Reflections.lean

import Tests.Reflections.ProducerGuardedTrap
import Tests.Reflections.VerifyDeferredTaskLandedThenFold
import Tests.Reflections.CycleBreaksAtBase
import Tests.Reflections.ConverseForwardAsymmetry
import Tests.Reflections.ReductionByImport
import Tests.Reflections.ParametricAssemblerExtraction
import Tests.Reflections.ConvergentReduction
import Tests.Reflections.RecursiveDeliverableProjectToFlat
import Tests.Reflections.ConsumerJointBeforeProducer
import Tests.Reflections.AdditiveParallelType
import Tests.Reflections.UniversalPackagingJoint
import Tests.Reflections.ProjectionFamilyCompletion
import Tests.Reflections.ProducerDualOfConsumer
import Tests.Reflections.EmitProducerStrengthening
import Tests.Reflections.StoredVsProjectedRecursionEdge
import Tests.Reflections.FreeProjectionInvariant
import Tests.Reflections.BoundaryBoundRecovery
import Tests.Reflections.FoldConsumerChain
import Tests.Reflections.UniversalProducerRootSeed
import Tests.Reflections.DescendStepConsumerJoint
import Tests.Reflections.StructuralMovesAdvance
import Tests.Reflections.EntryBoundaryLocator
import Tests.Reflections.WidthRecursionCombinator
import Tests.Reflections.GuardThreadingSkeleton
import Tests.Reflections.GuardEdgeFloorAsymmetry
import Tests.Reflections.AdditiveParallelGuard
import Tests.Reflections.DescendStrengthInvariant
import Tests.Reflections.LiftOnceMirrorEasyEdge
import Tests.Reflections.ProducerGuardedOracleReconstruct
import Tests.Reflections.NearLeafMirrorShedsMachinery
import Tests.Reflections.ThreadedGuardPrunesCaseTree
import Tests.Reflections.IncompleteProjectionStillFactors
import Tests.Reflections.NonRestrictionResidualNeedsRootSeed
import Tests.Reflections.MinimalPairExtractsTheGate
import Tests.Reflections.WindowAbsoluteGateSubsetRestriction
import Tests.Reflections.BoundaryResidualEndDual
import Tests.Reflections.PrefixGateReconstructedFromBoundary
import Tests.Reflections.GuardedUniversalFoldRelocatesGuard
import Tests.Reflections.RootSeedRecursiveProducerSwap
import Tests.Reflections.ProbeDeferredProviderHeadBlindGate
import Tests.Reflections.RebaseFactFromEnclosingWindow
import Tests.Reflections.ProbeProviderSatisfiableBeforeAssembler
import Tests.Reflections.CoerceToWeakerReuseWrapper
import Tests.Reflections.RootSeedDiscriminatorNotFromGate
import Tests.Reflections.FromLocatedAssemblerDirection
import Tests.Reflections.BackwardLocatorMirrorsForward
import Tests.Reflections.MetricBridgeIsComposition
import Tests.Reflections.DownstreamDeriskRestoresUpstream
import Tests.Reflections.TypeBlindInvariantTransportsViaConverseFrame
import Tests.Reflections.FloorBlindGateAdmitsCrossSibling
import Tests.Reflections.TwoFloorRelayCloseBound
import Tests.Reflections.ImportForcedParametricGuard
import Tests.Reflections.VacuousPositiveCannotExclude
import Tests.Reflections.NarrowFromRootBreaksRederivationCycle
import Tests.Reflections.PushBlindFramePreserveDependent
import Tests.Reflections.ComplementGuardNotSufficient
import Tests.Reflections.AdvanceArmBalanceFree
import Tests.Reflections.SeveredEdgeBoundsNavigator
import Tests.Reflections.AggregateCollapsesStructuredSeparates
import Tests.Reflections.DomainRestrictionPreservationNegation
import Tests.Reflections.ProducerStopsAtSeveredEdge
import Tests.Reflections.ProbeRefutesComplementProvider
import Tests.Reflections.EndFreeGateUnderdeterminesClose
import Tests.Reflections.ContextFreeAdapterKnot
import Tests.Reflections.FieldAuditLocalizesKnot
import Tests.Reflections.SeparatorBlindTypedInvariant
import Tests.Reflections.CarrierProvenanceNotType
import Tests.Reflections.ParentRelativeGConjunct
import Tests.Reflections.ProjectionUpStrengthOrder
import Tests.Reflections.DescopeIsRouteRelative
import Tests.Reflections.NavigatorDispatchArithmetic
import Tests.Reflections.LeafProductionIsPrefixSlice
import Tests.Reflections.ReadAheadConsumerProofState
import Tests.Reflections.WrapperCarriesInvariant
import Tests.Reflections.VestigialProjectionReopens
import Tests.Reflections.NavigatorArmsKeyedToPositions
import Tests.Reflections.CarriedInvariantAdvanceEdge
import Tests.Reflections.ResidualAlreadyProvenInSibling
import Tests.Reflections.ComposeArmSeamBeforeSkeleton
import Tests.Reflections.RefuteArmMirrorsPinningSibling
import Tests.Reflections.TypeBlindBridgeFalse
import Tests.Reflections.DeferredTypedFactInGuard
import Tests.Reflections.DemotedDispatchMetricFromStructure
import Tests.Reflections.AdjacentOriginReconstructs
import Tests.Reflections.GuardStructureArmByArm
import Tests.Reflections.StrictContainmentNeedsOpener
import Tests.Reflections.AdditiveFieldCostByKeying
import Tests.Reflections.SlicePositionalBridgeGetElemQ
import Tests.Reflections.HeadBlindCoreServesBothArms
import Tests.Reflections.TargetAnchoredTwinRefutesWalkBreak
import Tests.Reflections.DeltaGenericBoundaryFamily
import Tests.Reflections.RebracketReusesPrefixBridge
import Tests.Reflections.MetricMinimumCollapsesDispatch
import Tests.Reflections.SaturationCleavesTerminalBranch
import Tests.Reflections.DispatchRoleFactorsTypeMetric
import Tests.Reflections.CarveLeavesToEliminatorOutput
import Tests.Reflections.RootSeedDerivesShapeDefersValue
import Tests.Reflections.DeferredStructuralAlreadyProvenBySibling
import Tests.Reflections.ConjunctiveConsumerGatesOnOrthogonalAxis
import Tests.Reflections.LocateConsumerByGateStrength
import Tests.Reflections.WholeDomainSiblingViaWeakerGuard
import Tests.Reflections.DepthGateRestrictionDiagnostic
import Tests.Reflections.DeepConjunctRootSeedOnly
import Tests.Reflections.DeriskedMigrationOneClonePerConsumer
import Tests.Reflections.RestrictionHidesRootFalsity
import Tests.Reflections.RescopeByExcludingPremise
import Tests.Reflections.AllDepthOverreachSourceGlobally
import Tests.Reflections.RedirectedProviderContractFirst
import Tests.Reflections.ProduceJointBracketsGlobalContract
import Tests.Reflections.OrthogonalInvariantAlgebraBeforeThreading
import Tests.Reflections.GatedFieldSiblingWrapperShedsHyp
import Tests.Reflections.SynonymBridgeAndSlackGuard
import Tests.Reflections.BridgeDerivableFromInvariant
import Tests.Reflections.PrestageConsumerBoundaryFacts
import Tests.Reflections.SeveredEdgeBlocksProjection
import Tests.Reflections.PredicateFieldNotProducerOutput
import Tests.Reflections.AbsorbedBinderSplitDepth
import Tests.Reflections.CarryUpSplitsAtImportEdge
import Tests.Reflections.RedirectAuditFullGuard
import Tests.Reflections.RestoredArmAlreadyInClassify
import Tests.Reflections.GatedFieldResourcedViaNarrow
import Tests.Reflections.MirroredGateReprobeWitness
import Tests.Reflections.BoundaryDischargeGateTriggerTyped
import Tests.Reflections.NoncloningCornerEndDualOfCarrier
import Tests.Reflections.AdjacencyMirrorCornerIsLayerScoped
import Tests.Reflections.TriggerCoincidenceRelocatesObligation
import Tests.Reflections.SourceGateCollapseBlocksMirror
import Tests.Reflections.ProgressWitnessCertifiesDelta
import Tests.Reflections.InvariantNeutralSiblingNeedsHead
import Tests.Reflections.GateTokenIsSiblingHead
import Tests.Reflections.FieldOnMultiproducerPredicate
import Tests.Reflections.ParallelFieldExposeRelay
import Tests.Reflections.ContradictionBranchSuppliesBoundary
import Tests.Reflections.OrthogonalFieldMirror
import Tests.Reflections.EdgeAdjacentReadFromGlobal
import Tests.Reflections.FloorEncodesNonemptiness
import Tests.Reflections.ProviderFieldFromSiblingOutput
import Tests.Reflections.BracketGuardsAdmitCrossMatched
import Tests.Reflections.ContravariantGuardStrengthening
import Tests.Reflections.ProbeTheGoal
import Tests.Reflections.SelfPropagatingGuardDescent
import Tests.Reflections.DelegationTreeCollapsesFieldRipple
import Tests.Reflections.GuardFixBreaksItsCounterexample
import Tests.Reflections.GuardConduitThroughProducerChain
import Tests.Reflections.DockImportsConclusionProbesThreadedHyps
import Tests.Reflections.RelocateSorryToStrongerPredicateSite
import Tests.Reflections.StaleResidualFramingCoConstruction
import Tests.Reflections.GeneralizationHidesDescendObstruction
import Tests.Reflections.InterfaceExposureAsymmetricRipple
import Tests.Reflections.RootToWindowBaseAssemblerSwap
import Tests.Reflections.TopFrameGuardVsSpineGate
import Tests.Reflections.CarrierDomainWiderThanNavigatorReach
import Tests.Reflections.SeveranceRecursesByNestingDepth
import Tests.Reflections.AdditiveFieldForcesProducerMutualRecursion
import Tests.Reflections.ConjunctionMotiveBreaksProducerCycle
import Tests.Reflections.ConjunctionMergeCostIsCitationEdges
import Tests.Reflections.TwoRoleDeliverableBlocksSharedField
import Tests.Reflections.ConstructorFieldForcesMutualGroupMerge
import Tests.Reflections.SeveredConstructorBoundaryProjectsInteriorDoesnt
import Tests.Reflections.StrengthenSeveredPredicateMirrorsSibling
import Tests.Reflections.DownstreamProjectionRebuildFromConstituents
import Tests.Reflections.OpaqueWholeMovesProjectionConstituentsRebuild
import Tests.Reflections.TokenIndistinguishableSeveranceThreadsRecursionFromProducer
import Tests.Reflections.SeveranceRecursesThroughPairValue
import Tests.Reflections.DeepFamilyMirrorsFullMutualGroup
import Tests.Reflections.ParallelFamilyShedsOrthogonalField
import Tests.Reflections.DeliverableContractBeforeProducerBody
import Tests.Reflections.MirrorReadsConjunctNotProjection
import Tests.Reflections.ProbeProofFactorsGeneralReduction
import Tests.Reflections.ResidualIsCompositionOfLandedEdges
import Tests.Reflections.BoundaryInclusiveNeedsSiblingNotCoercion
import Tests.Reflections.BoundaryInclusiveSiblingCascade
import Tests.Reflections.EnclosingFrameRekeysWidthRecursion
import Tests.Reflections.DroppedBranchGuardMisMeasuresRecursion
import Tests.Reflections.GuardThreadingIsSignatureOnly
import Tests.Reflections.ContainedFrameIHFromOuterIH
import Tests.Reflections.ContainmentFromFloorConflict
import Tests.Reflections.ReexportErasedDependencyFact
import Tests.Reflections.WeakFamilyMemberProjectsDepthFree
import Tests.Reflections.ScanOwnsTheDepthDebt
import Tests.Reflections.GenericDiscriminantUnderdeterminesOutput
import Tests.Reflections.DepthGeneralMatchingClose
import Tests.Reflections.NestedTypedLocatorIsAFrame
import Tests.Reflections.DepthHypCostIsItsEqualityReads
import Tests.Reflections.SurfacedResidualFreeAtWiring
import Tests.Reflections.CoconstructionHalfFoldsToSiblingInput
import Tests.Reflections.RootSeedNeedsRootTrueGuard
import Tests.Reflections.RethreadStaysInWeakerTwinFamily
import Tests.Reflections.UnifiedResidualRoutesThroughOneInvariant
import Tests.Reflections.RescopeAssembleCostIsGuardReadSites
import Tests.Reflections.TransportingLemmaTwinsZeroBodyEdits
import Tests.Reflections.LiftRekeysByGuardKeyedChildNames
import Tests.Reflections.LiftForwardsDroppedDerivationPremise
import Tests.Reflections.ClimbingPremiseTerminatesAtCaseSplit
import Tests.Reflections.PremiseAbsorbedAboveTerminusCleanLift
import Tests.Reflections.ThinInstanceTwinIsProducerConsumerMeet
import Tests.Reflections.UnifiedResidualForcesSiblingProjection
import Tests.Reflections.CoercionDissolvesForcedProjection
import Tests.Reflections.GuardReadingEdgesNeedTwins
import Tests.Reflections.EdgesUnifyAsDeliverableProjection
import Tests.Reflections.BundleFreeProjectionIntoProducer
import Tests.Reflections.ContentSurfacingLocatorTwin
import Tests.Reflections.ParametricCarrierExtraction
import Tests.Reflections.LocatedContainerRead
import Tests.Reflections.ProducerGateCoversFragment
import Tests.Reflections.CrossFrameStructuralDescent
import Tests.Reflections.PositionalMapPairDescent
import Tests.Reflections.NavigatorDriverFold
import Tests.Reflections.SeqDescendTailWitness
import Tests.Reflections.SeqRootReconciliation
import Tests.Reflections.MapCarrierFoundation
import Tests.Reflections.MapGateBridge
import Tests.Reflections.MapRootProjection
import Tests.Reflections.MirrorInheritsDependencyAxioms
import Tests.Reflections.MapProducersCollapse
import Tests.Reflections.DelegatedNestingShedsGuardFields
import Tests.Reflections.ThreadingFormVsAssembleForm
import Tests.Reflections.BalanceInvisibleSplitGrammarLocated
import Tests.Reflections.SubblockNonemptyFromClassCollision
import Tests.Reflections.DispatchPinsLocatedDepth
import Tests.Reflections.DescendTailDualUseSeparatorSuccessor
import Tests.Reflections.DispatchFirstEntryToWholeWindow
import Tests.Reflections.MirrorNavigatorDriverStitch
import Tests.Reflections.JointNavigatorDriverCrossDeliverable
import Tests.Reflections.JointDescendTailDispatch
import Tests.Reflections.JointContentPackFromCarrier
import Tests.Reflections.JointDescendTailCarrier
import Tests.Reflections.JointGuardDescendTail
import Tests.Reflections.JointNavigatorDriverCarrier
import Tests.Reflections.JointOracleSeqIh
import Tests.Reflections.LocateHoleIsDispatchRepacked
import Tests.Reflections.AxisDualFromTypeAgnosticCore
import Tests.Reflections.BoundaryRobustVsFragileFact
import Tests.Reflections.MapCarrierRobustInhabitation
import Tests.Reflections.OmegaNonArithGoalPullsClassical
import Tests.Reflections.ValueRecoveryOuterShape
import Tests.Reflections.ValueRecoveryNodeDispatch
import Tests.Reflections.ValueRecoveryCompose
import Tests.Reflections.ValueRecoveryParseDocument
import Tests.Reflections.ValueRecoveryPosition
import Tests.Reflections.ValueRecoveryOuterShapeAssembled
import Tests.Reflections.ValueRecoveryContentResidual
import Tests.Reflections.ContentListStepAlgebra
import Tests.Reflections.LoopResultAppend
import Tests.Reflections.PointwiseFoldAssembly
import Tests.Reflections.EmissionIntercalate
import Tests.Reflections.CharListSegmentPeel
import Tests.Reflections.StreamMarkerFraming
import Tests.Reflections.ReparseConsumerJoint
import Tests.Reflections.LocalityReductionJoint
import Tests.Reflections.ParseNodeScalarDispatchLeaf
import Tests.Reflections.LoopElementInvariant
import Tests.Reflections.LoopStructuralStep
import Tests.Reflections.LoopPositionalIndex
import Tests.Reflections.LoopPushSubwit
import Tests.Reflections.LoopPushPointwise
import Tests.Reflections.ScalarTokenPinned
import Tests.Reflections.ScalarComposeValue
import Tests.Reflections.ComposeSeqItemsPointwise
import Tests.Reflections.ScannerSpanLocality
import Tests.Reflections.ScalarLocalityBridge
import Tests.Reflections.ComposeMapPairsPointwise
import Tests.Reflections.FlowMapLoopWitness
import Tests.Reflections.FlowSeqLoopWitness
import Tests.Reflections.FlowSeqLoopValueAt
import Tests.Reflections.FlowMapLoopPairAt
import Tests.Reflections.ScannerMapSpanLocality
import Tests.Reflections.ResolveAliasesEmpty
import Tests.Reflections.MappingAllScalarLocality
import Tests.Reflections.DeepNavigatorFires
import Tests.Reflections.ProviderCloseGate
import Tests.Reflections.R447RootCarrier
import Tests.Reflections.NonAllScalarLocality
import Tests.Reflections.GeneralLocalityBirth
import Tests.Reflections.EmitterTagPercentDecode
import Tests.Reflections.EmptyNodePropsSeqEntry
import Tests.Reflections.EscapedTrailingTab
import Tests.Reflections.OrderAwareAlias
import Tests.Reflections.IllusorySorryFree
import Tests.Reflections.PairListBodyContentAt

/-!
# Reflections — runnable proof-engineering demonstrations

This library collects the self-contained (core Lean, no `L4YAML` import) runnable
illustrations of the proof-engineering principles documented as numbered *Reflections* in
`Blueprint/08-initiative-4-intrinsic-foundations.md`.  They are kept separate from the
behavioural L4YAML test suites (parsing/emitting/round-trip) because they assert *methodology*,
not library behaviour: each is a toy model whose `#guard`/`#guard_msgs`/`#eval`/`by decide`
checks fail the build if the principle's positive/negative witnesses ever drift.

Each module names the Blueprint Reflection it illustrates:
* `ComplementGuardNotSufficient`          — Reflection 333 (the COMPLEMENT of a sufficient dispatch guard need not be a sufficient guard — the toy of `recseqbody_descend`, the DESCEND arm. A spine-walk splits into ADVANCE (`p` past the head entry) and DESCEND (`p` inside it). The ADVANCE guard `bal lo p = 0 ∧ lo < p` is SUFFICIENT for "past the head"; the NAIVE negation `bal lo p ≥ 1` is NOT sufficient for "inside the head" — `p` may be nested in a LATER entry (floor-blind, [[ref-floor-blind-gate-admits-cross-sibling]] on the complement side). The real DESCEND guard is the window-absolute FLOOR `∀ i ∈ (lo,p], bal lo i ≥ 1`. Witness `1 , [ [ 2 ] ]` (interior of `[1,[[2]]]`): a SCALAR head `1` (span `[0,1)`), then a doubly-nested seq. NEGATIVE (`#guard`): `bal 0 3 ≥ 1` holds so the negated guard fires, yet `p = 3 ≥ headEnd = 1` (past the head) and the FLOOR fails — `bal 0 1 = 0` (the head's return-to-`0`); the floor is the discriminator the bare `≥ 1` lacks. NEGATIVE (`#guard`): `delta op = delta mop` — a seq opener and a map opener share delta `+1`, so head-is-`.seq` is provably NOT a balance fact and enters as the dispatch hypothesis `h_lo_open`, not a derivation. POSITIVE (proven `floor_implies_in_head`, the crux of `recseqbody_descend`'s `h_p_lt`): abstractly over any `B`, if the head balances to `0` at its end `m` (`B m = 0`, `lo < m`) and the floor holds over `(lo,p]`, then `p < m` — the floor at `i = m` would force `B m ≥ 1`, contra `= 0`. The guard/complement analogue of [[ref-converse-forward-invariant-asymmetry]]; applies [[ref-window-absolute-gate-subset-restriction]] / [[ref-minimal-pair-extracts-the-gate]])
* `AdvanceArmBalanceFree`                  — Reflection 334 (the GENERAL ADVANCE arm is BALANCE-FREE once the caller supplies the decomposition — the toy of `recseqbody_advance_general`. R332's `recseqbody_advance` guarded advancing past the head with a BALANCE fact `bal lo p = 0` and spent its bulk USING that balance to RECONSTRUCT the structural `p ≥ lo + e.length`. R334 finding: the balance was never intrinsic to advancing — the CALLER already extracts the head entry and dispatches on `p ≥ lo + e.length`, so it already holds that inequality AND the `cons` decomposition `body = head ++ sep :: rest`; pass them DOWN and the balance machinery EVAPORATES, leaving pure slice algebra + one opener-vs-separator inequality. Witness `1 , [ [ 2 ] ]`: SCALAR head `1` (`headEnd = 1`), then a doubly-nested seq. NEGATIVE (`#guard`): `bal 0 3 = 1 ≠ 0` so the balance route cannot advance at the nested `p = 3`, yet `p ≥ headEnd` (the structural route can); the separator/opener tokens differ (`tok headEnd = .comma ≠ .op = tok 3`) so `p ≠ headEnd` is a CONSTRUCTOR inequality, not a balance fact. POSITIVE (proven `advance_rebase`): GIVEN `head ++ sep :: rest`, the re-base `(head ++ sep :: rest).drop (headLen + 1) = rest` is pure `List.drop_append` — no balance, no floor. POSITIVE (proven `sep_ne_opener`): if `body[headLen]? = some sep`, `body[p]? = some opener`, `sep ≠ opener`, then `p ≠ headLen`. The upstream dual of [[ref-reconstruct-in-place-over-relocate]]; resolution pattern for [[ref-complement-guard-not-sufficient]]; an [[ref-additive-parallel-type-over-shared-edit]] sibling)
* `SeveredEdgeBoundsNavigator`           — Reflection 335 (a SEVERED recursion edge bounds a navigator's domain; a PATH-blind gate admits windows past it — the toy of the `SeqMapPathNestedProbe` de-risk that REFUTED `rec_seq_body_nested_project`'s totality. A producer navigating a recursive deliverable can only reach windows whose PATH lies within the type's STORED edges; a member that PROJECTS rather than STORES the sub-deliverable (`RecSeqEntry.map` carries `WellBracketed`, not `RecSeqBody`) SEVERS the navigation. The consumer gate is PATH-BLIND (pins the IMMEDIATE enclosure, not the path), so it admits a map-PATH-nested seq window the navigator can't inhabit — invisible to a probe that only descends the navigable case; probe the PATH. Toy `Body`: `.seq` STORES the inner `Body`, `.map` PROJECTS to a weaker `Flat`. NEGATIVE (`#guard`): `bodyInner? (.map (.wrap .leaf)) = none` (navigator dies at the severed edge) though `flatIsSeqHead (.wrap .leaf) = true` (gate passes); `map_never_navigable`/`seq_always_navigable` show the severed edge is intrinsic to the constructor. POSITIVE (proven `flatProvider`): serve the gate-passing target from the WEAKER `Flat` substrate — the fix is RESTRICT the navigator + a flat provider, NOT strengthen the type. Sharpens [[ref-stored-vs-projected-severs-recursion-edge]] + [[ref-probe-provider-head-blind-gate]]; totality-refuting variant of [[ref-downstream-derisk-restores-upstream]])
* `AggregateCollapsesStructuredSeparates` — Reflection 336 (the dispatch is the un-aggregated STRUCTURED STATE, not a numeric aggregate of it — the toy of `SeqPathDispatchProbe`. After a [[ref-severed-edge-bounds-navigator-domain]] de-risk refutes a navigator's totality, find the DISPATCH partitioning the path-blind gate's windows into navigable vs unreachable by probing a numeric AGGREGATE against the un-aggregated STRUCTURED STATE it was folded from, over a minimal pair. Toy: a typed-frame `Stack`; `depth` is the `Nat` aggregate (the `flowBracketBalance` analogue), `pathAllSeq` reads the whole stack (the `btFold` analogue), `topFrame` is the gate's path-blind projection. NEGATIVE (`#guard` + `aggregate_collapses`): the map-path stack `[true,false,true]` and all-seq `[true,true,true]` have EQUAL `depth` 3 and EQUAL `topFrame` `some true` — the aggregate COLLAPSES the pair (REJECTED; the collapse IS the necessity leg). POSITIVE (`#guard` + `example`): `pathAllSeq` is `false` vs `true` — the buried map frame SEPARATES them; the structured state read WHOLE is the dispatch, the gate's `topFrame` only its head-projection. Applies [[ref-minimal-pair-extracts-the-gate]] to a PATH-dispatch; discharges the reshaped next step of [[ref-severed-edge-bounds-navigator-domain]])
* `DomainRestrictionPreservationNegation` — Reflection 337 (de-risk a navigator's DOMAIN-RESTRICTION with a PRESERVATION/NEGATION pair — the toy of `SeqPathAllSeq`'s descend lemmas. When a severed edge bounds a navigator's domain ([[ref-severed-edge-bounds-navigator-domain]]) and you RESTRICT the domain to fence it out, prove BOTH that the KEPT edge maps the domain into itself AND that the EXCLUDED edge maps it OUT — it is the NEGATION that licenses dropping the excluded recursion arm, not the preservation alone. Toy: a typed-frame `Stack`, `InDomain` = nonempty all-`true` (the `SeqPathAllSeq` analogue), `pushSeq`/`pushMap` the two edges. POSITIVE (proven `preservation`): `pushSeq` keeps an all-`true` stack in domain (the seq head discharges the restriction — `seqPathAllSeq_descend`). NEGATIVE (proven `negation`): `pushMap` BREAKS it (a map head is out-of-domain ⇒ no fifth map-mirror arm — `seqPathAllSeq_map_push_breaks`). `dominance`: the domain implies TOP `true` (`seqEnclosed_of_seqPathAllSeq`). `#guard`s pin the real minimal pair's stacks `[true,false,true]` (out) vs `[true,true,true]` (in). Lifts [[ref-converse-forward-invariant-asymmetry]] / [[ref-push-blind-frame-dependent]] from the TOP to the whole structured state [[ref-aggregate-collapses-structured-separates]])
* `ProducerStopsAtSeveredEdge` — Reflection 338 (a PRODUCER stops at a severed edge as a leaf; a NAVIGATOR dies there — the toy behind `rec_seq_body_nested_project`'s one-line landing. When a severed/projecting edge makes a NAVIGATOR non-total ([[ref-severed-edge-bounds-navigator-domain]]), check whether the deliverable can be PRODUCED instead of navigated before restricting the domain. Toy: a `Carrier` tree whose `box` member stores only a flat `Bool` (no recursive child — the `RecSeqEntry.map` analogue). NEGATIVE (proven `severed_navigation_stuck`): `navigate` DIES at a `box` window — it must descend INTO the member and there is no child (R335). POSITIVE (proven `severed_production_total`): `produce` STOPS AT the box, emits the leaf, recurses no further — TOTAL where navigation dies (`seqWindowRecSeqBody`'s near-leaf map oracle). `kept_edge_agrees`: the two agree on the KEPT seq edge, diverging only at the severed one. `#guard`s pin the divergence: a box-buried window navigates to `none` but produces `.box true`. For a `Prop` deliverable the two are interchangeable (proof-irrelevance) ⇒ prefer production, it sidesteps the edge; the domain restriction survives only as the consumer's routing tag ([[ref-coerce-to-weaker-reuse-wrapper]]), the four navigate-around arms an alternative not a necessity)
* `ProbeRefutesComplementProvider` — Reflection 339 (a probe of a would-be COMPLEMENT provider REFUTES its necessity — the toy behind `seqEnclosed_of_seqTypedInterior`'s one-line landing. When a navigator framing demands a domain PARTITION + a second provider for the excluded windows, PROBE before authoring: is the producer even sensitive to the partitioning predicate, is its real need PATH-INVARIANT, and does the consumer's GATE definitionally contain it. Toy: a `Stack` of typed frames; `Enclosed` = the HEAD is a seq (path-invariant); `StrongPath` = the WHOLE stack all-seq; `Gate` whose `enc` field IS `Enclosed`. BRIDGE (proven `enclosed_of_gate := g.enc`): the gate supplies the producer's need in one line ([[ref-conjunct-of-projection-is-free-field]] at the gate). PROBE (proven `probe_not_strongPath` + `probeGate`): the window `[true, false]` FAILS `StrongPath` (a `false` deeper down) yet the `Gate` HOLDS — so the producer serves the `¬StrongPath` window through the gate, NO complement needed. `#guard`s pin it: `probeStack.all (·==true) = false` but `probeStack.head? = some true`. So `StrongPath` is VESTIGIAL and ONE producer serves the whole gated domain — the size-down dual of [[ref-downstream-derisk-restores-upstream]] (the discriminator was never needed; the gate carried it))
