axon-frontend 3.0.0

AXON compiler frontend - lexer, parser, AST, epistemic type system, type checker, IR generator. Zero runtime dependencies. v1.59.0 (Fase 119) adds the two judgments the runtime shares verbatim: `stability` (the `mandate` gain band D < |Kp+Ki+Kd| < 1/L, both endpoints exclusive, verified at compile time against declared bounds) and `substrate` (the `fabric` provider/region/jurisdiction catalog behind axon-E041 region mismatch and axon-E042 compliance-jurisdiction). It also accepts the step-body statement positions the language reference has always published: mandate/shield/ots/lambda applications scoped to the step they govern, the PIX verbs with a braceless field list, and `hibernate until <event>`. v1.58.0 added axon-T957 RegulatedBoundaryCoverage. See https://www.ricardovelit.com/axon-docs
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178
1179
1180
1181
1182
1183
1184
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288
1289
1290
1291
1292
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322
1323
1324
1325
1326
1327
1328
1329
1330
1331
1332
1333
1334
1335
1336
1337
1338
1339
1340
1341
1342
1343
1344
1345
1346
1347
1348
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362
1363
1364
1365
1366
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385
1386
1387
1388
1389
1390
1391
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412
1413
1414
1415
1416
1417
1418
1419
1420
1421
1422
1423
1424
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435
1436
1437
1438
1439
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453
1454
1455
1456
1457
1458
1459
1460
1461
1462
1463
1464
1465
1466
1467
1468
1469
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502
1503
1504
1505
1506
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815
1816
1817
1818
1819
1820
1821
1822
1823
1824
1825
1826
1827
1828
1829
1830
1831
1832
1833
1834
1835
1836
1837
1838
1839
1840
1841
1842
1843
1844
1845
1846
1847
1848
1849
1850
1851
1852
1853
1854
1855
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897
//! §Fase 111 — **the anti-drift gate: the public README is a BUILD INPUT.**
//!
//! # Why this exists
//!
//! §111 audited every primitive the public README advertises and found ~22 of
//! ~74 to be aspirational. The obvious question afterwards was: *what gate would
//! have caught them?* The obvious answer — "assert README ⟺ registry ⟺ parser
//! production ⟺ dispatch arm" — is **wrong**, and it is worth being precise
//! about why, because the wrong gate is worse than none: it would have been
//! green.
//!
//! ```text
//!               README   registry   parser   dispatch arm   …and yet
//!   warden        ✓         ✓         ✓          ✓          a no-op
//!   quant         ✓         ✓         ✓          ✓          a no-op
//!   transact      ✓         —         ✓          ✓          no transaction
//!   compute       ✓         ✓         ✓          —          returns a string
//! ```
//!
//! **A presence-only gate catches nothing that matters.** Every serious §111
//! defect had all four boxes ticked. What was missing was never a *symbol* — it
//! was the answer to a question no linter can decide:
//!
//! > **Does the runtime do what the summary promises?**
//!
//! That is not statically inferable, so this gate does not pretend to infer it.
//! It forces a **human to state it, on the record**, and it makes the statement
//! impossible to omit: [`status_of`] has **no default arm**, so a name the README
//! advertises with no entry here is a **build failure**.
//!
//! # The four laws
//!
//! 1. **The README is parsed at test time.** Every `<code>` badge in its header
//!    block must have an entry here. The public promise is not a document that
//!    drifts from the code — it is an *input to the build*.
//! 1b. **(§114.z) The registry is the enumeration source.** Every
//!    `PRIMITIVE_REGISTRY` entry with `is_advertised: true` must have an entry
//!    here AND a `<code>` badge in the README. The §111 gate enumerated only
//!    the badges, so a primitive DISCUSSED but never BADGED escaped
//!    classification entirely — `budget` appeared in the README seventeen
//!    times, was badged zero, and its dead runtime (§114.a) survived every
//!    green build. **A gate that guards only the badges guards the
//!    packaging.** Conversely, an `is_advertised: false` primitive must be
//!    neither badged nor classified: hiding a primitive from the promise is a
//!    deliberate, pinned act.
//! 2. **Nothing advertised may be [`RuntimeStatus::NotImplemented`] or
//!    `RuntimeStatus::Unwired`** … except what is written down in
//!    [`KNOWN_DEBT`], which is a **ratchet**: it may only shrink. A *new*
//!    unkept promise is a red build. That is the whole point — §111's debt
//!    becomes a ledger the compiler enforces, instead of a finding in a
//!    document nobody rereads.
//!
//!    §122.a added `Unwired` to this law rather than beside it (D122.6). The
//!    two states differ in what the fix COSTS — `NotImplemented` needs an
//!    engine, `Unwired` needs a call site — and not at all in what the adopter
//!    experiences. If reclassifying could move a row out from under the
//!    ratchet, the ratchet would measure vocabulary instead of debt.
//! 3. **A [`RuntimeStatus::Real`] claim must cite its proof**, and if the proof
//!    names a test file, that file must exist on disk. A claim of reality that
//!    cannot point at the gate proving it is just a nicer-sounding assertion.
//! 4. **The proof must cite the PATH, not the engine** — §Fase 119.f.8, learned
//!    the expensive way. `reason` was attested `Real { proof:
//!    "pure_shape::run_reason" }`. The citation was accurate: the handler
//!    existed, worked, and had its own tests. It was also worthless, because the
//!    grammar that reaches it did not exist — the README's `reason { given ask
//!    depth }` (16 blocks, each its step's entire cognition) was thrown away at
//!    PARSE time, and `axon check` said `0 errors`. §111's own phrase: *motor
//!    real, cable muerto*. A function name proves an engine is there; it says
//!    nothing about whether any published program can call it. **Cite a gate
//!    that walks source → dispatch.** This is the table's blind spot, and it is
//!    why [`KNOWN_DEBT`] being empty is necessary and not sufficient.
//!
//! # How to change this file
//!
//! - **Shipping a primitive?** Flip it to `Real`, cite the gate that proves it,
//!   and delete its `KNOWN_DEBT` row **in the same PR**.
//! - **Retracting one?** Delete it from the README *and* from here.
//! - **Adding a new advertised primitive?** You cannot land it without stating
//!   what its runtime actually does. That is the feature.

#![allow(dead_code)]

/// What the RUNTIME does — as attested by a human, because no linter can decide
/// it.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum RuntimeStatus {
    /// The runtime delivers what the README's summary promises. MUST cite the
    /// evidence — a test file, or the fase that shipped it.
    Real { proof: &'static str },
    /// It delivers, with a documented gap versus the advertised claim. The gap
    /// is named so it cannot rot into a silent lie.
    Partial { gap: &'static str },
    /// It REFUSES — at compile time or at dispatch. Honest by construction: an
    /// adopter is told, loudly, rather than handed silence. This is the §108
    /// posture, and it is an acceptable state to advertise from, because the
    /// adopter cannot be *fooled* by it.
    FailsClosed { diagnostic: &'static str },
    /// The runtime does NOT do what the summary promises, and says nothing about
    /// it. **This may not be advertised** unless it is in [`KNOWN_DEBT`].
    NotImplemented { finding: &'static str },
    /// §Fase 122.a — **the engine EXISTS, is tested, and no production path
    /// reaches it.**
    ///
    /// The state this table was missing, and its absence is what produced the
    /// one false `Real` in it. The other five describe degrees of FULFILMENT —
    /// how close the runtime comes to the summary. None described
    /// REACHABILITY. `cache` was attested `Real` because its engine is complete
    /// and correct (content-addressed keys, single-flight, TTL with jitter,
    /// LRU, errors never cached, all with passing tests) and, of the five,
    /// `Real` was the only state that meant *"the engine is good"*. It was not
    /// dishonesty; it was a taxonomy with no box for the truth.
    ///
    /// `engine` names what exists, so a reader can tell a **cable job** from a
    /// **build job** — an `Unwired` row is not a missing feature, it is a
    /// missing call site.
    ///
    /// **It owes a [`KNOWN_DEBT`] entry, exactly like `NotImplemented`**
    /// (D122.6, ratified 2026-08-13). To the adopter the two are
    /// indistinguishable: the primitive does not do what the summary says, and
    /// nothing tells them. Letting `Unwired` dodge Law 2 would make
    /// reclassification an escape hatch from the ratchet — which is the exact
    /// species of drift this file exists to stop. The debt did not grow when
    /// these rows landed; it was **uncovered**. A ledger that stays empty
    /// because a row lies is worth nothing.
    Unwired { engine: &'static str },
    /// §111 has not verified this one. Advertised on trust, and counted: the
    /// unaudited population is pinned below and may only shrink.
    Unaudited,
    /// §Fase 122.a — **`Real`, re-attested under Law 4**: the claim names the
    /// `.axon` FIXTURE a published program could write, and the GATE that
    /// walks that fixture to dispatch.
    ///
    /// Law 4 has been written in this file since §119.f.8 and never ran. The
    /// mechanism of that erosion is the shape of [`Self::Real`]: Law 3 is
    /// conditional (*"if the proof names a test file"*) and `proof` is free
    /// prose, so a citation that names no file evaluates the check to vacuous
    /// truth. `cache`'s proof — *"cacheability derives from the type system's
    /// `effects: pure` proof"* — cited a COMPILE-TIME property as evidence of a
    /// runtime, and passed. Nothing had to be forgotten; a sentence was enough.
    ///
    /// A free-string field breeds an imaginary catalog — the third time this
    /// project has recorded that shape. The fix is the same as always: a closed
    /// pair the build can verify. `fixture` must exist and be `.axon`;
    /// `gate` must exist and must READ that fixture (§122.b).
    ///
    /// `Real { proof }` remains for rows not yet re-attested. Its population is
    /// pinned and **may only shrink**; §122.b drives it to zero. Migrating the
    /// shape and re-attesting forty rows in one commit would mix a mechanical
    /// refactor with forty judgements, and that mixture is where a convenience
    /// `Real` gets in (D122.2).
    Attested {
        /// Repo-relative path to an `.axon` source file a published program
        /// could have written.
        fixture: &'static str,
        /// Repo-relative path to the test that compiles `fixture` and drives it
        /// to dispatch.
        gate: &'static str,
    },
}

impl RuntimeStatus {
    /// Literally `NotImplemented` — nothing else.
    pub fn is_unimplemented(self) -> bool {
        matches!(self, RuntimeStatus::NotImplemented { .. })
    }

    /// **The predicate Law 2 turns on** (§122.a).
    ///
    /// Both states owe a ledger entry, because both present the adopter with
    /// the same thing: a promise the runtime does not keep, silently.
    /// `NotImplemented` has no engine; `Unwired` has one nothing calls. The
    /// distinction tells a maintainer what the fix costs; it tells an adopter
    /// nothing, and Law 2 is written for the adopter.
    pub fn owes_a_debt_entry(self) -> bool {
        matches!(
            self,
            RuntimeStatus::NotImplemented { .. } | RuntimeStatus::Unwired { .. }
        )
    }
}

use RuntimeStatus::*;

