S05 Cutover II - same-allocation/view + funded-dup family

Goal

The same-allocation identity scans and funded-duplication scans retire into partition classes + ledger events; per-field aggregate decomposition goes live; the hard 2+-owned-field aggregate-move cluster (struct_list_field flagship, carried dead-end 253’s named cure) is green.

Family (verified module list)

move_alias.rs, dup_inc.rs, call_arg_dup.rs, store_dup.rs, construct_fed.rs, nested_construct_return_passthrough.rs, sibling_union/, owner_borrow_view.rs, multi_exit_borrow_view.rs, closure_extract_borrow_view.rs, live_extract.rs + live_extract_site.rs, collection_literal_dead_source.rs, sharing_view_surplus.rs.

Work Items

• Cut the same-allocation/view + funded-dup family: move_alias.rs, dup_inc.rs, call_arg_dup.rs, store_dup.rs, construct_fed.rs, nested_construct_return_passthrough.rs, sibling_union/, owner_borrow_view.rs, multi_exit_borrow_view.rs, closure_extract_borrow_view.rs, live_extract.rs + live_extract_site.rs, collection_literal_dead_source.rs, sharing_view_surplus.rs replaced by partition classes + ledger events (sharing-view via the S02 CREDIT contract field)
• Per-field aggregate decomposition live: BurdenDecPartial skip_fields derived from partition consume marks (moved_fields fixpoint consumers migrate); the 2+-owned-field aggregate-move cluster (struct_list_field flagship) green under the gated probe
• Delete retired scans + toggles same-commit; KEPT cycles; family matrix (aggregates x niche-family sums x slices/substr views x closure captures x match-extract) + pins incl. sole-owner vs shared-across-N store shapes
• Gated probe zero-new (debug AND release); full ./test-all.sh green; cross-executor behavior, exact logical ownership/drop/unwind-event, and leak legs

Governing rules (embedded per plan self-containment)

• Calculus-first per arc.md CP-1: the governing theorem lands in compiled Lean BEFORE the consumer ships; never weaken a theorem to pass a shape; four-surface sync per CP-2 on every AIMS change.
• Verdict surface until S08 lands: the gated burden-sole probe ORI_DISABLE_PREDICATE_STACK_RC=1 ORI_VERIFY_ARC=1 ORI_VERIFY_EACH=1 via compiler_repo/diagnostics/aot-guardrail.sh --floor (debug AND release), zero-new vs compiler_repo/compiler/ori_llvm/tests/aot/fixtures/corpus_under_flag_gate/baseline_failing_ids.txt. The default path is FALSE-GREEN until S08 (per arc.md STOP); never cite it as an RC verdict.
• test-all is the compiler-state SSOT: every section-close verdict comes from a full ./test-all.sh run (background, flock-serialized; consume test-all-summary.json), never targeted runs alone.
• Banned cures (each a carried dead-end): use-count/type-membership PROXY discriminators (DE-150/174/175); broadening compute_genuine_same_alloc_reps / ForwarderUnionFind phi edges (DE-181); relocating a release past a multi-pred merge (DE-225/243/249/250); inc-only pair splits (attempt-287 290-UAF class); broad caller-side keep-alive incs (DE-254).
• Every retired scan/toggle records a KEPT ledger cycle with before/after teeth (collapse metric + floor).
• Cross-executor parity over evaluator, VM, LLVM debug/release/AOT, and admitted native/direct-WASM/JIT projections, plus exact logical ownership/drop/unwind-event correspondence and leak freedom, are per-section backend legs (L9 + L10). The AOT burden probe remains a current LLVM-projection migration gate, not the definition of AIMS correctness.