* `EndFreeGateUnderdeterminesClose` — Reflection 340 (an END-FREE gate underdetermines a window's CLOSE — the toy behind the `(i'-b-B2c-provider-from-gate)` probe `SeqGateWindownessProbe`. A provider quantified under a gate whose conjuncts constrain only window-INTERNAL invariants (balance, enclosure mark, Dyck floor — none mentioning the token AT the end `b`) cannot read its structural close off `get s b`. Toy: `Tok := op | cl | it | sep`; `bal`/`windowBal` over a slice; an END-free `Gate` with one balance-`0` conjunct. PROBE (proven `gate_24` + `end_24_not_close`): the `b ≠ close` window `[2,4)` = `it sep` (mirror of `"1" ,`) on `W = op op it sep it cl sep it cl` (mirror of `[[1,2],9]`) PASSES the gate yet `get W 4 = it`, NOT `cl`. BRIDGE (proven `located_close_24`): the close is read off the LOCATED enclosing structure `hiS = 5` (`get W 5 = cl`), the window SELECTED inside by `4 ≤ 5` — never off `b`, mirroring `seqDescent_provider_of_located`. `#guard`s pin it: `windowBal W 2 4 = 0` but `get W 4 ≠ cl`, while `get W 5 = cl`. END-dual of [[ref-probe-provider-head-blind-gate]] (head-blind admits spurious-HEADED windows; end-free admits spurious-ENDED ones); the existing satisfiability probe MASKED it by only using `b = close` windows. SHARPENED by Reflection 356 (`gate_admits_three_ends`/`close_token_separates_three_ends` on `V = op it sep it sep it cl`): a SETTLED next-step pointer (the emission-spine wrapper `nestedSeq_recseqentry_locate`, R355) re-credited balance-0 with pinning `b`; re-running the probe shows the gate admits not one but ARBITRARILY MANY non-close ends (a seq of `n` elements has `n-1` separator ends, all balance-0 + floored), so `b` is pinned by the consumer's explicit close hypothesis `tokens[hi]!.val = .flowSequenceEnd` — `seqWindowRecSeqBody`'s fourth `G`-conjunct — not by the interior gate; re-probe a boundary-pinning attribution even when a settled pointer states it)
* `ContextFreeAdapterKnot`                 — Reflection 343 (a CONTEXT-FREE IH adapter cannot thread a CONTEXT-DEPENDENT carrier fact — the toy behind the `(i'-b-B2c-desc-fixpoint-assembly)` probe. To break the carrier↔recursion circularity, the carrier-free `seqWindowRecSeqBody` would thread `FlowBodyContent` as a recursion `G`-conjunct instead of looking it up from the ambient carrier. The probe asked: clean ordering or co-recursive knot? KNOT, two ways. Toy: opaque `Rec`/`Content : Nat → Prop` (toy `RecSeqBody`/`FlowBodyContent` keyed on window width); `content_of_rec : ∀ w, Rec w → Content w` (the SAME-window edge, toy of `SafeBodyUnit`-of-`RecSeqBody` — R296); `dispatch : ∀ w, Content w → (∀ w' < w, Rec w') → Rec w` (the dispatch needs the CURRENT window's `Content` + a CONTEXT-FREE `Rec`-IH, toy `recseqentry_window_dispatch`). POSITIVE (`rec_via_carrier`): the GLOBAL carrier `∀ w, Content w` closes the producer — it answers `Content` at every window WITHOUT recursion. NEGATIVE (`rec_guarded_needs_carrier` + `content_same_window`): threading `Content` through the guard buys NOTHING — the context-free IH adapter `fun w' hw' => ih w' hw' ?` must inject `Content w'` for ARBITRARY smaller `w'`, and the only carrier-free source `content_of_rec` needs `Rec w'` (the output), so the step must take the whole carrier as an undischarged hypothesis (`Content w ⟵ Rec w ⟵ dispatch ⟵ Content w`, a SAME-window cycle width recursion cannot break; `P := Rec ∧ Content` does not untie it). RESOLUTION (`rec_resolved` + `content_resolved`): the knot cuts only by a `Content`-FREE dispatch (reconstruct its three head/first-entry facts carrier-free, [[ref-prefix-gate-reconstructed-from-boundary]]); then `Rec` closes with NO carrier and `Content` is a downstream COROLLARY. `#guard`s smoke-test the resolved + carrier routes on the trivial model. Why [[ref-cycle-breaks-at-base]]'s base-swap does NOT apply here (the cycle is per-window, not just at the root); the carrier was the external oracle [[ref-narrow-from-root-breaks-rederivation-cycle]] relied on)
* `FieldAuditLocalizesKnot`               — Reflection 344 (a multi-field guard INPUT localizes its dependency knot to ONE load-bearing field — the AUDIT behind the `(i'-b-B2c-dispatch-defront)` de-front, the move after R343's knot. The pivot removes `FlowBodyContent` from `recseqentry_window_dispatch`'s input, but the input is a THREE-field guard; the naïve fear is the WHOLE guard creates the cycle. The audit shows otherwise: `headContentStart` is a FREE projection (definitionally the SAME proposition as `FlowBodyContentDeep.headContentStart`, which the recursion already carries); `feContentStart` is DEAD (consumed by NEITHER the dispatch nor either bracket oracle — it serves the advance-tail plumbing, a sibling consumer); `bodySucc` is the GENUINE residual (R296: no all-depth balance-free form, NOT a field of `FlowBodyContentDeep`). So the knot localizes to the SINGLE field `bodySucc` at the SINGLE position the first-entry END. Toy: `Deep`/`Guard` structures with shared `head` target; `dispatch_via_guard` (carrier route, touches only `head`+`succ`). POSITIVE (`dispatch_defront` + `dispatch_via_deep_and_succ`): the consumer is inhabitable from the carried `Deep` (free `head`) + the lone residual `succ`, with NO `feStart` field in its signature; the full-`Guard` route factors through it. NEGATIVE (`deep_holds_without_succ` + `defront_needs_succ`): `succ` is irreducible — `Deep True True` holds while `Succ := False`, so no `Deep → succ` exists; the de-front must take `h_succ` standing. The free + dead fields MASKED which one field is load-bearing; auditing field-by-field shrinks the producer's debt to its minimum. Sharpens [[ref-incomplete-projection-still-factors]] (per-field granularity) + [[ref-conjunct-of-projection-is-free-field]] (the free-field mechanism); localizes [[ref-context-free-adapter-knot]])
* `SeparatorBlindTypedInvariant`         — Reflection 345 (a bracket-typed invariant is SEPARATOR-BLIND, so a separator-placement fact is provably not a projection of it — the PROBE behind `(i'-b-B2c-bodySucc-first-entry)`, R344's lone residual. The de-front works only if `FlowBodyContent.bodySucc`-at-first-entry-end is reconstructible CARRIER-FREE from the carried guards (`FlowBodyWindow.wellTyped` = the typed-bracket invariant `WellTyped`, and `FlowBodyContentDeep`). PROBE: REFUTED at the substrate level. The decisive mechanism is mechanical — `WellTyped`'s per-token step `btStep` matches the separator `.flowEntry` under the `_ => some s` IDENTITY catch-all (`WellBracketed.lean:906`), the SAME branch a content scalar takes, so the fold is utterly insensitive to separator placement. A MINIMAL PAIR settles it: two adjacent content units WITHOUT vs WITH a separator have the SAME `WellTyped` value, yet differ on `bodySucc`-at-first-entry; `FlowBodyContentDeep` is VACUOUS on a separator-free window (no openers/separators), so the full carried-guard set holds on the unseparated member while `bodySucc` fails. Hence NO `WellTyped l → bodySucc l` can exist. Toy: `Tok` (content/sep/opn/cls); separator-blind `step`/`fold`/`WT`; `firstSucc` (toy `bodySucc` at `k=0`); minimal pair `noSep`/`withSep`. POSITIVE (`wt_blind` + `firstSucc_sep`): both lists are `WT` — the invariant cannot tell them apart — and the SEPARATED one has the successor fact. NEGATIVE (`no_reconstruction` + `firstSucc_nosep` + `minimal_pair`): the UNSEPARATED list is `WT` yet fails `firstSucc`, so `¬ ∀ l, WT l → firstSucc l = true`; that non-existence is the substrate-level refutation — `bodySucc` is genuine EMISSION information, needing `SafeBodyUnit`. Sharpens R296 (no balance-free form → no typed-bracket-free form, via the explicit separator-blindness) + [[ref-type-blind-invariant-transports-via-converse-frame]] (separator-placement is the specific fact a type-blind invariant cannot CREATE); resolves the "if none" branch of [[ref-context-free-adapter-knot]] / [[ref-field-audit-localizes-knot]])
* `CarrierProvenanceNotType`             — Reflection 346 (a "narrow the root carrier" cycle-break works only if the carrier has an emission-INDEPENDENT producer; narrowability is provenance-blind — the PROBE behind `(i'-b-B2c-carrier-narrow)`, R345's resolution route. R345 charted the seq fixpoint to "source per-window `FlowBodyContent` from the EMISSION carrier `h_root_carrier`, narrowed to each window." PROBE: REFUTED as a TYPE MISIDENTIFICATION. A flat universal-over-sub-windows `Carrier lo hi := ∀ a, lo ≤ a → a ≤ hi → Fact a` is narrowable BY CONSTRUCTION (2-line `Nat.le_trans`), and that narrow lemma is PROVENANCE-BLIND — its proof depends only on the carrier's shape, so the SAME proof serves an emission-sourced carrier and a recursion-produced one ⇒ narrowability certifies NOTHING about circularity. The cycle-break works ONLY if the ROOT instance has a producer INDEPENDENT of the consuming recursion. But `h_root_carrier : SeqInteriorSeparators tokens 2 (size-2)` is NOT emission: its only producer `seqRoot_seqInteriorSeparators` consumes `desc`, whose nested half is the fixpoint `seqWindowRecSeqBody` that consumes `h_root_carrier` — the circle `carrier ⟸ desc ⟸ fixpoint ⟸ carrier`. Narrowing it relocates the circle, never breaks it; and the call site carries only the weaker `EmitScansInFlowBlock`, so emission's `RecSeqBody` is unreachable. Escape (already landed but unused): `seqSeparatorFacts_of_recseqbody` reads the facts off the window's OWN IH `RecSeqBody` (proof-irrelevant `Prop` = as good as a carrier lookup), seeded from emission by `emitList_scans_recseqbody`. Toy: flat `Carrier`; provenance-blind `narrow`; `Rec`/`carrier_of_rec` (IH route); provenance A `rec_from_emission` (recursion-independent) vs provenance B `Fix`/`Desc` (carrier-loop arrows). POSITIVE (`carrier_via_rec`): a recursion-independent producer yields the carrier UNCONDITIONALLY — cycle broken. NEGATIVE (`carrier_route_is_a_loop` + `narrow_same`): the carrier route composes to an ENDO-map `Carrier → Carrier` with no base, and `narrow` is the same endo shape — neither can seed. Sharpens [[ref-narrow-from-root-breaks-rederivation-cycle]] (needs an emission-INDEPENDENT root seed; a deliverable-typed "root carrier" is not one); carrier-side dual of [[ref-context-free-adapter-knot]])
* `ParentRelativeGConjunct`              — Reflection 347 (a PARENT-RELATIVE recursion-guard conjunct rides the recursion's structural SITES, not the uniform IH adapter — the PROBE that settled the live route for `(i'-b-B2c-ih-recseqbody-step)`, R346's handoff. R346 left two candidate carrier-free routes for the step's per-window `FlowBodyContent`: (A) read its separator facts off the window's OWN recursive output (`seqSeparatorFacts_of_recseqbody`), or (B) thread `FlowBodyContent` as a fifth `G`-conjunct propagated by the LANDED edges `seqRoot_flowBodyContent` (root, emission-seeded) / `flowBodyContent_descend` (646) / `flowBodyContent_advance` (4205). PROBE picks (B). FINDING: `FlowBodyContent`'s descend edge CONSUMES THE PARENT–CHILD RELATION (it takes the parent's `h_content` + the opener/close/floor), so the conjunct CANNOT be re-established in the dispatch's UNIFORM IH adapter (`recseqentry_window_dispatch`:5618/5629, which sees only the child's INTRINSIC four facts `FlowBodyWindow ∧ FlowBodyContentDeep ∧ SeqEnclosed ∧ close`, never how the child descends) — this is the R343 [[ref-context-free-adapter-knot]] knot, now RESOLVED: the four existing conjuncts are themselves supplied not in the adapter but at the recursion's STRUCTURAL CALL SITES (the seq oracle's descend, the assembler's advance), where the parent–child relation IS in scope; the adapter merely FORWARDS. So WIDEN the dispatch's IH SIGNATURE by the `F` conjunct and discharge it at those two sites via the landed edges. Route (A) is off the critical path: reading `F` off the window's OWN output is a same-window cycle for the producing window (output ≠ input) and redundant for children (the descend edge already builds it). The conjunct is NECESSARY: a nested window needs its own `bodySucc`, sourced only from the parent's `F` via descend — in scope only if `F` is threaded parent→child. Toy: `F` inductive (`root` no-parent | `descend` needs-parent); `Intrinsic` (the adapter's only data). POSITIVE (`F_root_seed` + `F_supply_at_descend`): the root seed and the structural-site supply both build `F` where the parent (or none) is in scope. NEGATIVE (`F_nonroot_carries_parent`): a nested `F` CARRIES a strictly-smaller parent (inversion), so no `Intrinsic lo hi → F lo hi` exists — the uniform adapter cannot manufacture it. NEGATIVE (`own_output_is_a_loop`): route (A) at the current window is an endo `F → F` with no seed, echoing R346's `carrier_route_is_a_loop`. RESOLVES the knot [[ref-context-free-adapter-knot]] diagnosed; corrects R346's framing — `seqSeparatorFacts_of_recseqbody` is off-path, the threaded `FlowBodyContent` edges are the route; applies [[ref-universal-producer-root-seed-first]] + [[ref-push-blind-frame-dependent]] (parent-dependent vs parent-blind edges))
* `ProjectionUpStrengthOrder`            — Reflection 348 (a carrier-free IH thread's DESCEND edge re-enters its OWN window: the five→four IH projection runs UP the strength order, and the combined deliverable RELOCATES the same-window cycle without breaking it — the PROBE that settled `(i'-b-B2c-dispatch-ih-widen)` step (3), run mechanically sorry-free in `Tests/Guards/Proofs/DescendIHProjectionProbe.lean` against the real defs. R347's route widens the dispatch IH by `FlowBodyContent` (`F`) and discharges it at the descend/advance sites; step (3) asks whether `flowBodyContent_descend`'s FOUR-conjunct `h_ih` projects from the widened FIVE-conjunct IH. FINDING 1 (STRICT STRENGTH ORDER): `IH4` (child `Out`/`RecSeqBody` from four INTRINSIC facts) is STRICTLY STRONGER than `IH5` (needs the child's `F` too) — four→five is a free drop (`ih5_of_ih4`), five→four closes IFF a per-window `provider : Intrinsic → F` exists (`ih4_of_ih5_iff_provider`), so the needed projection runs UP the strength order, impossible without a NEW producer for the dropped `F` — the carrier-free `F` the arc lacks (R296/R345). GENUINE arity entanglement, the fork's second branch. FINDING 2 (CYCLE SURVIVES COMBINATION): `F n` is read OFF `Out n` (`f_of_out`, toy `seqSeparatorFacts_of_recseqbody`) while `Out n`'s dispatch needs `F n` (`out_needs_f`); composed that is an endo with no seed (`same_window_loop`, R346's `carrier_route_is_a_loop` at ONE window), and the combined `Pair n := Out n ∧ F n` does not dissolve it (`combined_step_still_cyclic` — both fields trace through the same `F n` input) — combination relocates the cycle from the recursive edge INTO the step. THE BREAK (`break_via_emission`): only an EMISSION source of `F` independent of `Out` opens it — generalize the flat root seed (`seqRoot_safeBodyUnit`/`seqRoot_flowBodyContent`) to nested sub-values, making `F` a genuine four-conjunct-`G` INPUT. EDGE ASYMMETRY (the locus): `advance_supplies_child` is a clean parent→child arrow (NO `Out` in the loop, R347's optimistic shape — `flowBodyContent_advance` re-bases, no IH); `descend_supplies_child_via_out` routes the child's `F` through the child's own `Out` (`seqChild_safeBodyUnit`), which `out_needs_f` ties back — a same-window 2-cycle, because `bodySucc` has no all-depth balance-free form (R296) so descend cannot re-base down a level. Corrects R347's "landed edges" optimism (its toy abstracted descend as clean parent→child, hiding the `Out` re-entry); applies [[ref-push-blind-frame-dependent]] / [[ref-converse-forward-invariant-asymmetry]]; same-window loop is [[ref-carrier-provenance-not-type]]'s shape)
* `DescopeIsRouteRelative`               — Reflection 349 (a producer DESCOPED as "an alternative, not a necessity" UN-DESCOPES once the route that subsumed it is the one being eliminated; the emission seed EXTRACTS position-blind, it does not re-scan — the PROBE that settled `(i'-b-B2c-nested-fbc-emission-seed)`, with the offset gap `#guard`-confirmed in `Tests/Guards/Proofs/SeqNestedEmissionSeedProbe.lean`. R348 forced the per-window `FlowBodyContent` seed to be EMISSION-sourced per nested sub-value; the probe asks whether a NESTED seq window's `SafeBodyUnit` is sourceable from emission WITHOUT re-entering `seqWindowRecSeqBody`. FINDING 1 (POSITION-BLIND EXTRACTION): every `RecSeqBody`/`RecSeqEntry`/`SafeBodyUnit`/`ContentStartTok` constraint is `.val`-only, so the nested interior `RecSeqBody` STORED in the flat root `seqRoot_recseqbody`'s `RecSeqEntry.seq.h_rec` field sits over the EXACT outer-array slice (right `.pos`s) — the ASSEMBLE is LANDABLE NOW from an emission `RecSeqEntry` via `recseqentry_seq_extract` + `interior_window_eq` + `.toSafeBodyUnit` (`nestedSeq_safeBodyUnit_of_entry`, sorry-free, NO carrier/recursion). A standalone RE-SCAN is the WRONG object (`reScan_wrongObject`): same `.val`s but `.pos` offsets shifted by the enclosing `[` (`#guard`ed: in-context `2,5,7` vs standalone `1,4,6` on `[[1,2],9]`). FINDING 2 (DESCOPE IS ROUTE-RELATIVE): reaching the stored field at an arbitrary nested window is the R330–R337 SPINE-WALK navigator, DESCOPED as "an alternative, not a necessity" (`rec_seq_body_nested_project` is the carrier SHORTCUT — `seqWindowRecSeqBody` + `SeqEnclosed`-from-path, needs `h_root_carrier`, re-enters the recursion) BECAUSE the carrier route served the whole domain; but the carrier route is exactly what the emission seed ELIMINATES, so removing it UN-DESCOPES the navigator (`spineWalk_redundant_given_richRoute` the historical descope, conditional on `richRoute`; `seed_needs_spineWalk_without_carrier` / `descope_is_route_relative` the un-descope once `Carrier` is withheld). THE RULE: "X is redundant — R delivers it" is conditional on R staying in the design; a goal that eliminates R silently re-owes every X descoped because of R. The residual is the emission-spine-walk LOCATOR (`ref-from-located-assembler-direction` bottom-up; R330 already `#guard`-de-risked its measure + offsets). Sharpens [[ref-reduction-by-import]] / [[ref-downstream-derisk-restores-upstream]] (a later consumer re-opens a descoped PRODUCER, not a deliverable); extract is [[ref-coerce-to-weaker-reuse-wrapper]]'s val-transfer; offset gap is [[ref-probe-provider-satisfiable-before-assembler]]'s right-object check)
* `NavigatorDispatchArithmetic`          — Reflection 350 (a position-indexed navigator splits DECISION from CORRECTNESS: the bottom-up locator's branch dispatch is pure offset/length arithmetic, balance is demoted to the correctness side — the PROBE that settled `(i'-b-B2c-nested-fbc-emission-locator)`, `move_trichotomy`/`move_exclusive` pure `omega`, `#guard`ed on three witnesses in `Tests/Guards/Proofs/SeqNestedEntryLocateProbe.lean`. R349 left the emission-spine-walk LOCATOR as the residual; the probe asks its single-step shape — (a) one offset-tracked `body.length` recursion, or (b) a separate balance-locate front end. FINDING (option a): a navigator over a recursive deliverable splits into a DECISION procedure (which branch) and a CORRECTNESS justification (why); the decision is the cheap part. Walking `RecSeqBody body` with base offset `off`, the head entry `e` occupies `[off, off+e.length-1]`, so the target window start `a` selects the move by comparing `a` against `off+1` and `off+e.length` ALONE — leaf (`a=off+1`) / descend (`off+1<a<off+e.length`, off'=off+1) / advance (`off+e.length<a`, off'=off+e.length+1), `a=off+e.length` the impossible separator/close (`navMove`/`classifyMove` total, `classify_leaf`/`_descend`/`_advance`/`move_exhaustive`/`move_exclusive` pure `omega`). The structure STORES each entry's length and the offset-slice invariant `body=(take H).drop off` ties it to absolute coordinates, so the navigator NEVER calls balance to decide. BALANCE IS DEMOTED to correctness: R330's TOP-DOWN projection selected the entry by `flowBracketBalance=0` (it had a token coordinate, had to FIND the entry); this BOTTOM-UP locator keyed on `[a,b)` locates by offset arithmetic, balance entering only the PROOF that the slice equals the window (via all-seq-path/`WellTyped`), never the selector (`topDown_needs_balance` vs `bottomUp_decides_by_arithmetic`). THE RULE: before importing a locate's heavy front end into a navigator descending the same structure, ask which part is the DECISION vs the CORRECTNESS — if the deliverable stores the positional data the decision needs, the decision is a length-arithmetic trichotomy (`omega`) and the front end belongs only to correctness. Sharpens [[ref-backward-locator-mirrors-forward]] / [[ref-near-leaf-mirror-sheds-machinery]] (the backward/bottom-up direction sheds the forward locate's machinery) and [[ref-from-located-assembler-direction]] (the bottom-up single-step shape); the machinery was already paid for by the structure's stored lengths [[ref-metric-bridge-is-composition]])
* `LeafProductionIsPrefixSlice`          — Reflection 351 (the LEAF — the only deliverable-PRODUCING move of a position-navigator — is balance-FREE even on the CORRECTNESS side: its window identity is a pure prefix-slice fact; balance is confined to the non-producing interior MOVES. The AUTHORING result that landed the leaf of `nestedSeq_recseqentry_locate` (`(i'-b-B2c-nested-fbc-emission-locator-author)`), in `NonemptyStructure.lean` (`head_entry_slice` + `nestedSeq_recseqentry_locate_leaf`, sorry-free, verified-but-unconsumed). R350 split a navigator into DECISION (arithmetic) + CORRECTNESS (balance) and demoted balance to correctness; AUTHORING the leaf SHARPENS that — R350's "correctness needs balance" is too coarse. The leaf, the SINGLE move that produces the deliverable (descend/advance only re-base and recurse), has a correctness obligation — the window identity `(L.take (off+e.length)).drop off = e` — that is ITSELF balance-free: a pure `take`/`drop` prefix-slice fact derivable from the offset-slice invariant `(L.take H).drop off = e ++ rest` + fit bound `off+e.length ≤ H` via `take_take`/`drop_take`/`take_append_of_le_length` (`head_entry_slice`, PROBED axiom-clean before authoring). So at the leaf BOTH halves of R350's split are cheap: decision = length arithmetic (`leaf_decision_is_arithmetic`), correctness = prefix slicing (`leaf_correctness_balance_free`); importing balance is dead (`leaf_with_balance_redundant`). BALANCE IS CONFINED to the non-producing moves: only DESCEND/ADVANCE (which-child navigation) can use it, and they produce NOTHING — the producing move and the balance-using moves are DISJOINT (`producing_is_balance_free`: `produces m → ¬ usesBalance m`). "The producing case is the easy case." THE RULE: when a navigator stores children as prefixes/segments and carries an offset-slice invariant, AUTHOR THE LEAF FIRST and expect its correctness to be PURE SLICE ALGEBRA, not the metric the forward locate used; reaching for balance to justify the leaf's output is over-engineering. Sharpens [[ref-navigator-dispatch-is-arithmetic]] (R350: locates WHERE balance enters — not even the leaf's correctness, only the interior moves) and [[ref-near-leaf-mirror-sheds-machinery]] (the leaf sheds even the correctness-side metric); the slice fact is the window identity [[ref-from-located-assembler-direction]]'s assembler consumes)
* `ReadAheadConsumerProofState`          — Reflection 352 (read-ahead the CONSUMER chain to de-alarm a terse downstream step-list: proof-STATE, not prose, sets the pace. A trajectory de-risk that read steps (3)–(6) below the two `FlowSubrangesOk tokens := sorry` sites BEFORE grinding the mechanical locator bricks. A dependency map lists downstream steps as one-liners ("drive X … thread Y … wire Z"); a one-liner is INDISTINGUISHABLE between already-proven / trivial-plumbing / a whole parallel-effort — only the source's `theorem … := by` vs `:= sorry` tells them apart (`plan_prose_is_state_blind`: the plan exposes one constant bit across all states). A first-pass SURVEY flagged `EmitScansInFlowRecEntry` "definition only, no proof"; FALSE — `emit_scans_in_flow_rec_entry` (NonemptyStructure.lean:2418) proves it from `Grammable`. The survey checked the `def`, not the PRODUCER (`survey_overalarms_vs_source`, `source_verdict_reads_producer_not_def`: read producer not def). Net: no hidden deep obligation in (3)–(6); per-window facts carrier-supplied inside the proven `seqWindowRecSeqBody`, map RecMapBody step-lemmas landed, single open funnel = `seqRoot_seqInteriorSeparators`'s `desc` (which the `nestedSeq` locator builds). Verdict — not circling: the tree is bounded and SHALLOWER than the terse map read. THE PAYOFF is a PACING decision (`no_hidden_wall`): no wall behind the mechanical bricks ⇒ BATCH them instead of one-per-session. Grep for a PRODUCER (`: T := by`/`→ T`/`_of_`), not the `def T`; treat a multi-agent survey as a LEAD, source as the verdict. Complements [[ref-probe-deferred-universal-before-producing]] (probes a PRODUCER target; this probes a CONSUMER chain before pacing) and pairs with [[ref-leaf-production-is-prefix-slice]] (the bricks this cleared the runway for))