/// Every `<code>` badge the README's header block advertises, and what its
/// runtime actually does.
///
/// Verdicts sourced from the §111 Gate-1/Gate-2 audit (see the fase's topic
/// file). Where §111 did not reach, the entry is honestly `Unaudited` rather
/// than optimistically `Real` — an unchecked box is not a passing one.
pub const ADVERTISED: &[(&str, RuntimeStatus)] = &[
    // ── Cognitive core — LLM-driven, and honestly so. Calling the model IS
    //    their nature; that is not the defect §111 hunts.
    // §Fase 122.b — was the bare module name `flow_dispatcher::pure_shape`, one
    // of the 38 rows Law 3 never checked. The fixture below was added by §122.b
    // and declares a `persona` alongside the `mandate` that governs its output.
    ("persona", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/13_compliance_persona_mandate.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("intent", Unaudited),
    // §Fase 122.b — FIRST TWO RE-ATTESTATIONS. Both used to cite a module
    // (`flow_dispatcher::dispatch_node`, `flow_dispatcher::pure_shape`) — an
    // ENGINE citation, the shape §119.f.8 proved worthless, and one Law 3 never
    // checked because it names no test file. The parity corpus is the honest
    // replacement: `fase33z_d_parity_corpus` reads each `.axon` fixture from
    // disk, drives it through BOTH execution paths (sync runner + async
    // dispatcher) under the stub backend, and pins the results byte-equal. The
    // input is source an adopter could have written; the gate walks it to
    // dispatch. That is Law 4 satisfied, not asserted.
    ("flow", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/banking/01_canonical_loan_decision.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // §Fase 119.f.8 — the proof used to read `pure_shape::run_reason`, and it was
    // TRUE and USELESS. The handler existed and worked; the grammar that reaches
    // it did not. The README's `reason { given ask depth }` — 16 blocks, each one
    // its step's entire cognition — was discarded at PARSE time, so this "Real"
    // attested an engine no published program could call.
    //
    // ⚠️ The lesson is about THIS TABLE, not about `reason`: a proof that names a
    // FUNCTION proves the engine exists. It does not prove any published program
    // reaches it. Cite the gate that walks the path — grammar to dispatch — and
    // the attestation means what a reader thinks it means.
    // §Fase 122.b — §119.f.8's semantic gates (`fase119_f8_reason_block`,
    // `fase119_f8_reason_prompt_is_built`) still hold and still run; what they
    // could not do is satisfy Law 4, because they build their source inline and
    // no file on disk holds it. The parity corpus does: a published-shaped
    // program carrying a `reason` block, executed on both paths.
    ("reason", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/09_content_moderation_reason.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // §Fase 122.b — was the bare engine name `anchor_checker`. The fixture below
    // was ADDED by §122.b for exactly this: every gate proving `anchor`, `probe`
    // and `weave` built its source inline, so no file on disk held a program
    // using them and the rows could only cite an engine. The corpus gate
    // discovers it by directory walk and drives it through both paths.
    ("anchor", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/12_legal_intake_probe_weave_anchor.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // §Fase 122.b — was the bare engine name `pure_shape::run_refine`.
    ("refine", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/18_refine_grad_compute.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
        // §Fase 122.b — was `cognitive::run_remember / run_recall`. This citation proves
    // the DECLARATION path and says so: the PEM write-through stays proven by §112's
    // gates. The fixture's `store: session` and `retrieval: semantic` reach the IR,
    // and both closed catalogs are watched refusing a value outside them.
    ("memory", Attested {
        fixture: "tests/fixtures/fase122_b_declarations/memory_pix_store.axon",
        gate: "tests/fase122_b_declaration_laws.rs",
    }),
    // §Fase 122.b — was the bare engine name `lambda_tools::dispatch_use_tool_real`.
    // The gate that DID read a file for `tool` (`fase54_c_tool_dispatch_example`)
    // only parses and type-checks the canonical example — the front half. This
    // fixture is dispatched.
    ("tool", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/15_tool_budget_governance.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // §Fase 122.b — see the `anchor` note above; same fixture, same gate.
    ("probe", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/12_legal_intake_probe_weave_anchor.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // §Fase 119.f.9 — see rule 4 above: this proof used to name the handler
    // alone, and the handler was reachable only from a braced form no published
    // block writes. Worse, it sent the model the source NAMES, so even when
    // reached it synthesised over identifiers instead of outputs.
    // §Fase 122.b — §119.f.9's gates (`fase119_f9_weave_statement`,
    // `fase119_f9_weave_prompt_is_built`) still hold: grammar → IR → resolved
    // prompt, over the engine `pure_shape::run_weave`. They build their source
    // inline, so they cannot satisfy Law 4. Same fixture as `anchor`/`probe`.
    ("weave", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/12_legal_intake_probe_weave_anchor.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // §Fase 122.b — was `pure_shape::run_validate`, a bare engine name and one
    // of the 38 rows Law 3 never checked (no `tests/` token ⇒ vacuous). §121's
    // own gates prove the scoring; this proves a published program reaches it.
    ("validate", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/04_capability_mediation_validate.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("context", Unaudited),
    // ── Epistemic scopes
    ("know", Unaudited),
    ("believe", Unaudited),
    ("speculate", Unaudited),
    ("doubt", Unaudited),
    // ── Concurrency & continuation
    // §Fase 122.b — real fan-out via `join_all` (§65) stays the mechanism; the
    // citation now names a program that uses it and the gate that runs it.
    ("par", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/banking/04_par_concurrent_checks.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("hibernate", Partial { gap: "§119.d made the suspension REAL on the production dispatch path: the walk HALTS at the hibernate point (the task dies — zero further compute, zero tokens, the primitive's economic guarantee), the continuation parks under the README's SHA-256(flow ∥ event ∥ position) id with the remaining nodes + bindings + catalogs, `emit <channel>` WAKES matching continuations (fire-and-forget resume through the real dispatcher), a late resume is REFUSED by lazy expiry (no timer burns while asleep), and `hibernate until \"event\"` — the README's own spelling — parses. Gates: tests/fase119_d_hibernate.rs (halt counted in StepCompletes, park, emit-wake e2e, nested refusal) + hibernation unit suite; 4/4 mutations killed incl. the F20 walk-keeps-going reinjection. THE GAP: the parking lot is in-process (the pem::InMemoryBackend discipline) — a continuation does not survive process restart, so README's sleep-for-months across restarts is the durable-store enterprise catch-up (cognitive_states), and chained hibernation inside a resumed continuation is not yet defined" }),
    // ── Deterministic data plane (§108)
        // §Fase 122.c — §108's finding is what this citation keeps closed:`dataspace` was
    // declared, type-checked and carried into the IR while `dataspace_specs` was
    // `#[serde(skip)]`-hidden and read by NOTHING. The declared dataspace reached no
    // runtime state, so this whole verb family was NARRATION — the program would
    // have sent "You are ingesting…" to a language model and returned prose.
    //
    // Group C was scoped as needing a live database. Measured: it does not. The §108
    // engine is first-party COLUMNAR and in-process, and the server's deploy path
    // builds it; what cannot reach it is the PARITY corpus, which passes `None` and
    // therefore fails these verbs closed BY DESIGN. "The parity harness cannot drive
    // it" is not "it needs Postgres".
    //
    // The gate deploys the fixture, executes it, and reads the ENGINE afterwards:
    // three CSV rows land as three typed rows, born `Untrusted` (§98) with a 64-hex
    // witness hash, and the `Float` column reads back as a float. Four perturbations
    // kill it: the declared column TYPE, the `max_rows` limit, selecting an
    // undeclared column in `focus`, and joining `associate` on the wrong key.
    ("dataspace", Attested {
        fixture: "tests/fixtures/fase122_c_dataspace/lead_pipeline.axon",
        gate: "tests/fase122_c_dataspace_from_disk.rs",
    }),
        // §Fase 122.c — see the `dataspace` note above; same fixture and gate. The
    // execute-success assertion is what makes this verb's presence a claim rather
    // than decoration: §108's verbs fail CLOSED without the engine, so a green
    // execute is what says it ran.
    ("ingest", Attested {
        fixture: "tests/fixtures/fase122_c_dataspace/lead_pipeline.axon",
        gate: "tests/fase122_c_dataspace_from_disk.rs",
    }),
        // §Fase 122.c — see the `dataspace` note above; same fixture and gate. The
    // execute-success assertion is what makes this verb's presence a claim rather
    // than decoration: §108's verbs fail CLOSED without the engine, so a green
    // execute is what says it ran.
    ("focus", Attested {
        fixture: "tests/fixtures/fase122_c_dataspace/lead_pipeline.axon",
        gate: "tests/fase122_c_dataspace_from_disk.rs",
    }),
        // §Fase 122.c — see the `dataspace` note above; same fixture and gate. The
    // execute-success assertion is what makes this verb's presence a claim rather
    // than decoration: §108's verbs fail CLOSED without the engine, so a green
    // execute is what says it ran.
    ("associate", Attested {
        fixture: "tests/fixtures/fase122_c_dataspace/lead_pipeline.axon",
        gate: "tests/fase122_c_dataspace_from_disk.rs",
    }),
        // §Fase 122.c — see the `dataspace` note above; same fixture and gate. The
    // execute-success assertion is what makes this verb's presence a claim rather
    // than decoration: §108's verbs fail CLOSED without the engine, so a green
    // execute is what says it ran.
    ("aggregate", Attested {
        fixture: "tests/fixtures/fase122_c_dataspace/lead_pipeline.axon",
        gate: "tests/fase122_c_dataspace_from_disk.rs",
    }),
        // §Fase 122.c — see the `dataspace` note above; same fixture and gate. The
    // execute-success assertion is what makes this verb's presence a claim rather
    // than decoration: §108's verbs fail CLOSED without the engine, so a green
    // execute is what says it ran.
    ("explore", Attested {
        fixture: "tests/fixtures/fase122_c_dataspace/lead_pipeline.axon",
        gate: "tests/fase122_c_dataspace_from_disk.rs",
    }),
    // ── Budget, selection & synthesis
    ("deliberate", FailsClosed { diagnostic: "axon-T939 (§111) — the body is discarded at parse time; no budget was ever controlled" }),
    ("consensus", FailsClosed { diagnostic: "axon-T940 (§111) — no votes, no aggregation, no candidates" }),
    ("forge", Partial { gap: "§111 F17 — the Poincaré pipeline + NCD novelty gate are real, but `coherence` is hardcoded to 1.0, so a declared `constraints:` coherence floor is INERT" }),
    // §Fase 119.m.1 — `Unaudited` → `Partial`. It was the worst state in this
    // table: §111 never checked it, and when §119 finally did there was nothing
    // to check — eleven declared `IRAgent` fields, and no executor anywhere in
    // the dispatcher. It now RUNS, with `strategy:` as a control policy
    // (D119.5) and a termination proof per strategy.
    //
    // `Partial`, not `Real`, and the gap is one specific thing rather than a
    // hedge: `strategy: custom` means "the control policy is the `step` list
    // written inside the agent block", and `AgentDefinition` has no body field,
    // so the parser discards those steps. Dispatch REFUSES `custom` by name
    // instead of substituting another policy. `on_stuck: hibernate` is refused
    // for the same reason in the other direction — §119.d parks a flow walk's
    // remaining nodes and an agent loop has no such list.
    ("agent", Partial {
        gap: "§119.m.1 — react / reflexion / plan_and_execute run with per-strategy \
              termination proofs (gate: fase119_m1_agent_executor.rs). `strategy: custom` \
              is REFUSED, not substituted: its policy is the `step` list inside the agent \
              block and `AgentDefinition` has no body field, so the parser drops it. \
              `on_stuck: hibernate` is refused likewise — an agent loop has no \
              remaining-node list for §119.d to park.",
    }),
    ("shield", Partial { gap: "§111 — the scanner registry IS consulted and a Reject really fails the step, but OSS ships ZERO registered scanners, so an OSS adopter's shield is an identity pass-through until one is mounted" }),
    // ── Security & autonomous analysis
    // §Fase 122.a — both were `Unaudited`, which was honest in §111 and is no
    // longer: they HAVE been audited now (2026-08-13), and the finding is
    // reachability, not uncertainty. `Unwired` is strictly more informative.
    ("savant", Unwired { engine: "holograph::ReferenceHolographCodec (HRR, FFT, dim-capped) + inference::ReferenceInference (VFE/EFE) + topology::ReferenceTopology (Betti/PHC) — three tested engines with ZERO callers outside their own tests. `cognition.depth:` is read only by the PCC (axon-T876, catalog validity) and by `main.rs` to print it; HOLOGRAPH_DIM_CAP is never exercised. Wiring active inference is its own fase, not a cable" }),
    ("synth", Unwired { engine: "synth::DenyByDefaultSynth — the OSS reference, which refuses BY DESIGN (§87.j: OSS never executes synthesised code). No mount point exists, so no flow reaches it. NOTE: cabling it in OSS yields FailsClosed, not Real — the enterprise Extism/gVisor executor is what makes it Real, and it needs the sandbox reachable at all" }),
    // §Fase 122.b — §111.c's nine joints all still run, and all nine hand-build
    // `IRScope`/`IRWarden` in Rust: a proof of the HANDLER. The gate now also
    // compiles a fixture through the real pipeline and dispatches the node the
    // COMPILER produced, against the same `ReferenceStaticWarden` the runner
    // mounts. Perturbing the DECLARATION kills it three ways — a target outside
    // `targets:`, an empty `approver:`, and `depth: live_network` above the OSS
    // ceiling — so the authorization envelope really comes from the source.
    //
    // §Fase 122.c adds the SECOND proof, and it is about timing rather than
    // dispatch: `tests/fase122_c_deploy_gate.rs` deploys a program whose `warden`
    // block sits after two emitting steps, and the mounted backend's inability to
    // reach `depth: live_network` now refuses at /v1/deploy — before the flow acts
    // — instead of on the seventh step, after it already had. The citation below
    // stays pointed at §111.c because that is the gate that proves the engine
    // ANALYSES; §122.c proves only that an unreachable one is refused in time.
    // Two properties, two gates; collapsing them would lose the first.
    ("warden", Attested {
        fixture: "tests/fixtures/fase122_b_warden/authorized_audit.axon",
        gate: "tests/fase111_c_warden_wired.rs",
    }),
    // §Fase 122.b — the scope catalog under test is the one the compiler emitted
    // from the fixture's `scope InternalAudit { … }`, not a Rust literal. See the
    // `warden` note above; the same three perturbations kill this citation.
    ("scope", Attested {
        fixture: "tests/fixtures/fase122_b_warden/authorized_audit.axon",
        gate: "tests/fase111_c_warden_wired.rs",
    }),
    // ── Effects & streaming
    // §Fase 119.n — `Real` → `Partial`, and the DOWNGRADE is the honest move.
    //
    // The old proof read `tests/fase111_e_stream_runs.rs (§111.e — the body is
    // parsed, lowered and EXECUTED)`. Every word of it was true, and it violated
    // law 4 above: §111.e gave `StreamBlock` a `body: Vec<FlowStep>` and proved
    // THAT runs — but no published block and no paper writes that shape. The
    // specified surface (`fase_23` §3.7, whose D8 promises "backward compat 100%,
    // cero cambios en `.axon` source files") is `stream<T> { on_chunk on_complete }`,
    // and README block 15 publishes exactly it. Measured: at flow level the
    // published body was a hard parse error; in a step body the whole block was
    // discarded, so block 15's `step Stream` dispatched with `pix_ops=0`,
    // `ask=""`, `output=""` — an EMPTY step whose `Stream.output` the next step
    // reasoned over, and which had left the §117 ledger on the strength of
    // compiling. The `reason` defect one fase later, in the table that recorded it.
    ("stream", Partial { gap: "§119.n made the PUBLISHED surface real: `stream<T> { on_chunk: … on_complete: … }` parses at both the step-body and flow positions (it was a hard parse error at flow level and a SILENT DISCARD in a step body), the `<T>` chunk type reaches the IR instead of being eaten by the argument-skip loop, and each arm is a step body so its `output:` lands. BOTH chunk sources are wired: a streaming TOOL bound with `apply:` (README block 15's own shape — the handler rides `unified_stream_handler`, so it sees the chunks the declared `backpressure:` policy let through, never the raw source), and the step's own generation (fase_23 §3.7's `stream<Token>` case, hooked into `drain_direct`). Neither has a private drain, so a handler cannot drift from the stream it handles. `on_complete` binds the accumulation as `complete` and its output becomes the step's. An `apply:` that is not a registered streaming tool is REFUSED, never demoted to the LLM path — demoting would stream something the author never named (§112). §119.n.3 added the THIRD arm, `on_error:`, run when the SOURCE fails with the failure bound as `error`; the step then completes with that arm's output (a recovery the author declared, not a swallowed error) and `on_complete` does NOT run, because a stream that broke did not close. It is deliberately NOT a catch-all: a failure raised by the author's own `on_chunk` is tagged and excluded, since a broken handler that silently catches itself and reports the stream as healthy is worse than one that crashes; cancellation is not a failure either. `on_chunk` is SEQUENTIAL and INTERLEAVED — one run per chunk, during the stream, gated by a wire-trace test that a buffered implementation would fail (it passes every other assertion in the file). Gates: axon-frontend/tests/fase119_n_stream_handlers.rs (12, source→AST→IR) + axon-rs/tests/fase119_n_stream_dispatch.rs (16, source→dispatch, incl. README block 15 VERBATIM executing); 7/7 mutations killed. THE GAP: `stream<τ>` is NOT desugared to `effect _StreamBuiltin<T>` + `handle … in …`, so fase_23's D8 claim of one-shot delimited continuations under this primitive is still future work and the algebraic `perform Stream.Yield` bridge stays orthogonal. A handler slower than the producer backpressures the whole step — correct, but a performance property an adopter should be told about. And `on_error` cannot RESUME the stream: it runs once, after the source is already gone" }),
    // §Fase 122.b — `parse_effect_row` + the type checker are the engines; §85's
    // cacheability derivation reads the `effects: pure` proof. Verified on this
    // fixture by perturbation: `effects: <not_an_effect>` fails it with the
    // closed catalog named — "Valid: io, network, pure, random, storage, stream,
    // trust, sensitive, legal, ots, web" — so the row really is decided here.
    ("effects", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/19_run_effects_compliance.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // §Fase 120 — the algebraic-effect system. `effects` (plural, above) is a
    // DIFFERENT thing that shares a word: the `effects: <io, network>` row on a
    // tool declaration. These three are Plotkin/Pretnar handlers.
    //
    // ⚠️ What was measured before §120, and why it is the sharpest case law 4
    // has produced. `axon-rs/src/effects/` is a real 590-line FSM — handler
    // stack, one-shot delimited continuations (D2), forward-to-outer (D12) —
    // shipped in §Fase 23 with 49 green tests. It was never `Unaudited` and
    // never in `KNOWN_DEBT`, because it was never ADVERTISED: no README badge,
    // no registry entry, nothing to classify. And so nobody ever asked the
    // question that mattered, which is not *"does the engine work?"* (it did)
    // but *"can any program reach it?"*. The answer was no, in the most total