Test strategy

• Matrix: aggregates (1/2/3 owned heap fields) x niche-family sums x seamless-slice views x closure captures x match-extract x store-into-1/2 containers (sole-owner vs shared-across-N derived, not certified).
• Pins: struct_list_field exactly-one-release-per-field; slice co-owner no-surplus-inc + escaping-slice inc; DE-244/DE-250 negative pins (no whole-var admit change; per-field decs local).
• Before cutting any file, grep every real consumer of compute_funded_store_dup_aliases and compute_funded_call_arg_dup_aliases beyond the two Phase-5 dispatchers (scan_helpers::compute_owned_rc_filter, scan_orchestration::emit_burden_ops) — confirmed against source, not graph (the extractor under-resolves pub(crate)/crate:: re-export paths in this crate): compute_funded_call_arg_dup_aliases is REAL-called from BOTH scan_helpers.rs:205 AND scan_orchestration.rs:349, a joint Phase-A+Phase-B per-function cutover risk identical in shape to S04’s borrowed.rs/forwarder.rs treatment; compute_funded_store_dup_aliases is called from branch_release.rs:156 (S04’s OWN retiring file — verify against S04’s actual landed diff whether that import still exists before assuming a clean slate), construct_fed.rs:207 (S05-internal), aims/realize/burden_elim.rs:283 (Phase 6 elimination, direct crate::lower::burden_lower:: call), and aims/realize/emit_unified.rs:9296 (Phase 6/7). Retire compute_funded_store_dup_aliases and compute_funded_call_arg_dup_aliases as joint multi-site cutovers verified against ALL confirmed call sites, not per-dispatcher deletions — a worker touching only one dispatcher’s call list leaves the other half silently orphaned. Then cut the remaining family (move_alias.rs, dup_inc.rs, construct_fed.rs, nested_construct_return_passthrough.rs, sibling_union/, owner_borrow_view.rs, multi_exit_borrow_view.rs, closure_extract_borrow_view.rs, live_extract.rs + live_extract_site.rs, collection_literal_dead_source.rs, sharing_view_surplus.rs) over to partition classes + ledger events (sharing-view via the S02 CREDIT contract field).

Items

• struct_list_field is NOT a floor cell today — confirmed absent from baseline_failing_ids.txt; it already passes via the OLD whole-var mechanism (burden_inc_kept_by_whole_var_disposition, RC-remark-confirmed: 70 locality-blocked + 32 cardinality-blocked of the 102-survivor population). ‘Green under the gated probe’ is therefore NOT sufficient success evidence — it is already true today and cannot distinguish a genuinely-exercised NEW per-field mechanism from the OLD mechanism silently still carrying the case. The actual evidence bar: (1) S03’s w-37cfb516 differential emitter-vs-scan harness proving the NEW per-field ledger mechanism produces equivalent-or-correct output vs the OLD mechanism on struct_list_field’s corpus — gated on S03’s own undischarged kill-criterion (the transfer_anchor_net / BUG-04-237 cyclic-CFG non-convergence regression pin) actually landing first; (2) a positive pin proving struct_list_field’s exactly-one-release-per-field fires via the NEW BurdenDecPartial skip_fields derived from partition-consume marks, not via the OLD moved_fields whole-var admission silently still firing underneath (the DE-244/DE-250 negative pins — no whole-var admit change; per-field decs local — are this mechanism); (3) a no-regression pin keeping struct_list_field out of the floor for the whole cutover. Per-field aggregate decomposition (BurdenDecPartial skip_fields derived from partition consume marks; moved_fields fixpoint consumers migrate) counts as live only once all three hold.

• Author and green the family matrix (aggregates x niche-family sums x slices/substr views x closure captures x match-extract) + pins incl. sole-owner vs shared-across-N store shapes FIRST — including negative regression pins for the four historical bug shapes whose sole fix-site was compute_funded_store_dup_aliases (BUG-04-139 list-literal double-owned-field leak, BUG-04-173 direct two-store SIGSEGV + alias-store leak, BUG-04-176 branch-exclusive terminal-move leak, BUG-04-179 both-arms-store switch-match leak: four closed bugs, one function, each a special case added to the same ratchet the mission exists to replace), since store_dup.rs’s entire mechanism is being replaced and these are its own documented four-time-repeated failure history. Verify per-function test coverage by direct grep against lower/burden_lower/tests.rs and ownership_scans/tests.rs BEFORE assuming any of the ~90 family symbols is covered — the graph’s caller-resolution signal for this family is confirmedly unreliable across pub(crate)/crate:: re-export boundaries (3 of 3 spot-checked functions were false-negative). Only THEN delete each retired scan module + its ORI_DISABLE_* toggle in the same commit as recording its KEPT ledger cycle (collapse metric + floor teeth) — deleting before the matrix and pins are green removes the bisection fallback a cutover this size needs, the same sequencing defect S04’s own review corrected.