* `WrapperCarriesInvariant`              — Reflection 353 (the WRAPPER of a position-navigator is NOT among its mechanical slice bricks: partition the moves by what each PRODUCES, not by step-list position. The R352 de-risk batched "descend + advance + wrapper" as mechanical bricks; authoring descend + advance (`nestedSeq_recseqentry_locate_descend`/`_advance`, sorry-free) confirmed the SLICE half but exposed the wrapper's mis-binning. The leaf/descend/advance SLICE bricks re-base coordinates and produce NOTHING (`slice_bricks_produce_nothing`); the WRAPPER produces the located deliverable (`wrapper_produces_and_is_not_a_brick`) by threading a DOMAIN INVARIANT + a termination measure. THE TELL: its DESCEND arm (firing at `off+1 < a < off+entryLen`) excludes scalars/empties by ARITHMETIC alone (`scalar_empty_excluded_by_arithmetic` — empty descend range), but a MAP head SURVIVES the pure-arithmetic dispatch (`arithmetic_dispatch_admits_map` — `entryLen ≥ 4`) yet descending into a map interior is wrong. Arithmetic CANNOT separate a seq head from a map head (`arithmetic_cannot_separate_seq_from_map` — both survive); only the domain invariant `SeqPathAllSeq` does (`invariant_separates_seq_from_map`, via `seqPathAllSeq_map_push_breaks`). So the wrapper is the invariant-bearing assembly, needing its own interface-design probe before authoring — reaching for it as a "grind" after the slice bricks is the mis-binning. Sharpens [[ref-read-ahead-consumer-chain-proof-state]] (binning by step-LIST position mis-classifies the invariant-bearing assembly as a brick) and complements [[ref-leaf-production-is-prefix-slice]] (R351: the leaf produces nothing → slice algebra; the wrapper is its complement — produces everything, carries the invariant); interface discipline [[ref-from-located-assembler-direction]])
* `VestigialProjectionReopens`           — Reflection 354 (a VESTIGIAL projection re-opens for a structure-walking consumer: a whole-structure invariant retired as vestigial for a value-blind consumer — which reads only a TOP projection — is LOAD-BEARING for a sibling consumer that WALKS the typed structure. Vestigial-ness is CONSUMER-RELATIVE. The wrapper of `nestedSeq_recseqentry_locate` (R353) must carry a domain invariant; R354's PROBE (`SeqNestedWrapperIfaceProbe.lean`, `#guard`-green on real tokens) settles WHICH: the WHOLE-path `SeqPathAllSeq`, not the TOP `SeqEnclosed`/`SeqTypedInterior` the `desc` consumer hands it. MINIMAL PAIR — the SAME nested seq `[1,2]` reached two ways: `[[1,2]]` (all-`[` path, stack `[true,true]`) vs `[{x:[1,2]}]` (through a `{`, stack `[true,false,true]`). The negative's TOP is `true` (`pos_both`/`neg_top_holds_full_fails`) so it PASSES the projection, but its WHOLE path is not all-`true` so it FAILS the full invariant — `projection_equal_full_separates`: the projection canNOT separate the pair, the full invariant DOES. The value-blind consumer ADMITS the bad window (`value_blind_admits_bad_window`) the structure-walker must REJECT (`walker_rejects_bad_window`) — same invariant, opposite verdicts. And the bridge "projection ⟹ full" is FALSE (`projection_does_not_imply_full`, the negative is its counterexample), so the walker sources the full invariant from its OWN descent discipline (descends only through seq openers — R338), not from the projection-providing gate. Consumer-relative dual of [[ref-downstream-derisk-restores-upstream]]; the probe is [[ref-minimal-pair-extracts-the-gate]]; sharpens [[ref-wrapper-carries-invariant-not-a-slice-brick]] (names WHICH invariant and proves the weaker candidate insufficient); structured-vs-aggregate [[ref-aggregate-collapses-structured-separates]])
* `NavigatorArmsKeyedToPositions`        — Reflection 355 (a position-navigator's per-arm exclusion facts live at DIFFERENT positions: the DESCEND arm's DOMAIN at the recursion BASE `off`, the LEAF arm's head CLASSIFICATION at the TARGET WINDOW `a = off+1`. R354 settled the carried domain is the WHOLE-path `SeqPathAllSeq tokens off`; the blueprint then claimed the interface RESOLVED and attributed the LEAF arm's head-is-`.seq` to that SAME carried hypothesis. R355's PROBE (`SeqNestedLeafEnclosureProbe.lean`, `#guard`-green on real tokens) finds the attribution IMPRECISE and the carried-state list INCOMPLETE: `SeqPathAllSeq tokens off` is BLIND to `tokens[off]` (the head entry's own opener — it constrains only the stack BEFORE `off`), so it cannot decide whether the head is a `[` (seq, leaf admissible) or `{` (map, leaf inadmissible). Only the WINDOW's `SeqEnclosed tokens a` — the second conjunct of the `SeqTypedInterior tokens a b` that `desc` consumes — separates them. MINIMAL PAIR — SAME body base `off = 2`, SAME would-be leaf window `a = 3`, differing only in the head bracket TYPE: `[[1,2]]` (seq head, `SeqEnclosed 3 = true`) vs `[{x:[1,2]}]` (map head, `SeqEnclosed 3 = false`). They AGREE on the carried base domain (`SeqPathAllSeq tokens 2 = true` for BOTH — `carried_domain_blind_to_head`) but DISAGREE on the window enclosure (`seq_head_window_enclosed`/`map_head_window_not_enclosed`) — `base_equal_window_separates`: the carried base domain is EQUAL across the pair, the window enclosure SEPARATES it. `carried_domain_cannot_classify_head`: no function of the carried domain alone classifies the head, so the WRAPPER MUST ALSO CONSUME the target window's `SeqTypedInterior tokens a b` (the LEAF map-exclusion via `SeqEnclosed`, and the balance-0 that pins `b` to the head entry's edge). Sharpens R354's [[ref-vestigial-projection-reopens-for-structure-walker]] (R354 settled the BASE domain; R355 finds the LEAF arm needs a SECOND, window-keyed fact the base hypothesis cannot supply); the probe is [[ref-minimal-pair-extracts-the-gate]]; the per-arm position-keying is [[ref-two-boundary-consumer-joint]] for a navigator)
* `CarriedInvariantAdvanceEdge`           — Reflection 357 (a recursion that CARRIES a domain invariant needs one PRESERVATION edge per recursion MOVE — descend AND advance — not per deliverable constructor; the descend edge + its NEGATION mask the missing ADVANCE (frame) edge. Authoring the wrapper `nestedSeq_recseqentry_locate`, its ADVANCE arm must recurse with `SeqPathAllSeq tokens (off+e.length+1)`; the next-step pointer named "R337 seqPathAllSeq advance edge" as if it existed, but R337 authored only `seqPathAllSeq_descend` (the seq-head PUSH preserves) and `seqPathAllSeq_map_push_breaks` (the map-head PUSH breaks) — descend + negation, NO advance. That pair FEELS exhaustive (a [[ref-converse-forward-invariant-asymmetry]] pair: seq edge preserves, map edge cannot) but answers only the DESCEND axis; advance is a third, ORTHOGONAL obligation. CODE `seqPathAllSeq_advance` (SeqInteriorSeparators.lean, sorry-free, build green 614 jobs, frontier 4) is the whole-stack analogue of `seqEnclosed_advance`: a FRAME not a push — `WellTyped_frame` returns the fold to the SAME stack `s`, so all three conjuncts (defined/nonempty/all-`true`) transport VERBATIM, even more directly than the top-only `seqEnclosed_advance` which must re-read the head. The missing edge is the EASY one, which is exactly why the hard descend PUSH (and proving its negation) masked it. Toy `os`/`om`/`it`/`cl` bracket fold + `PathAllSeq` stack predicate: `descend_preserves` (PUSH true) / `advance_preserves` (FRAME a balanced segment) positives, `map_break` the negation; the `#guard`s make the masking literal — the advance frame is BLIND to the stack (`bfold [os,it,cl] [false] = [false]` preserves even a non-all-true stack) whereas a descend push CHANGES it (`bfold [os] [false] = [true,false]`), so descend + negation cannot supply the advance. Sharpens [[ref-structural-moves-complete-recursion]] (one move per DELIVERABLE constructor → here one preservation edge per recursion MOVE for the CARRIED invariant); a probe-before-producing win [[ref-probe-deferred-universal-before-producing]]; the residual is the leaf `b`-pin [[ref-end-free-gate-underdetermines-close]] + the `Nat.strongRecOn` skeleton)
* `ResidualAlreadyProvenInSibling`         — Reflection 358 (a sub-fact a multi-session pointer flags as "the analytically-hard residual" may already be FULLY PROVEN inside a SIBLING lemma over the same substrate that derives it as an intermediate `have` and CONSUMES it for a DIFFERENT deliverable. Authoring the wrapper `nestedSeq_recseqentry_locate`, its LEAF arm needs `h_b : b = off + e.length - 1` (the close-pin) — flagged across R354/355/356 as the analytically-hard residual. But `recseqbody_head_seq_project` (the OLD top-down locate's base case) already proves PRECISELY that uniqueness as its internal `h_uniq : j + 1 = lo + e.length` (a two-sided bracket match: the located floor forbids an earlier close, the entry's own interior floor forbids a later one) and CONSUMES it to build the descended `RecSeqBody` interior. CODE `recseqentry_close_pin` (NonemptyStructure.lean, sorry-free, build green 615 jobs, frontier 4) reuses that prelude VERBATIM through `h_uniq`, then RETURNS the `.seq` decomposition (opener, nonempty interior, RecSeqEntry, head-window identity) + `h_uniq` — exactly the leaf brick's `h_b` + `.seq` shape. The exposure needs a DIFFERENT SHAPE than the sibling's internal use (the sibling built a `RecSeqBody` interior from the same `h_uniq`), so it is extract-AND-repackage, not a verbatim call; duplicating the ~60-line prelude rather than refactoring the sibling is the IRON-RULE-safe choice. The "hard" was an EXPOSURE problem masquerading as a derivation problem. Toy: a two-floor uniqueness `j+1 = L`; `sibling_consumer` derives it as `huniq` and CONSUMES it for a SUFFIX deliverable (`drop (j+1) = []`), `uniq_pin` re-surfaces it in a PREFIX-length shape (`j = L-1`) the second consumer wants; the `#guard`s show the same value serves both shapes, the negative being that the sibling's suffix fact cannot recover the pin. Sharpens [[ref-metric-bridge-is-composition]] + [[ref-reduction-by-import]]; a search-before-deriving win on [[ref-probe-deferred-universal-before-producing]]; complements [[ref-parametric-assembler-extraction]] — the primitive was already produced, just unexported)
* `ComposeArmSeamBeforeSkeleton`           — Reflection 359 (a recursion's branch ARMS are NOT uniform in difficulty; AUDIT each before authoring the `Nat.strongRecOn` skeleton — which call already-landed bricks (compose-only) vs which need infra that does NOT yet exist. Authoring `nestedSeq_recseqentry_locate`, the arm audit found LEAF + ADVANCE compose-only (`recseqentry_close_pin` + `nestedSeq_recseqentry_locate_leaf`; `..._advance` + `seqPathAllSeq_advance`), but DESCEND hides a hard sub-case: a `RecSeqEntry.map` head can't be descended through (no stored `RecSeqBody` interior) and must be REFUTED — and the refutation is NOT one-step `seqPathAllSeq_map_push_breaks` (the carried `SeqPathAllSeq tokens off` is BLIND to `tokens[off]`, and a map head CAN sit at an all-seq-path base, `[{...}]`); it needs a not-yet-existing map-frame-persists lemma. So the full recursion is NOT a safe single increment. The move: COMPOSE the landed bricks of an EASY arm into a standalone arm-callable — the inter-brick SEAM (brick A's output shape reshaped into brick B's input shape) is itself unproven slice/shape algebra, worth landing green in isolation BEFORE the skeleton tangles it with dispatch + measure. CODE `nestedSeq_recseqentry_locate_leaf_full` (NonemptyStructure.lean, sorry-free, build green 616 jobs, frontier 4) composes close-pin→leaf-brick: the window identity `(op::(interior++[cl])) = ((take H).drop off).take L` becomes the prefix decomposition `body = (op::(interior++[cl])) ++ rest` via `List.take_append_drop` (`rest := body.drop L`), the close pin `b+1 = off+L` becomes `h_b`. The new-infra DESCEND map-head refutation is isolated as the next increment. Toy: landed `producer` (shape-A take-equality out) + `consumer` (shape-B append-decomposition in) bricks, `seam` reshapes A→B via `List.take_append_drop` (the new content), `leaf_arm` is the composed standalone callable; `hard_arm` needs an EXTERNAL witness the compose-only bricks can't supply (stays a hypothesis = the deferred obligation); `#guard`s make the seam reshape and the isolated hard arm literal. Sharpens [[ref-from-located-assembler-direction]] (per-arm refinement) + [[ref-structural-moves-complete-recursion]] (moves aren't equal-cost); complements [[ref-parametric-assembler-extraction]] (both primitives exist, the SEAM is the gap))
* `RefuteArmMirrorsPinningSibling`       — Reflection 360 (a flagged "needs-new-infra" REFUTATION arm is often a PINNING sibling's MIRROR: flip the type-discriminator bit, relax the pin-hypothesis to a floor. The R359 audit deferred the DESCEND map-head arm as needing a not-yet-existing map-frame-persists lemma; authoring it (testing that pessimism, [[ref-backward-locator-mirrors-forward]]) showed it was NOT new infra. `seqPathAllSeq_map_frame_persists` (SeqInteriorSeparators.lean, R360, sorry-free, build green 617 jobs, frontier 4) is a near-twin of the EXISTING sibling `seqOpenerType_of_located_and_gate`, which PINS the located opener's type (`tokens[p] = .flowSequenceStart`). Both read the SAME substrate `btFold_frame_inv` (a floored fold from a base whose bottom frame is `bit :: base` returns `m ++ (bit :: base)` — the frame survives). The refutation is the mirror with TWO edits: (1) FLIP the bit `true`→`false` (a `[`→`{`) and conclude the OPPOSITE membership (a surviving `false` ⟹ not all-`true`); (2) RELAX the pin-hypothesis — pinning needs the EXACT body balance (forces the surviving prefix `m = []` so the head is read directly), refuting needs only the FLOOR (the frame is never popped, `m` may be nonempty above the `false`). The substrate already existed for the adjacent consumer; the "new infra" was a parametric twin. Probed true on `[{a: [1]}]` (every position strictly inside the map span `(1,7]` carries a `false`) before authoring. The refuted hypothesis is the window's seq-enclosure `SeqPathAllSeq tokens (a-1)` (R355), making the map-head DESCEND case vacuous (no fifth arm). Toy: shared `FrameInv` substrate (`S = m ++ (bit :: base)`), `pin` sibling (bit `true` + exact `m = []` ⟹ head pinned), `refute` mirror (bit `false`, NO exact hyp ⟹ surviving `false` ⟹ not all-`true`); `#guard`s show the pin's all-`true` stack, the mirror's surviving `false` with a NONEMPTY `m`, and the NEGATIVE (without the surviving frame, `[].all = true` — the floor is load-bearing). Sharpens [[ref-compose-arm-seam-before-skeleton]]; builds on [[ref-near-leaf-mirror-sheds-machinery]] + [[ref-backward-locator-mirrors-forward]]; applies [[ref-metric-bridge-is-composition]])
* `TypeBlindBridgeFalse`                 — Reflection 362 (a balance-only invariant is TYPE-BLIND, so a named "structure ⇒ typed-fact" bridge across a type-blind constructor is FALSE; PROBE a minimal pair before authoring, and on refutation THREAD the typed fact as a parametric-assembler hypothesis. Composing the ADVANCE seam `nestedSeq_recseqentry_locate_advance_step`, the domain brick `seqPathAllSeq_advance` demanded the consumed segment be `WellTyped`. The plan named a discharge — "the head entry is a `RecSeqEntry`, a balanced bracket pair ⇒ `WellTyped`" — and flagged SMALLEST-FIRST to probe it. The probe REFUTED it: `WellBracketed` (the `pbalance` Dyck condition) is type-blind because `flowBracketDelta` maps BOTH `[`/`{` to `+1` and BOTH closers to `−1`, so it cannot tell bracket TYPES apart; and `RecSeqEntry.map` gates its interior ONLY on `WellBracketed`, admitting a mistyped `[ }`. Concretely `{ [ } }` has `pbalance = 0` (passes the gate) yet `btFold (some []) · = none` (NOT `WellTyped`) — ONE `#guard` witness refutes the universal bridge. The move on refutation: do NOT strengthen the shared inductive ([[ref-additive-parallel-type-over-shared-edit]]) and do NOT chase a stronger local invariant (a type-blind invariant cannot CREATE a typed fact, only TRANSPORT one — [[ref-type-blind-invariant-transports-via-converse-frame]]); THREAD the typed fact as a parametric-assembler hypothesis ([[ref-parametric-assembler-extraction]]) in structural form `WellTyped (e ++ [fe])` (slice bridge proven internally), isolating its production as a later frame-transport. Toy: `bal` (type-blind balance, both openers `+1`) vs `tfold`/`typed` (a stack fold that PUSHES which bracket type opened and POPs only the match); `Struct.wrap` gates only on `balOnly`; `#guard`s show the mistyped `{ [ } }` passes `balOnly` but fails `typed`, an `example` builds it as a real `Struct` that is provably `¬ typed`, and `seam` threads `typed` as a hypothesis it cannot manufacture from `Struct`. Sharpens [[ref-probe-deferred-universal-before-producing]] + [[ref-minimal-pair-extracts-the-gate]] (the probe target is a NAMED bridge refuted by one #guard witness, not a ∀-survey); seam context [[ref-compose-arm-seam-before-skeleton]])
* `DeferredTypedFactInGuard`              — Reflection 363 (a seam's deferred "source it LATER by frame-transport" typed-fact obligation is often ALREADY carried by the recursion's existing guard `G` and ALREADY transported by a SIBLING driver over that same `G` — the de-risk is a READ, not a build. R362 threaded the ADVANCE arm's `WellTyped (e ++ [fe])` and filed its production as a residual to be "sourced later by frame-transport from a global `WellTyped`." Two reads resolved it. (1) The guard: the consuming recursion's four-conjunct `G` carries `FlowBodyWindow tokens off H`, and `FlowBodyWindow.wellTyped` IS the WHOLE-window typed fact (`.dyck` the floor) — so the "global `WellTyped` to transport down" is a FIELD of a guard the recursion already descends along, not a fact to manufacture. (2) The sibling: `seqWindowRecSeqBody` (R323), a driver over the SAME `G`, had ALREADY written the exact transport at its own depth-0 cut `m+1` — `WellTyped_subrange … h_win.wellTyped h_bal_m1 (h_win.dyck …)` (lines 1860-1863). The new supplier `nestedSeq_recseqentry_locate_advance_welltyped` (R363, SeqInteriorSeparators.lean, sorry-free, build green 619 jobs, frontier 4) is that four-line transport re-aimed at this seam's slice — same body, different cut. So the ADVANCE arm has TWO landed content pieces (the consume-seam R362 + the produce-supplier R363) and the skeleton owes ZERO content bricks. Toy: `Win` guard BUNDLES the whole-context typed fact as a field `wholeTyped`; `SubrangeTransporter` is the pre-existing transport primitive (modeled as given — re-used, not re-derived); `sibling` calls it on the guard field at one cut and `supplier` re-aims the SAME call at the seam's `e ++ [fe]` (token-identical bodies); POSITIVE = a concrete `Win` whose field holds and whose seam-prefix is genuinely typed; NEGATIVE = the guard field is load-bearing — on the mistyped `{ [ } }` `Win` is uninhabitable, so the typed fact must hold UPSTREAM, never manufactured. Sharpens [[ref-type-blind-invariant-transports-via-converse-frame]]; echoes [[ref-metric-bridge-is-composition]] + [[ref-root-seed-recursive-producer-swap]]; discipline [[ref-compose-arm-seam-before-skeleton]])
* `DemotedDispatchMetricFromStructure`   — Reflection 364 (demoting a recursion's DISPATCH from METRIC-keyed to STRUCTURE-keyed does not delete a downstream arm's metric fact; the fact migrates from "dispatch byproduct" to "structural derivation", and that derivation already exists as an inline block inside the metric-keyed SIBLING — lift it to a standalone brick. The emission-spine-walk locator dispatches by pure LENGTH ARITHMETIC (`move_trichotomy`, R350), "balance demoted to the correctness side, never the decision." But its ADVANCE arm's `WellTyped` supplier (R363) consumes a balance-`0` cut fact `flowBracketBalance tokens off (off+e.length+1) = 0`. In the metric-keyed SIBLING `seqWindowRecSeqBody` this fact (`h_bal_m1`) falls out of the dispatch FOR FREE — it LOCATES the separator `m` by `balance lo m = 0` then adds the comma's delta-`0`. The length-arithmetic locator makes no such call. R364's answer: re-source it STRUCTURALLY — the head entry is a complete `RecSeqEntry` (`pbalance e = 0` via `toWellBracketed`), the `.flowEntry` separator has delta `0`, so `e ++ [fe]` is balanced; and that derivation is NOT new — it is the `h_bal_sep` block already proven inline inside the metric-keyed sibling `recseqbody_advance` (`NonemptyStructure.lean:1169`). The brick `nestedSeq_recseqentry_locate_advance_balance` (R364, SeqInteriorSeparators.lean, sorry-free, build green 620 jobs, frontier 4) is that block lifted standalone, keyed on the locator's slice frame — the last non-mechanical dispatch piece before the closed recursion. Toy: `bal` (type-blind cumulative balance) + a delta-`0` `sep`; `EntryOk` is the structural completeness projecting to `bal e = 0` (toy of `RecSeqEntry`); `metricCut` gets `bal e = 0` from a LOCATED separator (dispatch byproduct), `structureCut` gets the SAME `bal e = 0` from `EntryOk.balanced` (structure) with a TOKEN-IDENTICAL body — the fact migrated, did not vanish; POSITIVE = a concrete complete entry whose cut is `bal (e ++ [sep]) = 0`; NEGATIVE = `EntryOk` is load-bearing — a lone opener (`bal = 1`) cannot build it and its cut is genuinely FALSE. Dispatch dual of [[ref-metric-bridge-is-composition]]; metric analogue of [[ref-deferred-typed-fact-in-guard-via-sibling]]; discipline [[ref-compose-arm-seam-before-skeleton]])
* `AdjacentOriginReconstructs`           — Reflection 366 (a consumer fact at an origin ADJACENT to a carried bundle's origin is NOT a separate guard-debt; it reconstructs by single-token compose across the boundary token whose delta the guard already pins — so itemize the consumer's debt as ONE window-absolute bundle, deriving the lower-origin fact in place. R366 landed the LEAF branch of the emission-spine-walk locator's per-window step `h_step` (`nestedSeq_recseqentry_locate_leaf_typed`, SeqInteriorSeparators.lean, sorry-free, full build green 621, frontier 4). The LEAF seam `nestedSeq_recseqentry_locate_leaf_full` (R359) reads TWO balance facts at DIFFERENT origins: `h_inner` (interior balance `flowBracketBalance (off+1) b = 0`, origin `off+1`) and `h_floor` (the ENCLOSURE floor `∀ i ∈ (off, b], flowBracketBalance off i ≥ 1`, origin `off`, one token LOWER — the opener's own position). A naïve `G` carries both. But `G` is keyed window-ABSOLUTE on the FIXED `[off+1, b)` (R356) via `SeqTypedInterior tokens (off+1) b`, whose interior floor is `≥ 0` at origin `off+1` — no `off`-origin floor. The origin gap is exactly ONE token, the opener at `off` whose delta the guard pins (`tokens[off]! = [` ⇒ `flowBracketDelta = +1`), so `flowBracketBalance off i = flowBracketBalance off (off+1) + flowBracketBalance (off+1) i = (+1) + (≥0) ≥ 1` (`flowBracketBalance_compose` + the single-token opener read) — the `≥ 1` floor is DERIVED, NOT a separate field. So `G` owes the LEAF ONE balance bundle, not two floors. Toy: `bal` (recursive cumulative balance over per-position deltas `δ`); `bal_step` (the single-token compose, toy of `flowBracketBalance_compose`); `floor_lo_from_floor_hi` reconstructs the `≥ 1` floor at origin `lo` from the `≥ 0` floor at `lo+1` + the opener pin `δ lo = 1`. POSITIVE = the reconstruction FIRES on a concrete opener window (`δopen`, opener at `lo=2`); NEGATIVE = LOAD-BEARING on the pin — with a delta-`0` token at `lo` (`δflat`) the interior floor STILL holds but the `≥ 1` enclosure floor FAILS (`bal lo (lo+1) = 0`), so an unpinned/non-adjacent origin IS a genuine debt. Origin-shift instance of [[ref-reconstruct-in-place-over-relocate]]; keeps fields window-absolute per [[ref-window-absolute-gate-subset-restriction]]; the LEAF de-risk of [[ref-width-recursion-combinator-before-grammar-step]]'s SEARCH step)
* `GuardStructureArmByArm`               — Reflection 367 (when pinning a recursion GUARD as a structure, build its field set ARM-BY-ARM: include only fields whose CONSUMER ARM has landed, DEFER a field a not-yet-landed arm needs as an additive extension of the new own-type — the deferral is a de-risk, the arm proof pins the field's exact form, AND free, it is your own type not a shared one. R367 pinned the emission-spine-walk locator's guard as `structure SeqLocateGuard tokens a b off H body` and proved the LEAF disjunct through it (`nestedSeq_recseqentry_locate_step_leaf`, SeqInteriorSeparators.lean, sorry-free, full build green 622, frontier 4). The blueprint named `FlowBodyWindow tokens off H` as a probable field, but only the ADVANCE arm's `WellTyped` supplier consumes it and ADVANCE has not landed — committing it now would GUESS its form (which of its seven fields, whether `2 ≤ lo` holds at the walked windows). So the structure ships LEAF/DESCEND-settled fields only and DEFERS `FlowBodyWindow` to the ADVANCE increment, a free additive extension of the own-type. Landing the LEAF projection PINS seven of ten fields against a real proof. Toy: `GuardBase` carries only the base arm's fields and projects to `Deliv` (`step_base`); when the recursive arm lands it is added as `GuardFull extends GuardBase` and the base projection survives unchanged (`step_base_via_full`). POSITIVE = the base projection type-checks through the extension; NEGATIVE = `guessed_unsat_at_base` — a guard that front-loads the recursive arm's field with a WRONG too-strong precondition `2 ≤ off` is UNSATISFIABLE at the base window `off = 0` even though the real base fact holds, so the guess is unsound until the arm pins it; plus the `rec`-field/`.rec`-recursor name-collision gotcha. Guard-bundle instance of [[ref-additive-parallel-type-over-shared-edit]]; completes fields per [[ref-structural-moves-complete-recursion]]; simplest-arm-first per [[ref-universal-producer-root-seed-first]])