    // way this repo has recorded: ZERO lexer tokens, no AST, no IR emission,
    // and `EffectRuntime::new()` with both call sites inside `#[cfg(test)]`.
    // An unadvertised subsystem is invisible to every gate in this file.
        // §Fase 122.b — cited against the PUBLISHED EXAMPLE, not a fixture written for
    // the gate. That is deliberate and stronger: `examples/algebraic_effects.axon`
    // is what this repository shows an adopter, so if it rots the row goes red, and
    // it is the file people actually read. `fase117_a_examples_compile` already
    // proves it COMPILES; §120's dispatch gate runs the machine from inline source.
    // This joins the two ends — the published program, dispatched.
    //
    // §120's finding: the Plotkin/Pretnar engine from §23 (590 lines, 49 tests) had
    // ZERO lexer tokens. There was no grammar. It was invisible to every gate
    // because it was never ADVERTISED — no badge, nothing to classify.
    //
    // Renaming the declared `effect` or the `handle` target kills the citation.
    ("effect", Attested {
        fixture: "examples/algebraic_effects.axon",
        gate: "tests/fase122_b_effects_from_the_example.rs",
    }),
        // §Fase 122.b — see the `effect` note above; same published example and gate.
    ("handle", Attested {
        fixture: "examples/algebraic_effects.axon",
        gate: "tests/fase122_b_effects_from_the_example.rs",
    }),
        // §Fase 122.b — see the `effect` note above; same published example and gate.
    ("perform", Attested {
        fixture: "examples/algebraic_effects.axon",
        gate: "tests/fase122_b_effects_from_the_example.rs",
    }),
    ("@contract_tool", Unaudited),
    ("@csp_tool", Unaudited),
    // ── Knowledge navigation (PIX · MDN)
        // §Fase 122.b — was `pix_navigator`. Declaration path only; §63 owns the
    // navigation itself. The declared `depth: 4` reaches the IR — §119 found
    // `pix_ops` being read by nobody, so a declared field arriving at a consumer is
    // exactly the property worth pinning here.
    ("pix", Attested {
        fixture: "tests/fixtures/fase122_b_declarations/memory_pix_store.axon",
        gate: "tests/fase122_b_declaration_laws.rs",
    }),
    ("navigate", Partial { gap: "§111 F11 — three REAL deterministic engines (MDN store-sourced, MDN in-memory, PIX), BUT with no indexable source in scope it falls back to an LLM prompt that INSTRUCTS the model to fabricate a provenance trail. The one live §108 left in the tree" }),
    ("drill", Partial { gap: "§111 — real subtree navigation when a source is in scope; degrades to a placeholder string otherwise" }),
    ("trail", Partial { gap: "§111 — reads the real breadcrumb `navigate` seeds; falls back to a placeholder when no navigate ran. Inherits F11: a trail harvested from the LLM fallback is confabulation wearing an audit's clothes" }),
    // §Fase 122.b — `mdn` (signed Epistemic PageRank, §62–§64) is the engine and
    // has its own unit coverage; this citation is the PATH: a published program
    // declaring a `corpus`, compiled from disk and executed.
    ("corpus", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/06_mdn_navigate_graph.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // ── Advanced cognition & trust
    ("psyche", Unaudited),
    ("ots", Partial { gap: "§119.c made the dispatch layer REAL: `apply_ots_to_target` (identity, §111 F18) is deleted; `run_ots_apply` resolves the declaration, consults the name-keyed `ots_registry` (shield_registry's shape — the hook that F18 said did not exist, now tested by registering a transformer and watching it fire), propagates transformer refusals, and REFUSES an unregistered name (identity under a transformation's name fabricates a result). Step-scoped `ots X on y -> b` elevates before generation. THE GAP: no OSS transformer registers by default — any generic default would be the identity lie again — so OSS `ots` refuses at runtime until the media pipeline (crate::ots) or an enterprise vertical registers; the paper's JIT synthesis pipeline remains future work" }),
    ("mcp", Unaudited),
    // §Fase 122.b — §119.b's account stays true and is worth keeping: the closed
    // loop runs through production dispatch via `mandate_engine.rs` (e = 1 − CSR
    // from `pem::semantic_validator`, PID from `pem::density_matrix`,
    // Converge(e,ε,N) with Breach fail-closed, declared-D premise discharge,
    // |C|=0 refused before any token), driven by `run_mandate_apply` + the
    // D119.4 step guard (buffered — attempts never stream). Tier 1 logit-bias
    // bans on the OpenAI-compat wire, Tier 2 CSP feedback everywhere. Gates:
    // mandate_engine (16), algebraic_handlers MandateApply incl. the F18
    // regression (an unresolved name REFUSES, never identity),
    // openai_compat logit_bias wire, fase119_b3_stability_band.rs,
    // fase119_b_mandate_grammar.rs — 9/9 dispatch-chain mutations killed.
    // None of those reads a file, so none could satisfy Law 4. This does.
    ("mandate", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/13_compliance_persona_mandate.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // §Fase 122.b — §119.c's account stays true and is worth keeping here: the
    // ΛD engine (`lambda_data.rs`: ψ = ⟨T,V,E⟩, four invariants, compose with
    // c_out ≤ min(c_i); `lambda_runtime.rs`: Theorem 5.1 enforced at apply, only
    // raw data may carry c = 1.0) runs on the PRODUCTION dispatch path.
    // `apply_lambda_data` — the §111 F18 placeholder string — is deleted, an
    // undeclared lambda REFUSES, and the step-scoped form elevates BEFORE prompt
    // interpolation. Gates: the lambda_tools elevation suite incl. the F18
    // regression + fase119_c_apply_grammar.rs; mutations C1/C2/C5 killed.
    // The citation below is the one Law 4 asks for: source on disk → dispatch.
    ("lambda", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/08_rate_limiting_lambda.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // ── Deterministic compute
    // §Fase 119.o — the proof now cites a gate whose INPUT is `.axon` source
    // (law 4). The §111.f citation stayed, because it is still true and still
    // the engine's own gate — but on its own it was the §119.n shape: it proved
    // `compute` evaluates a §70 expression while the form every published block
    // writes (`input:` / `output:` / `logic { let … return }`) did not parse at
    // all. Three of the four README computes were in the §117 ledger for it.
    // §Fase 122.b — `fase111_f_compute_real.rs` stays the semantic gate (§111.f
    // deleted the placeholder string that a downstream step consumed as if it
    // were a number). It builds its source inline, and until this fixture NO
    // `.axon` in the repository declared a `compute` at all — the third such
    // primitive, with `json` and `budget`.
    ("compute", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/18_refine_grad_compute.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // ── Reactive processes & platform boundary
    // §Fase 122.b — was the bare module name `daemon.rs`. The delivery proof is real
    // and stays (it lives in that module's unit tests), but it builds its source
    // inline, so nothing on disk held the program. This citation drives §74.a's
    // headline from a fixture: a producer emits on a typed channel, the bus — built
    // FROM the compiled IR, so the channel is registered because the PROGRAM
    // declares it — carries the event, and the consumer daemon's `listen` body runs
    // with the payload bound. §52.g's `axon-W009` said that delivery did not exist.
    //
    // Emptying the `listen` body or renaming the daemon kills the citation.
    ("daemon", Attested {
        fixture: "tests/fixtures/fase122_b_daemon/intent_learner.axon",
        gate: "tests/fase122_b_daemon_delivery.rs",
    }),
    ("listen", Partial { gap: "§111 F7 — TWO disjoint paths sharing one keyword. Inside a DAEMON: real (§74 outbox → deliver_typed_event → execute_server_flow). Inside a FLOW BODY: binds the canned string \"(awaiting <channel>)\". Sub-gap: a daemon listener body executes ONLY `run <Flow>` steps; any other step type is silently dropped" }),
        // §Fase 122.b — was the bare engine name `axon_server`. The fixture is DEPLOYED
    // and its route FETCHED. Perturbing the declared `path:` kills it, and so does
    // swapping `execute:` — but only after the test was strengthened to assert the
    // step name that belongs to the declared flow. The first version checked only
    // that `a` flow ran, which does not discriminate between two flows of the same
    // shape; the mutation found that weakness in the TEST.
    ("axonendpoint", Attested {
        fixture: "tests/fixtures/fase122_b_endpoint/served_routes.axon",
        gate: "tests/fase33z_c_default_on_and_tool_call.rs",
    }),
        // §Fase 122.b — `axpoint` claims to be an ALIAS of `axonendpoint` (same
    // TokenType). That is a claim only a program can check, so the fixture writes
    // one route each way and the gate fetches BOTH, asserting each runs the flow it
    // declares and not the other's.
    ("axpoint", Attested {
        fixture: "tests/fixtures/fase122_b_endpoint/served_routes.axon",
        gate: "tests/fase33z_c_default_on_and_tool_call.rs",
    }),
        // §Fase 122.b — was `wire_integrations::run_{persist,retrieve,mutate,purge}`.
    // `backend: in_memory` follows §113.d's precedent deliberately: this proves the
    // DECLARED surface — the closed backend catalog, the isolation level, and the
    // §38.b inline schema riding the artifact — not the Postgres wire, which
    // `fase38_i_integration` owns. A store whose declared shape reaches no consumer
    // is the §111 shape, so `column_schema` being present is the assertion.
    ("axonstore", Attested {
        fixture: "tests/fixtures/fase122_b_declarations/memory_pix_store.axon",
        gate: "tests/fase122_b_declaration_laws.rs",
    }),
    // ── Cognitive I/O (λ-L-E, Fases 1–9)
    //
    // §111 F14 + the §11 REFRAME: this family is not merely unwired — it is
    // UNREACHABLE BY CONSTRUCTION. There is no FlowStep, no IRFlowNode and no
    // daemon field that can consume any of them. The kernels are real,
    // well-written and unit-tested; the language never grew a way to reach them.
    // Founder-ratified: designing that consumption surface is §112+.
    // §Fase 122.b — §113.c's flagship is the difference between the resource being a
    // WIRE and being a LABEL: before it, `capacity:` was declared, type-checked,
    // lowered into the IR, advertised in the README as a pool cap — and read by
    // nothing. Every pool was 10, always, for everyone. Its gates hand-build
    // `IRResource`/`IRAxonStore`, which proves the REGISTRY; this fixture is the
    // program an adopter writes, and the store deliberately declares no
    // `connection:` so the DSN can only come from the resource's config key
    // (axon-T944). Three perturbations kill it: changing the declared `capacity:`,
    // changing the `endpoint:` config key, and pointing `resource:` at a name that
    // does not resolve.
    ("resource", Attested {
        fixture: "tests/fixtures/fase122_b_resource/pooled_store.axon",
        gate: "tests/fase113_c_resource_is_a_wire.rs",
    }),
    ("fabric", Partial { gap: "§119.e made provider/region DECIDE things, on the line the knowledge doc draws (fabric describes what the runtime expects to find; it is explicitly NOT infrastructure-as-code, so `provision` is not what it owed). COMPILE TIME: `axon-E041` refuses a region that cannot belong to the declared provider (the doc's own `provider: aws region: \"eastus\"` example) and `axon-E042` refuses a compliance obligation the substrate cannot satisfy (the doc's own \"a GDPR-tagged manifest deployed to a non-EU region is rejected\") — with an UNDETERMINABLE jurisdiction counted as a violation, never a pass. RUNTIME: a tool whose resource lives `within` a fabric carries that fabric's (provider, region) on its binding and into its audit row — the doc's compliance propagation, made a fact — and a `within:` naming an undeclared fabric REFUSES the binding. Gates: axon-frontend/tests/fase119_e_fabric_substrate.rs (10) + substrate unit suite (11) + axon-rs/tests/fase119_e_fabric_runtime.rs (5); 6/6 mutations killed. THE GAP: the provider catalog is open by design, so a provider whose region shape this compiler does not know is accepted UNVALIDATED (visible via ProviderShape::Unvalidated) — and `zones`/`ephemeral`/`shield:` are still consumed by nothing, so a fabric-level shield does not yet wrap resource acquisition" }),
    ("manifest", Partial { gap: "§111 F14 — the κ/compliance half IS genuinely consumed (it feeds attestation + the audit scorer); the \"desired shape\" half is dead" }),
        // §Fase 122.b — the readings that drive the immune's baseline come through this
    // `observe` declaration, sampling a source adapter the gate registers. A
    // refused observation feeds nothing downstream (deny-by-default).
    ("observe", Attested {
        fixture: "tests/fixtures/fase122_b_cognitive_io/immune_reflex_heal.axon",
        gate: "tests/fase112_d_immune_fires.rs",
    }),
    // §Fase 122.b — §112.e already deploys through the real path and measures
    // REAL Jaccard drift between the manifest's desired shape and the observed
    // world (before it, the loop compared the belief against itself and reported
    // 0.0 for every world). The fixture makes that program a file. Three
    // perturbations kill it: widening `tolerance:` past the measured drift,
    // changing `on_drift:` to `noop`, and shrinking the manifest — the last
    // proving the drift is computed against the DECLARATION, not a constant.
    ("reconcile", Attested {
        fixture: "tests/fixtures/fase122_b_cognitive_io/reconcile_drift.axon",
        gate: "tests/fase112_e_reconcile_drift.rs",
    }),
    // §Fase 122.b — the sharpest case in the whole §111 line, and worth restating
    // because this fixture is what makes it checkable from source: the kernel was
    // NEVER broken. `LeaseKernel` had acquire/use_token/release, the CT-2 Anchor
    // Breach and all three `on_expire` policies, and its unit tests passed for
    // years. IT HAD NO SUBJECT — the README promised that using a resource after
    // expiry is a breach, in a language where a flow could not USE a resource at
    // all. A guarantee about using a thing that cannot be used is not weak; it is
    // VACUOUS: unviolatable, and therefore unkeepable. §113 made the store
    // operation the use.
    //
    // Perturbing the DECLARATION kills it: widening `duration:` past the clock we
    // advance, and changing `on_expire:` away from `anchor_breach`.
    ("lease", Attested {
        fixture: "tests/fixtures/fase122_b_resource/leased_store.axon",
        gate: "tests/fase113_d_lease_breach_fires.rs",
    }),
    // §Fase 122.b — §112.c exercised `ensemble` ONLY as a refusal (an unsatisfiable
    // quorum must refuse the deploy, because a half-instantiated immune system is
    // worse than none — it looks like one). That law stays, and it left the path
    // the CLAIM is about — aggregating observations actually TAKEN — with no
    // program on disk. This fixture is the satisfiable case.
    //
    // Writing it surfaced a law worth knowing: the type checker refuses a Byzantine
    // ensemble over a single observation ("Byzantine quorum requires >= 2").
    // Byzantine agreement over one voter is not agreement, and the compiler says so
    // rather than deploying something that merely looks like a quorum.
    //
    // Perturbations that kill it: a quorum above the declared observations, and
    // pointing an observation at a source nobody registered — the latter proving
    // the aggregator counts only observations that were really taken.
    ("ensemble", Attested {
        fixture: "tests/fixtures/fase122_b_cognitive_io/ensemble_quorum.axon",
        gate: "tests/fase112_c_cognitive_io_deploy.rs",
    }),
    // §Fase 122.a — ADJUDICATED, because two different things in this codebase
    // are called "topology" and the §122 audit tripped over it. This badge is
    // the SESSION-TYPE liveness checker (Honda), which is real and compile-time.
    // It is NOT `topology.rs`'s `TopologyBackend`/`ReferenceTopology` (Betti
    // numbers / persistent homology), which is one of `savant`'s three unwired
    // engines and is carried by that row. The proof below does not overclaim —
    // it names exactly what it means — but a reader scanning for "topology" will
    // find the unwired engine first, so the disambiguation lives here.
    // §Fase 122.b — the session family and `topology` are COMPILE-time claims
    // (`check_session_duality` decides dual involution with capture-avoiding
    // substitution and coinductive equality; `check_topology_liveness` is a DFS
    // gray/black cycle detector emitting a Honda-liveness violation). The corpus
    // gate COMPILES every fixture before executing it, so both deductions run on
    // this file on every corpus run — which makes a compiled fixture the RIGHT
    // KIND of citation here, not a weaker substitute for a dispatch one.
    //
    // Verified by breaking it, not by assuming: flipping ONE arm of `Buyer`'s
    // `select` from `send` to `receive` fails the gate with the full session
    // type and its dual printed —
    //   `!Quote.?Settlement.+{accept: ?Settlement.end, …}` vs the expected
    //   `?Quote.!Settlement.&{accept: !Settlement.end, …}`
    // — so the duality is genuinely DECIDED arm-for-arm on this fixture, not
    // merely parsed.
    ("topology", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/17_session_duality_topology.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("session", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/17_session_duality_topology.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("send", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/17_session_duality_topology.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("receive", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/17_session_duality_topology.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("select", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/17_session_duality_topology.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("branch", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/17_session_duality_topology.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
        // §Fase 122.b — §112.d already deploys through the REAL `POST /v1/deploy`,
    // so the path was never in doubt; what it lacked was a program on DISK, which
    // is what lets a build catch the citation going stale. The KL sensor detects a
    // real deviation from a LEARNED baseline (wiring it exposed a kernel bug that
    // made it structurally blind). Perturbing the fixture's `window: 4` kills the
    // test — the declared learning window is honoured.
    ("immune", Attested {
        fixture: "tests/fixtures/fase122_b_cognitive_io/immune_reflex_heal.axon",
        gate: "tests/fase112_d_immune_fires.rs",
    }),
        // §Fase 122.b — see `immune`. Perturbing the fixture's `action: quarantine`
    // kills the test: the reflex takes the action the ADOPTER declared, not a
    // default, and its firing carries an HMAC-signed trace.
    //
    // NOTE for a future mutation attempt: loosening `on_level` does NOT kill it,
    // and that is correct, not a hole. `level_at_least` is `observed >= threshold`
    // over know(0) < believe < speculate < doubt(3) — severity order — so a lower
    // threshold fires on a MORE severe classification. Discrimination in the other
    // direction is what `a_steady_system_stays_quiet_once_the_baseline_is_learned`
    // pins.
    ("reflex", Attested {
        fixture: "tests/fixtures/fase122_b_cognitive_io/immune_reflex_heal.axon",
        gate: "tests/fase112_d_immune_fires.rs",
    }),
        // §Fase 122.b — see `immune`. The HealKernel is registered from the compiled
    // IR and renders a decision under the fixture's declared `mode: audit_only`.
    ("heal", Attested {
        fixture: "tests/fixtures/fase122_b_cognitive_io/immune_reflex_heal.axon",
        gate: "tests/fase112_d_immune_fires.rs",
    }),
    // §Fase 122.b — DOWNGRADED from `Real`, deliberately, and this is the row that
    // shows the ratchet doing what it was built for.
    //
    // Measured 2026-08-14: `compliance: [NOT_A_FRAMEWORK]` on an `axonendpoint`
    // COMPILES CLEAN. In the same fixture, `effects: <not_an_effect>` is refused
    // with its closed catalog named. `compliance:` is a free-string field.
    //
    // It could have been attested — a fixture declaring it compiles and passes —
    // and that citation would have proven the field EXISTS, not that it GOVERNS.
    // Writing it would have been the exact species of claim §122 exists to remove,
    // committed by the fase that removes it. So the row states the gap instead.
    //
    // This is the fourth recorded instance in this project of "a free string field
    // breeds an imaginary catalog", and the most exposed: the values are `PCI_DSS`,