• Close BUG-04-186’s S05-half (high, open, no scaffolded plan dir: ‘Aliveness-aware Phase-7 elision verdict flips 3 passing cells - needs the dup-funded/branch-exclusive event model before it can land’). Repro: the reverted BUG-04-182 cure (b) — aliveness-aware compute_elidable_fresh_self_alloc_incs via the Phase-6.99 walk — full-corpus A/B flipped cow_set_union_shared, set_int_operations_canonical, and probe_collect_set_result_multibranch_dead_freed; the verdict is provably righter per RL3_elision_net_preserving (position-blind elision strips load-bearing incs) but the walk must model dup-funded release events before it can land without flipping those cells. S04’s own already-landed fold-in work item (w-98394977) verifies S04’s branch-exclusive-event half of this repro and explicitly records this section’s dup-funded half as a residual cross-section dependency rather than closing prematurely — this item is that complementary S05-half, NOT a re-fold of BUG-04-180/-183/-241 (S04’s own scope, already dispositioned there; do not duplicate S04’s item). Once store_dup.rs/call_arg_dup.rs/dup_inc.rs are cut over to dup-funded ledger events (w-766222ca), re-run the full-corpus A/B against the three previously-flipped cells under the gated burden-sole probe with the aliveness-aware verdict now modeling dup-funded release events, and confirm the zero-flip obligation holds; treat the repro as a kill-criterion pin folded into the family matrix (w-79c0afb6). Close BUG-04-186 via the bug_tracker atomic flip API citing this section once green; if the branch-exclusive half S04 already verified plus this dup-funded half still cannot jointly discharge the zero-flip obligation, record the residual explicitly with an updated bug note rather than leaving it silently open through the cutover.

• Before cutting any file, re-run the full consumer census for compute_funded_store_dup_aliases and compute_funded_call_arg_dup_aliases by direct source grep (grep -rn ‘compute_funded_store_dup_aliases|compute_funded_call_arg_dup_aliases’ compiler_repo/compiler/ori_arc/src/ —include=’.rs’), NEVER the graph (extractor confirmed under-resolves pub(crate)/crate:: re-export paths in this crate: call-arg fan-in reads 2 in the graph vs 5 in source). Verified census at 2026-07-07 HEAD: compute_funded_call_arg_dup_aliases <- scan_helpers.rs:205 (Phase-A dispatcher) + scan_orchestration.rs:349 (Phase-B dispatcher) + construct_fed.rs:208 (S05-internal) + burden_elim.rs:280 (Phase 6 elimination) + emit_unified.rs:9113 (Phase 6/7 realize); compute_funded_store_dup_aliases <- branch_release.rs:156 (S04 family file, ALIVE — S04 retired zero scan files) + construct_fed.rs:207 + burden_elim.rs:291 + emit_unified.rs:9320. The two computations are cross-phase SHARED PREDICATES, not Phase-5 scans. Design the cutover accordingly and record the decision in the section body: EITHER (a) derive ‘funded’ once in Stage-B (partition classes + CREDIT/Consume events) and migrate ALL Phase-6/7 consumers onto the ledger-derived facts, OR (b) retire only the SCAN role and record the predicates as legacy-fallback-only until S08 sweeps the legacy realize tail — naming which source is canonical at each stage (two live ‘is this consume funded’ authorities is LEAK:algorithmic-duplication). Kill-criterion: the compute_funded_ functions may be DELETED only when class-ledger-diff.sh shows zero fallback functions whose shapes exercise them AND all confirmed call sites are removed in the same commit; a per-dispatcher deletion silently orphans the Phase-6/7 half. The family cut itself is w-766222ca’s deliverable.

• Retire each cut scan with an explicit, census-gated disposition — never a silent reinterpretation. Per scan module: (1) deletion is permitted ONLY when diagnostics/class-ledger-diff.sh shows zero fallback functions whose shapes exercise that scan AND w-5da6d021’s family matrix + pins are green under the NEW mechanism (S04’s corrected sequencing — deleting earlier removes the bisection fallback); (2) when deletion lands, delete the scan module + its ORI_DISABLE_* toggle in the SAME commit as recording its KEPT ledger cycle with before/after teeth (collapse metric + floor), sweeping every toggle doc home (oric/src/debug_flags.rs registration + arc.md Debugging entry; check-flag-docs.sh is the consistency gate) and coordinating with S10 (toggle-consolidation, in-progress in parallel) before touching debug_flags.rs/arc.md; (3) a scan whose fallback census cannot reach zero within S05 records an explicit deferral to S08’s compiled-counter adapter cutover in the section body/HISTORY — replacement coverage + KEPT teeth are then S05’s deliverable for that scan, with file deletion recorded as S08’s. The deletion-vs-coverage decision per scan is recorded, not implied.