* `StrictContainmentNeedsOpener`         — Reflection 368 (a two-floor relay closes only the NON-strict containment `b ≤ c`; the STRICT `b < c` — the inner close does not coincide with the enclosing interior's OWN end — needs a THIRD input the relay is HEAD-BLIND to: the inner window's START opener at `a-1`. The enclosing gate constrains the interior balance + Dyck floor + the mark at `a`, but says NOTHING about the token at `a-1`, so it cannot tell a genuine entry interior (opener `[`) from a MID-ENTRY SUFFIX (start one-past a separator `,`): inside an interior `x , [y]` the window at `a` = one past the `,` passes the gate with `b` = the enclosing end `c`. So the relay alone yields `b ≤ c`; the opener `bal (a-1) a = 1` upgrades it to `b < c` (it composes to `bal (off+1)(a-1) = -1`, contra the enclosing Dyck floor). The opener is INDEPENDENT of the gate's other fields (the mark gives the stack TOP at `a`, not the token at `a-1`), so it cannot be re-derived downstream — restore it as a window-absolute carrier field that descends free. POSITIVE = `strict_containment`, the abstract relay proved with the opener hypothesis; NEGATIVE = a concrete `[ x , [y] ]` balance where the mid-suffix window `a=3` passes the gate (`bal 3 6 = 0`, floor ≥ 0) with `b = c = 6` yet `bal 2 3 = 0 ≠ 1` (opener absent), while the genuine window `a=4` has `bal 3 4 = 1` and `b = 5 < 6`. Real code: `seqTarget_close_lt_interiorEnd` (SeqInteriorSeparators.lean, R368, the descend re-bundle's `win_hi`). END-dual of [[ref-probe-provider-head-blind-gate]]; complement of [[ref-end-free-gate-underdetermines-the-close]]; relay is [[ref-two-floor-relay-close-bound]]; restore-upstream per [[ref-downstream-derisk-restores-upstream]])
* `ProducerGuardedTrap`                  — Reflection 218 (the producer-guarded-quantifier trap)
* `ConverseForwardAsymmetry`             — Reflection 219 (converse/forward invariant asymmetry)
* `ReductionByImport`                    — Reflection 225 (reduction by import — retype, not shrink)
* `ParametricAssemblerExtraction`        — Reflections 226 + 228 (parametric assembler extraction)
* `ConvergentReduction`                  — Reflection 227 (convergence corollary of reduction-by-import)
* `RecursiveDeliverableProjectToFlat`    — Reflections 234 + 235 (recursive deliverable, project-to-flat-first; single-level descent step)
* `ConsumerJointBeforeProducer`          — Reflection 231 (+ 232 / 237 / 241) (build the consumer joint before the producer; faithful mirror)
* `AdditiveParallelType`                 — Reflection 242 (land a forced deliverable refinement as an additive parallel type, never a shared edit; a dedicated type internalizes the guard)
* `UniversalPackagingJoint`              — Reflection 243 (universal packaging is its own consumer joint — the field/joint hypothesis gap IS the producer's deliverable type; build the assembler before the producer)
* `ProjectionFamilyCompletion`           — Reflection 244 (complete a newly-added deliverable type's projection family before the producer walks it — the omitted projection is the locate's navigation invariant, a verbatim mirror of the sibling's; projections track STORED fields, not desired properties)
* `EmitProducerStrengthening`            — Reflections 249 + 250 (the emit-producer strengthening is itself a consumer-joint-before-producer move at the emit boundary — key the assembler on a SUPERSET per-item predicate carrying the recursive deliverable (`RecEntry`, unrecoverable from the flat `FlatEntry`, witnessed by `flatentry_aa` + `not_recentry_aa`); and the recursive producer is a verbatim mirror of the flat one over ONE shared induction, only the leaf constructor swapped — `buildRecBody` is `buildFlatBody` with `RecBody.single/.cons` for `FlatBody.single/.cons`, `recbody_to_flatbody` projecting rec ⟹ flat. **R250 map layer**: the same strengthening mirrored across a SECOND axis (seq→map) — `RecPair` REUSES `RecEntry` verbatim for both key and value slots (predicate reuse), `buildRecMapBody` is `buildFlatMapBody` with the leaf swapped AND `buildRecBody` with the per-item predicate swapped (the two-axis mirror), and `recpair_len_floor` (`3 ≤ length`) is the load-bearing map-side scaffolding the seq body lacks — keep it, mirror the same-axis parent not the other-axis sibling)
* `MirrorReadsConjunctNotProjection`       — Reflection 464 (a flat→strengthened producer MIRROR is a pure TEXT-SWAP iff the flat proof reads each per-item fact from the predicate's STANDALONE CONJUNCT, not from a PROJECTION off the per-item inductive — the toy of STEP D step 8's deep body assemblers. The minimal/severance-free deep family ([[ref-parallel-family-sheds-orthogonal-field]]) carries only `.toFlat`, having SHED the orthogonal `.toEntryUnit`/`.toEntrySafe`/`.toWellBracketed` projections; so wherever the flat proof wrote `hentry.toEntryUnit` the deep mirror gives `hentry : RecEntryDeep` and `RecEntryDeep.toEntryUnit` does not exist — the mirror must REROUTE to the predicate's standalone `EntryUnit` conjunct (kept precisely because the deep family cannot reproject it). So the mirror cost is QUANTIFIED before writing: (text swaps) + (one reroute per `.toX`-projection read). LANDED this round: `emitList_scans_recseqbodyDeep` (the seq body assembler) read `EntryUnit`/`ContentStartTok` from STANDALONE conjuncts `h_eu₁`/`h_cs₁` ⇒ ZERO reroutes, a pure two-swap mirror; PREDICTED next: `emitPairList_scans_recmapbodyDeep` reads `h_ve.toEntryUnit` ×2 (value side; key side none) ⇒ 4 swaps + exactly 2 reroutes to `_h_eu_v`, no new helper. Toy: `FEntry` (rich — STORES `hne`) vs `DEntry` (minimal — sheds it), `FEntry.toExtra` exists, `DEntry.toExtra` deliberately does NOT (`#check_failure` witnesses the gap). `clean_flat`/`clean_deep` (conjunct read — identical proof, pure swap) vs `proj_flat`/`proj_deep_rerouted` (projection read — the deep one rerouted to the standalone `hx`). Sharpens [[ref-recursive-producer-mirrors-flat-over-shared-induction]] with the when-is-it-verbatim predictor, via [[ref-parallel-family-sheds-orthogonal-field]] + [[ref-stored-vs-projected-severs-recursion-edge]])
* `ProbeProofFactorsGeneralReduction`      — Reflection 468 (a `native_decide`/`#guard` satisfiability PROBE of `P(concrete)` whose proof factors as `general_reduction (concrete_fact)` is itself a TEMPLATE for the general producer — only the `native_decide` leaf is example-specific, so promote the probe by replacing that ONE leaf with a structural derivation of the single fact it localized, reusing the generic reduction VERBATIM. The toy of the seq-side residual-(2) discharge: `seqFoldTotal_satisfiable_on_real_output` (R441) `native_decide`d the fold-totality universal `∀ m, ∃ s, btFold (some []) (take m) = some s` on ONE stream — but its proof `native_decide`d only the whole-object leaf `WellTyped tokens.toList` and then derived the `∀ m` form GENERICALLY via `WellTyped_prefix_some`; so promoting it to the axiom-clean general producer (`seqFoldTotal_of_context`, retiring residual (2) of `seqHRec_of_root_and_context`) was just replacing that leaf with a structural derivation (`seqWholeStreamWellTyped` — fold the whole stream `streamStart :: [ :: interior ++ ] :: streamEnd` piecewise, the interior framing back via `WellTyped_frame`), reusing `WellTyped_prefix_some` verbatim. Toy: `step`/`foldFrom` a fold with an absorbing `none` (the `btStep`/`btFold` analog); `Whole l := foldFrom (some 0) l = some 0` DECIDABLE (the PROBE's `decide` leaf); `AllPrefixesFold l := ∀ m, ∃ s, foldFrom (some 0) (l.take m) = some s` the deliverable; `allPrefixesFold_of_whole` THE producer-AGNOSTIC reduction (the `WellTyped_prefix_some` analog, consumes only `Whole`); `probe_concrete := allPrefixesFold_of_whole _ (by decide)` and `general_producer l h_struct := allPrefixesFold_of_whole l h_struct` share the reduction — `probe_is_producer_at_decide_leaf : probe_concrete = general_producer _ (by decide) := rfl`. NEGATIVE: an underflowing list `[-1, …]` is not `Whole` (`decide`) and its first prefix folds to `none`, so the reduction's whole-fact is load-bearing. Sharpens [[ref-probe-deferred-universal-before-producing]] (the probe's PROOF STRUCTURE, not just its yes/no, localizes the generalization residual) and is the promote-side dual of [[ref-metric-bridge-is-composition]] / [[ref-root-seed-recursive-producer-swap]])
* `ResidualIsCompositionOfLandedEdges`     — Reflection 469 (a residual named "preserve invariant `I` across a single LOCATED edge `X`" can hide a FRAME-TO-REACH component: the located position is NOT adjacent to the window origin — sibling structure intervenes — so the edge is `EDGE_X-at-the-locator ∘ FRAME-origin→locator`, and BOTH component edges are usually already landed; a SIBLING producer may already compose the very same two, so PROBE for the composition before authoring a "new edge". The toy of the seq carrier↔recursion co-construction's `SeqPathAllSeq` descend edge: `seqWindow_safeBodyUnit`'s NESTED arm needs `SeqPathAllSeq tokens (lo-1)` re-established at each descended CHILD bracket body, which the blueprint named "the btFold-push preservation of `SeqPathAllSeq` across a located `[`" — a presumed NEW edge. The de-risk found it is NOT new: reaching the child opener `n` is a PUSH across the located `[` at `k` (`seqPathAllSeq_descend`, R337, landed) THEN a FRAME across the earlier sibling entries `[k+1, n)` (the child opener need not be the FIRST entry — `seqPathAllSeq_advance`, R357, landed); both edges were ALREADY composed for the NAVIGATOR (`nestedSeq_recseqentry_locate_descend_step`/`_advance_step`), so the joint CARRIER induction's descend edge is the SAME composition — the one-line `seqPathAllSeq_into_child`, no new edge owed. Toy: `Tok`/`step`/`fold` a typed bracket stack (`[` pushes `true`, `]` pops a matching `true`, `,` identity — the `btStep`/`btFold` analog); `AllSeq pre` the path invariant (`SeqPathAllSeq` analog); `allSeq_push` THE LOCATED EDGE (`seqPathAllSeq_descend` analog); `Balanced`/`fold_frame`/`allSeq_frame` THE FRAME (a Dyck sibling run returns the stack unchanged — `WellTyped_frame`/`seqPathAllSeq_advance` analog); `allSeq_into_child := allSeq_frame ∘ allSeq_push` THE COMPOSITE residual, NO new edge. POSITIVE: the composite reaches the child opener PAST a complete sibling entry `[],` (the FRAME bridges positions 1→4 the bare PUSH cannot). NEGATIVE: drop `Balanced` and an unbalanced "sibling" `]` pops out of the enclosing bracket, emptying the stack — `AllSeq` FAILS, so push-at-origin alone cannot reach the child opener. Applies [[ref-compose-arm-seam-before-skeleton]] to a sibling producer's edge; the residual-is-already-built dual of [[ref-reduction-by-import]])
* `BoundaryInclusiveNeedsSiblingNotCoercion` — Reflection 470 (an INTERIOR-only producer cannot be COERCED UP to a BOUNDARY-INCLUSIVE window — author the OPENER-INCLUSIVE sibling instead, and it SHEDS the empty-case guard. The seq carrier↔recursion co-construction's last residual `h_widthEnc` hands the enclosing opener `p`'s window to `seqDescent_provider_of_located`, which consumes `FlowBodyWindow tokens p hiE` SOLELY to drive `flowBracketBalance_matching_close tokens p p hiE` — a re-scan that needs `bal` to START AT the opener `p` (`balance p hiE = 0`, opener-INCLUSIVE). The landed `flowBodyWindow_descend` (R285) delivers the INTERIOR `[k+1, j)` (opener-EXCLUSIVE), guarded on non-emptiness `k+1 < j`. The de-risk: do the enclosing-window facts re-base from the parent's `FlowBodyWindow` or need a new producer? SUBTLE BOTH — they re-base (same `flowBracketBalance_matching_close` + `WellTyped_subrange`) but NOT through `flowBodyWindow_descend`: the interior producer threw away the opener+closer, so it cannot be coerced up. The brick `flowBodyWindow_child_bracket` is the opener-inclusive sibling delivering `FlowBodyWindow tokens k (j+1)`; and because `[k, j+1)` is never empty it sheds the R285 guard. Toy: `bal` a token-list balance (`+1`/`-1`/`0`, the `flowBracketBalance` analog; `bal_cons`/`bal_append` the single/compose analogs); `interiorWindow I = I` (opener-EXCLUSIVE, `flowBodyWindow_descend`); `boundaryWindow I = (1::I)++[-1]` (opener-INCLUSIVE, the consumer's need); `closeAtEnd` THE CONSUMER (re-scans from the start as a single bracket — `matching_close` analog); `bal_boundaryWindow` the sibling's `balanced` field. POSITIVE/NEGATIVE on `I=[1,-1,1,-1]` (`[][]`, balanced but TWO sub-brackets): the consumer HOLDS on `boundaryWindow`, FAILS on `interiorWindow` (its prefix returns to 0 internally) — both balanced, only the opener-inclusive one re-scannable. EMPTY case `I=[]`: `interiorWindow []=[]` (degenerate, the guarded case) vs `boundaryWindow []=[1,-1]` nonempty + consumer holds — the sibling sheds the guard. Dual of [[ref-coerce-to-weaker-reuse-wrapper]] (coerce DOWN to weaker works; coerce UP to boundary-inclusive does not); the arity/storage delta is the two brackets [[ref-mirror-constructor-arity-reads-storage]]; the shed guard is [[ref-near-leaf-mirror-sheds-machinery]]'s opposite-sign storage asymmetry)
* `BoundaryInclusiveSiblingCascade`      — Reflection 471 (the BOUNDARY-INCLUSIVE SIBLING CASCADE: when a BUNDLED multi-structure deliverable needs the opener-inclusive convention, EACH structure owes its own opener-inclusive sibling, but the COST is GRADED and the boundary token INVERTS which field is hardest. R470's `h_widthEnc` does not deliver one structure — it delivers a BUNDLE over the same window `FlowBodyWindow ∧ FlowBodyContentDeep ∧ FlowBodyContent tokens p hiE`. Reading the cascade: (1) `FlowBodyWindow` — the LOCATING structure, DEAREST: searches for the close `j` (`flowBracketBalance_matching_close`) + rebuilds dyck/`WellTyped`, axioms `[propext, Classical.choice, Quot.sound]`; (2) `FlowBodyContentDeep` — BALANCE-FREE/window-ABSOLUTE, CHEAP: a PURE RESTRICTION (quantifier domain `[k,j+1) ⊆ [lo,hi)` by `omega`, `j` handed in), axioms `[propext, Quot.sound]` — it DROPS the `Classical.choice` the window sibling keeps; the AXIOM SET is the cost meter; (3) `FlowBodyContent` — the depth-`0` PROJECTION, FREE via `flowBodyContent_of_deep` (residuals vacuous against the interior floor). The brick `flowBodyContentDeep_child_bracket` lands #2. THE HEAD FIELD INVERTS: in the INTERIOR sibling `flowBodyContentDeep_descend` the head `tokens[k+1]` is the HARDEST field (read off the PARENT's all-depth opener-content fact, a nesting level down); in the OPENER-INCLUSIVE sibling the head IS the boundary token (the opener `tokens[k]`, content-start by its own `flowBracketDelta = 1` ⟹ `flowSeqStart`/`flowMapStart`, both `isFlowContentStart`) — FREE, no parent. The boundary that complicates the CONSUMER simplifies the PRODUCER's head — the [[ref-near-leaf-mirror-sheds-machinery]] opposite-sign asymmetry on a FIELD not a guard; and like the window sibling it sheds the `k+1 < j` interior-non-emptiness guard. Toy: `tok xs i` the `tokens[i]!` analog (`1` opener/`-1` closer/`0` scalar, delta=token); `isContentStart t := 0 ≤ t`; `contentStart_of_opener` the boundary-token head bridge (opener `=1` ⟹ content-start free); `DeepGuard` the `FlowBodyContentDeep` analog (head + window-absolute `openerCS`); `deepGuard_descend` the interior sibling (head READS the parent `h.openerCS k`); `deepGuard_child_bracket` the opener-inclusive sibling (head FREE `contentStart_of_opener h_open`, same `openerCS` restriction, `k+1<j` guard SHED). Concrete: interior head `tok [1,0,-1] 1 = 0` is a SCALAR ≠ opener, so the bridge does NOT apply — descend needs the parent; boundary head `tok [1,0,-1] 0 = 1` always the opener, always free. Continues [[ref-boundary-inclusive-needs-sibling-not-coercion]] (R470); the cost gradient sharpens [[ref-additive-parallel-type-over-shared-edit]]; the FREE projection #3 is [[ref-conjunct-of-projection-is-free-field]])
* `EnclosingFrameRekeysWidthRecursion`   — Reflection 472 (a width strong-induction whose per-window obligation references the ENCLOSING FRAME — one bracket-level OUT, wider by exactly 2 — CANNOT be keyed on the inner BODY width: the IH `< bodyWidth` never reaches the frame obligation at `bodyWidth + 2`; RE-KEY on the ENCLOSING-FRAME width, where the outermost frame is the base and every descent goes strictly INWARD. The SMALLEST-FIRST de-risk R470/R471 queued before authoring the seq carrier↔recursion JOINT WIDTH STRONG-INDUCTION. The queued plan: `Nat.strongRecOn` on BODY width `hi - lo` co-producing the carrier `SeqInteriorSeparators tokens lo hi` and `RecSeqBody` per body window. The queued de-risk: does the child window `[p, hiE)` produced by the R470/R471 siblings satisfy `hiE - p < hi - lo`? OUTCOME — NO, structurally: the carrier quantifies over every gated `[a,b) ⊆ [lo,hi)`, and for a TOP-LEVEL gated window (`balance lo a = 0`) `seqEnclosingOpener_of_gate` locates `p = lo - 1` — the body's OWN bracket opener, OUTSIDE the body — with matching close `j = hi`, so the obligation references the FRAME `[lo-1, hi+1)`, width `(hi - lo) + 2`. A body-width IH `< hi - lo` can never reach `hi - lo + 2`. Confirmed by balance arithmetic on the real types: `balance (lo-1) a = 1 + balance lo a = 1` pins the nearest enclosing opener to `lo-1`, and the `.flowSequenceEnd` at `hi` with `balance lo hi = 0` pins its matching close to `hi`. The gap widths are benign in CONSUMPTION (the child `SafeBodyUnit` reads the IH only at the body's entries, all `< hi-lo`) but not in the TYPE: width `hi-lo` has exactly one inhabited frame-interior window — `[lo,hi)` itself, whose `RecSeqBody` is the pair's other half (self-reference); width `hi-lo+1` is vacuous. PIVOT: re-key on the ENCLOSING-FRAME width — the document bracket `[1, size-1)` is the outermost/largest frame (base case), nested frames are strictly narrower (`frameWidth - 2`), so the IH guard and the FRAME-shaped obligation index coincide with no `+2` gap. Toy: `bodyWidth`/`frameWidth` the body `[lo,hi)` and frame `[lo-1,hi+1)`; `frame_eq_body_add_two` the `+2` gap (`omega`); `frame_index_exceeds_body_ih` the obstruction (`¬ (w+2 < w)`); `solveFrame` the RE-KEYED `termination_by` recursion descending `frameW - 2 < frameW` (CLOSES via `frame_descends`). Concrete: body `[2,6)` width 4, frame `[1,7)` width 6 = 4+2; `solveFrame 6 = 3` (6→4→2→0). Runs the de-risk queued by [[ref-boundary-inclusive-sibling-cascade]] (R471) + [[ref-boundary-inclusive-needs-sibling-not-coercion]] (R470); sharpens [[ref-probe-deferred-universal-before-producing]] and [[ref-width-recursion-combinator-before-grammar-step]] (the recursion MEASURE itself is the de-risk, not just the grammar step))
* `DroppedBranchGuardMisMeasuresRecursion` — Reflection 473 (a width-recursion producer that DROPS the BRANCH-GUARD selecting its sub-case MIS-DIAGNOSES its recursion MEASURE — **CORRECTS Reflection 472**. R472 concluded the seq carrier↔recursion joint induction had to be re-keyed from BODY width onto ENCLOSING-FRAME width, because a gated sub-window's enclosing opener was found at `p = lo - 1` (the body's own bracket opener, OUTSIDE the body), making the obligation reference the frame `[lo-1, hi+1)` of width `(hi-lo)+2`. WRONG BRANCH: the dispatcher `seqInteriorSeparators_of_safebody_and_descent` CASE-SPLITS every gated `[a,b) ⊆ [lo,hi)` on `flowBracketBalance tokens lo a = 0` — the `then` branch (`balance lo a = 0`, a TOP-LEVEL window) is handled directly from the flat root `SafeBodyUnit` (`seqEnclosingFacts_provider_of_located`, `loS=lo,hiS=hi`, no descent), and THAT is the `p = lo - 1` case; the `else` branch (`balance lo a ≠ 0`, strictly NESTED) is the ONLY branch `desc`/`h_widthEnc` handles. Under that guard the located opener cannot be `lo - 1` (`p+1=lo` ⟹ `balance (p+1) a = balance lo a ≠ 0`, contradicting the locator's `balance (p+1) a = 0`), so `lo ≤ p`, the frame `[p,hiE) ⊆ [lo,hi)`, width `hiE - p ≤ hi - lo` (NEVER `+2`), and the body-width IH (`< hi-lo`) covers the frame IH (`< hiE - p ≤ hi - lo`) with NO gap — the `<` is strict so even the equality case `p=lo,hiE=hi` is covered. The real bug: `h_widthEnc`'s signature DROPS the `balance lo a ≠ 0` guard (`_hbal`, bound by `desc` and in scope at the call site, but not passed) — the producer-guarded-quantifier trap ([[ref-producer-guarded-quantifier]]): unguarded it must hold for `p = lo - 1`, demanding the UNINHABITABLE `FlowBodyWindow tokens 1 hiE` (`lo_ge : 2 ≤ lo` excludes the document bracket). FIX: thread the guard into `h_widthEnc`, keep body-width keying — NO re-keying. Toy: `BodyWin`/`boundary_frame_uninhabitable` the `lo_ge` uninhabitability of `[1,…)`; `guard_excludes_document_opener` the restored guard (`bal lo a ≠ 0` + `bal (p+1) a = 0` ⟹ `p+1 ≠ lo`, any `bal`); `frame_le_body` the containment `hiE - p ≤ hi - lo`; `body_ih_covers_frame_ih` the no-gap coverage (contrast R472's `¬ (w+2<w)`); `r472_thenBranch_is_plus_two` the `+2` frame as the `then`-branch case `desc` never sees. Corrects [[ref-enclosing-frame-rekeys-width-recursion]] (R472); the dropped guard is [[ref-guarded-universal-fold-relocates-guard]] / [[ref-reconstruct-in-place-over-relocate]] (a guard relocated into the producer's contract); sharpens [[ref-probe-deferred-universal-before-producing]] (probe WHICH branch the producer serves before measuring))
* `GuardThreadingIsSignatureOnly`        — Reflection 474 (repairing the producer-guarded-quantifier trap is a SIGNATURE-ONLY edit while the deferred hypothesis is VERIFIED-BUT-UNCONSUMED — the EDIT R473 queued and this turn LANDED. The dropped guard the deferred `h_widthEnc` needs (`flowBracketBalance tokens lo a ≠ 0`) is ALREADY bound at the dispatcher's `else` branch as `_hbal` (it is `desc`'s 4th argument), so threading it cost exactly (one signature conjunct) + (one already-in-scope argument at the call site), touched NO consumer (the lemma is verified-but-unconsumed), kept the build green and frontier at 4, and flipped `h_widthEnc` from UNSATISFIABLE — as stated it had to inhabit `FlowBodyWindow tokens 1 hiE` at `p = lo - 1` — to satisfiable (every instance now has `lo ≤ p`). The reusable point is the TRAP'S REPAIR COST IS ASYMMETRIC IN TIME: free while unconsumed (rename a dropped binder into the signature; nothing supplies the hypothesis so nothing breaks), expensive once a supplier exists (the supplier inherits the previously-impossible obligation and must redo the hidden satisfiability work). Toy: `Deliv` inhabited only at `2 ≤ a` (`FlowBodyWindow.lo_ge` analog); `provU_unsatisfiable` the unguarded hypothesis `∀ a, 1 ≤ a → Deliv a` is unsatisfiable (boundary `a=1` demands `2 ≤ 1`) yet type-checks as a hypothesis; `provG_satisfiable` the guarded `∀ a, 1 ≤ a → a ≠ 1 → Deliv a` is a CLOSED term; `dispatch` case-splits on `a = 1` and the `else` branch BINDS `h : a ≠ 1` to feed the provider (mirrors `_hbal` in scope at the `h_widthEnc` call); `cost_is_one_in_scope_argument` the delta is exactly that one in-scope argument. Sharpens [[ref-producer-guarded-quantifier]] with the timing/cost corollary; lands the fix R473 ([[ref-dropped-branch-guard-mis-measures-recursion]]) queued; the guard relocated into the contract is [[ref-guarded-universal-fold-relocates-guard]])
* `ContainedFrameIHFromOuterIH`          — Reflection 475 (a width-gated IH over an inner CONTAINED frame `[p, hiE) ⊆ [lo, hi)` is dischargeable from the OUTER joint width IH, and the per-step ASSEMBLE that does it ISOLATES the locator while SIDESTEPPING the SafeBodyUnit ↔ carrier ↔ recursion circularity — the brick `seqWidthEnc_of_enclosingLocate_and_recIH` landed this turn. `h_widthEnc`'s deliverable, per gated window `[a,b)` with enclosing opener `p`, is the ENCLOSING-WINDOW facts of a frame `[p, hiE)` PLUS a `RecSeqBody` IH for THAT frame's sub-windows, gated by the FRAME width `hi' - lo' < hiE - p`. The joint induction's own IH is gated by the BODY width `hi' - lo' < hi - lo`. The two gates differ, so the inner IH is not literally the outer one — yet the locator delivers the frame INSIDE the body (`lo ≤ p`, `hiE ≤ hi`), and those two containments give `hiE - p ≤ hi - lo`, so the inner gate IMPLIES the outer (`hi' - lo' < hiE - p ≤ hi - lo`) and the same containments lift `p ≤ lo'` / `hi' ≤ hiE` to `lo ≤ lo'` / `hi' ≤ hi` — all three obligations pure `omega`. The assemble composes the LOCATE residual (`enclosingLocate`, returning the contained frame) and the joint width IH (`recIH`), proving the width arithmetic R473 flagged and isolating the LOCATOR as the single residual; it touches NO `SafeBodyUnit`/carrier (that circular construction is the SEPARATE `seqLocalCarrier_of_widthEnc` step), so it is the half of the joint induction that sidesteps the circularity. Toy: `inner_frame_IH_from_outer_IH` the structural heart (frame-gated IH from body-gated IH under the two containments, three `omega`s the bridge); `assemble` the full `∃`-frame per-step assemble mirroring the real lemma; `bridge_needs_containment` the containment is LOAD-BEARING (drop it, pick a frame WIDER than the body `hiE - p > hi - lo`, and the inner gate no longer implies the outer — `5 < 10-0` but `¬ 5 < 1-0`); a concrete non-vacuous run. Builds on [[ref-dropped-branch-guard-mis-measures-recursion]] (the width arithmetic) + [[ref-guard-thread-free-while-unconsumed]] (R474, which made `h_widthEnc` satisfiable); applies [[ref-parametric-assembler-extraction]] / [[ref-probe-provider-satisfiable-before-assembler]] (lift the locator, land the assemble))