    // `SOX`, `HIPAA` — read by a regulated adopter as an assertion. The ESK maps
    // `shield.scan` to ISO 27001 A.8.23 with `CompileTime` evidence, which is
    // honest about its own strength; this field has no such qualifier.
    //
    // Closing it is compiler work — a closed catalog keyed to what the runtime
    // reaches, and a decision about what declaring a framework OBLIGES — not
    // fixture work. A dedicated fase is scheduled after §122's release.
    // §Fase 123 — the FIRST half of that gap is closed, and the row stays
    // `Partial` because the second half is not.
    //
    // What changed: `compliance:` is a closed catalog (`axon-T1214`).
    // `[NOT_A_FRAMEWORK]` no longer compiles, on any of the four declarations
    // that carry the field, and a typo gets its suggestion.
    //
    // Worth recording WHY the law had been missing, because it was not an
    // oversight: the canonical registry and its validating predicate already
    // existed — in `axon-rs::esk::compliance`, which is DOWNSTREAM of the type
    // checker (`axon-frontend` depends on `serde` and nothing else). The
    // catalog was on the wrong side of the dependency edge, so the rule the ESK
    // paper states as compile-time could not be written where it belonged. It
    // had been true in the retired Python interpreter — the paper still cites
    // that test by name — and was lost in the Rust rewrite. §123 moved the
    // vocabulary up; the metadata stayed down, with a test pinning the two.
    //
    // A side effect worth naming: `axon-T957` compares these strings as a set
    // difference, so a `type` labelled `[HIPPA]` used to be perfectly covered
    // by a shield labelled `[HIPPA]`. Closing the vocabulary makes that shape
    // unrepresentable, so the coverage law keeps its exact logic and stops
    // being satisfiable by nonsense. T957 was not edited.
    //
    // §Fase 124 — the second half is closed, and the row is `Attested`.
    //
    // The three defects the §123 gap named, each with its fix:
    //
    // 1. THE CHANNEL SEAM. `TypedEventBus::from_ir_program` handed both
    //    production callers (`daemon.rs`, `runner.rs`) the permissive
    //    `|_,_| true` — a shield covering NOTHING satisfied a channel
    //    carrying PHI at `publish`, the operation that extrudes a capability
    //    to outside parties (D8). §124.c derives the predicate from the SAME
    //    IR the bus registers channels from, and adds the missing dual of
    //    T957 at CHECK time: `axon-T1215` refuses the uncovered DECLARATION
    //    (a mid-flow refusal is the §122.c shape). Both doors are exercised
    //    from the same `.axon` sources in the cited gate. T1215's first
    //    catch was our own published example: `mobile_channels.axon`
    //    documented "compliance MUST cover" in a comment and then declared a
    //    second-order channel relaying κ=PCI_DSS with no shield at all.
    //
    // 2. PRESENCE SCORING. The audit engine granted
    //    `has_compliance_annotation` on `!compliance.is_empty()` anywhere,
    //    and on that feature the risk register asserted MITIGATION and the
    //    gap analyzer marked C1.1/P1.1/P6.1/A.5.34 satisfied. The feature is
    //    now `compliance_coverage_holds` — granted iff at least one
    //    regulated boundary exists and EVERY one names a shield whose κ
    //    covers the data's κ (`esk::audit_engine::coverage`, one definition
    //    shared by both scorers). A label nothing carries grants nothing.
    //
    // 3. THE VOCABULARY (§123, recorded above): closed catalog, T1214.
    //
    // What a declared framework now OBLIGES, stated precisely: κ classes are
    // machine-checked coverage obligations — refused at declaration when
    // uncovered (T957 endpoints, T1215 channels), refused at publish for IR
    // that never met the checker, and scored by the audit engine only when
    // the rule HOLDS. What it still does not oblige, deliberately: the
    // SEMANTIC content of each regulation (what HIPAA requires operationally)
    // is the adopter's shield/flow design, not something a compiler can
    // infer — the ESK maps controls to evidence with that qualifier stated.
    ("compliance", Attested { fixture: "tests/fixtures/fase124_c_channel_kappa/phi_relay.axon", gate: "tests/fase124_c_channel_kappa.rs" }),
    ("component", Partial { gap: "§111 — the compile-time shield-coverage law over regulated κ IS genuinely enforced (a real set difference). But the component renders NOTHING; the README itself defers the renderer" }),
    ("view", Partial { gap: "§111 — only referential integrity is checked. No `route` check, no session-typed-reactivity check, and it renders nothing" }),
    // ── Enterprise I/O (Fases 80–85)
    // §Fase 122.a — was `Real { proof: "cache_runtime — cacheability derives
    // from the type system's `effects: pure` proof (§85)" }`. That proof cited
    // a COMPILE-TIME property as evidence of a runtime, named no test file, and
    // so passed Law 3 vacuously and Law 4 not at all. Measured 2026-08-13:
    // `CacheRuntime::dispatch` has ZERO production callers (only its own
    // tests), `CacheBackend` has no enterprise implementor, and fase_85's own
    // plan records §85.h as "deferred, not built". `backend:`, `ttl:`,
    // `key_params:`, `invalidate_on:` and `default_policy:` are inert in BOTH
    // flavours — `backend: redis` is not a downgrade to in-process, there is no
    // cache. Shipped as `Real` in 2.88.0; this is the row with public exposure.
    //
    // §Fase 122.d — CABLED. The fixture deploys a `pure` tool under a default
    // cache and calls it twice; the gate counts hits on a real upstream and
    // finds ONE. It also pins the three properties a memoiser is worthless or
    // dangerous without: `cache: none` still computes twice, a FAILED call is
    // never stored (D85.10), an `emit` on an `invalidate_on:` channel flushes,
    // and a second TENANT does not read the first one's entry (D85.11).
    //
    // Worth recording that §122.a called this "the cheapest cable in the
    // class" and was wrong on every count. `cache` had THREE declared
    // consumers, not one: `use Tool(…)`, a streaming `apply:` tool, and
    // `retrieve … cache:` — the last of which had lived in the IR since §85.b
    // with no reader. The streaming one cannot be memoised at all (a chunk
    // sequence is not a value), so §122.d added `axon-T1213` to refuse the
    // combination rather than accept a declaration it could not honour. And
    // the cross-tenant assertion could not even be made honestly until
    // §122.d.1 fixed the tenant that two of the three execution doors were
    // losing — see `fase122_d_cache_hits.rs`.
    ("cache", Attested {
        fixture: "tests/fixtures/fase122_d_cache/memoised_pure_tool.axon",
        gate: "tests/fase122_d_cache_hits.rs",
    }),
    ("voice", Unaudited),
    ("shell", Unaudited),
    ("path rewrite", Unaudited),
    ("PASETO", Unaudited),
    // ── Session types (§41)
    // §Fase 122.b — §111.i already deploys through the real path and boots a real
    // TCP listener; its only Law 4 gap was that the program was a Rust `const`.
    // The finding it closed is why the citation matters: the OSS server had NO
    // WebSocket route — not a stub, none — while the README led with session-typed
    // dialogue as the headline feature; and when a route appeared, every socket got
    // a hardcoded canonical chat schema, so the protocol proven at compile time was
    // not the protocol enforced.
    //
    // Perturbing the fixture kills it two ways: breaking the session's duality
    // (`send Fill` -> `send Order` in the broker's arm), and pointing the socket at
    // an undeclared protocol — which must REFUSE rather than substitute.
    ("socket", Attested {
        fixture: "tests/fixtures/fase122_b_socket/trade_dialogue.axon",
        gate: "tests/fase111_i_socket_served.rs",
    }),
    // §Fase 122.b — the surface forms the README badges separately from the bare
    // names above. The same fixture carries all four literally: `send Quote`,
    // `receive Settlement`, and the labelled `select`/`branch` whose arms the
    // duality check pairs one for one.
    ("send T", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/17_session_duality_topology.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("receive T", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/17_session_duality_topology.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("select {ℓᵢ:…}", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/17_session_duality_topology.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("branch {ℓᵢ:…}", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/17_session_duality_topology.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
        // §Fase 122.b — the §80 upstream fixture DECLARES `backpressure: credit(8)` and
    // narrowing it to `credit(3)` kills that gate, so the declared credit window is
    // what the session runtime honours.
    ("backpressure: credit(k)", Attested {
        fixture: "tests/fixtures/fase122_b_upstream/stt_dialogue.axon",
        gate: "tests/fase80_d_upstream_e2e.rs",
    }),
    ("reconnect: cognitive_state", Unaudited),
    // ── §Fase 114.z — the classifications the badge-only gate never asked for.
    //
    // Twenty-two primitives were part of the public promise (registered,
    // corpus-documented, or discussed in the README at length — `step` 136
    // mentions, `type` 79, `document` 25, `budget` 16) and had NO entry here,
    // because the old gate enumerated only the README's `<code>` badges. A
    // gate that guards only the badges guards the packaging. The registry is
    // the enumeration source now (`is_advertised`), and every one of these is
    // classified with §111's own discipline: Real only with a citable gate,
    // Partial only with a named gap, Unaudited where nobody has looked — an
    // unchecked box is not a passing one.
    //
    // The language core — exercised by essentially every gate in both repos.
    // §Fase 122.b — see the `flow` note above; same fixture, same gate. The
    // fixture is a single-`step` flow, so the byte-equal pin IS the step
    // executor's output on both paths.
    ("step", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/banking/01_canonical_loan_decision.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // §Fase 122.b — §65's unified executor (runner + execute_server_flow, binding
    // flow+persona+context) is what every gate that runs a program goes through,
    // which made the old citation true and unfalsifiable at once. This fixture
    // carries a literal top-level `run` statement, and perturbation confirms it
    // is resolved: `run NoSuchFlowAtAll()` fails with "Undefined flow
    // 'NoSuchFlowAtAll' in run statement".
    ("run", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/19_run_effects_compliance.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // §Fase 122.b — `type_checker` (structural + refinement validation) and
    // `store_schema` (§38, declared shapes pinned to SQL column types) are the
    // engines. The fixture below DECLARES types and is compiled from disk by the
    // gate before it executes, so the front half of the path is exercised on
    // source an adopter could have written.
    ("type", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/06_mdn_navigate_graph.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // §Fase 122.b — `fase73_c_json_accessors.rs` + `fase73_e_json_lens.rs` stay
    // the semantic gates for §73's totality (navigation yields null rather than
    // panicking; coercions are honest about a type mismatch). Neither reads a
    // file. The fixture carries both surfaces — open `Json` and the `Json<T>`
    // lens — and is the first published program in the repo to use either.
    ("json", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/16_json_open_navigation.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // The audit chain + π-calc channel family.
    ("ledger", Unaudited),
    ("channel", Partial { gap: "§114.z — durable persistence (§74 outbox) and the σ-shield egress gate (§114, tests/fase114_channel_shield_egress.rs) are proven; `qos:`/`lifetime:` enforcement is unaudited" }),
    // §Fase 122.b — the previous citation (`tests/fase114_channel_shield_egress.rs`)
    // is the SEMANTIC gate and still runs: the channel's σ-shield scans on every
    // path by IR-resolution, and a Reject fails closed before any routing. But
    // its dispatch half hand-builds `IREmit`, so it proves the handler, not the
    // path — the §119.f.8 distinction. The parity corpus supplies the path.
    ("emit", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/banking/09_credit_score_reasoning.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("publish", Unaudited),
    ("discover", Unaudited),
    // Governance operators.
    // §Fase 122.b — `fase114_a_budget_governs_the_canonical_path.rs` (9/9) still
    // proves the ceiling binds on the canonical `use Tool(…)` path, and stays
    // the semantic gate. What it cannot do is satisfy Law 4: it builds its
    // source inline. §114.a rescued `budget` from being README prose that
    // governed nothing — and it was STILL true, until this fixture, that no
    // published `.axon` in the repo declared one. That is the same shape one
    // level up: a primitive whose runtime is real and whose surface nobody
    // writes.
    ("budget", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/15_tool_budget_governance.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    ("window", Unaudited),
    ("cors", Unaudited),
    // The governed-egress trio (§105 · §99/§106 · §110) — none was ever badged.
    // §Fase 122.b — verified by perturbation on this fixture: 
    // `target: notaformat` fails it (§99's serializer catalog is decided, not
    // parsed).
    ("document", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/20_document_notify_egress.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // §Fase 122.b — was `delivery.rs + axon-T920`, a module plus a code.
    //
    // The boundary is stated precisely, because overstating it would be the very
    // defect this fase closes: this citation proves the DECLARATION path (source →
    // type checker → IR), NOT the egress. `deliver` cannot be dispatched from a
    // fixture at all — `secret:` is a per-tenant key under §94 custody (axon-T923),
    // so no fixture without a mounted minter reaches the wire. The egress stays
    // proven by §105's own runtime gates.
    //
    // What the fixture does carry is the substance an adopter meets first, each law
    // watched refusing on the file's own text: T921 (`target:` is a closed
    // system-of-record class), T924 twice — the delivery must declare the `web` it
    // crosses, AND binding `sensitive:*` into a system of record is further
    // processing (D105.6) so the legal basis is not decoration — and T926 (every
    // operation carries an idempotency key).
    ("deliver", Attested {
        fixture: "tests/fixtures/fase122_b_deliver/crm_handoff.axon",
        gate: "tests/fase122_b_deliver_laws.rs",
    }),
    // §Fase 122.b — verified by perturbation on this fixture: 
    // `window: 0m` fails it — §110's mandatory positive window. All five
    // §110 laws fired when the block was first written wrong, and the fixture
    // keeps their diagnostics as comments.
    ("notify", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/20_document_notify_egress.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
    // Credentials + custody verbs.
        // §Fase 122.b — §92's gates hand-build `IRCredential`. The contract under test
    // is now the one the compiler emitted from `credential WidgetSession { ttl: 15m
    // grants: [chat.invoke] }`. Perturbation kills it three ways: changing the
    // declared `grants:`, renaming the `as` binding, and — after the helper was
    // fixed to run the TYPE CHECKER — pushing `ttl:` past the 24h ceiling, which
    // now fails with `axon-T894` naming the §81 service-account surface instead.
    ("credential", Attested {
        fixture: "tests/fixtures/fase122_b_credential/visitor_session.axon",
        gate: "tests/fase92_mint_runtime.rs",
    }),
        // §Fase 122.b — the flow-body verb, from source: `mint WidgetSession as tok`.
    // The bearer is bound under the name the SOURCE chose, its grants come from the
    // DECLARED contract, and the test still pins the property that matters — the
    // raw token rides neither the outcome nor the wire.
    ("mint", Attested {
        fixture: "tests/fixtures/fase122_b_credential/visitor_session.axon",
        gate: "tests/fase92_mint_runtime.rs",
    }),
    // §Fase 122.b — a DECLARATION-path citation, and the boundary is structural
    // rather than a testing gap: §94's runtime gate drives a local tool server on
    // an ephemeral port, and a tool endpoint has no config-key indirection the way
    // §80 requires for `upstream` — so a static file cannot name it without
    // bending. `rotation_without_revelation` (ENUMERATE + ROTATE(CAS) + USE, no
    // term evaluating to a secret) stays proven by §94's own gates.
    //
    // What the file carries are the two laws that make the verb governable, each
    // watched refusing: `axon-T898` — the target must be a `backend: secrets`
    // store, because you cannot rotate what is not custody — and `axon-T899` — the
    // exchange tool must be declared, not ad-hoc.
    ("rotate", Attested {
        fixture: "tests/fixtures/fase122_b_credential/rotate_crm_class.axon",
        gate: "tests/fase122_b_declaration_laws.rs",
    }),
    // Session types + quantum bridge.
    // §Fase 122.b — §80's gates hand-build `IRUpstream`, which proves the DIAL.
    // This citation compiles the declaration an adopter writes and dials the same
    // real WebSocket vendor with it. A static fixture works here for the reason
    // `rotate` cannot yet use one: `resolve:`/`secret:` are CONFIG KEYS by §80's
    // rule, never literals, so the vendor's ephemeral address is supplied by the
    // resolver and nothing about the program bends to the test.
    //
    // Three perturbations kill it: changing the declared `auth:` from header to
    // query (the secret must ride where the DECLARATION says), narrowing the
    // `backpressure: credit(n)` window, and changing the `when` clause that
    // classifies the inbound frame — the last proving the vendor's reply is typed
    // by the fixture's `map:`, not guessed.
    ("upstream", Attested {
        fixture: "tests/fixtures/fase122_b_upstream/stt_dialogue.axon",
        gate: "tests/fase80_d_upstream_e2e.rs",
    }),
    // §Fase 122.b — §111.d's gates all still run and all hand-build `IRQuant`:
    // a proof of the HANDLER. The gate now also compiles a fixture and dispatches
    // the node the COMPILER lowered, against the same `ReferenceSimulator` the
    // runner mounts. The expected value is ANALYTIC — |0⟩ under Pauli-Z gives
    // ⟨Z⟩ = +1 exactly — so no placeholder satisfies it. Perturbation kills it
    // three ways: flipping the term's sign, renaming the observable, and rotating
    // the carrier off the ground state.
    ("quant", Attested {
        fixture: "tests/fixtures/fase122_b_quant/ground_state_measurement.axon",
        gate: "tests/fase111_d_quant_wired.rs",
    }),
    // §Fase 122.b — the observable under test is the one the compiler emitted from
    // `observable GroundEnergy { qubits: 1  term: 1.0 * \"Z\" }`, and the result
    // must NAME it. Renaming the reference in the `quant` header kills the
    // citation; so does flipping the declared term's coefficient.
    // §Fase 122.c — as with `warden`, the deploy gate is the timing proof: an
    // `observable` declaring more qubits than the mounted simulator can hold is
    // refused at /v1/deploy. Worth recording WHY that test was hard to write —
    // the first draft declared `qubits: 24` with a one-qubit Pauli string and was
    // refused by `axon-E0785` (declared width must match the terms) before the
    // capacity gate ran at all. The two laws are complementary: E0785 asks whether
    // the DECLARATION is coherent with itself, §122.c asks whether a coherent
    // declaration is REALISABLE on the backend actually mounted.
    ("observable", Attested {
        fixture: "tests/fixtures/fase122_b_quant/ground_state_measurement.axon",
        gate: "tests/fase111_d_quant_wired.rs",
    }),
    // Symbolic differentiation.
    // §Fase 122.b — `fase109_grad_runtime.rs` stays the semantic gate (it deploys
    // through the REAL /v1/deploy + /v1/execute and checks the evaluated
    // derivative). It builds its source inline. `grad` is SYMBOLIC and happens at
    // COMPILE time — the gradient IS IR under the PCC GradientSoundness witness —
    // so the corpus gate's compile pass is where the claim is exercised.
    ("grad", Attested {
        fixture: "tests/fixtures/fase33z_parity_corpus/cross_vertical/18_refine_grad_compute.axon",
        gate: "tests/fase33z_d_parity_corpus.rs",
    }),
];