• Adjudicate BUG-04-255 and BUG-04-256 as S05 kill-criterion pins BEFORE the family cut completes — both re-verified open/critical this session and both fail the CLASS-LEDGER path (not just the legacy path) in S05-family shapes: BUG-04-255 (owned aggregate param branch-stored into a collection literal leaks its payload on ALL paths) is construct_fed/branch-store payload-funding territory; BUG-04-256 (struct-with-heap-field through a NESTED identity-forwarder chain double-frees on ALL paths; single hop green) is forwarder-identity/nested_construct_return_passthrough credit-chain territory. S04’s close anchored both to S09/S08 as ‘legacy-predicate-stack defects’, but the ALL-paths-incl-class-ledger repro contradicts that framing for their class-ledger half: cutting more shape families onto an emitter that mis-accounts these two shapes propagates the miss. Author their minimal repros as adversarial rows of the w-5da6d021 family matrix proving Stage-B’s funded-dup CONSUME and forwarder CREDIT-passthrough event families classify them correctly (green under the gated burden-sole probe with ORI_CLASS_LEDGER_EMITTER=1), OR record an explicit routing decision (which section owns each half, with rationale) in the section body + updated bug notes per routing.md — never a silent ride-along through the cutover.

• Implement per-field aggregate decomposition in the class-ledger planner — the mechanism w-82951b54’s abandonment re-homed here and no other live item builds. Verified gap: PlannedOpKind in class_ledger/emit.rs:35 is exactly {Inc, Dec} (whole-var only). CP-1 calculus-first: BEFORE any Rust, name the governing compiled-Lean theorem for per-field decomposition consuming partition consume-marks (T1-T5 + PV-comp are landed; if no existing theorem covers the skip_fields derivation shape, prove the extension in scratch Lean first, land it, then implement; four-surface sync per CP-2). Then: add the per-field planned op (or a skip-set parameter on Dec) deriving BurdenDecPartial skip_fields from the S02 partition’s consume marks — the compile-time analog of Rust drop-elaboration’s Static/Dead per-field classification; scope per the Swift/Rust convergence: named struct/enum fields only (dynamically-indexed collection elements stay on the sharing-view CREDIT avenue), the user-drop-glue gate keeps declining (custom-Drop exclusion), niche-family sum variants gated by discriminant; migrate the moved_fields fixpoint consumers (IA-MF1’s release-active-assert discipline carries to any new fixpoint) and sibling_union/ per-field widening onto the partition-derived marks. Per-field accounting is an ADDITIVE side-table consumption — NEVER a widening of whole-var admission (DE-181 dead-end; compute_genuine_same_alloc_reps / ForwarderUnionFind are constrained symbols). Done only when w-b5b9372b’s three-part evidence bar holds.

Fresh intel (regenerated)

The terrain FLIPPED between this section’s authoring and now. The prior recon (2026-07-02) was written against a not-started plan; today S01-S04 are complete, and the class-ledger emitter is not a target — it is a LIVE, per-function-gated Phase-5 replacement (pipeline/aims_pipeline/mod.rs:269 -> apply_class_ledger_replacement; on replaced=true the legacy emit_burden_ops is SKIPPED, line 280) whose latest checked-in differential report says: 62 programs, 0 divergent, 187 functions REPLACED, 89 fallback — and the fallback ranking names S05’s work by name: zero-classes (67) > field-view-liveness (17) > readiness-not-clean (4) > trmc-context (1). The field-view-liveness gate (replace.rs:157, computed by field_view_hazard_classes at class_ledger/mod.rs:200) is EXACTLY this section’s same-allocation/view problem: a locally-released container class whose field-path VIEW classes are eventful in a different class — and a cure pass ALREADY EXISTS (cure_view_with_extraction_funding, mod.rs:246: RL-1 dup inc after each member-defining Project, re-planned + re-verified under owned semantics) but fails to verify Clean on 17 corpus functions. S05’s Stage-A/B/C work begins INSIDE that cure’s decline set, not on a blank slate.