* `ContainmentFromFloorConflict`         — Reflection 476 (the load-bearing LOWER containment `lo ≤ p` of the (α) `enclosingLocate` residual — the first sub-piece of R475's locate boundary — falls out of a BALANCE-ADDITIVITY contradiction against the LOCATOR's OWN Dyck floor, touching NO content structure and NO close location. The brick `seqLocatedOpener_within_body` landed this turn. Two floors are in hand at DIFFERENT origins: the body window's Dyck floor gives `bal lo a ≥ 0` and the gate's `≠ 0` lifts it to `bal lo a ≥ 1` (the nested start `a` sits at depth ≥1 relative to `lo`); the backward-locator delivers its OWN interior floor `bal (p+1) i ≥ 0` over `[p+1, a]` plus the balanced body `bal (p+1) a = 0`. If the opener escaped the window (`p < lo`, so `p+1 ≤ lo ≤ a`), composing the located body balance at the cut point `lo` gives `0 = bal (p+1) a = bal (p+1) lo + bal lo a`, forcing `bal (p+1) lo = -(bal lo a) ≤ -1 < 0` — contradicting the locator's floor at `lo`. So `lo ≤ p`: the locator's interior floor FORBIDS the opener sitting before the window start. One `flowBracketBalance_compose` + `omega`, no `FlowBodyWindow`/content build. Toy: `opener_within_window` the structural heart (`bal` abstract additive, sole law = interval composition); `depth_pos_of_floor_and_ne` the ≥0+≠0⇒≥1 step (the only use of the gate's nonzero hyp); `needs_locator_floor` the floor is LOAD-BEARING (a `bal` with `bal 5 10 = 1`, `bal 1 10 = 0` admits `lo=5, a=10, p=0` with all non-floor premises true yet `5 ≤ 0` false); a concrete potential-difference run. The two containments it begins delivering are exactly what `ContainedFrameIHFromOuterIH` (R475) consumes; applies [[ref-parametric-assembler-extraction]] (sub-piece-by-sub-piece of the lifted locator). The demo's END-dual section also records R477 `seqLocatedClose_within_body` — the UPPER containment `hiE ≤ hi` from the CLOSE-locator's interior floor against the enclosing total — the mirror to the other window end)
* `ReexportErasedDependencyFact`          — Reflection 478 (RE-EXPORT, don't re-derive: a downstream consumer that ERASES a fact its OWN dependency already computed forces a PARALLEL WRAPPER that RE-RUNS the dependency keeping the dropped binder, and consuming the sibling brick proven for the erased fact forces file placement AFTER it. The brick `seqClose_of_located_and_enclosing_within` landed this turn — the α.1-remaining sub-piece of the (α) `enclosingLocate` residual. `seqClose_of_located_and_enclosing` locates a matching close via `flowBracketBalance_matching_close_seq`, which delivers BOTH `j < hi` AND the located interior's Dyck floor — but the locator `_`-DROPS the floor and OMITS `j < hi` from its return type, leaving the (α) existential still owing the UPPER containment `hiE ≤ hi` and the floor that the dependency ALREADY computed. The new locator re-runs the dependency keeping the floor (an [[ref-additive-parallel-type-over-shared-edit]] sibling — the original is consumed elsewhere, not edited) and discharges `hiE ≤ hi` via R477 `seqLocatedClose_within_body`, which CONSUMES R477 ([[ref-reduction-by-import]]: the wiring retypes the residual). Consuming a later definition is a forward reference Lean rejects — the real turn hit `unknownIdentifier` placing the locator beside its sibling (which precedes R477), so it lives AFTER R477. Toy: `consumer_erases` (projects `P` from `P ∧ Q`, the erasure); `reexport` the structural heart (re-runs the dependency keeping `Q`, applies the sibling to recover `R`); `erasure_is_genuine` the negative (`R` is NOT recoverable from `∃ w, P w` alone — `P:=True`, `Q:=R:=False` admits the consumer's `∃ w, P w` yet `∃ w, P w ∧ R w` is FALSE, so re-export is NECESSARY); `sibling_le`/`reexport_concrete` the by-name, placement-forcing variant; two concrete non-vacuous runs. Sharpens [[ref-reduction-by-import]] (the dependency already computed the fact; the consumer threw it away — re-run, don't re-derive) and [[ref-additive-parallel-type-over-shared-edit]] (the re-export is a sibling, not an in-place return-type edit))
* `WeakFamilyMemberProjectsDepthFree`    — Reflection 479 (the WEAK member of a child-window structure family PROJECTS its strong sibling through the family's existing `strong→weak` projector, residuals VACUOUS against the window's own interior floor — and is DEPTH-AGNOSTIC because the floor is keyed on the CHILD origin. The brick `flowBodyContent_child_bracket` landed this turn — the (α.2) content half of the seq `enclosingLocate` residual, the THIRD and final opener-inclusive child-bracket sibling completing the trio `{flowBodyWindow_child_bracket, flowBodyContentDeep_child_bracket, flowBodyContent_child_bracket}`. `FlowBodyContent` is a PROJECTION of `FlowBodyContentDeep` (the family ships the projector `flowBodyContent_of_deep`), so the weak member is NOT a fresh producer: pipe the all-depth deep sibling (`flowBodyContentDeep_child_bracket`) through that projector and discharge its two residuals (`bodySucc`, `noTrailingSep`) VACUOUSLY — the only child-origin balance-`0` prefix ends in `[k, j+1)` are the two ENDPOINTS (the opener sits at balance `≥ 1` by the floor so its `=0` premise fails; the close takes the trivial left disjunct and contradicts the `.flowEntry` premise via its own `.flowSequenceEnd` type). DEPTH-AGNOSTIC: the strict floor is keyed on the CHILD origin `k` (`balance k i ≥ 1`), so NO `balance lo k = 0` discriminator appears — the depth caveat lives ENTIRELY in the LOCATING sibling's outer-origin scan, the family splitting into a depth-NEEDING locator and a depth-FREE projector. Toy: `Floor`/`Content`/`content_of_deep` model the family + projector; `content_child_bracket` the structural heart (pipe `deep` through the projector, both residuals from the `k`-keyed floor + close type); `floor_is_load_bearing` the negative (drop the floor and an INTERIOR balance-`0` at `i=2` breaks `bodySucc`, demanding `1 = 3`); a concrete non-vacuous run. Realizes the projection `flowBodyContentDeep_child_bracket`'s doc only PROMISED; instance of [[ref-complete-projection-family-for-new-member]] (the content member's PROJECTION obligation) reusing the projector per [[ref-coerce-to-weaker-reuse-wrapper]], residuals discharged as [[ref-boundary-residual-end-dual]] vacuous boundary facts)
* `ScanOwnsTheDepthDebt`                  — Reflection 480 (the depth-`0` premise belongs to the LOCATING SCAN, not to any family member: take the located close as INPUT and EVERY child-window constructor is DEPTH-AGNOSTIC — a sharpening of R479. The brick `flowBodyWindow_child_bracket_at` landed this turn — the WINDOW member of the "given close" child-bracket trio, completing `{flowBodyWindow_child_bracket_at, flowBodyContentDeep_child_bracket, flowBodyContent_child_bracket}` for the (α) `enclosingLocate` assemble. `flowBodyWindow_child_bracket` LOCATES the matching close `j` via the forward scan `flowBracketBalance_matching_close`, and THAT scan is the SOLE reason it needs the depth-`0` discriminator `balance lo k = 0` (the scan reads the close off the `lo`-keyed balance returning to depth `0`, which coincides with the bracket's own close only at depth `0`). R479 showed the PROJECTED content member is depth-free; this shows the directly-CONSTRUCTED window member is too — remove the scan (take `j`, the interior balance, the closer delta, and the CHILD-ORIGIN floor `balance k i ≥ 1` as INPUTS) and `balanced`/`dyck`/`wellTyped` carry NO `balance lo k = 0`. The family splits into ONE depth-needing locator + THREE depth-free "given close" constructors, all keyed on `k`. Axioms IDENTICAL to its sibling `flowBodyWindow_child_bracket` (`[propext, Classical.choice, Quot.sound]`; the `Classical.choice` is inherited from `WellTyped_subrange`'s typed transport, not the proof) — no `sorryAx`. Toy: `childBal B k i = B i - B k` makes the depth offset visible as the `- B k` term; `win_given_close` the depth-free constructor (`balanced` cancels `B k` by composition, `dyck` reads `≥ 1` off the floor); `scan_misses_true_close_when_nested` the negative on a nested `k=1` (`Bex 1 = 1 ≠ 0`) where the scan FIRES at the enclosing close `j=4` and MISSES the true close `j=3`; `scan_aligns_at_depth_zero` (depth-`0` is what makes the scan condition `B(j+1)=0` coincide with the child-balance close); `floor_is_load_bearing` (drop the floor and an interior dip to `-1` breaks `dyck`); a concrete non-vacuous run. Sharpens [[ref-weak-family-member-projects-depth-free]] (the depth caveat lives in the locator, the constructors are depth-free — generalized from the projected member to ALL members) via [[ref-rebase-fact-from-enclosing-window]])
* `GenericDiscriminantUnderdeterminesOutput` — Reflection 481 (a GENERIC-discriminant premise underdetermines a TYPE-SPECIFIC output — surface the refinement as an explicit hypothesis, don't derive it. Discovered while landing the brick `seqEnclosingLocate_of_seqOpener_at_depth` this turn — the (α) `enclosingLocate` ASSEMBLE for the seq child, feeding ONE located close UNIFORMLY to all three "given close" child-bracket constructors (R479/R480) to deliver `lo ≤ p ∧ ∃ hiE, b ≤ hiE ∧ hiE ≤ size ∧ hiE ≤ hi ∧ FlowBodyWindow/Deep/Content tokens p hiE`. `seqWidthEnc_of_enclosingLocate_and_recIH` (R475) hands the assemble the GENERIC located-opener premise `flowBracketDelta tokens[p]!.val = 1` ("`p` is some opener") — but `delta = 1` admits BOTH `.flowSequenceStart` (`[`) and `.flowMappingStart` (`{`), while the seq output `FlowBodyContent`/the close locator (R478) force a `[`. So the type-specific refinement `tokens[p]!.val = .flowSequenceStart` is PROVABLY NOT derivable from the generic premise — a `{`-opener satisfies it yet has a map child. The honest move: take the refinement (and the depth-`0` discriminator `balance lo p = 0`, R478's sole depth sink) as EXPLICIT hypotheses, retyping the residual from "build `enclosingLocate`" to the strictly smaller "at the located `p`, discharge seq-opener-type + depth-0" — pure boundary facts, no more structure. The assemble's job is to SURFACE the irreducible refinement as a named consume-side residual, not invent a derivation that cannot exist. The five moves: (1) `lo ≤ p` (R476), (2) locate close `hiS` (R478), (3) child-keyed floor `balance p i ≥ 1` by one compose through the opener, (4) `hiS < hi` from `balance lo hiS = 1 ≠ 0 = balance lo hi`, (5) the three depth-free constructors at `k := p, j := hiS, hiE := hiS + 1`. Toy: `isOpener` (the generic `delta=1`, admits `seqOpen`+`mapOpen`) vs `isSeqOpener` (the refinement, admits only `seqOpen`); `SeqChild` the typed output; `seqChild_of_seqOpener` the constructor from the refinement; `generic_opener_underdetermines` the negative (`isOpener .mapOpen ∧ ¬ SeqChild .mapOpen` — the `{` satisfies the premise yet has no seq output); `seqOpener_implies_opener` (the refinement is strictly stronger); `seqOpener_of_seqChild` (the converse — the refinement IS recoverable once the OUTPUT pins the type, so the irreducibility is purely about the too-generic INPUT premise). Same shape as the head-blind/end-free gate findings ([[ref-probe-provider-head-blind-gate]], [[ref-end-free-gate-underdetermines-close]]) but on the CONSUMER's supplied premise, not the producer's precondition; the assemble pays the family's depth once at the locator per [[ref-scan-owns-the-depth-debt]])
* `DepthGeneralMatchingClose`            — Reflection 482 (the located encloser is at depth ≥ 1, so the close locator must be DEPTH-GENERAL; the matching-close scan is purely RELATIVE, so the depth-0 lemma re-bases mechanically. Discovered while trying to WIRE the R481 seq assemble `seqEnclosingLocate_of_seqOpener_at_depth` into `seqWidthEnc_of_enclosingLocate_and_recIH` (R475): the seq carrier `seqLocalCarrier_of_widthEnc` locates each gated window's INNERMOST enclosing opener `p` (`seqEnclosingOpener_of_gate`) and asks `enclosingLocate` for `p`'s span `[p, hiE)`. For a DEEPLY-NESTED gated window `p` sits at depth ≥ 1, so the assemble's `h_p_depth : balance lo p = 0` — inherited from `seqClose_of_located_and_enclosing_within` ⟸ `flowBracketBalance_matching_close_seq`'s `h_k_depth` — is FALSE; the depth-0-only close locator cannot find a nested opener's close. (The OTHER discriminator `h_open : .flowSequenceStart` is FREE in the consume context — `seqOpenerType_of_located_and_gate` derives it from the gate's enclosure mark; only `h_p_depth` was the gap, and it is not even true.) The fix is RE-BASE not RE-RESTRICT: the matching-close scan never reads the opener's absolute depth — every clause is a DIFFERENCE from `balance lo k` — so `flowBracketBalance_matching_close` generalizes to a nested opener by substituting the return level `0 ↦ balance lo k` and the post-opener level `1 ↦ balance lo k + 1`; the global Dyck floor `≥ 0` survives only to pin `d ≥ 0` (the recurse step switches to the threaded interior invariant). The landed production brick: `flowBracketBalance_matching_close_nested` (`ParserGrammableBase.lean`), the depth-general BALANCE core, axioms `[propext, Classical.choice, Quot.sound]`, no `sorryAx`. Toy: `matchesClose B k j` states the close relation as differences from `B k`; `matchesClose_shift` proves it INVARIANT under a uniform shift `B' = B + c` (the formal content of "depth-relative, so depth-0 re-bases to any depth"); `depth0_precondition_fails` the obstruction (`Bnest 1 = 1 ≠ 0` — the nested opener); `nested_opener_has_matching_close` (`matchesClose Bnest 1 3` — the close IS locatable at depth 1). The shift does NOT transfer the global floor (`B i ≥ 0 ↦ B' i ≥ c`), which is why the real proof re-proves rather than reduces. Continues [[ref-scan-owns-the-depth-debt]] (R480 located the depth debt in the scan; this pays it by generalizing the scan) via [[ref-rebase-fact-from-enclosing-window]])
* `NestedTypedLocatorIsAFrame`           — Reflection 483 (the nested TYPED close locator is a FRAME, not a re-proof — and the frame is CLEANER than the hand-rolled depth-0 special case. The typed half of the R482 obstruction: `seqEnclosingOpener_of_gate` returns a depth-≥1 innermost opener, so the typed locators' `h_k_depth : balance lo k = 0` is FALSE too. R482 fixed the BALANCE core by RE-BASING (a scalar shifts uniformly under nesting, so the proof re-derives against `balance lo k`, since the global Dyck floor does not shift-transfer). R483 fixes the TYPED layer by FRAMING: the nested opener sits over a base stack `s_k` whose bottom `d` markers are INERT across the positive-depth span, so the depth-0 argument frames by `s_k` — opener pushes `b :: s_k` (`btStep_frame`), the balanced `WellTyped` interior folds from `b :: s_k` back to `b :: s_k` (`WellTyped_frame`, replacing the depth-0 proof's bespoke `btFold_getLast?_preserved`), and `btStep_frame_inv` strips `s_k` off the close — collapsing the nested `btStep tokens[j]! (b :: s_k) = some s_k` to the IDENTICAL depth-0 `btStep tokens[j]! [b] = some []`, so the close-type readers `btStep_pop_eq_{seqEnd,mapEnd}` apply VERBATIM. The dividing line: RE-BASE when the carrier is a scalar difference; FRAME when it is a stack with an inert suffix. Landed (verified-but-unconsumed, axioms `[propext, Classical.choice, Quot.sound]`, frontier still 4): `matching_close_typed_{generic,core}_nested` + `flowBracketBalance_matching_close_{seq,map}_nested` in `WellBracketed.lean` part 5.5 — all DROP `h_k_depth` and take the relative interior floor the balance core outputs (so the seq/map wrappers are simpler than their depth-0 originals — no `flowBracketBalance_interior_dyck` re-derivation). Toy: `step`/`fold` stack machine, `step_frame`/`fold_frame` the two framing engines, `fold_frame_self` the "balanced body returns to ANY prefix" (`WellTyped_frame` analogue), `nested_close_via_frame` the punchline (the nested close IS the depth-0 close framed by `s_k`), and `nestedWord`/`inner_close_is_framed` a concrete depth-1 `[ { x } ]` witness. Contrast `DepthGeneralMatchingClose` (R482, the BALANCE re-base) — same obstruction, complementary repair shapes)
* `DepthHypCostIsItsEqualityReads`        — Reflection 484 (a base-depth hypothesis `h_p_depth : balance lo p = 0` costs exactly its EQUALITY reads to drop — countable by grep before editing. The CONSUME side of R483: once the depth-general PRIMITIVE exists (`flowBracketBalance_matching_close_seq_nested`, [[NestedTypedLocatorIsAFrame]]), re-proving a consumer without `h_p_depth` is scoped by tracing where the hypothesis is READ. Two kinds: a FLOOR read (a fact from the Dyck floor `≥ 0`, monotone/frame-stable — never touches `h_p_depth`, free at every depth) vs an EQUALITY read (an `rw [h_depth]` substituting the pinned `= 0` — depth-BOUND, gone at depth ≥ 1, the downstream `omega` must re-derive from `≥ 0`). Cost(drop) = (locator call → pure SWAP to the depth-general twin) + (one re-derivation per `=0`-equality read). R484 landed `seqClose_of_located_and_enclosing_within_nested` (`SeqInteriorSeparators.lean`): it has ZERO equality reads — every downstream fact (`a ≤ j`, `balance a j = 0`, `b ≤ j`, upper containment `j ≤ hi` via `seqLocatedClose_within_body`) is a floor read off the enclosing `≥ 0`, so dropping `h_p_depth` is a pure swap (`…_seq` → `…_seq_nested`), body byte-identical, axioms `[propext, Classical.choice, Quot.sound]`, frontier still 4. The SIBLING R481 `seqEnclosingLocate_of_seqOpener_at_depth` has exactly ONE equality read — step (4)'s `rw [h_p_depth] at hc1` computing `balance lo hiS = 0 + 1 = 1`; dropping it there costs swapping to `balance lo hiS = d + 1 ≥ 1 > 0` from `d ≥ 0` (the next brick). Toy: `closeN`/`close0` (the depth-general locator subsumes its `d = 0` special case), `consumerA0`/`consumerAN` the pure-swap pair (floor-only reads, byte-identical bodies), `consumerB0`/`consumerBN` the equality-read pair (the `rw [h]` becomes one `omega` re-derivation), and `consumer{A,B}_general_subsumes` witnessing the general consumers reproduce the depth-0 ones. Pairs with [[NestedTypedLocatorIsAFrame]] (the primitive) and [[ScanOwnsTheDepthDebt]])
* `SurfacedResidualFreeAtWiring`          — Reflection 486 (a refinement surfaced as an explicit consume-side residual is often discharged FOR FREE at the wiring site from a CO-LOCATED invariant the consumer already carries — the POSITIVE closure of R481 `GenericDiscriminantUnderdeterminesOutput`. R481 proved the seq assemble's `tokens[p]!.val = .flowSequenceStart` is NOT derivable from the generic slot premise `flowBracketDelta tokens[p]!.val = 1` (a `{` satisfies `delta = 1` yet has a map child), so it SURFACED the refinement as an explicit hypothesis `h_open`. R486 wires that assemble into R475 via `seqWidthEnc_of_recIH`: the surfaced `h_open` costs the caller NOTHING because the SAME gate that delivers `SeqTypedInterior tokens a b` also carries the enclosing-type MARK (its `btFold`-top `= some true` conjunct `hgate.2.1`), and `seqOpenerType_of_located_and_gate` RECONSTRUCTS the `[` from `delta = 1` + that mark + the locator floor — the residual is discharged in place at the wiring and never reaches R475's caller interface. The discriminating question is not "does the producer's NAMED premise determine the refinement?" (R481: no) but "does SOME fact co-located at the wiring determine it?" (R486: yes — the gate mark); a residual is only truly owed by the caller if NO co-located invariant pins it. Toy: a 3-token alphabet `seqOpen`/`mapOpen`/`content`; `delta1` (the weak discriminator, admits `[` and `{`) and `markTrue` (the co-located mark, admits `[` and `content`); `delta1_alone_underdetermines` + `mark_alone_underdetermines` show each premise alone admits a non-output witness (so neither pins the output by accident); `reconstruct` (toy `seqOpenerType_of_located_and_gate`) pins `isSeqOpener` from BOTH; `wire` (toy `seqWidthEnc_of_recIH`) builds the typed `SeqChild` from the weak discriminator + mark with NO refinement in its interface; `seqOpener_of_seqChild` the converse closing the loop (the refinement was knowable, just not from the too-weak NAMED premise). Pairs with [[GenericDiscriminantUnderdeterminesOutput]] (the negative it closes), [[ReductionByImport]] (consuming R485 retypes it), [[PrefixGateReconstructedFromBoundary]] + [[ProducerGuardedOracleReconstruct]] (reconstruct-in-place))
* `CoconstructionHalfFoldsToSiblingInput`  — Reflection 487 (a folded consumer chain that is ONE HALF of a mutual co-construction bottoms out at its SIBLING's output, not at external givens. The last seq residual is a JOINT width co-construction producing per window `[lo,hi)` the PAIR `SeqInteriorSeparators tokens lo hi` (the CARRIER) `∧ RecSeqBody ((take hi).drop lo)` (the RECURSION). R487 landed `seqLocalCarrier_of_recIH`, the CARRIER half folded — via `seqLocalCarrier_of_widthEnc ∘ seqWidthEnc_of_recIH` (R446 ∘ R486, CONSUMING R486 — `ref-reduction-by-import`) — into ONE signature with three inputs: the body-window facts (`FlowBodyWindow`/`FlowBodyContentDeep`), the window's own `SafeBodyUnit`, and the body-width `RecSeqBody`-IH. Of those three, two are genuine EXTERNALS the joint step holds, but the `SafeBodyUnit` is SIBLING-supplied — `RecSeqBody.toSafeBodyUnit` of the recursion half's output at THIS window. Recognizing the sibling-supplied input tells you (1) the fold bottomed out at the co-construction BOUNDARY, not at external givens; (2) the joint step's evaluation ORDER — produce the sibling's `RecSeqBody` first, project it to `SafeBodyUnit`, then feed the carrier half; (3) ACYCLICITY — the recursion half consumes the carrier only at STRICTLY-NARROWER sub-windows (gated `< hi - lo`), never this window's, so the strong width induction closes. Toy: mutual `Prop`s `Carrier`/`Rec` over a `Nat` width; `Carrier.mk` consumes `hSelfRec : Rec n` (the sibling, projected via `Safe n := Rec n`, `rec_to_safe`) + a narrower `Rec`-IH; `Rec.mk` consumes `Carrier` only at `m < n`; `carrier_of_recIH` (toy `seqLocalCarrier_of_recIH`) is the fold `carrier_of_widthEnc ∘ widthEnc_of_recIH`; `coconstruct` closes the pair by ONE `Nat.strongRecOn` whose acyclicity is load-bearing on the `< n` gating (had `Rec.mk` needed `Carrier n`, a cycle). Sharpens [[FoldConsumerChain]] (not all folded inputs are external — one is the sibling half's output), pairs with [[ReductionByImport]], [[ConsumerJointBeforeProducer]] + [[ProducerDualOfConsumer]] (the two halves of a co-construction). **CORRECTED by R488**: the "`h_safe` is sibling-supplied per-window" framing describes a per-window construction the architecture REJECTS as circular (the per-window `SafeBodyUnit` route is circular; the carrier is built ONCE at the root with the FLAT `seqRoot_safeBodyUnit` off emission, no `RecSeqBody`, and narrows to sub-windows for free). Worse, `seqLocalCarrier_of_recIH` is keyed on `FlowBodyContentDeep`, which is PROVABLY FALSE at the root (`flowBodyContentDeep_root_seed_false`) — so it (and R486) is descended-window-only and CANNOT seed the root carrier; the root needs the `_seq` family ([[RootSeedNeedsRootTrueGuard]]))
* `RootSeedNeedsRootTrueGuard`             — Reflection 488 (a width/window-parametric carrier lemma is VACUOUS at the recursion's ROOT SEED when its keying guard is provably FALSE there — the root and the interior windows satisfy DIFFERENT guards. Executing step γ (the joint width co-construction) surfaced this: the seq carrier chain R485→R486→R487 (`seqEnclosingLocate_of_seqOpener_nested`/`seqWidthEnc_of_recIH`/`seqLocalCarrier_of_recIH`) is keyed on `FlowBodyContentDeep tokens lo hi`, and the obvious "instantiate at the root span `[2, size-2)` to seed the root carrier" move is a VACUITY dead-end because `flowBodyContentDeep_root_seed_false` machine-checks `¬ FlowBodyContentDeep tokens 2 (size-2)` — the deep guard is a `∀`-over-all-depths the producer cannot establish at the top-level body, and the dispatch even RELIES on its falsity-causing field to exclude the empty-bracket leaf (a REAL case). The chain is TRUE and useful at every DESCENDED window but vacuous at the outermost one: "window-parametric" ≠ "usable at the boundary instance." The fix is the root-TRUE parallel family `FlowBodyContentDeepSeq` (R393's re-scoped guard); the OPEN brick is the `_seq` re-thread of R485→R486 so the root carrier's `h_widthEnc` is non-vacuous. The transferable rule: before SEEDING a width/window recursion at its ROOT with a window-parametric lemma, check the keying guard is not provably false there; seed with the boundary-true parallel family, not the interior lemma — the consume-side companion to [[UniversalProducerRootSeed]] (root seed first, but it needs the right GUARD). Toy: windows as `Nat` (0 = root, ≥1 = nested), `Deep w := 1 ≤ w` (false at 0), `DeepSeq w := True` (root-true), `deep_false_at_root` the toy `flowBodyContentDeep_root_seed_false`, `widthEnc_of_deep` the interior chain, `widthEnc_of_deepSeq` the `_seq` twin, `rootCarrier_via_seq` the seed that ONLY the twin closes, `interiorChain_at_root_is_vacuous` reachable only under the false `Deep 0`, `interiorChain_at_nested` showing the interior lemma is fine off-root. Fully axiom-free. Pairs with [[ProbeTheGoal]] (the falsity the projection hides), [[ProbeProviderSatisfiableBeforeAssembler]] (vacuous-hypothesis trap), [[NonRestrictionResidualNeedsRootSeed]] (the root seed needs the right field), [[AdditiveParallelType]] (the `_seq` family is the fix), and CORRECTS [[CoconstructionHalfFoldsToSiblingInput]])