/// **The ratchet.** Every advertised name whose runtime is
/// [`RuntimeStatus::NotImplemented`] or `RuntimeStatus::Unwired` — i.e. every
/// promise the README makes today that the code does not keep.
///
/// This list may only ever **shrink**. Adding a name to it requires editing this
/// file, which is the point: a new unkept promise cannot land quietly. Removing
/// one means you either implemented it or retracted it from the README — both
/// good outcomes, and both must happen in the same PR as the deletion.
///
/// §111 inherited every one of these. They are the fase's open debt, and now the
/// compiler holds the ledger.
///
/// # §Fase 122.a — this ledger went 0 → 3, and that is the ratchet WORKING
///
/// §119 drove it to empty and that was true of everything the table classified
/// honestly. It was not true of the table. `cache` was attested `Real` on a
/// proof that named a compile-time property, so its dead runtime was never
/// counted; `savant` and `synth` sat under `Unaudited`, which said *nobody
/// looked* — accurate in §111, and no longer accurate once someone did.
///
/// **The debt did not grow. It was uncovered.** Three engines that exist, pass
/// their own tests, and are reachable from no published program. Recording them
/// is the entire thesis of §122 applied to the file that carries it: a ledger
/// that stays empty because a row lies is worth less than one that admits three.
pub const KNOWN_DEBT: &[&str] = &[
    // Tier 4 — implement or retract.
    // `compute` LEFT this ledger in §111.f: it is now a real pure function over
    // the §70 expression language. This is the ratchet turning — the only
    // direction it turns.
    // `hibernate` LEFT this ledger in §119.d (2026-08-07): the walk halts,
    // the continuation parks under the published SHA-256 id, emit wakes it,
    // and lazy expiry refuses lateness. Fifth turn of the ratchet.
    //
    // `mandate` LEFT this ledger in §119.b (2026-08-07): the enforcement loop
    // runs through production dispatch, fails closed, and its name resolving
    // to nothing is a refusal — the exact call that used to be the identity
    // passthrough is now the F18 regression test. Second turn of the ratchet.
    //
    // `lambda` and `ots` LEFT in §119.c (2026-08-07), the same day: the ΛD
    // engine reached the production dispatch path (Real), and ots's dispatch
    // layer + registry hook became real with an honestly-named gap (Partial:
    // no OSS transformer registers by default — a generic default would be
    // the identity lie F18 named). Third and fourth turns.
    // The Cognitive-I/O block.
    //
    // §112 PAID SIX OF THESE. `observe` · `ensemble` · `immune` · `reflex` · `heal` ·
    // `reconcile` are now driven by the CognitiveIoSupervisor and each cites a gate
    // that proves it runs through the REAL deploy path.
    //
    // My §111 diagnosis of this family was WRONG in a way worth remembering: I called
    // it a language-design problem ("no verb can reach them"). The language was
    // already complete — the declarations form a dataflow graph and reference each
    // other, and the kernels took the compiled IR directly. **Nobody had ever built
    // the loop.**
    //
    // §113 PAID TWO MORE. `resource` and `lease` left this ledger.
    //
    // `resource` now governs what actually runs: an `axonstore { resource: Db }`
    // DERIVES its DSN and its POOL SIZE from the resource (`capacity: 20` ⇒ twenty
    // connections — before §113 that field was read by zero lines of code in either
    // repository while every pool sat at a hardcoded 10), and `lifetime` decides how
    // many holders may name it (`axon-T945`).
    //
    // `lease` was the sharpest case in the whole line, and worth remembering: its
    // kernel was never broken. `LeaseKernel` had `acquire`, `use_token`, `release`,
    // the CT-2 Anchor Breach and all three `on_expire` policies, and its unit tests
    // passed for years. **IT HAD NO SUBJECT.** The README promised that using a
    // resource after expiry is a breach — in a language where a flow could not USE a
    // resource at all. A guarantee about using a thing that cannot be used is not a
    // weak guarantee; it is a VACUOUS one. It cannot be violated, and so it cannot be
    // kept. §113 made the store operation the use, and the breach finally fires.
    //
    // ── AND `fabric` STAYS. ────────────────────────────────────────────────────
    //
    // This is the ratchet doing its job on the fase that was in a position to fudge
    // it. `within:` gave `fabric` subjects, and Separation-Logic disjointness is now
    // unrepresentable by construction (one field ⇒ a resource cannot be in two
    // fabrics). It would be *easy* to call that Real.
    //
    // But `provider` / `region` / `zones` are consumed by NOTHING at runtime — in
    // `LiveHandler::provision` the parameter is literally `_fabrics`, underscored,
    // and that function refuses anyway. A `fabric` still governs nothing that runs.
    //
    // Calling it Real here is exactly the lie §111.g exists to prevent, told by the
    // person who wrote the gate. The ledger only shrinks by what is PROVEN.
    // §Fase 119.e (2026-08-07) — `fabric` LEFT this ledger, and with it the
    // ledger itself: provider/region now refuse an impossible substrate and an
    // unsatisfiable obligation at compile time, and reach the running channel
    // and its audit row. SIXTH AND LAST TURN.
    //
    // ═══════════════════════════════════════════════════════════════════
    //  §111 opened this ledger with 22 advertised primitives that were not
    //  real. §111.f paid `compute`. §112 paid six of the Cognitive-I/O block.
    //  §113 paid `resource`/`lease`. §114 paid the governed channel. §119 paid
    //  the last five — `mandate` (b), `lambda` + `ots` (c), `hibernate` (d),
    //  `fabric` (e), all on 2026-08-07 — and the list reached EMPTY.
    //
    //  §Fase 122.a re-opened it at THREE, and the reason is the point of the
    //  whole fase: the list was empty of everything this table classified
    //  honestly, and the table had one row that did not. Each entry below is an
    //  `Unwired` engine — complete, tested, and reachable from no published
    //  program. NONE of them is new work discovered by §122; all three predate
    //  it and were simply not counted.
    //
    //  A KNOWN_DEBT of 0 or 3 does NOT mean every other primitive is Real.
    //  Several are `Partial` with the gap NAMED — a bounded, published limit an
    //  adopter can read and plan around, which is the whole point of the
    //  distinction.
    // ═══════════════════════════════════════════════════════════════════
    //
    // §Fase 122.d — `cache` LEFT this ledger. The seam has its call sites (both
    // of them), and `fase122_d_cache_hits.rs` counts one upstream hit for two
    // identical calls, through the real deploy + execute handlers.
    //
    // §122.a's entry said it would leave via "the cheapest cable in the class,
    // because the engine is already there". The engine was indeed already
    // there and the estimate was still wrong: three consumers rather than one,
    // a seam whose synchronous shape did not fit the async dispatch path, a
    // combination the language had to start refusing (`axon-T1213`), and a
    // tenant that two of the three execution doors were losing outright
    // (§122.d.1). Left as a note to the next reader of this file: an entry
    // that estimates its own cost is estimating something nobody has measured.
    //
    // §Fase 122.a — three tested engines (HRR codec, VFE/EFE inference,
    // Betti/PHC topology), zero callers outside their own tests. It LEAVES when
    // active inference is wired, which is a fase, not a cable.
    "savant",
    // §Fase 122.a — `DenyByDefaultSynth` exists and has no mount point. NOTE
    // the honest ceiling: cabling it in OSS yields `FailsClosed` (§87.j — OSS
    // never executes synthesised code), not `Real`. It leaves this ledger for
    // `FailsClosed`, which is an acceptable state to advertise from.
    "synth",
];