Five decisive facts, each verified fresh this session:

1. S04 set the cutover precedent: ZERO scan files were deleted. All 8 S04-family files (borrowed.rs, forwarder.rs, branch_release.rs, …) still exist and are still dispatcher-wired (scan_orchestration.rs:666,719,771 re-verified). S04 closed on replacement COVERAGE (187 replaced, floor-parity, valgrind matrix) with the legacy scans retained as the fallback path. [JOIN] S05’s w-79c0afb6 (“Delete retired scans + toggles same-commit”) therefore needs an explicit re-scoping decision: a scan cannot be deleted while ANY fallback function still routes through it — deletion is gated on the fallback census for the scan’s shapes reaching zero (or explicitly deferred to S08’s compiled-counter adapter cutover), and the S04 precedent suggests the plan’s real per-section deliverable is replacement coverage + KEPT teeth, with file deletion landing later (§1, §2.2, §4.1).
2. The funded-dup fan-in GREW since the section body’s own w-27894d74 grep was recorded. compute_funded_call_arg_dup_aliases now has FIVE real call sites (scan_helpers.rs:205, scan_orchestration.rs:349, construct_fed.rs:208, burden_elim.rs:280 NEW, emit_unified.rs:9113 NEW); compute_funded_store_dup_aliases has FIVE (branch_release.rs:156 — S04’s file, alive; construct_fed.rs:207, burden_elim.rs:291, emit_unified.rs:9320, + mod.rs re-exports). Phase 6 AND Phase 7 now consume BOTH funded sets. Cutting the scans requires migrating those Phase-6/7 consumers onto partition/ledger facts (or keeping the compute fns alive as shared predicates past the scan retirement) — a per-dispatcher deletion orphans four downstream consumers (§2.2, §3.1).
3. Two NEW critical bugs sit in S05’s exact shape territory and fail the class-ledger path too. BUG-04-255 (owned aggregate param branch-stored into a collection literal leaks its payload on ALL paths incl. ORI_CLASS_LEDGER_EMITTER=1 — construct-fed / branch-store payload accounting) and BUG-04-256 (struct-with-heap-field through a NESTED identity-forwarder chain double-frees on ALL paths; single hop green — forwarder-identity / nested-construct territory). Both were discovered by S04’s own move_borrow_matrix valgrind harness. S04’s close routed their fold-in anchors to S09/S08 as “legacy-predicate-stack defects” — but both FAIL THE CLASS-LEDGER PATH, in S05-family shapes (construct_fed.rs, nested_construct_return_passthrough.rs, move_alias.rs forwarder-identity). [JOIN] Cutting more shape families over to an emitter that itself mis-accounts these two shapes propagates the miss; S05 must adjudicate them as its own kill-criterion pins or record an explicit deferral rationale (§4.2).
4. The class-ledger planner has NO per-field op. PlannedOpKind is exactly {Inc, Dec} (emit.rs:35) — whole-var only. w-82951b54’s “BurdenDecPartial skip_fields derived from partition consume marks” is genuinely NEW planner machinery, and the legacy moved_fields/ fixpoint (IA-MF1, release-active assert) + sibling_union/ per-field widening are the consumers that must migrate. Per CP-1, a new planner op kind needs its governing compiled-Lean anchor named BEFORE the Rust (T1-T5 + PV-comp are landed; the per-field DECOMPOSITION consumption of partition consume-marks must cite which theorem covers it or extend via scratch-Lean-first) (§1, §3H).
5. The evidence bar the body already encodes still stands, with one gate DISCHARGED. struct_list_field is still NOT a floor cell (live gated floor = 14 failing ids at b61c7ea61, per compiler_repo/build/aot-floor-gated.json; the 42-line baseline file carries stale prune-candidates), and the 102-survivor burden_inc_kept_by_whole_var_disposition population (70 locality-blocked + 32 cardinality-blocked) is unchanged per rc-cause-rank — so “green under the gated probe” remains a NON-signal for this cell, exactly as w-b5b9372b records. The prior dossier’s decision-5 blocker is CLEARED: BUG-04-237 (transfer-anchor entry-net non-convergence) is resolved — the differential harness’s verify core no longer carries that undischarged kill-criterion (§6, §9).

Decisions this package forces before any Rust is written:

1. Pull the CURRENT fallback census per shape (diagnostics/class-ledger-diff.sh; ORI_LOG=ori_arc::aims::class_ledger=debug for per-function mode/fallback_reason) and treat the 17 field-view-liveness + relevant zero-classes functions as the cutover worklist — the leverage is in events.rs/emit.rs/verify.rs/cure_view_with_extraction_funding completeness, NOT in touching the 13 old scans first (§3D).
2. Decide the deletion question explicitly against the S04 precedent: replacement-coverage-then-delete-later vs delete-in-section. Record the decision in the section body/HISTORY; do not let w-79c0afb6 be silently reinterpreted (§0 fact 1).
3. Adjudicate BUG-04-255/256 routing NOW (S05 pins vs S09/S08 anchors) — both fail the class-ledger path in S05-family shapes; the “legacy-only defect” framing S04’s close used does not hold for these two (§4.2).
4. Resolve the BUG-04-186 landing-surface tension: the bug note says “stays open pending S05+S07 (landing surface S07)”, S05’s own w-92fa46c5 says close it citing this section once green. Re-run the 3-cell zero-flip A/B after the dup-funded events land and record which section closes it (§4.2).
5. Design the per-field planner op (w-82951b54) as an ADDITIVE side-table consumption per the Swift/Rust convergence (§7): named struct/enum fields only, never dynamic-index paths; whole-var default untouched; the Rust drop-elaboration Static/Dead/Conditional/Open categorization is the closest shipped analog of skip_fields derivation (§7.2).