* `RethreadStaysInWeakerTwinFamily`        — Reflection 489 (a RESTRICTION producer cannot upgrade the guard: re-threading a window-parametric chain onto the boundary-true WEAKER twin stays in the weak family END-TO-END, even at descended windows where the strong guard genuinely HOLDS. Step γ′ began the `_seq` re-thread of the seq carrier chain that R488 ([[RootSeedNeedsRootTrueGuard]]) showed must be SEEDED at the root with the weaker `FlowBodyContentDeepSeq`. The de-risk read R485 `seqEnclosingLocate_of_seqOpener_nested`'s first `h_deep` consumer, `flowBodyContentDeep_child_bracket`, which RESTRICTS the parent's deep guard to a child bracket `[p, hiE)` and delivers `FlowBodyContentDeep tokens p hiE` for the recursion IH. The trap: the child IS a nested `[ … ]` where the strong guard genuinely HOLDS, so the tempting shortcut is "produce the strong child, feed the existing strong recursion." FALSE in a restriction setting — restriction is MONOTONE in the guard and only carries forward what the parent holds; the weaker `FlowBodyContentDeepSeq` parent lacks the strong guard's `{`/empty-opener facts (it is gated to non-empty `.flowSequenceStart`), so the strong child is UNREACHABLE from a weak parent (its truth comes from GLOBAL emitter structure the local restriction cannot see). `Strong ⇒ Weak` coerces, `Weak ⇒ Strong` does not. So the re-thread stays weak end-to-end (weak parent → weak child → weak-keyed IH, exactly `seqWindowRecSeqBody_seq`'s conjunct), and each child producer needs a `_seq` twin. This turn landed `flowBodyContentDeepSeq_child_bracket` (the `_seq` twin of `flowBodyContentDeep_child_bracket`, axioms `[propext, Quot.sound]`, no `sorryAx`/`Classical.choice`, frontier still 4) — strictly SIMPLER than the strong sibling: `headContentStart` from the located `.flowSequenceStart` opener directly (no `flowBracketDelta_eq_one_iff` `[`-vs-`{` split, the type is pinned), opener/fe fields pure restrictions with the re-scoped premises threading verbatim. Transferable rule: when re-threading a window-parametric producer chain onto a boundary-true WEAKER guard `P'`, every restriction-shaped child producer must output `P'` children, not `P` — even where `P` holds — and you build a `_seq` twin of each, never a `P' ⇒ P` upgrade. Toy: `Strong lo := ∀ k ≥ lo, Content (k+1)` (fires at every opener, false at root) vs `Weak lo := ∀ k ≥ lo, IsSeq k → Content (k+1)` (seq openers only, root-true); `strong_to_weak` the one-way membrane; `child_strong`/`child_weak` the two restriction producers; `weak_at_root` + `not_strong_at_root` the non-invertibility; `root_child_is_weak` (only `child_weak` is available at the seed) + `strong_child_needs_strong_parent` (the strong producer needs the false `Strong 0`). Axiom-clean (`propext`/`Quot.sound` from `omega`; the membrane `strong_to_weak` + `weak_at_root`/`not_strong_at_root` axiom-free; no `sorryAx`). Sharpens [[RootSeedNeedsRootTrueGuard]] (once the seed needs the weak twin, the whole producer chain does) + [[AdditiveParallelType]] (the `_seq` twins are the additive family); pairs with [[ReductionByImport]] (the `_seq` R485 twin will consume this) + [[SurfacedResidualFreeAtWiring]] (the chain this re-threads))
* `UnifiedResidualRoutesThroughOneInvariant` — Reflection 490 (a guard RE-SCOPE that demotes a guard-PROJECTED field to a UNIFIED named residual can SIMPLIFY the downstream consumer — the unified residual routes through ONE invariant the consumer already holds, shedding the strong twin's boundary-specific hypothesis. Step γ′ landed `flowBodyContent_child_bracket_seq`, the content child-bracket `_seq` twin, consuming R489's `flowBodyContentDeepSeq_child_bracket` + `flowBodyContent_of_deepSeq` (R393). The STRONG assembler `flowBodyContent_of_deep` SPLITS the per-separator obligation into an INTERIOR branch (projected straight off the guard's all-depth, unguarded `feContentStart`) and a BOUNDARY branch (named residual `noTrailingSep`, discharged at the window CLOSE `h_jclose`). The re-scoped guard's `feContentStart` is GATED (`tokens[k+1] ≠ .key`) so the consumer cannot project the interior either, and `flowBodyContent_of_deepSeq` therefore UNIFIES both into a SINGLE `feContent` residual (interior AND boundary, carrying the `balance = 0` premise). This LOOKS like an added burden, but at the child bracket `[k, j+1)` the unified residual routes through ONE invariant the consumer ALREADY holds — the floor `balance k i ≥ 1` for `k+1 ≤ i ≤ j`, whose range REACHES the close position `j`. So the floor kills EVERY balance-`0` separator with `k' > k` (interior AND boundary), the typed opener kills `k' = k`, and the boundary close-contradiction the strong twin needed is SUBSUMED — `h_jclose` is REDUNDANT and DROPPED from the twin's signature. The re-scope's apparent cost is paid by an invariant the consumer holds anyway, and the payment is CHEAPER than the strong split (one uniform floor+opener argument replaces guard-projection + close-marker). Landed `flowBodyContent_child_bracket_seq` (axioms `[propext, Quot.sound]`, no `sorryAx`/`Classical.choice`, frontier still 4). Transferable rule: when a guard re-scope demotes a projected field to a UNIFIED residual, check whether the consumer holds a SINGLE invariant strong enough to discharge the whole thing — if so the re-scope SIMPLIFIES rather than complicates, decoupling the discharge from the per-case hypotheses (guard projection AND boundary marker) the split required. Toy: child bracket `[0, 4)` (opener `0`, close `3`), `bal i := if 1 ≤ i ∧ i ≤ 3 then 1 else 0` (floor reaching the close `3`), `floor` the invariant, `strong_feContent (gp cl)` consuming BOTH a guard projection and a close marker, `weak_feContent` discharging the unified residual through the floor + opener with NEITHER. Axiom-clean (`propext`/`Quot.sound` from `omega`; `opener_not_sep` from `decide`; no `sorryAx`). Continues [[RethreadStaysInWeakerTwinFamily]] (the `_seq` re-thread, this is its content child-bracket twin); pairs with [[ReductionByImport]] (consumes R489 + R393), [[CoerceToWeakerReuseWrapper]] (the re-scoped guard is weaker at the consume boundary), [[BoundaryResidualEndDual]] (the boundary separator the floor subsumes), [[AdditiveParallelType]] (the `_seq` family))
* `RescopeAssembleCostIsGuardReadSites`   — Reflection 491 (the TERMINAL ASSEMBLE of a guard re-thread is GREP-BOUNDED: its cost is exactly the guard hypothesis's READ SITES, each swapped to a pre-landed child twin, while the locate/floor/close SKELETON is guard-AGNOSTIC and copies verbatim. Step γ′ landed `seqEnclosingLocate_of_seqOpener_nested_seq`, the `_seq` re-thread of the R485 `enclosingLocate` assemble keyed on the root-TRUE weaker guard `FlowBodyContentDeepSeq` ([[RootSeedNeedsRootTrueGuard]] R488, [[RethreadStaysInWeakerTwinFamily]] R489). A guard hypothesis `h_deep` funnels to a SMALL enumerable set of read sites — the LEAF constructors building the deliverable's guard-typed conjuncts; EVERYTHING ELSE (locate the matching close, the child floor, the `close < hi` re-derivation, the guard-NEUTRAL window constructor) reads OTHER hypotheses (window facts, locator) and is GUARD-AGNOSTIC. So cost(re-scope an assembler) = (grep `h_deep`) read sites, each a SWAP to the corresponding pre-landed child twin, + (swap the guard TYPE in signature + conclusion); the bulk skeleton copies verbatim. Here `h_deep` funnelled to EXACTLY two sites — site 1 swap `flowBodyContentDeep_child_bracket ↦ flowBodyContentDeepSeq_child_bracket` (R489, passing the located typed opener for the weaker delta) and site 2 swap `flowBodyContent_child_bracket ↦ flowBodyContent_child_bracket_seq` (R490, which also DROPS the close argument) — the ~50-line locate/floor/close block byte-identical to R485. CONSUMES R489 + R490 (both `_seq` child twins retype into consumed ones, [[ReductionByImport]]) and re-uses R485's skeleton unchanged ([[RootSeedRecursiveProducerSwap]]: the slice/window framing is guard-agnostic, only the body producer swaps). Landed `seqEnclosingLocate_of_seqOpener_nested_seq` (axioms `[propext, Classical.choice, Quot.sound]` — IDENTICAL to its strong R485 parent, the `Classical.choice` inherited from the shared locator skeleton, no `sorryAx`, frontier still 4). Transferable rule: when a guard re-thread reaches its terminal ASSEMBLE, don't re-prove it — GREP the guard hypothesis in the strong parent's body; its read sites are the only edits, each swapping to a child twin built in a PRIOR turn, the guard type swapping in signature/conclusion. This is WHY the child twins are built first one per turn: they convert the parent assemble from a proof obligation into a mechanical grep-bounded copy — the assemble is the last brick AND the cheapest. The structural-GUARD analog of [[DepthHypCostIsItsEqualityReads]] (a scalar-baseline hypothesis, where each read either swaps to a depth-general twin or re-derives one equality) — here the hypothesis is a whole inductive GUARD and every read swaps uniformly to its `_seq` twin, no equality re-derivation. Toy: window `n`, `Strong`/`Weak` the two guard families, `skeleton` the guard-agnostic block (byte-identical call in both assemblers), `childGuard_strong`/`childGuard_weak` + `content_strong`/`content_weak` the pre-landed per-leaf twins, `assemble_strong` (R485) vs `assemble_seq` (R491) differing in EXACTLY the two guard-reading calls + the guard type. Fully axiom-free (direct term proofs over `Nat` ≤, no tactics). Continues [[RethreadStaysInWeakerTwinFamily]] + [[UnifiedResidualRoutesThroughOneInvariant]] (this assembles their child twins); pairs with [[ReductionByImport]], [[RootSeedRecursiveProducerSwap]], [[AdditiveParallelType]], generalizes [[DepthHypCostIsItsEqualityReads]] from scalar baseline to structural guard)
* `TransportingLemmaTwinsZeroBodyEdits`   — Reflection 492 (a TRANSPORTING lemma — guard OBTAINED-then-rethreaded, never inspected — re-threads to its `_seq` twin with ZERO body edits: a SIGNATURE-ONLY swap, the FLOOR of the grep-bounded cost. Step γ′ landed `seqWidthEnc_of_enclosingLocate_and_recIH_seq`, the `FlowBodyContentDeepSeq`-keyed twin of R475 `seqWidthEnc_of_enclosingLocate_and_recIH` — the next link of the `_seq` re-thread UP from the leaf assemble `seqEnclosingLocate_of_seqOpener_nested_seq` (R491, [[RescopeAssembleCostIsGuardReadSites]]). The TRANSPORT vs CONSTRUCT distinction: R491's leaf assemble CONSTRUCTS the deliverable's guard conjuncts at the child-bracket constructors, so its guard hypothesis is READ at each leaf and the twin cost EXACTLY those read sites (2 body swaps); R475 never constructs the guard — it `obtain`s `h_deep : FlowBodyContentDeep` from its `enclosingLocate` hypothesis, `refine`s it straight into the conclusion's matching slot, threads the conclusion's IH premise straight into `recIH`, and never matches/destructures/inspects it. Grep the guard in R475's BODY: ZERO hits — every occurrence is in the SIGNATURE (4 positions: `enclosingLocate` deliverable, `recIH` premise, conclusion deliverable, conclusion IH premise), all transported. So cost(re-scope a TRANSPORTING lemma) = swap the guard TYPE at its signature positions, BODY copies byte-identical (0 edits) — the FLOOR of the grep-bounded cost (read-site count literally 0). This is WHY a whole re-thread chain is cheap: cost concentrates in the few CONSTRUCTING leaves (R489/R490/R491), every PLUMBING link (R475→R492) re-keys for free. Landed `seqWidthEnc_of_enclosingLocate_and_recIH_seq` (axioms `[propext, Quot.sound]` — IDENTICAL to R475's strong parent, and NOTABLY no `Classical.choice`: pure transport via `omega` never touches the locator skeleton; no `sorryAx`, frontier still 4). Verified-but-unconsumed until `seqWidthEnc_of_recIH_seq` (the R486-twin) feeds it. Transferable rule: classify a re-thread link TRANSPORT vs CONSTRUCT before editing — a transporting (plumbing) lemma's twin is signature-only (0 body edits), a constructing (assemble/leaf) lemma's twin costs its grep'd read sites. Toy: window `n`, `Strong`/`Weak` the two guard families, `transport_generic {G}` the guard-AGNOSTIC core (proof term mentions no guard — the formal content of "byte-identical body"), `transport_strong` (R475) vs `transport_seq` (R492) each the IDENTICAL one-liner application of the core differing ONLY in the signature guard, plus a `construct_strong`/`construct_seq` contrast whose bodies DO differ at the read site. Fully axiom-free. The structural-GUARD FLOOR of [[RescopeAssembleCostIsGuardReadSites]] (when read sites = 0, even the swaps vanish) and of [[DepthHypCostIsItsEqualityReads]]; continues [[RethreadStaysInWeakerTwinFamily]] + [[RootSeedNeedsRootTrueGuard]], pairs with [[ReductionByImport]], [[AdditiveParallelType]])
* `LiftRekeysByGuardKeyedChildNames`     — Reflection 493 (a LIFT — a lemma whose body COMPOSES child-lemma calls — re-keys to a guard's weaker twin via one NAME swap per guard-KEYED child it invokes; guard-NEUTRAL calls are free. The swap unit at a lift is the guard-keyed NAME, not the guard READ ([[TransportingLemmaTwinsZeroBodyEdits]] measured the guard READ to twin a lemma's OWN body; a PARENT that CALLS a child names it, and a name is guard-typed). Step γ′ landed `seqWidthEnc_of_recIH_seq`, the `FlowBodyContentDeepSeq`-keyed twin of R486 `seqWidthEnc_of_recIH` — the LIFT above the R492 transporting assemble + R491 constructing leaf. R486 calls THREE lemmas: (1) `seqWidthEnc_of_enclosingLocate_and_recIH` — a TRANSPORTING child (R475/R492; its body twins for free) but its NAME is guard-keyed ⇒ swap the call to `…_seq` (R492); (2) `seqOpenerType_of_located_and_gate` — guard-NEUTRAL (names no content guard) ⇒ UNCHANGED character-for-character; (3) `seqEnclosingLocate_of_seqOpener_nested` — a CONSTRUCTING child (R485/R491) ⇒ swap the call to `…_seq` (R491). So the lift's body cost = TWO named swaps (the two guard-keyed children), NOT the "≈1 swap" an earlier read predicted by counting only the constructing call — the transport/construct distinction governs each CHILD's own twinning, it does NOT discount the lift's CALL to a transporting child. cost(re-key a LIFT) = #(guard-KEYED child lemmas it invokes), each a NAME swap to the child's twin; guard-NEUTRAL invocations free. Why "transport ⇒ verbatim" is right for the child, wrong for the parent's call: transport means the child's PROOF TERM is guard-agnostic (one core, byte-identical body), but the parent does not COPY the child's body — it NAMES the child, and the strong name has the strong type, so the call swaps exactly like a constructing child's. Landed `seqWidthEnc_of_recIH_seq` (axioms `[propext, Classical.choice, Quot.sound]` — IDENTICAL to its strong R486 parent, the `Classical.choice` inherited from the constructing leaf's locator skeleton, no `sorryAx`, frontier still 4). Transferable rule: to re-key a lift, COUNT the guard-keyed lemma names in its body — each is one name swap to that child's already-landed twin; guard-neutral helpers and the proof skeleton are free. Toy: window `n`, `Strong`/`Weak` the two guard families, `Disc` a guard-NEUTRAL discriminator, `transport_child_strong/_seq` (byte-identical bodies — transport), `neutral_helper` (no twin — guard-free), `construct_child_strong/_seq` (bodies differ at the read — construct), `lift_strong` (R486) vs `lift_seq` (R493) differing in EXACTLY the two guard-keyed child names + the signature guard, the neutral call verbatim. Fully axiom-free. Sharpens + CORRECTS the R492 prediction of [[TransportingLemmaTwinsZeroBodyEdits]] (the call-site swap unit is the NAME, so a transporting child still costs a name swap at the lift), composes [[RescopeAssembleCostIsGuardReadSites]] (the constructing child) + R492 (the transporting child); pairs with [[ReductionByImport]] (each swapped child retypes from verified to consumed), [[FoldConsumerChainToProducerContract]] (the lift reads off the boundary's whole spec as one signature), [[AdditiveParallelType]])
* `LiftForwardsDroppedDerivationPremise`  — Reflection 494 (a transporting LIFT's re-key cost is #(guard-keyed child names) PLUS the child twin's DROPPED-DERIVATION premise — the sharpening of [[LiftRekeysByGuardKeyedChildNames]] (R493: `cost = #guard-keyed child names`). Step γ′ pivoted from the PRODUCER side (`h_widthEnc` built keyed on `FlowBodyContentDeepSeq`, R489→R493) to the CONSUMER side: `seqLocalCarrier_of_widthEnc` (R446) extracts the weaker `h_deep : FlowBodyContentDeepSeq` and feeds it down `seqDescent_provider_of_located → seqChild_safeBodyUnit → recseqentry_seqbracket_oracle`. CLASSIFICATION (the R493-queued task): `seqDescent_provider_of_located` is STRONG-KEYED, NOT a free re-key — it passes `h_deep` into `seqChild_safeBodyUnit` and its IH premise carries `FlowBodyContentDeep`; so every consumer link needs a `_seq` twin. The leaf `recseqentry_seqbracket_oracle_seq` already landed (R415); this turn landed the bottom-most MISSING link `seqChild_safeBodyUnit_seq`. `seqChild_safeBodyUnit` is a PURE TRANSPORTING LIFT (body = one oracle call + `.1.toSafeBodyUnit`, reads no deep field), so by R493 its twin = ONE guard-keyed name swap (`recseqentry_seqbracket_oracle ↦ _seq`). But the LEAF twin has a STRICTLY LARGER signature: it takes an extra `h_ne : tokens[lo+1]! ≠ .flowSequenceEnd` because the strong `FlowBodyContentDeep.openerContentStart` (firing at EVERY delta-`1` opener) SELF-DERIVED interior non-emptiness, while the weaker `FlowBodyContentDeepSeq.openerContentStart` is GUARDED by that very non-emptiness ([[WindowAbsoluteGateSubsetRestriction]]) so it cannot. That dropped self-derivation becomes a THREADED premise the lift must FORWARD — `h_ne` is a new hypothesis of the twin, passed straight to the oracle twin. So cost(re-key a LIFT) = #(guard-keyed child names) + #(child-twin premises the weaker guard FORCED that this lift must forward) [R494: 1 keyed name + 1 forwarded `h_ne`]. The leaf cannot SOURCE `h_ne`: the empty seq `[]` (`j = p+1`, `tokens[p+1]! = ]`) satisfies EVERY non-`h_ne` hypothesis (`h_pj`, `h_jclose`, `h_inner`, `h_floor`), so it is genuinely un-derivable at the leaf and climbs the chain until an ancestor knows the body is a GENUINE non-empty seq ([[PrefixGateReconstructedFromBoundary]]). Landed `seqChild_safeBodyUnit_seq` (axioms `[propext, Classical.choice, Quot.sound]` — IDENTICAL to its strong parent, no `sorryAx`, frontier still 4). Toy: `NE`/`Deliverable`/`Packaged`, `StrongG` (unconditional `opener` field self-derives `NE`) vs `WeakG` (gated `openerGated : NE → NE`, useless for deriving `NE`), `oracle_strong` (self-derives) vs `oracle_seq` (takes `h_ne`), guard-neutral `wrap`, `lift_strong` vs `lift_seq` differing in EXACTLY the one child name + the forwarded `h_ne`, plus `weakG_holds_but_ne_fails : WeakG 0 ∧ ¬ NE 0` witnessing the un-sourceability and `strongG_derives_ne` the contrast. Fully axiom-free. Sharpens [[LiftRekeysByGuardKeyedChildNames]] (adds the forwarded-premise term), composes [[TransportingLemmaTwinsZeroBodyEdits]] (the transport body) + [[WindowAbsoluteGateSubsetRestriction]] (the gate that drops the derivation) + [[PrefixGateReconstructedFromBoundary]] (where the premise is finally sourced); continues [[RethreadStaysInWeakerTwinFamily]] + [[RootSeedNeedsRootTrueGuard]], pairs with [[ReductionByImport]], [[AdditiveParallelType]])
* `ClimbingPremiseTerminatesAtCaseSplit`  — Reflection 495 (the climbing dropped-derivation premise of [[LiftForwardsDroppedDerivationPremise]] (R494) terminates at a CASE SPLIT, not a single discharge — the sharpening surfaced landing `seqDescent_provider_of_located_seq`, the `FlowBodyContentDeepSeq`-keyed twin of `seqDescent_provider_of_located`, the consumer-chain link ABOVE the R494 leaf lift `seqChild_safeBodyUnit_seq`. R494 predicted this ancestor would SOURCE the forwarded `h_ne`. It does NOT source it unconditionally: the weaker guard ADMITS the very degenerate input the strong guard's UNCONDITIONAL opener field excluded — an empty enclosing seq `[ … [] … ]` whose inner empty seq's gated window has `j = p+1` and `tokens[p+1]! = .flowSequenceEnd` ⇒ `h_ne` is FALSE — and the dispatcher hands the descent provider windows with `a ≤ b` (NOT `a < b`), so that degenerate input REACHES this ancestor. So the premise terminates at a CASE SPLIT on the discriminator the strong guard had ENCODED (`p + 1 < j`, enclosing seq non-empty): the NON-degenerate branch SOURCES `h_ne` from the interior floor (`tokens[p+1]! = .flowSequenceEnd` ⇒ `balance p (p+2) = 1 + (-1) = 0` contradicts the matched-bracket floor `≥ 1`) and routes through the R494 lift; the DEGENERATE branch (`j = p+1`) sees the gated window collapse to `a = b = p+1`, both separator facts VACUOUS, so produces the existential `⟨p+1, p+1, …⟩` DIRECTLY (`balance loS a = 0` is `h_body_bal` verbatim), BYPASSING the leaf it could not feed. The ENTIRE preamble is character-identical to the strong parent ([[TransportingLemmaTwinsZeroBodyEdits]] — reads no deep field), so `cost(terminating ancestor) = #(guard-keyed child names) + (source the premise on the re-discovered discriminator) + (produce the deliverable vacuously on the degenerate branch the weaker guard admits)`. Landed `seqDescent_provider_of_located_seq` (axioms `[propext, Classical.choice, Quot.sound]` — IDENTICAL to its strong parent, no `sorryAx`, frontier still 4). Toy: `WeakG` (gated, holds at the degenerate `WeakG 0`), `oracle_seq`/`lift_seq` (forward `h_ne`, R494), discriminator `D n := 2 ≤ n` with `ne_of_D : D n → NE n`, deliverable `Goal n := ∀ k, k+1 < n → Packaged n` (VACUOUS for `n < 2`), and the brick `terminate` case-splitting on `D` — non-degenerate routes through `lift_seq` (sourcing `h_ne` from `D`), degenerate produces `Goal` directly; `degenerate_reaches_ancestor : WeakG 0 ∧ ¬ NE 0` re-exhibits the un-sourceability and `example : Goal 0 := terminate 0 ⟨id⟩` lands via the bypass. Axiom note: the toy `terminate` is `[propext, Quot.sound]` — LIGHTER than the real lemma, because the discriminator is DECIDABLE so `by_cases` adds NO `Classical.choice`; accurately, the real lemma's `Classical.choice` is INHERITED from the deeper locator machinery it transports (the matching-close locator's `split`/`if`), not from its own decidable case split, so the case split adds a reachable branch, not an axiom. Sharpens [[LiftForwardsDroppedDerivationPremise]] (the climb's TERMINUS is a case split, not a discharge); composes [[ThreadedGuardPrunesCaseTree]] inverted (here the WEAKER guard ADDS a reachable case the stronger guard pruned) + [[DeadBranchUnderDomainInvariant]] (the degenerate branch is vacuous, produced not proven impossible) + [[BoundaryResidualEndDual]] (vacuous discharge on a degenerate window); continues [[RethreadStaysInWeakerTwinFamily]] + [[RootSeedNeedsRootTrueGuard]])
* `PremiseAbsorbedAboveTerminusCleanLift`  — Reflection 496 (the climbing dropped-derivation premise of [[LiftForwardsDroppedDerivationPremise]] (R494) does NOT re-emerge above its case-split terminus ([[ClimbingPremiseTerminatesAtCaseSplit]] R495) — the terminating ancestor is an ABSORPTION boundary, so the lift ABOVE it reverts to the pure [[LiftRekeysByGuardKeyedChildNames]] (R493) re-key: premise-free, no case split. Step γ′ landed `seqLocalCarrier_of_widthEnc_seq`, the `FlowBodyContentDeepSeq`-keyed twin of `seqLocalCarrier_of_widthEnc` (R446), the consumer-chain link ABOVE the R495 descent provider twin `seqDescent_provider_of_located_seq`. The KEY fact about a case-split terminus is that its CONCLUSION is premise-FREE: `seqDescent_provider_of_located_seq` internalised the climbing `h_ne` premise into a case split on `p + 1 < j` (sources it on the non-degenerate arm, vacuous on the degenerate empty-seq arm the weaker guard admits), so it produces the descent existential from `WeakG`-family hypotheses ALONE — no `h_ne` in its signature. The lift above therefore sees a clean premise-free interface: NO `h_ne` to forward, NO degenerate case to restore. It reverts to the pure R493 form — ONE guard-keyed name swap (`seqDescent_provider_of_located ↦ _seq`, the lone guard-keyed child; `seqEnclosingOpener_of_gate` LOCATE + `seqEnclosed_succ_of_located_opener` IH-seed are guard-NEUTRAL) plus re-keying `h_widthEnc`'s two `FlowBodyContentDeep` occurrences (enclosing-window fact + inner IH premise) to `FlowBodyContentDeepSeq`, the body otherwise term-for-term the strong parent ([[TransportingLemmaTwinsZeroBodyEdits]]). So a climbing dropped-derivation premise has a SINGLE absorption point (its case-split terminus): below it the chain forwards the premise (R494), AT it the chain discharges it by case split (R495), ABOVE it the chain is premise-free (R496). Once the terminating ancestor is located, STOP tracking the premise upward. Landed `seqLocalCarrier_of_widthEnc_seq` (axioms `[propext, Classical.choice, Quot.sound]` — IDENTICAL to its strong R446 parent, the `Classical.choice` inherited from the descent child's locator skeleton not this lift's absent case split, no `sorryAx`, frontier still 4). Toy: `StrongG` (unconditional `opener`) vs `WeakG` (gated `openerGated`, holds at `WeakG 0`); `terminate_strong` (premise-free, no split) and `terminate_seq` (R495's absorbing terminus — case-splits on `D n := 2 ≤ n`, premise-FREE conclusion `(hg : WeakG n) : Goal n`); guard-neutral plumbing `Safe`; `localCarrier_strong` (R446) vs `localCarrier_seq` (R496) THE BRICK — the strong carrier with ONE name swap + guard re-key, taking ONLY `WeakG`, no `NE` argument (that it typechecks IS the proof the premise did not re-emerge); `degenerate_flows_through_clean_carrier : WeakG 0 ∧ ¬ NE 0 ∧ Goal 0` re-exhibits R494's un-sourceability AND shows the carrier still produces `Goal 0` premise-free. Axiom note: every theorem is `[propext, Quot.sound]` at most (decidable `D`, `omega`), LIGHTER than the real lemma whose `Classical.choice` is inherited from the descent child. Confirms R495's "Next step" prediction (the terminus restores a clean interface upward); sharpens [[ClimbingPremiseTerminatesAtCaseSplit]] (the terminus is also an absorption boundary) + [[LiftForwardsDroppedDerivationPremise]] (the climb ends, it does not propagate past the terminus); composes [[LiftRekeysByGuardKeyedChildNames]] (the clean lift IS the R493 form recovered) + [[TransportingLemmaTwinsZeroBodyEdits]] (the transport body); continues [[RethreadStaysInWeakerTwinFamily]] + [[RootSeedNeedsRootTrueGuard]], pairs with [[ReductionByImport]], [[AdditiveParallelType]])