/// Look up what an advertised name's runtime actually does.
///
/// **No default arm, deliberately.** An unknown name returns `None`, and the
/// gate below turns that into a build failure — so a primitive cannot be added
/// to the README without someone stating what it does.
pub fn status_of(name: &str) -> Option<RuntimeStatus> {
    ADVERTISED
        .iter()
        .find(|(n, _)| *n == name)
        .map(|(_, s)| *s)
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::collections::HashSet;
    use std::path::Path;

    /// The repo root, from `axon-frontend/`.
    fn repo_root() -> &'static Path {
        Path::new("..")
    }

    /// Parse the README's header badge block — the public promise, as published.
    fn readme_advertised() -> Vec<String> {
        let readme = std::fs::read_to_string(repo_root().join("README.md"))
            .expect("the public README must be readable — it is an INPUT to this build");
        let start = readme
            .find("<!-- Cognition primitives -->")
            .expect("the README's primitive badge block must be findable");
        let end = readme[start..]
            .find("</p>")
            .expect("the badge block must terminate")
            + start;
        let block = &readme[start..end];

        let mut out = Vec::new();
        let mut rest = block;
        while let Some(i) = rest.find("<code>") {
            rest = &rest[i + 6..];
            let j = rest.find("</code>").expect("unterminated <code> badge");
            out.push(rest[..j].to_string());
            rest = &rest[j + 7..];
        }
        out
    }