DIG DEEPER

python -m scripts.plan_corpus.read plans/aims-provenance-ledger --completion
python3 -c "import json; d=json.load(open('compiler_repo/build/class-ledger-diff.json')); print(json.dumps(d['summary'],indent=1))"
python3 -c "import json; print(json.load(open('compiler_repo/build/aot-floor-gated.json'))['failing_ids'])"
grep -rn 'compute_funded_store_dup_aliases\|compute_funded_call_arg_dup_aliases' compiler_repo/compiler/ori_arc/src/ --include='*.rs' | grep -v tests

(full dossier: cutover-same-alloc-views—s-48dfbd12.intel.md)

Funded-predicate census + cutover authority decision (w-e313740b, 2026-07-07)

• Census re-verified by direct source grep at compiler HEAD 61738a851 (graph under-resolves this crate’s re-export paths; source grep is the census instrument):
  • compute_funded_call_arg_dup_aliases <- scan_helpers.rs:205 (Phase-A dispatcher), scan_orchestration.rs:349 (Phase-B dispatcher), construct_fed.rs:208 (S05-internal), burden_elim.rs:280 (Phase-6 elimination), emit_unified.rs:9113 (Phase-6/7 realize). 5 live call sites.
  • compute_funded_store_dup_aliases <- branch_release.rs:156 (S04 family file, alive), construct_fed.rs:207, burden_elim.rs:291, emit_unified.rs:9320. 4 live call sites.
• DECISION: option (b) — retire the SCAN role only; the predicates stay legacy-fallback-only until S08 sweeps the legacy realize tail. Canonical funded-authority per stage:
  • REPLACED functions (ORI_CLASS_LEDGER_EMITTER=1, readiness gate green): Stage-B ledger facts are the SOLE authority — partition classes + Credit/Consume events + seed-funded demand surfaces (demand_blocks_excluding_seeded / plan_incs funded pricing). The replacement skips legacy emission AND Phase-6 elimination/repairs wholesale (ArcFunction::class_ledger_emission), so no function ever mixes the two authorities.
  • FALLBACK functions: compute_funded_* remain the sole cross-phase authority (Phase-5 scans, Phase-6 burden_elim, Phase-6/7 emit_unified) — the per-function replacement gate IS the dispatcher between the two authorities; within any one function exactly one authority is live (no LEAK:algorithmic-duplication — the duplication is partitioned, never co-consulted).
• Kill-criterion (unchanged): DELETE compute_funded_* only when class-ledger-diff.sh shows zero fallback functions whose shapes exercise them AND all 9 confirmed call sites are removed in the same commit; per-dispatcher deletion silently orphans the Phase-6/7 half.

Per-scan retirement dispositions (w-9d2bed53, 2026-07-07)

Census instrument: diagnostics/class-ledger-diff.sh at compiler HEAD 61738a851 — 208 fallback functions remain (zero-classes 171, trmc-context 23, field-view-liveness 11, field-decomposition-shape 2, readiness-not-clean 1), so NO cut scan’s fallback census can reach zero within S05 (a zero-classes fallback runs the whole legacy walk, exercising every scan). Every cut scan therefore takes disposition (3) — explicit deferral, never silent:

• compute_funded_store_dup_aliases / compute_funded_call_arg_dup_aliases are cross-phase shared predicates, NOT scans — their authority partition is the w-e313740b decision (b) record above; same S08 deletion gate.
• No ORI_DISABLE_* toggle is deleted in S05 (disposition (2) fires only at deletion); S10 toggle-consolidation coordinates any debug_flags.rs/arc.md sweep at that point.
• KEPT coverage teeth (ledger cycle appended this date): replaced functions 532 -> 598 and field-view fallbacks 77 -> 11 across the S05 increments, differential sweep 0 divergent over 226 programs, gated AOT floor 14 ids byte-identical to the S04 close.