* `ThinInstanceTwinIsProducerConsumerMeet` — Reflection 497 (the seq ROOT CARRIER `_seq` twin is the producer/consumer MEET, and a thin-instance twin is the CHEAPEST link in a guard re-thread — zero proof BODY. Step γ′ landed `seqRoot_carrier_of_widthEnc_seq`, the `FlowBodyContentDeepSeq`-keyed twin of `seqRoot_carrier_of_widthEnc`, the thin `lo := 2`, `hi := tokens.size - 2` instance of the R496-re-keyed window-parametric `seqLocalCarrier_of_widthEnc_seq`. TWO points, one brick. (1) The MEET: the whole `_seq` re-thread (R488→R496) existed to reconcile a TYPE MISMATCH at this interface — the producer side (`seqWidthEnc_of_enclosingLocate_and_recIH_seq`, R492→R493) hands an `h_widthEnc` keyed on the weak `FlowBodyContentDeepSeq`, but the OLD root carrier demanded one keyed on the strong root-FALSE `FlowBodyContentDeep`, so the producer could NOT plug into the consumer's slot; this twin re-keys the consumer's hypothesis, and the two types now COINCIDE — producer-out ⟶ consumer-in, no adapter. And the reconciliation was NECESSARY: the strong-keyed root residual is UNSATISFIABLE (the strong guard is FALSE at the root), so re-keying the CONSUMER was the only way the two meet. (2) A thin instance is the cheapest possible re-key — it has NO proof body: its body is a SINGLE application of the window-parametric parent at the root window, so its `_seq` cost is the degenerate floor of [[LiftRekeysByGuardKeyedChildNames]] (R493) / [[TransportingLemmaTwinsZeroBodyEdits]] (R492) — exactly ONE guard-keyed parent swap (`seqLocalCarrier_of_widthEnc ↦ _seq`) + the guard re-key of the FORWARDED residual `h_widthEnc` (its two `FlowBodyContentDeep` ⤳ `FlowBodyContentDeepSeq`); the guard-NEUTRAL instantiation args (the `Nat.sub_le` width bound, the flat root `seqRoot_safeBodyUnit` — content-guard-agnostic, scans straight off emission) transport byte-identical, body otherwise term-for-term `seqRoot_carrier_of_widthEnc`. Landed `seqRoot_carrier_of_widthEnc_seq` (axioms `[propext, Classical.choice, Quot.sound]` — IDENTICAL to its strong parent, no `sorryAx`, frontier still 4). Toy: `StrongG n := 1 ≤ n` (FALSE at root sub-window `0`) vs `WeakG _ := True`; guard-keyed residual `WidthEnc G n := G 0 ∧ (∀ k, k+1 < n → Packaged n)`; guard-polymorphic window carrier `localCarrier` (reads only the packaged conjunct, transports the guard); thin root instances `rootCarrier_strong` vs `rootCarrier_seq` (THE BRICK — one parent guard-arg swap + forwarded-residual re-key, zero body); `producer : WidthEnc WeakG root` and `meet : Goal root := rootCarrier_seq producer` (the producer plugs straight in); `strong_root_residual_unsatisfiable : ¬ WidthEnc StrongG root` (the OLD strong consumer's hypothesis was a dead end — `StrongG 0 = 1 ≤ 0` — which is WHY the re-thread re-keyed the consumer). Axiom note: `producer`/`meet`/`strong_root_residual_unsatisfiable` are axiom-FREE `[]` (`decide` over the concrete root), LIGHTER than the real lemma whose `Classical.choice` is inherited from the window-parametric parent's locator machinery, not this thin instance's absent logic. Realizes [[RootSeedNeedsRootTrueGuard]] (R488 — the root seed is now non-vacuous, the weak guard is root-TRUE) at the concrete root; the degenerate floor of [[LiftRekeysByGuardKeyedChildNames]] + [[TransportingLemmaTwinsZeroBodyEdits]]; the MEET that the chain re-thread [[RethreadStaysInWeakerTwinFamily]] + [[PremiseAbsorbedAboveTerminusCleanLift]] (R489→R496) was building toward; pairs with [[ReductionByImport]], [[AdditiveParallelType]], [[FoldConsumerChainToProducerContract]])
* `UnifiedResidualForcesSiblingProjection` — Reflection 499 (a *unifying* consumer forces a *second, fuller* projection of the producer's recursive deliverable that the *split* consumer never needed — the number of projections a producer must supply is set by the CONSUMER's choice to split-vs-unify its residual, not by the deliverable's own shape. Step γ′ landed `seqChild_safeBody_seq`, the `SafeBody`-projecting SIBLING of R494 `seqChild_safeBodyUnit_seq` — same located child `[p+1, j)`, same `recseqentry_seqbracket_oracle_seq` call, but `.1.toSafeBody` in place of `.1.toSafeBodyUnit`. WHY a second projection: the `_seq` `FlowBodyContent` assembler `flowBodyContent_of_deepSeq` (R393) demands the separator obligation as ONE field `h_feContent` over EVERY interior depth-`0` separator, because the weak `FlowBodyContentDeepSeq.feContentStart` carries a `≠ .key` premise undischargeable at the descend site, so R393 UNIFIED what the strong `flowBodyContent_of_deep` SPLIT (interior from the guard's own all-depth field + BOUNDARY-only `noTrailingSepFact`). The unit projection (`.toSafeBodyUnit`) supplies `bodySuccFact` + `noTrailingSepFact` — and `noTrailingSepFact` covers the LAST position ONLY (vacuous via `seqSeparatorFacts_of_windowed_safebodyunit`); the all-interior `h_feContent` instead needs `SafeBody_array_flowEntry_window`, which fires content-start after every depth-`0` `.flowEntry` but only off the FULL `SafeBody`. So the SAME child `RecSeqBody` is projected BOTH ways — `bodySucc` off `.toSafeBodyUnit` (R494), the all-interior `feContent` off `.toSafeBody` (R499) — and the second projection is the one the unifying consumer forced; the strong `flowBodyContent_descend`, whose split residual asked only `noTrailingSepFact`, never needed it. Proof-irrelevant: `RecSeqBody` is a `Prop`, so re-invoking the oracle for the second projection costs only proof-term size. Landed `seqChild_safeBody_seq` (axioms `[propext, Classical.choice, Quot.sound]` — IDENTICAL to its strong/unit siblings, the `Classical.choice` from the oracle's locator skeleton, no `sorryAx`, frontier still 4). This unblocks the `_seq` `FlowBodyContent` descend edge `flowBodyContent_descend_seq`, whose carrier-free thread (root + descend + advance) the JOINT width co-construction needs — the carrier route is circular at the same window (carrier ⊃ h_safe ⊃ RecSeqBody ⊃ FlowBodyContent ⊃ carrier), so the joint induction's recursion half must source per-window `FlowBodyContent` carrier-free. Toy: `Deliv` (non-empty all-`true` list) models `RecSeqBody`; `unitProj l := l.head? = some true` (ONE boundary position) vs `fullProj l := ∀ x ∈ l, x = true` (all interior) model `.toSafeBodyUnit`/`.toSafeBody`, both off `Deliv` (`Deliv.toUnit`/`Deliv.toFull`); `GoalBoundary` (split residual, `split_route := h.toUnit`) vs `GoalAll` (unified residual, `unified_route := h.toFull`); `unit_cannot_serve_unified : unitProj [true,false] ∧ ¬ GoalAll [true,false]` witnesses the NECESSITY — the boundary projection admits a list the unified goal rejects, so the fuller projection is not redundant. Fully axiom-free. Sharpens [[CompleteProjectionFamilyForNewMember]] (the second projection completes the descend edge's projection family) + [[IncompleteProjectionStillFactors]] (a split residual needs only the partial/boundary projection); composes [[WindowAbsoluteGateSubsetRestriction]] (the `≠ .key` gate that forced the unification) + [[LiftForwardsDroppedDerivationPremise]] (the same R494 child, now its SafeBody sibling); continues [[RethreadStaysInWeakerTwinFamily]] + [[RootSeedNeedsRootTrueGuard]], pairs with [[ReductionByImport]], [[AdditiveParallelType]])
* `CoercionDissolvesForcedProjection`    — Reflection 500 (a *forced second projection* — R499's prediction that a unifying consumer forces a fuller projection of the producer's deliverable — DISSOLVES when the weaker projection is COERCIBLE to the fuller one. Building the `_seq` `FlowBodyContent` descend edge `flowBodyContent_descend_seq` (R500) refuted R499 for this instance: the unit projection (R494 `seqChild_safeBodyUnit_seq`) ALONE serves the unified `h_feContent` of `flowBodyContent_of_deepSeq`. The unified residual splits INTERIOR (`k+1<j`) ∪ BOUNDARY (`k+1=j`); BOTH come from the ONE windowed `SafeBodyUnit` via the EXISTING `seqEnclosingFacts_of_windowed_safebodyunit` — interior through `seqInteriorFeContentStart_of_windowed_safebodyunit`, which already COERCES `SafeBodyUnit → SafeBody` internally (`SafeBodyUnit_safeBody ContentStartTok_ne_flowEntry`) before calling `SafeBody_array_flowEntry_window`, and boundary through `noTrailingSepFact` VACUOUSLY. So the "fuller projection" R499 thought forced is recovered from the unit projection by a head-conditioned COERCION already packaged in the consumer; `seqChild_safeBody_seq` (R499) stays a valid verified-but-unconsumed sibling, off the critical path. The number of DISTINCT projections a producer must supply is reduced by any head/element-conditioned coercion `Weak → Strong` on the consume side: the unified residual routes through `(weak projection) + (coercion)`, not a second projection. Two conditions make the coercion possible — and they are exactly what R499's minimal-pair demo dropped: the WEAK projection must carry the INTERIOR data (R499's `unitProj := head?` carried none ⇒ genuinely non-coercible, the regime where the forcing holds), and a HEAD condition must close the one head-gap. `flowBodyContent_descend_seq` also FORWARDS `h_ne` (the empty-seq guard the weak `openerContentStart` can't self-derive) and assembles via the UNIFIED `flowBodyContent_of_deepSeq`; axioms `[propext, Classical.choice, Quot.sound]` identical to its strong twin, frontier still 4. Toy: `Deliv` (nonempty all-`true` list) models `RecSeqBody`; `Weak` (proper-TAIL all-true + content-typed head, `≠ false`) models `SafeBodyUnit`; `Strong := ∀ x ∈ l, x = true` models `SafeBody`; `Deliv.toWeak` is R494, `Weak.toStrong` is the `SafeBodyUnit_safeBody` coercion, `strong_via_coercion := h.toWeak.toStrong` is the DISSOLUTION (Strong with no direct `Deliv → Strong`); `head_condition_load_bearing : (∀ x ∈ [false].tail, x = true) ∧ ¬ Strong [false]` witnesses the head condition is genuinely consumed — the interior alone does not close the gap. Sharpens/partially-CORRECTS [[UnifiedResidualForcesSiblingProjection]] (the forcing is conditional on non-coercibility); composes [[CompleteProjectionFamilyForNewMember]], [[ReductionByImport]] (the dissolution reuses an existing consumer helper rather than a new projection))
* `GuardReadingEdgesNeedTwins`           — Reflection 501 (re-threading a downstream projection over a STRENGTHENED/re-scoped recursion guard re-twins ONLY the guard-READING structural moves; a projection-re-basing move is GUARD-NEUTRAL and reused VERBATIM. Completing the carrier-free `FlowBodyContent` thread for the seq axis needed only the ROOT SEED `seqRoot_flowBodyContent_seq` (R501) beyond the R500 descend edge — because the ADVANCE edge `flowBodyContent_advance` operates purely on the PROJECTION `FlowBodyContent` and never READS the deep guard, so the SAME term serves the strong and `_seq` threads. The three moves of a root+descend+advance thread PARTITION by guard-sensitivity: DESCEND reads the guard to PRODUCE the child ⇒ `_seq` twin (`flowBodyContent_descend_seq`, R500); ROOT consumes the root-true guard as a hypothesis ⇒ `_seq` twin (R501); ADVANCE re-bases the projection (guard ABSENT from its type) ⇒ guard-neutral, shared. So when you weaken a recursion guard and re-thread a projection over it, COUNT the guard-READS: guard-in-signature ⇒ twin, guard-absent ⇒ shared — the re-thread work-list is pre-countable from the edge signatures. `seqRoot_flowBodyContent_seq` is the producer's ROOT-LEAF: it SHEDS all the descend edge's recursion machinery (no `h_ne` forwarding, no `flowBodyContentDeepSeq_descend`, no IH, no floor — the child `SafeBodyUnit` is the FLAT `seqRoot_safeBodyUnit` off emission, the root guard a hypothesis), and routes the unified residual through the R500 dissolution (unit projection's enclosing facts: interior coerced + boundary vacuous). Axioms `[propext, Classical.choice, Quot.sound]` identical to its strong twin `seqRoot_flowBodyContent`, frontier still 4; this COMPLETES the carrier-free seq `FlowBodyContent` thread (root + descend + advance). Toy: `Proj := ∀ x ∈ l, x = true` models `FlowBodyContent`; `GStrong := ∀ x ∈ l, x = true` and the distinct-TYPE `GWeak` (allTrue + nonempty) model `FlowBodyContentDeep`/`FlowBodyContentDeepSeq`; `rootStrong`/`rootWeak` + `descendStrong`/`descendWeak` are the guard-READING twins (the guard is in their type), `advance : Proj (a::rest) → Proj rest` is the SINGLE guard-neutral edge; `thread_strong`/`thread_weak` reach the goal through the SAME `advance` after their twinned roots, `advance_after_descendStrong`/`advance_after_descendWeak` show one `advance` composes after EITHER descend, `demo_strong`/`demo_weak` reach the SAME `Proj [true]` via the same `advance` (axiom-free `decide` leaves), `gweak_is_strictly_more` witnesses `GWeak` is a distinct type forcing the twins. Sharpens [[StructuralMovesCompleteRecursion]] (the moves partition by guard-sensitivity) + [[NearLeafMirrorShedsMachinery]] (the root-leaf sheds the descend's recursion machinery); composes [[CoercionDissolvesForcedProjection]] (R500, the unified residual the root routes through) + [[StoredVsProjectedSeversRecursionEdge]] (a projecting edge severs the guard dependency); continues [[RethreadStaysInWeakerTwinFamily]] + [[RootSeedNeedsRootTrueGuard]])
* `EdgesUnifyAsDeliverableProjection`     — Reflection 502 (the carrier-free `FlowBodyContent` edges UNIFY into ONE projection of the recursion's own deliverable. Completing the seq thread, the two guard-READING edges — root `seqRoot_flowBodyContent_seq` (R501) and descend `flowBodyContent_descend_seq` (R500) — differ ONLY in HOW they obtain a windowed `SafeBodyUnit`; the content-assembly tail `seqEnclosingFacts_of_windowed_safebodyunit ▸ flowBodyContent_of_deepSeq` is byte-identical, and that `SafeBodyUnit` is in BOTH cases a window's `RecSeqBody.toSafeBodyUnit`. So both edges are the SAME function of the window's OWN deliverable (`RecSeqBody`): producing the body and reading it back as content is one projection. `flowBodyContent_of_recseqbody_seq` (R502) names that projection once — `RecSeqBody.toSafeBodyUnit ▸ seqEnclosingFacts_of_windowed_safebodyunit ▸ flowBodyContent_of_deepSeq` — keyed on the deliverable directly (the full-content lift of the 2-fact `seqSeparatorFacts_of_recseqbody`). Consequence for the JOINT consume step: the IH yields `RecSeqBody` for any sub-window, so the sub-window's content is a FREE projection — no second IH call, no oracle re-entry; the only content the recursion owes top-down is the CURRENT window's (the head dispatch consumes `h_content` before the body exists), the CHILDREN's is this projection. Different windows ⇒ no same-window cycle — the split that lets the co-construction be a top-down content thread over a bottom-up body deliverable. Axioms `[propext, Classical.choice, Quot.sound]`, identical to its twins, frontier still 4. Toy: `Deliv := l ≠ [] ∧ ∀ x ∈ l, x = true` models `RecSeqBody`, `Inter`/`Content := ∀ x ∈ l, x = true` model `SafeBodyUnit`/`FlowBodyContent`, `Guard := True` models `FlowBodyContentDeepSeq`; `projInter` is `.toSafeBodyUnit`, `assemble` the byte-identical tail, `contentOfDeliv` the unifying lemma; `rootEdge`/`descendEdge` both reduce to it and `edges_agree : rootEdge g d = descendEdge g d := rfl` proves the SOURCE is the only delta; `childContent_free` models the IH projection, `deliv_needs_nonempty : ¬ Deliv []` witnesses non-vacuity. Consume-side dual of [[RecursiveProducerMirrorsFlatOverSharedInduction]]; instance of [[ProducerDualOfConsumer]] (the deliverable's WRITE direction reversed to a READ); sharpens [[GuardReadingEdgesNeedTwins]] (the guard-reading edges, once written, COLLAPSE to one deliverable projection) + composes [[CoercionDissolvesForcedProjection]] (R500, the unified residual the tail routes through))
* `BundleFreeProjectionIntoProducer`     — Reflection 503 (the CONSUME-side of R502 ([[EdgesUnifyAsDeliverableProjection]]): realize the free projection AT the producer that already computes the deliverable, BUNDLING it into the producer's output — the deliverable does DOUBLE DUTY — instead of re-deriving it downstream via a PARALLEL edge that re-runs the deliverable's own producer. Step γ′ landed `recseqentry_seqbracket_oracle_seq_content`, the content-emitting twin of the seq oracle `recseqentry_seqbracket_oracle_seq` (R415). The oracle already draws the child `RecSeqBody ((take j).drop (lo+1))` off the CONTENT-FREE width IH (`seqChild_safeBodyUnit_seq`, R494) and internally builds the child deep guard `h_deep'` (`flowBodyContentDeepSeq_descend`); R502's `flowBodyContent_of_recseqbody_seq` turns exactly those two into the child `FlowBodyContent` with NO second IH call and NO re-run of the R500 descend edge `flowBodyContent_descend_seq`. So the twin returns `RecSeqBody ∧ FlowBodyContent ∧ trailing-sep` — the one IH-produced deliverable serving BOTH the `RecSeqEntry`-assembly consumer AND the descend child's content `G`-conjunct, the concrete instance of [[ProducerDualOfConsumer]] (the body's WRITE reversed to a READ) at the recursion site. What it does NOT close (the same-window coupling, R502): the child content here is the CHILDREN's free projection, but the CURRENT window's content (`h_content`) is still consumed by the dispatch BEFORE the current body exists, so it stays the top-down `G`-seed; and the oracle's IH stays CONTENT-FREE (the emitted content is downstream of `h_rec`, never fed back), so the carrier-free OUTER bridge — sourcing that content-free width IH without the carrier — remains the next brick. Axioms `[propext, Classical.choice, Quot.sound]`, identical to the oracle and R502, frontier still 4. Toy: `Deliv := l ≠ [] ∧ ∀ x ∈ l, x = true` models `RecSeqBody`, `Content := ∀ x ∈ l, x = true` models `FlowBodyContent`, `proj` is R502; `ihFree` the content-free IH, `oracle` the OLD producer (deliverable only), `oracleContent` THE TWIN (`let d := ihFree …; ⟨d, proj d⟩` — one evaluation, double duty), `reDerive` the R500-style parallel edge (`proj (ihFree …)` — re-invokes the producer); `twin_content_is_projection`/`twin_shares_one_deliverable` (`rfl`) make the double duty / single `d` manifest, `twin_agrees` (`rfl`) shows bundling LOSES NOTHING (same outputs, only the projection's call-site differs), `deliv_needs_nonempty : ¬ Deliv []` the non-vacuity. Fully axiom-free. The CONSUME-side realization of [[EdgesUnifyAsDeliverableProjection]] (R502) at the actual recursion site; instance of [[ProducerDualOfConsumer]]; sharpens [[ReductionByImport]] (the bundled projection retypes the descend child's content from a separate R500 derivation to a free read off the oracle's existing `h_rec`); composes [[CoercionDissolvesForcedProjection]] (R500's edge the bundling avoids re-running); continues [[RethreadStaysInWeakerTwinFamily]] + [[RootSeedNeedsRootTrueGuard]])
* `ContentSurfacingLocatorTwin`          — Reflection 504 (surface a LOCATOR's buried witness to propagate a free child projection one level up. R503 ([[BundleFreeProjectionIntoProducer]]) bundled the free child `FlowBodyContent` into the seq oracle; the oracle's emitted child content lives at the descend close `j`, but the located form `recseqentry_seqbracket_located` runs the close-locator `matchingClose_full_seq` and reports only the ENTRY-shaped `∃ m, RecSeqEntry …`, whose boundary `m` is the entry END (`j` or `j+1`), so `j` is BURIED. Step γ′ landed `recseqentry_seqbracket_located_content`, lifting R503's content-emitting oracle through the locator: it returns that SAME entry AND a second existential `∃ j, lo+1 < j ∧ j < hi ∧ tokens[j]! = .flowSequenceEnd ∧ balance (lo+1) j = 0 ∧ FlowBodyContent (lo+1) j` — SURFACING the witness the entry output hides (interior non-emptiness `lo+1 < j` from the forwarded `h_ne`). HONEST SCOPE — the brick does NOT advance the carrier-free recursion's descend. Reading `seqWindowRecSeqBody_seq_general` against `seqChild_safeBodyUnit_seq` settles the architecture: that recursion's guard `G` is ALREADY content-free (`FlowBodyWindow ∧ FlowBodyContentDeepSeq ∧ SeqEnclosed ∧ close ∧ bounds`), and the carrier `SeqInteriorSeparators` is consumed in EXACTLY ONE place — sourcing the CURRENT window's `FlowBodyContent`. The descend itself is content-FREE: the seq oracle draws the child `RecSeqBody` from the content-free width IH (`seqChild_safeBodyUnit_seq` calls the oracle ONCE on `(lo+1, j)`), so the descended child needs NO content. Hence R503's and this brick's surfaced child content is genuinely free but NOT consumed by the descend recursive call. The ONE real obstacle is isolated: the CURRENT window's content, intrinsically TOP-DOWN / path-dependent — R500 `flowBodyContent_descend_seq` produces a child's content from the PARENT's content — so a pure `windowWidth_strongRecOn` (bottom-up by WIDTH, no parent) cannot thread it. Closing it carrier-free needs `P := FlowBodyContent → RecSeqBody` (content as ANTECEDENT) with a nested content-free body IH carrying parent content, or a custom recursor on the descent carrying parent content — a JOINT/mutual construction, not single-theorem wiring. This brick is the seq-branch unit a content-threading dispatch twin will consume. Axioms `[propext, Classical.choice, Quot.sound]`, identical to R503 and the oracle, no `sorryAx`, frontier still 4. Toy: `Body`/`Content` (`0 < j`) model `RecSeqBody`/`FlowBodyContent`, `proj` is R502; `oracle` R503's content-emitting twin, `locate` the close-locator, `Entry`/`located` (`∃ m, Entry m`, `m := j+1`) the entry-shaped output that buries `j`, `locatedContent` THE TWIN surfacing `∃ j, … Content j`; `descendIH` the content-FREE descend (no content arg), `surfaced_content_is_free` (`rfl`) shows the surfaced content equals the projection of the body the descend already produces — free AND unneeded by the descend; `step`/`step_consumes_current_content` model the real obstacle — the CURRENT window's content is a top-down INPUT, not derivable from the child body; `body_needs_nonempty : ¬ Body 0` the non-vacuity. Fully axiom-free. The located-level companion of [[BundleFreeProjectionIntoProducer]] (R503); instance of [[ProducerDualOfConsumer]] (the deliverable's WRITE reversed to a READ, surfaced past the locator); sharpens [[BoundaryBoundRecovery]] (the locator's buried witness recovered once at the located level); continues [[RethreadStaysInWeakerTwinFamily]] + [[RootSeedNeedsRootTrueGuard]], pairs with [[ReductionByImport]])
* `ParametricCarrierExtraction`           — Reflection 505 (lift a recursion's SOLE carrier use into an abstract per-window content PROVIDER hypothesis — [[ParametricAssemblerExtraction]] at the recursion level. R504 ([[ContentSurfacingLocatorTwin]]) isolated that the carrier `SeqInteriorSeparators` is consumed in EXACTLY ONE place in `seqWindowRecSeqBody_seq_general` — sourcing the CURRENT window's `FlowBodyContent` — while the descend (off the content-free width IH) and the advance (its `≠ .key` premise paid from the content guard's own separator fact) are already carrier-free. R505 landed `seqWindowRecSeqBody_seq_of_provider`: the recursion verbatim with that one carrier call replaced by an abstract `h_provider : ∀ lo hi, FlowBodyWindow → FlowBodyContentDeepSeq → SeqEnclosed → lo0 ≤ lo → hi ≤ hi0 → FlowBodyContent tokens lo hi`. ANY provider drives the recursion; the carrier is one INSTANCE (fed `seqWindow_flowBodyContent_seq_general … h_carrier`), and `seqWindowRecSeqBody_seq_general` is kept standalone as that instance so its consumers are untouched ([[AdditiveParallelTypeOverSharedEdit]]). This ISOLATES the single remaining carrier-free obligation — producing `h_provider` without the carrier (the hard fixpoint). Per R502 ([[EdgesUnifyAsDeliverableProjection]]) the provider for the CHILDREN is free off the body the IH produced; only the CURRENT window's content is the genuine TOP-DOWN seed, because its `bodySucc` (the depth-`0` separator-successor fact) has NO descend-stable, balance-free form — unlike `FlowBodyContentDeepSeq`'s opener/separator fields — so it cannot be sourced bottom-up from the window's own guard. Axioms `[propext, Classical.choice, Quot.sound]`, identical to the carrier recursion, no `sorryAx`, frontier still 4. Toy: `Guard n := 0 < n` (content-free guard), `BodySucc n := n ≠ 7` (the fact the guard can't see), `Content n := 0 < n ∧ BodySucc n`, `Body n := 0 < n ∧ BodySucc n` (carries `BodySucc`, so R502 projects it); `dispatch` consumes content (not just guard), `recBodyOfProvider prov` the parametric recursion (uses `prov` in ONE place), `Carrier`/`carrierProvider`/`recBodyOfCarrier` the carrier instance with `carrier_is_an_instance` (`rfl`) showing the abstraction loses nothing; `childProvider : Body n → Content n` the R502 free child projection; `guard_does_not_entail_content : Guard 7 ∧ ¬ Content 7` the structural crux (the guard CANNOT project `BodySucc`, so the provider is a genuine extra hypothesis — exactly the carrier's irreducible job and why its root seed is the open obligation); `recursion_needs_only_provider` shows the carrier-free goal reduces to producing one provider; `body_needs_nonempty : ¬ Body 0` the non-vacuity. Fully axiom-free. Acts on [[ContentSurfacingLocatorTwin]] + [[WidthRecursionCannotThreadTopdownFact]] (R504 — names the isolated fixpoint as one hypothesis); instance of [[ParametricAssemblerExtraction]]; the children's-half-free claim is [[EdgesUnifyAsDeliverableProjection]] (R502); kept additive per [[AdditiveParallelTypeOverSharedEdit]])