    /// **LAW 1 — the README is a build input.**
    ///
    /// Every badge it advertises must be classified here. A primitive cannot be
    /// added to the public promise without someone stating, on the record, what
    /// its runtime actually does.
    #[test]
    fn every_advertised_name_is_classified() {
        let missing: Vec<String> = readme_advertised()
            .into_iter()
            .filter(|n| status_of(n).is_none())
            .collect();
        assert!(
            missing.is_empty(),
            "the README advertises {} name(s) with NO entry in `ADVERTISED`:\n  {}\n\n\
             You cannot advertise a primitive without stating what its runtime does. \
             That omission is exactly how §111 happened: `warden` and `quant` had a README \
             badge, a registry entry, a parser production AND a dispatch arm — and were no-ops.",
            missing.len(),
            missing.join("\n  ")
        );
    }

    /// **LAW 1b (§114.z) — the registry is the enumeration source.**
    ///
    /// Every `PRIMITIVE_REGISTRY` entry with `is_advertised: true` must be
    /// classified here. This is the law the badge-only gate lacked: `budget`
    /// was discussed in the README seventeen times, badged zero, tracked in NO
    /// table — and its dead runtime (§114.a) survived every green build.
    #[test]
    fn every_advertised_registry_primitive_is_classified() {
        let missing: Vec<&str> = crate::primitive_registry::PRIMITIVE_REGISTRY
            .iter()
            .filter(|i| i.is_advertised)
            .map(|i| i.name)
            .filter(|n| status_of(n).is_none())
            .collect();
        assert!(
            missing.is_empty(),
            "{} registry primitive(s) are `is_advertised` with NO entry in `ADVERTISED`:\n  {}\n\n\
             The registry is the enumeration source (§114.z). A primitive that is part of \
             the public promise cannot exist without someone stating, on the record, what \
             its runtime does. That omission is exactly how `budget` (§114.a) happened.",
            missing.len(),
            missing.join("\n  ")
        );
    }

    /// **LAW 1b, visibility half (§114.z)** — an advertised primitive must be
    /// VISIBLE in the promise: every `is_advertised` registry entry carries a
    /// `<code>` badge in the README's header block. Classification without
    /// visibility would let the promise live only inside this file.
    #[test]
    fn every_advertised_registry_primitive_is_badged() {
        let badges: HashSet<String> = readme_advertised().into_iter().collect();
        let unbadged: Vec<&str> = crate::primitive_registry::PRIMITIVE_REGISTRY
            .iter()
            .filter(|i| i.is_advertised)
            .map(|i| i.name)
            .filter(|n| !badges.contains(*n))
            .collect();
        assert!(
            unbadged.is_empty(),
            "these `is_advertised` registry primitives have NO `<code>` badge in the README: \
             {unbadged:?}\nAdd the badge (and its classification) or flip `is_advertised` — \
             deliberately, in the same PR."
        );
    }

    /// **LAW 1b, negative half (§114.z)** — an `is_advertised: false` registry
    /// primitive must be neither badged nor classified. If either exists, the
    /// polarity flag is lying about the promise.
    #[test]
    fn non_advertised_registry_primitives_are_neither_badged_nor_classified() {
        let badges: HashSet<String> = readme_advertised().into_iter().collect();
        for info in crate::primitive_registry::PRIMITIVE_REGISTRY {
            if info.is_advertised {
                continue;
            }
            assert!(
                !badges.contains(info.name),
                "`{}` is `is_advertised: false` but carries a README badge — the flag lies",
                info.name
            );
            assert!(
                status_of(info.name).is_none(),
                "`{}` is `is_advertised: false` but is classified in ADVERTISED — \
                 either advertise it deliberately or remove the classification",
                info.name
            );
        }
    }

    /// The reverse: no zombie entries. If a name leaves the README (retracted),
    /// it must leave this table too — otherwise the table slowly becomes a
    /// museum and stops describing the promise.
    #[test]
    fn every_classified_name_is_still_advertised() {
        let advertised: HashSet<String> = readme_advertised().into_iter().collect();
        let zombies: Vec<&str> = ADVERTISED
            .iter()
            .map(|(n, _)| *n)
            .filter(|n| !advertised.contains(*n))
            .collect();
        assert!(
            zombies.is_empty(),
            "these names are classified here but are NO LONGER advertised in the README: {zombies:?}\n\
             Retracting a primitive means deleting it from BOTH."
        );
    }

    /// **LAW 2 — the ratchet.** Nothing advertised may be `NotImplemented` OR
    /// `Unwired` unless it is in `KNOWN_DEBT`, and that list may only shrink.
    ///
    /// This is the law that makes §111's findings durable. A *new* unkept promise
    /// is a red build. The existing ones are a ledger the compiler holds — not a
    /// paragraph in a document nobody rereads.
    ///
    /// §122.a widened it from `is_unimplemented()` to `owes_a_debt_entry()`
    /// (D122.6). Had `Unwired` been added beside this law instead of inside it,
    /// the state would have been an escape hatch: any `NotImplemented` row could
    /// be relabelled out from under the ratchet, and the ratchet would measure
    /// vocabulary instead of debt.
    #[test]
    fn no_new_unkept_promises() {
        let debt: HashSet<&str> = KNOWN_DEBT.iter().copied().collect();
        let undeclared: Vec<&str> = ADVERTISED
            .iter()
            .filter(|(_, s)| s.owes_a_debt_entry())
            .map(|(n, _)| *n)
            .filter(|n| !debt.contains(*n))
            .collect();
        assert!(
            undeclared.is_empty(),
            "these advertised primitives are NotImplemented/Unwired and are NOT in KNOWN_DEBT: {undeclared:?}\n\n\
             You have advertised a promise the code does not keep. Either implement it, wire it, \
             retract it from the README, or (if you are knowingly shipping the gap) add it to \
             KNOWN_DEBT with its finding — so it is a LEDGER ENTRY and not a lie."
        );
    }

    /// The ratchet's teeth: `KNOWN_DEBT` may only shrink. Bump this DOWN when a
    /// debt is paid; a build that needs it bumped UP is telling you something.
    ///
    /// §122.a TIGHTENED the cap 14 → 3. The old cap was slack left over from
    /// §111's opening balance: with the list at zero, eleven rows could have
    /// been added before any gate complained. A ratchet with slack is a ratchet
    /// that has stopped measuring. The three entries are the `Unwired` engines
    /// §122.a uncovered; the next move is 3 → 2 when §122.d cables `cache`.
    #[test]
    fn the_debt_ledger_only_shrinks() {
        assert!(
            KNOWN_DEBT.len() <= 2,
            "KNOWN_DEBT grew to {} — the ratchet only turns one way. §122.a re-baselined it at 3 \
             (the `Unwired` engines it uncovered) and TIGHTENED the cap to match; §122.d cabled \
             `cache` and took it to 2. A new entry is not a row to add, it is a bug to fix.",
            KNOWN_DEBT.len()
        );
    }

    /// **§122.a — the `Unwired` population is pinned, and may only shrink.**
    ///
    /// Three, measured 2026-08-13: `cache` · `savant` · `synth`. Each is an
    /// engine that exists, passes its own tests, and is reachable from no
    /// published program.
    ///
    /// This pin exists so the state cannot become a comfortable parking spot.
    /// `Unwired` is the honest label for a cable that was never run — it is not
    /// a place to move rows that have become inconvenient to defend as `Real`.
    /// The only direction is down, and down means a call site landed.
    #[test]
    fn the_unwired_population_only_shrinks() {
        let n = ADVERTISED
            .iter()
            .filter(|(_, s)| matches!(s, Unwired { .. }))
            .count();
        assert!(
            n <= 2,
            "the Unwired population grew to {n} — §122.a measured 3 (cache · savant · synth) \
             and §122.d cabled `cache`, leaving 2. A new Unwired row means a primitive was \
             advertised with an engine nobody calls; wire it or retract it."
        );
    }

    /// Every `Unwired` row must NAME the engine that exists. The name is what
    /// separates a cable job from a build job — without it the state degrades
    /// into a politer `NotImplemented`, which is not what it is for.
    #[test]
    fn every_unwired_row_names_its_engine() {
        for (name, status) in ADVERTISED {
            if let Unwired { engine } = status {
                assert!(
                    !engine.trim().is_empty(),
                    "`{name}` is Unwired with no engine named — say what exists, or the row \
                     cannot be told apart from NotImplemented"
                );
            }
        }
    }

    /// Every debt entry must actually BE a debt — no padding the ledger with
    /// names that are fine, which would let a real one hide among them.
    #[test]
    fn the_debt_ledger_has_no_padding() {
        for name in KNOWN_DEBT {
            let s = status_of(name)
                .unwrap_or_else(|| panic!("KNOWN_DEBT names `{name}`, which is not advertised"));
            assert!(
                s.owes_a_debt_entry(),
                "`{name}` is in KNOWN_DEBT but its status is {s:?} — if it was implemented, wired, \
                 or retracted, delete its ledger row in the same PR."
            );
        }
    }

    /// **LAW 3 — a claim of reality must cite the gate that proves it.**
    ///
    /// And where the proof names a test file, that file must exist. A `Real`
    /// claim pointing at nothing is just a nicer-sounding assertion — which is
    /// precisely what the README's feature table was.
    #[test]
    fn every_real_claim_cites_a_proof_that_exists() {
        for (name, status) in ADVERTISED {
            if let Real { proof } = status {
                assert!(
                    !proof.trim().is_empty(),
                    "`{name}` claims Real with an empty proof"
                );
                if let Some(path) = proof.split_whitespace().find(|t| t.starts_with("tests/")) {
                    let full = repo_root().join("axon-rs").join(path);
                    let alt = repo_root().join("axon-frontend").join(path);
                    assert!(
                        full.exists() || alt.exists(),
                        "`{name}` claims Real and cites `{path}`, which does not exist. \
                         A proof that cannot be run is not a proof."
                    );
                }
            }
        }
    }

    /// **§122.a — LAW 4's shape.** An `Attested` claim must name a `.axon`
    /// FIXTURE that exists and a GATE that exists.
    ///
    /// This is the half of Law 4 that the SHAPE can enforce. The other half —
    /// that the gate actually READS that fixture — is §122.b, and it is the
    /// half that makes the citation mean something. Landing the shape first is
    /// deliberate (D122.2): re-attesting sixty-four rows is sixty-four
    /// judgements, and mixing them into a mechanical refactor is how a
    /// convenience `Real` gets in.
    #[test]
    fn every_attested_claim_names_a_fixture_and_a_gate_that_exist() {
        for (name, status) in ADVERTISED {
            if let Attested { fixture, gate } = status {
                assert!(
                    fixture.ends_with(".axon"),
                    "`{name}` is Attested but its fixture `{fixture}` is not a `.axon` source. \
                     Law 4 wants the input a published program could have written — a test file \
                     proves the engine, not the path."
                );
                for (label, path) in [("fixture", fixture), ("gate", gate)] {
                    let found = [repo_root().join(path)]
                        .into_iter()
                        .chain([
                            repo_root().join("axon-rs").join(path),
                            repo_root().join("axon-frontend").join(path),
                        ])
                        .any(|p| p.exists());
                    assert!(
                        found,
                        "`{name}` is Attested and cites {label} `{path}`, which does not exist. \
                         A citation that cannot be run is not a proof."
                    );
                }
            }
        }
    }

