_span mints for kernel nodes, and the empty string meaning unknown -- while every consumer discriminates only empty from non-empty. lookup_checkpoint and type_realization_decision therefore read as a KNOWN declaration and proceed to the spelling-keyed arm; decl_file_declares_structurally compares that synthetic identity against a roster of real paths with contains, which no can ever match, so the structural gate is unreachable for a kernel-resolved reference BY CONSTRUCTION rather than by decision. The key reaches those gates with exactly that value through type_reference_decl_file, from v1.compiler.emit coerce_primitive_type and v1.compiler.emit_rust rust_named_type_base and rust_applied_type_base. **What makes this the third form rather than an instance of the first two is the evidence that the state is REAL: the tree already handles it, three times, by string prefix.** numeric_realization_declaring_modules carries the literal "