    /// **§122.b — LAW 4, ENFORCED.** The cited gate must actually reach the
    /// cited fixture, and the fixture must be a program the compiler accepts.
    ///
    /// # What this proves, and what it does not
    ///
    /// Enforced here, mechanically:
    ///
    /// 1. the fixture **compiles** — a `.axon` that no longer parses is not a
    ///    program any adopter could have written, and a citation to it is
    ///    stale. This is the check that catches rot;
    /// 2. the gate **names a path that reaches the fixture** — the fixture
    ///    itself, or a directory under `fixtures/` that contains it (the
    ///    corpus-driven idiom `fase116_laws_corpus` and `fase33z_d_parity_corpus`
    ///    already use). A gate naming only `tests/fixtures` proves nothing and
    ///    is rejected: the path must be at least one segment deeper.
    ///
    /// **Not** enforced, and it must be said plainly, because a ratchet that is
    /// believed to prove more than it does is the exact defect this file
    /// exists to close: nothing here decides whether the gate *meaningfully
    /// exercises the primitive*. That stays a human attestation — the premise
    /// of [`RuntimeStatus`] from the beginning, *because no linter can decide
    /// it*. What §122.b removes is the ability to cite something that cannot be
    /// run, or that has quietly stopped compiling. It makes the CITATION
    /// verifiable. It does not make the JUDGEMENT automatic.
    #[test]
    fn every_attested_gate_reaches_a_fixture_that_still_compiles() {
        for (name, status) in ADVERTISED {
            let Attested { fixture, gate } = status else {
                continue;
            };
            // (1) The fixture is a program the compiler still accepts.
            let fixture_path = resolve_repo_path(fixture)
                .unwrap_or_else(|| panic!("`{name}` cites fixture `{fixture}`, which is missing"));
            let src = std::fs::read_to_string(&fixture_path)
                .unwrap_or_else(|e| panic!("`{name}`: cannot read `{fixture}`: {e}"));
            let tokens = crate::lexer::Lexer::new(&src, fixture)
                .tokenize()
                .unwrap_or_else(|e| {
                    panic!(
                        "`{name}` cites fixture `{fixture}`, which no longer LEXES: {e:?}\n\
                         A citation to a program the compiler rejects is stale."
                    )
                });
            crate::parser::Parser::new(tokens).parse().unwrap_or_else(|e| {
                panic!(
                    "`{name}` cites fixture `{fixture}`, which no longer PARSES: {e:?}\n\
                     A citation to a program the compiler rejects is stale."
                )
            });

            // (2) The gate names a path that reaches it.
            let gate_path = resolve_repo_path(gate)
                .unwrap_or_else(|| panic!("`{name}` cites gate `{gate}`, which is missing"));
            let gate_src = std::fs::read_to_string(&gate_path)
                .unwrap_or_else(|e| panic!("`{name}`: cannot read gate `{gate}`: {e}"));
            assert!(
                gate_mentions_a_path_reaching(&gate_src, fixture),
                "`{name}` is Attested, but gate `{gate}` never names a path that reaches fixture \
                 `{fixture}`.\n\n\
                 This is LAW 4. A gate that does not read the fixture proves the ENGINE, not the \
                 PATH — §119.f.8's lesson, and the hole `cache` went through. Name the fixture (or \
                 the corpus directory that holds it) in the gate, or cite a gate that does."
            );
        }
    }

    /// Resolve a repo-relative path, tolerating the two crate roots the table's
    /// citations use.
    fn resolve_repo_path(p: &str) -> Option<std::path::PathBuf> {
        [
            repo_root().join(p),
            repo_root().join("axon-rs").join(p),
            repo_root().join("axon-frontend").join(p),
        ]
        .into_iter()
        .find(|c| c.exists())
    }

    /// True when `gate_src` names the fixture, or a directory under a
    /// `fixtures` segment that contains it.
    ///
    /// The depth rule is the load-bearing part: naming `tests/fixtures` alone
    /// would let any gate claim any fixture, so an ancestor only counts when it
    /// is at least one segment deeper than the `fixtures` directory itself.
    fn gate_mentions_a_path_reaching(gate_src: &str, fixture: &str) -> bool {
        let fixture = fixture.replace('\\', "/");
        if gate_src.contains(&fixture) {
            return true;
        }
        let segments: Vec<&str> = fixture.split('/').collect();
        let Some(fx) = segments.iter().position(|s| *s == "fixtures") else {
            return false;
        };
        // Ancestors strictly deeper than `.../fixtures`, longest first.
        (fx + 2..segments.len())
            .rev()
            .any(|end| gate_src.contains(&segments[..end].join("/")))
    }

    /// **§Fase 122.d — the README's VERSION is a build input too.**
    ///
    /// This file has parsed the README as a build input since §111 — for the
    /// primitive badges. Nobody pinned the version, and it drifted until the
    /// README disagreed with itself: the title said `v2.75.0`, the badge said
    /// `v2.85.0`, the prose said `v2.75.0`, and the shipped crate was `2.88.0`.
    /// Three numbers in one file, none of them right.
    ///
    /// That is the same species of unverified public claim §122 spent itself
    /// removing from the ledger, sitting two screens above the ledger. The gate
    /// costs two lines and closes it: every `vX.Y.Z` the header block asserts
    /// about THIS crate must equal `axon-rs/Cargo.toml`'s version.
    ///
    /// Scope note — deliberate, and narrower than the first draft: only the
    /// title, the badges, and the two-repositories note are checked. The
    /// primitive-census `<details>` block sits between them and carries
    /// HISTORICAL labels ("Session types (v2.3.0)"), which say when a feature
    /// shipped and must never move. The first version of this gate swept the
    /// whole header and immediately flagged those — correctly refusing to let
    /// me conflate "what ships now" with "when this arrived".
    #[test]
    fn the_readme_header_states_the_version_the_crate_actually_is() {
        let cargo = std::fs::read_to_string(repo_root().join("axon-rs/Cargo.toml"))
            .expect("axon-rs/Cargo.toml must be readable");
        let version = cargo
            .lines()
            .find_map(|l| l.strip_prefix("version = \""))
            .and_then(|r| r.split('"').next())
            .expect("axon-rs/Cargo.toml must declare a version");

        let readme = std::fs::read_to_string(repo_root().join("README.md"))
            .expect("README.md must be readable");
        let header_end = readme
            .find("## What is AXON?")
            .expect("the README must still have its `What is AXON?` heading");
        // Everything above the prose, MINUS the primitive-census block, whose
        // version labels are historical.
        let (census_start, census_end) = (
            readme.find("<details>").unwrap_or(header_end),
            readme
                .find("</details>")
                .map(|i| i + "</details>".len())
                .unwrap_or(header_end),
        );
        let header = format!(
            "{}{}",
            &readme[..census_start.min(header_end)],
            &readme[census_end.min(header_end)..header_end]
        );
        // …and MINUS the `axon-enterprise` note, which states a DIFFERENT
        // product's version.
        //
        // That note has always been there; it was invisible to this gate only
        // because the gate matched the literal `"v2."` while enterprise was on
        // `v3.x`. The README says the two lines "diverge by design", and at
        // axon-lang v3.0.0 they stopped diverging in the MAJOR — so a purely
        // lexical scan can no longer tell `v3.0.0` (this crate) from
        // `v3.100.0` (the control plane). The exclusion has to be named rather
        // than emergent, exactly like the census block above.
        //
        // The note is a blockquote, so it ends at the first blank line.
        let header: String = match header.find("axon-enterprise") {
            None => header,
            Some(at) => {
                let tail_from = header[at..]
                    .find("\n\n")
                    .map(|i| at + i)
                    .unwrap_or(header.len());
                // Rewind to the start of the blockquote that mentions it.
                let quote_from = header[..at].rfind("\n>").map(|i| i + 1).unwrap_or(at);
                format!("{}{}", &header[..quote_from], &header[tail_from..])
            }
        };
        let header = header.as_str();

        let expected = format!("v{version}");
        // §Fase 122 wrote this anchor as the literal `"v2."`, and v3.0.0 is
        // where that came due: the header stated `v3.0.0`, the scan found zero
        // `v2.` claims, and the gate failed with "the header must state the
        // version somewhere" — reporting a restructured README when nothing had
        // moved. A gate keyed to the CURRENT major cannot survive the next one,
        // so it now matches any `vN.N.N` and compares every one it finds.
        let claims: Vec<&str> = header
            .match_indices('v')
            .filter(|(i, _)| header[i + 1..].starts_with(|c: char| c.is_ascii_digit()))
            .map(|(i, _)| {
                let rest = &header[i..];
                let end = rest
                    .find(|c: char| !(c.is_ascii_digit() || c == '.' || c == 'v'))
                    .unwrap_or(rest.len());
                &rest[..end]
            })
            .filter(|c| c.matches('.').count() == 2)
            .collect();

        assert!(
            !claims.is_empty(),
            "the README header must state the version somewhere — if this fires, the \
             header was restructured and this gate needs its anchor updated"
        );
        for c in &claims {
            assert_eq!(
                *c, expected,
                "the README header claims `{c}` but axon-rs/Cargo.toml is `{version}`. \
                 Every version the header asserts about THIS crate must match the crate. \
                 (Historical `vX.Y.Z (Fase N) adds…` references live BELOW the header and \
                 are deliberately out of scope — they say when something shipped.)"
            );
        }
    }

    /// §122.b — the depth rule inside [`gate_mentions_a_path_reaching`] is the
    /// load-bearing half, so it gets its own test rather than trust.
    ///
    /// Without it, a gate that merely says `tests/fixtures` anywhere in its
    /// source could claim EVERY fixture in the repo — which would make Law 4
    /// enforceable in form and vacuous in fact, the precise failure this whole
    /// fase exists to end.
    #[test]
    fn naming_the_fixtures_root_alone_does_not_reach_a_fixture() {
        let fixture = "tests/fixtures/fase33z_parity_corpus/banking/01_canonical_loan_decision.axon";

        // Too shallow: the corpus root is not named.
        assert!(!gate_mentions_a_path_reaching("reads tests/fixtures/", fixture));
        assert!(!gate_mentions_a_path_reaching("reads tests/", fixture));
        // An unrelated corpus does not reach it either.
        assert!(!gate_mentions_a_path_reaching(
            "reads tests/fixtures/fase116_laws",
            fixture
        ));
        // Deep enough: the corpus directory that actually holds it.
        assert!(gate_mentions_a_path_reaching(
            "reads tests/fixtures/fase33z_parity_corpus/",
            fixture
        ));
        // And the fixture named outright.
        assert!(gate_mentions_a_path_reaching(
            &format!("reads {fixture}"),
            fixture
        ));
        // A fixture outside any `fixtures/` directory must be named exactly.
        assert!(!gate_mentions_a_path_reaching(
            "reads examples/",
            "examples/loan.axon"
        ));
    }

    /// **§122.a — the legacy `Real { proof }` population is pinned, and may only
    /// shrink.** §122.b drives it to zero.
    ///
    /// **Sixty-nine** rows still carry the free-prose citation whose conditional
    /// check let `cache` through: Law 3 only verifies a proof that happens to
    /// name a test file, and Law 4 — written since §119.f.8 — never ran at all.
    /// Every row that migrates to `Attested` is one that has been re-attested
    /// against a fixture, by hand, on purpose.
    ///
    /// The number going UP means a new claim of reality was made in the old,
    /// unverifiable shape.
    #[test]
    fn the_legacy_real_population_only_shrinks() {
        let n = ADVERTISED
            .iter()
            .filter(|(_, s)| matches!(s, Real { .. }))
            .count();
        assert!(
            n <= 0,
            "the legacy `Real {{ proof }}` population grew to {n} — §122.a measured 69 and §122.b \
             drives it to zero (69 → 0). A NEW claim of reality must be \
             `Attested {{ fixture, gate }}`: name the `.axon` a published program could write, \
             and the gate that runs it."
        );
    }

    /// Partial / FailsClosed entries must NAME the gap or the diagnostic. An
    /// unnamed gap is how a documented compromise rots into an undocumented lie.
    #[test]
    fn every_partial_and_failsclosed_names_its_gap() {
        for (name, status) in ADVERTISED {
            match status {
                Partial { gap } => assert!(
                    !gap.trim().is_empty(),
                    "`{name}` is Partial with no stated gap — name it, or it will rot"
                ),
                FailsClosed { diagnostic } => assert!(
                    !diagnostic.trim().is_empty(),
                    "`{name}` FailsClosed with no diagnostic named"
                ),
                _ => {}
            }
        }
    }

    /// The unaudited population is pinned. §111 could not reach everything, and
    /// says so; but the number may only go down. An unchecked box is not a
    /// passing one.
    ///
    /// §114.z RE-BASELINED this pin 18 → 23 — not because auditing went
    /// backwards, but because the DENOMINATOR grew: the census forced a
    /// classification for 22 primitives the badge-only gate never asked about,
    /// and five of them (`ledger` · `publish` · `discover` · `window` ·
    /// `cors`) are honestly Unaudited — their existing gates pin grammar/IR,
    /// not runtime behaviour, and claiming more without looking would be the
    /// exact lie this file exists to prevent. From 23, the only direction is
    /// down.
    #[test]
    fn the_unaudited_population_only_shrinks() {
        let n = ADVERTISED
            .iter()
            .filter(|(_, s)| matches!(s, Unaudited))
            .count();
        // §Fase 122.b — restored to 23 after a blind string replace walked this pin
        // down alongside the legacy-`Real` pin, which happened to hold the same
        // number. The Unaudited population is 20 today (`savant` and `synth` left it
        // for `Unwired` in §122.a); it is NOT re-baselined here, because a pin that
        // moves as a side effect of editing another pin has stopped being a ratchet.
        assert!(
            n <= 23,
            "the Unaudited population grew to {n} — §111 left 18, §114.z's census widening \
             re-baselined at 23. Auditing is the only direction."
        );
    }
}