* `LocatedContainerRead`                 — Reflection 506 (a navigator LOCATES a container that STORES the deliverable; reading the deliverable — and its downstream projection — out of the located container is FREE, so the navigator's job collapses to LOCATION, not PRODUCTION. R505 ([[ParametricCarrierExtraction]]) reduced the carrier-free recursion to one per-window content PROVIDER; the fixpoint-free way to discharge it is to NAVIGATE the root `RecSeqBody` (known off emission) to each window and READ its content off the body it already holds, never PRODUCING the body from content (the same-window self-cycle). R506 landed `flowBodyContent_of_located_seq_entry`, the navigator's terminal READ: the emission-spine-walk navigator (R350–R359 slice-keyed LEAF/DESCEND/ADVANCE arms, awaiting only the recursion wrapper) LOCATES the enclosing seq ENTRY — output `RecSeqEntry (op :: interior ++ [cl])` + opener + nonempty + the window-identity slice `(take (hi+1)).drop lo_e = op :: interior ++ [cl]` with `lo_e + 1 = lo` — and THIS lemma turns that located entry into `FlowBodyContent tokens lo hi` carrier-free via three landed lemmas: `recseqentry_seq_extract` (the seq-opener entry STORES `RecSeqBody interior`, the four non-seq shapes excluded), `nestedSeq_recseqentry_locate_descend` (R353, the interior re-slices to `(take hi).drop lo` — pure drop-algebra, run with `rest = []` so the entry IS the whole window), and R502 `flowBodyContent_of_recseqbody_seq` (the body projects to content). The PAYOFF (sharpens [[EdgesUnifyAsDeliverableProjection]]): the carrier-free provider need NOT produce a sub-`RecSeqBody` at every window — that would re-pose R505's own recursion — it need only LOCATE the enclosing entry, which the spine-walk arms already step, because the entry's stored interior IS the window body and content is a free projection off it. So the navigator's deliverable is the located ENTRY, not the body. Axioms `[propext, Classical.choice, Quot.sound]`, identical to the carrier recursion and R502, no `sorryAx`, frontier still 4. Toy: `BodySucc n := n ≠ 7` the guard-invisible fact, `Deep n := True` the content-free deep guard (provider-supplied), `Body`/`Content := BodySucc n`; `LocatedEntry n` a structure STORING the interior `Body` (the navigator's output, the `seq.h_rec`-carrying container), `extract` (`recseqentry_seq_extract`, reads the stored body off), `proj b d` (R502, body + deep guard → content), `content_of_located := proj (extract e) d` THE BRIDGE (carrier-free); `guard_cannot_produce : Guard 7 ∧ ¬ Content 7` the same-window cycle (content NOT producible from a content-free guard, only from a LOCATED body — R505's crux), `deep_is_free` shows the deep guard is not what's missing, `located_excludes_bad : ¬ LocatedEntry 7` the non-vacuity. Fully axiom-free. Acts on [[ParametricCarrierExtraction]] (R505 — the navigator-READ that discharges its `h_provider`) + [[WidthRecursionCannotThreadTopdownFact]] (R504 — the fixpoint-free route the warning queued); sharpens [[EdgesUnifyAsDeliverableProjection]] (R502 — the navigator locates, content is the free deliverable projection); the located-container dual of [[StoredVsProjectedSeversRecursionEdge]] (the entry STORES the body, so the read severs the production cycle); continues [[ContentSurfacingLocatorTwin]])
* `ProducerGateCoversFragment`           — Reflection 507 (a landed producer's GATE may cover only a FRAGMENT of the consumer's domain — the DUAL of [[ProbeProviderHeadBlindGate]] (gate too WEAK, admits spurious windows) is a gate too STRONG (excludes valid windows the consumer needs). R507 CONSUMES R506 ([[LocatedContainerRead]]): the brick `nestedSeq_flowBodyContent_of_locator` feeds the already-landed, hypothesis-free-over-emission navigator `nestedSeq_recseqentry_locate` into R506's terminal read, yielding per-window `FlowBodyContent` carrier-free — retyping R506's residual execution→structural ([[ReductionByImport]]). Wiring it surfaced TWO corrections: (1) the producer the blueprint Next step said to BUILD ("the spine-walk recursion wrapper") already EXISTED, assembled reflections earlier under a different name in a different file from a parallel step-lemma family (`seqLocateRecDriver` + `nestedSeq_recseqentry_locate_hstep` + `_root_seed`) — so the turn CONSUMES it; a stale Next step can name a built artifact, check before building. (2) The navigator carries `SeqPathAllSeq tokens (a-1)` (EVERY enclosing frame `[`-typed) but the frontier consumer `h_seq_rec` (`flowSubrangesOk_of_window_producers` via `seqLocator_of_window_recseqbody`) fires on EVERY balanced seq window — including a map-nested seq `[{a:[b]}]`'s inner `[b]`, where `SeqPathAllSeq` is FALSE (a `false` from the `{` below the top) yet `SeqEnclosed` (the TOP frame) holds — so the navigator and the WHOLE R350–R388/R447 seq-locator infra serve only the all-seq-path FRAGMENT, one ARM of a gate-dispatch. The weak-gate (path-free) remainder is the genuine residual, served by the R505 recursion route whose per-window gate is the path-FREE `SeqEnclosed`, threading descent through its own IH and never reading the global spine ([[StoredVsProjectedSeversRecursionEdge]]). Brick axioms `[propext, Classical.choice, Quot.sound]`, no `sorryAx`, frontier unchanged. Toy: `Deliverable n := True` (content irrelevant, the GATE is the point); `Enclosed n := n%2=0` the WEAK consumer gate (whole domain), `AllSeqPath n := n%4=0` the STRONG producer gate; `allseq_imp_enclosed` (strong ⟹ weak, the navigator's windows ⊆ the domain), `navigator h` (LANDED, gated strong), `fragment_is_strict : Enclosed 2 ∧ ¬AllSeqPath 2` the CONCRETE map-nested witness in the gap, `navigator_arm` the strong arm = the R507 brick, `residual := ∀ n, Enclosed n → ¬AllSeqPath n → Deliverable n` the weak-only OWED arm, `dispatch h_res` the full producer = navigator ⊕ residual. Headline `demo`/`dispatch` axiom-free; the subset lemma uses `[propext]` only. DUAL of [[ProbeProviderHeadBlindGate]]; consumes [[LocatedContainerRead]] + [[ReductionByImport]]; points at [[StoredVsProjectedSeversRecursionEdge]] for the path-free route)
* `CrossFrameStructuralDescent`          — Reflection 508 (the path-FREE route the R507 residual ([[ProducerGateCoversFragment]]) needs: the root `RecSeqBody` (off emission, `seqRoot_recseqbody`) ALREADY STORES every nested window's body as a subterm of the mutual inductive — `RecSeqEntry.seq` stores `RecSeqBody interior`, `RecSeqEntry.mapRec` stores `RecMapBody interior`, a `RecMapPair` stores its key/value blocks as `RecSeqEntry`s — so descending the INDUCTIVE reaches every window regardless of the bracket PATH; the `SeqPathAllSeq` gate is an artifact of TOKEN-SPINE walking, not of the deliverable. That descent crosses frames at three edges; two existed (`recseqentry_seq_extract` — seq entry → nested seq body; the `.mapRec` field — seq entry → nested map body), the THIRD — the map→seq edge from a `RecMapPair` into a key/value block that is itself a nested seq — was MISSING (the spine-walk navigators STOP at `{`). R508 lands `recmappair_block_descent`: a `RecMapPair p` exposes its `kt :: (block_k ++ vt :: block_v)` shape, `.key`/`.value` separators, both blocks as `RecSeqEntry`s, AND — the cross-frame payoff — when EITHER block is a non-empty flow-seq, its nested `RecSeqBody interior` read off by `recseqentry_seq_extract` on the pair's OWN stored entry (sound: the inner `∀` quantifies over the pair's own `block_k`/`block_v`, so the extract matches the supplied seq-shape internally and refutes the four non-seq shapes — no external split to align off the ambiguous `block_k ++ vt :: block_v` append). The map mirror of `recseqentry_seq_extract` at the pair level, co-located with `RecMapPair.ne_nil`/`head_key`; reusable by either path-free architecture (a structural navigator over the root body, or a joint seq+map spine navigator). Axioms `[propext, Classical.choice, Quot.sound]` — identical to `recseqentry_seq_extract`, no `sorryAx`, frontier 4. Toy mutual inductive `SBody`/`SEntry`/`MBody`/`MPair` (Type-valued): `SEntry.seqBody`/`mapBody` the two existing edges, `MPair.blockDescent` the map→seq primitive; the map-nested seq `[{a:[b]}]` built bottom-up (`root`); `path_not_all_seq : allSeq [seqF, mapF, seqF] = false` (the `{` frame fails the spine gate), `spineSeqOnly mapEntry = none` (the path-gated walk STOPS at `{`), yet `structuralDescend root = some innerSeq` (the structural descent reaches it path-free). `path_not_all_seq` axiom-free; the `rfl` computations over the mutual inductive use `[propext]` only. Consumes [[ProducerGateCoversFragment]] (R507 — the residual it serves) + [[StoredVsProjectedSeversRecursionEdge]] (storage stores the body, severing the production cycle); enables the path-free producer the [[WidthRecursionCannotThreadTopdownFact]] route still owes)
* `PositionalMapPairDescent`             — Reflection 509 (the first CONSUMER of R508 ([[CrossFrameStructuralDescent]]) and its POSITIONAL dual: `recmappair_window_descent`, the inverse of the build-UP `recmappair_window`. Given a `RecMapPair` over a positional window `(take m).drop lo`, it recovers the pair's own value-separator position `kv` and the two key/value sub-windows `(take kv).drop (lo+1)` / `(take m).drop (kv+1)` as `RecSeqEntry`s — the structural navigator's map-pair DESCEND step. The proof is the structural→positional bridge run in the descend direction: R508's `recmappair_block_descent` gives the LIST-level `W = kt :: (block_k ++ vt :: block_v)`, then `kv = lo + 1 + block_k.length` is DETERMINED (not located by minimality), and the slice identities follow from `List.drop_take`/`take_take`/`drop_drop`/`take_left`/`drop_left` + the window length `m - lo = |W|` (`Nat.min_eq_left`, `m ≤ size`) — the same slicing `recmappair_window` uses forward. The decisive SOUNDNESS subtlety: a key block can itself nest a `.value` (a nested map), so a first-`.value` SCAN mis-splits INSIDE the key block — the brick reads `kv` off `block_k.length` instead (cf. R508's no-external-split note: `block_k ++ vt :: block_v` does not split uniquely). Axioms `[propext, Classical.choice, Quot.sound]` — identical to the sibling positional descents `recseqbody_window_of_located_entry`/`recmapbody_window_of_located_entry`, no `sorryAx`, frontier 4. Demo models the pair window abstractly (`Nat` tokens, `KEY`/`VALUE` sentinels): a concrete pair `[KEY,VALUE,7,VALUE,9]` whose key block nests a `VALUE` — `naive_firstValue` mis-splits at the nested marker, `naive_unsound` shows scan ≠ determined position, while `1 + |block_k|` recovers both blocks (`key_block_general`/`value_half_general`, the brick's `take_left` / `← drop_drop`+`drop_left` core). The `decide` facts are axiom-free; the two general recoveries use `[propext]` only. Consumes [[CrossFrameStructuralDescent]] (R508 — its structural producer); advances the path-free navigator [[WidthRecursionCannotThreadTopdownFact]] still owes)
* `NavigatorDriverFold`                  — Reflection 510 (the STITCH that turns the completed structural-move family into the seq navigator: `recseqbody_navigator_driver` instantiates the width-recursion combinator `windowWidth_strongRecOn` at `P := RecSeqBody ((take hi).drop lo)`, bakes in the ADVANCE/TERMINATE selector `recseqbody_window_assemble` (R225-era, which itself bundles `recseqbody_cons_window`/`recseqbody_single_window`), and re-expresses the per-window step as the navigator's CONTRACT — so the whole seq navigator reduces to EXACTLY two named obligations: `locate` (per-window first-entry classify — the entry `RecSeqEntry [lo,m)` + marker `m = hi ∨ tokens[m] = .flowEntry`, handed the recursion's own width-oracle; NEARLY `recseqentry_window_dispatch_seq` already, modulo adapting its richer `h_ih` premise-list to the combinator's plain `G`-keyed oracle — where the concrete guard `G` is finally pinned) and `descend_tail` (the guard descends from `[lo,hi)` to the SUFFIX `[m+1,hi)` past the located separator — the genuine remaining analytical brick, the producer's GIFT / consumer's DEBT). The driver is AGNOSTIC to `G`: leaving it abstract makes visible that the hard guard-reconciliation reduces to those two and nothing else — `fold-consumer-chain-to-producer-contract` at the recursion-DRIVER layer, the dual of `windowWidth_strongRecOn`'s `consumer-joint-before-producer`. By the R264 mirror discriminator it names `RecSeqEntry`/`RecSeqBody` (via the assemble), so `recmapbody_navigator_driver` is the symmetric next brick. Axioms `[propext, Classical.choice, Quot.sound]` (Classical via the reused `recseqbody_window_assemble` segment-split plumbing), identical to the seq assembler family, no `sorryAx`, frontier still 4. Demo models the architecture over a list-segment toy (body = single-token entries separated by single `SEP`s): `lenRec` the combinator (mirror of `windowWidth_strongRecOn`), `navigatorDriver` THE FOLD (combinator + `Body.cons`/`Body.single` reduced to the two-obligation contract), a concrete guard `Good` with BOTH obligations discharged (`good_locate`, `good_descend_tail`) and a RUN (`run`) producing a real `Body [5, SEP, 7]` through the driver. The soundness subtlety isolated in `good_descend_tail`: it is stated for an ARBITRARY split `e` yet is true only because `Good` forces every explicit `SEP` onto a separator slot — a DEEP split (`e = a :: SEP :: e''`) is discharged by RECURSION on the `Good` derivation (the IH), mirroring why the real `descend_tail` needs the located-separator (`least`) clause / an inductive guard, not an arbitrary positional split. `run`/`demo` axiom-profile `[propext, Quot.sound]` (the toy assemble is bare constructors, shedding the real driver's `Classical.choice`). Consumes the structural-move family [[StructuralMovesAdvance]] + the combinator [[WidthRecursionCombinator]]; instance of [[FoldConsumerChain]] + [[ConsumerJointBeforeProducer]] at the driver layer; the `descend_tail` obligation is [[GuardThreadingSkeleton]]; advances the path-free navigator [[WidthRecursionCannotThreadTopdownFact]]; pairs with the map-pair descend [[PositionalMapPairDescent]] (R509) — the per-level steps `locate` will dispatch into)
* `SeqDescendTailWitness`                — Reflection 511 (lands `descend_tail`, the structural half of the R510 driver's two-obligation contract ([[NavigatorDriverFold]]): `recseqbody_seq_descend_tail`, EXTRACTED verbatim from the inline ADVANCE block of `seqWindowRecSeqBody_seq_general` (R415) — the per-window guard descent past a depth-`0` separator, narrowing the three structural guards `FlowBodyWindow`/`FlowBodyContentDeepSeq`/`SeqEnclosed` to the suffix `[m+1,hi)` + proving `m+1 < hi`, composing only landed advance edges `flowBodyWindow_advance`/`flowBodyContentDeepSeq_advance`/`seqEnclosed_advance` over the delta-`0` comma re-basing. The decisive FINDING (probing the obligation, [[ProbeDeferredUniversalBeforeProducing]] + [[MinimalPairExtractsTheGate]]): the R510 driver typed `descend_tail` on the BARE marker `tokens[m] = .flowEntry`, which is UNSOUND on two independent counts — (1) a `.flowEntry` can sit at any bracket depth, so the descend needs the depth-`0` witness `flowBracketBalance tokens lo m = 0` (`h_bal_m`, which `locate`/the dispatch emits but the driver's `locate` output DROPPED); (2) a depth-`0` `.flowEntry` at the last interior slot is a TRAILING comma whose suffix is empty, ruled out only by the current window's `FlowBodyContent` (`h_content`: `feContentStart` at `m` forces `isFlowContentStart tokens[m+1]`, but `tokens[hi]=.flowSequenceEnd` is not a content start ⇒ `m+1≠hi`; the same `h_content` discharges the re-scoped edge's `tokens[m+1]≠.key`). So the driver must be re-typed to thread `h_bal_m`, and the guard `G` must carry the window's content provider — the carrier-free top-down-content obstacle [[WidthRecursionCannotThreadTopdownFact]] pinned to its precise entry point, the `descend_tail` edge. `h_content` is CONSUMED not reproduced (next window's content re-sourced from the carrier), so the descend outputs only the three structural guards + `m+1<hi`. The guard-threading skeleton [[GuardThreadingSkeleton]] for the seq descend edge. Axioms `[propext, Classical.choice, Quot.sound]` — seq-family profile (Classical from the advance edges' WellTyped plumbing), no `sorryAx`, frontier still 4. Demo isolates the finding over a tiny token/balance model (`0`=SEP, `1`/`2`=brackets, `≥3`=content; `bal` = prefix delta-sum): `marker_not_depth0` (a SEP nested in `[OPEN,SEP,CLOSE]` — marker holds yet `bal l m ≠ 0`), `depth0_marker_can_be_trailing` (a depth-`0` SEP at the end of `[3,SEP]` — marker + depth-`0` hold yet `m+1 = length`), `WitnessedSep` (the marker∧depth0∧nonTrailing bundle the descend really needs, mirror of `(h_sep,h_bal_m,h_content)`), and a FLAT body `Good`/`good_descend_tail`/`run_tail` where the witnesses are automatic (no brackets ⇒ depth always `0`) — the flat model HIDES the obstacle precisely because it cannot express the two counterexamples, which is why the real grammar must thread the dropped witnesses; `witnessed_flat` exhibits the same index-`1` SEP as a genuine `WitnessedSep` in `[5,SEP,7]`. `demo` axioms `[propext]`, `run_tail` axiom-free (the toy sheds the real Classical). Consumes [[NavigatorDriverFold]] (R510 — the driver whose `descend_tail` this discharges and re-types); instance of [[GuardThreadingSkeleton]]; advances [[WidthRecursionCannotThreadTopdownFact]] by pinning the content obstacle to the descend edge; pairs with `locate` (the still-owed dispatch-half obligation))
* `SeqRootReconciliation`                — Reflection 512 (the critical-path RECONCILIATION that fixes WHERE the genuine remaining work lives: `flowSubrangesOk_of_seqRoot_and_map_producers` folds the whole DISCHARGED seq chain into the actual contract consumer ([[FoldConsumerChainToProducerContract]] at the contract level) — it composes `flowSubrangesOk_of_window_producers` with `seqHRec_of_root_and_emit` in its `h_seq_rec` slot, a DIRECT substitution since R440 made the two universals textually identical, so the entire SEQ half of the frontier obligation `FlowSubrangesOk tokens` (`NonemptyStructure.lean:11208`) collapses to the SINGLE hypothesis `h_root_carrier` = `SeqInteriorSeparators tokens 2 (size-2)` + emit/boundary context already in scope. Two findings PINNED: (1) the genuine open seq residual is now exactly the root carrier (= `seqRoot_seqInteriorSeparators` fed its `desc` descent provider — `seqEnclosingOpener_of_gate` LOCATE + `seqDescent_provider_of_gate` ASSEMBLE, the hard B2 brick), while the MAP side stays as its seven RAW per-window producers (`h_map_rec` + six grammar facts) — a recorded seq/map ASYMMETRY, seq one carrier away, map owing its whole family; (2) the width-recursion DRIVER `recseqbody_navigator_driver` (R510, [[NavigatorDriverFold]]) + its `recseqbody_seq_descend_tail` (R511, [[SeqDescendTailWitness]]) are OFF this critical path — a parallel modular re-derivation of R415's inlined `step`; since `RecSeqBody`-at-a-window is a `Prop`, the driver-route and carrier-route witnesses are the SAME proof up to proof-irrelevance, so the driver re-proves what R415 already delivers. The discovery came from TRACING the actual critical path: R415 + the R432–R441 emit/fold-totality chain already close the seq navigator end-to-end given the root carrier (residual (2) `h_fold_total` discharged GENERALLY via `seqWholeStreamWellTyped`+`seqFoldTotal_of_context`). Demo (self-contained core Lean) models the fold over a token toy: `Carrier` (hard residual stand-in) + `Emit` → `windowFacts_of_carrier` (toy R432) → `seqProducer_of_windowFacts` (toy R415) folded by `seqProducer_of_carrier_and_emit` (toy `seqHRec_of_root_and_emit`); `contract_of_producers` (toy consumer) needs a `SeqProducer` + a RAW `MapProducer`; `contract_of_carrier_and_map` (toy R512) collapses the seq half so `Contract` follows from `Carrier ∧ Emit ∧ MapProducer`; `seqProducer_via_driver` + `driver_route_redundant` model the off-path finding (a 2nd route to the SAME `SeqProducer` Prop, equal by `rfl` proof-irrelevance); `run` exhibits a concrete `Contract sample` through the reconciliation. `demo`/`run` axiom-FREE (the real R512 carries `[propext, Classical.choice, Quot.sound]`; the toy sheds it), frontier still 4. Instance of [[FoldConsumerChainToProducerContract]] / [[ReductionByImport]]; pins the residual exposed by [[WidthRecursionCannotThreadTopdownFact]]; supersedes the [[NavigatorDriverFold]]/[[SeqDescendTailWitness]] driver line as off-path)
* `MapCarrierFoundation`                 — Reflection 513 (the FOUNDATION of the map mirror, attacking the seq/map ASYMMETRY R512 pinned: where the SEQ axis is one root carrier from done, the MAP axis owed its WHOLE producer family (seven RAW per-window producers: `h_map_rec` + six grammar facts). This brick lands the map analog of `SeqTypedInterior`/`SeqInteriorSeparators` + its three subset-restriction edges: the gate `MapTypedInterior` (the `some false` DUAL of the seq gate's `some true` — `btStep` convention `true = [`, `false = {`), the bundled `MapGrammarFacts` (the six `flowSubrangesOk_of_window_producers` map hypotheses re-keyed `lo→a`, `hi→b`, window-ABSOLUTE on `a`), the carrier `MapInteriorSeparators := ∀ a b, lo ≤ a → a ≤ b → b ≤ hi → MapTypedInterior → MapGrammarFacts`, and `_narrow`/`_descend`/`_advance`. Three findings PINNED: (1) window-absolute ⇒ subset restriction is fact-count-AGNOSTIC — `_narrow`'s proof is BYTE-IDENTICAL to the seq carrier's (`exact h a b (Nat.le_trans …) hab (Nat.le_trans …) hgate`) however many facts are bundled, because `_narrow` never inspects the body ([[WindowAbsoluteGateSubsetRestriction]]); (2) the gate is the `some false` type-DUAL — the same `narrow`/`descend`/`advance` core drives BOTH axes off one design; (3) marker-FREE ⇒ re-projects for free — the carrier drops the consumer's `flowMappingEnd`/`flowMappingStart` boundary premises (its `= some false` enclosure identifies the map interior instead), so it is STRICTLY STRONGER and implies each marker-bearing consumer hypothesis by discarding the marker at `a := lo, b := hi` (the next brick `mapGrammarFacts_of_mapRoot`). Demo (self-contained core Lean) models all three over a token toy: a `Prop`-valued `Gate` reading `enclTop t a = some false`, a multi-conjunct `GrammarFacts` (to exhibit `_narrow` ignoring them), `MapCarrier` as the guarded universal, the three edges by `Nat.le_trans` exactly as in the file, `projects_to_consumer` dropping a marker premise, and `run`/`demo` exhibiting descend + advance + re-projection. `demo`/`run` axiom-FREE (the real `MapInteriorSeparators_narrow`/`_advance` carry `[propext]` only — the structural edges shed even `Classical.choice`/`Quot.sound`), frontier still 4. Verified-but-unconsumed: its consumer — a future `mapHRec_of_root_and_emit` + `flowSubrangesOk_of_seqRoot_and_mapRoot` — does not exist yet. The map dual of [[SeqRootReconciliation]]; instance of [[WindowAbsoluteGateSubsetRestriction]]; foundation for [[FoldConsumerChainToProducerContract]] on the map axis)
* `MapGateBridge`                        — Reflection 514 (the genuine "real work" R513 named for the map root projection `mapGrammarFacts_of_mapRoot`: SUPPLYING the gate `MapTypedInterior` the carrier `MapInteriorSeparators` carries as a premise. The gate's enclosing-opener conjunct `(btFold (some []) (tokens.toList.take a)).bind (·.head?) = some false` is a fact about the PREFIX `[0,a)`, NOT the window interior `[a,b)`, so it is not a projection of any interior predicate — it must be RECONSTRUCTED IN PLACE at the window from its boundary opener ([[ReconstructInPlaceOverRelocate]] / [[PrefixGateReconstructedFromBoundary]]): split `take (q+1) = take q ++ [opener]`, fold the typed-prefix witness `btFold .. (take q) = some s` through the single opener step, read the new stack top. Two lemmas landed in the source file: `enclosingMark_false_of_opener` (the `{`-opener pushes `false`) and `mapTypedInterior_of_opener` (bundles balance + the reconstructed conjunct + floor into the gate). They are the `some false`/`.flowMappingStart` DUAL of the seq pair `enclosingMark_true_of_opener` (`:1310`) / `seqTypedInterior_of_opener` (`:1335`) — a PURE TWO-SYMBOL TEXT-SWAP (`.flowSequenceStart → .flowMappingStart`, `some true → some false`) resting on ONE `btStep` fact: a `{` pushes `false` where a `[` pushes `true` (`WellBracketed.lean:1540-1541`). The mirror sheds NO machinery ([[NearLeafMirrorShedsMachinery]] degenerate: nothing dropped, nothing added) — a [[MirrorCostDeltaAlphabet]] of cost exactly `{push-symbol swap}`; axioms `[propext, Quot.sound]`, byte-identical to the seq pair. Demo (self-contained core Lean, no imports) models all three over a `Tok` toy (`lbrack`/`lbrace`/`other`): the `btStep` push-dual, the prefix-split reconstruction in BOTH directions (proving the swap is the ONLY difference), and the bundled gate; `demo` carries `[propext, Quot.sound]` (the `Quot.sound` via `List.foldl_append`, faithfully matching the real lemmas). Frontier still 4. Verified-but-unconsumed: `mapGrammarFacts_of_mapRoot` does not exist yet. Foundation under [[MapCarrierFoundation]]; instance of [[ReconstructInPlaceOverRelocate]] + [[MirrorCostDeltaAlphabet]])
* `MapRootProjection`                     — Reflection 515 (COMPOSES R513's carrier ([[MapCarrierFoundation]]) and R514's gate bridge ([[MapGateBridge]]) into the map root projection `mapGrammarFacts_of_mapRoot` — the map twin of the seq root projection, the step that turns the abstract carrier `MapInteriorSeparators tokens lo' hi'` into the concrete six `MapGrammarFacts tokens (q+1) hi` the final consumer `flowSubrangesOk_of_window_producers` (`NonemptyStructure.lean:10434+`) wants. Three findings PINNED: (1) the projection is a ONE-STEP composition, not new induction — a guarded-universal carrier yields its body by INSTANTIATION (pick the window `[q+1,hi)`, supply the gate, read the facts); nothing recurses because the carrier already did the universal work ([[GuardedUniversalFoldRelocatesGuard]]: consuming the carrier CONSUMES the guard, never re-produces it); (2) the gate's two NON-premise inputs are FOLDED as hypotheses — the gate `MapTypedInterior` has three conjuncts, two are the consumer's OWN premises (body balance, the `.flowMappingStart` opener driving the bridge), the other two — the pre-opener PREFIX witness `btFold (some []) (take q) = some s` and the body FLOOR — are NOT carried by the consumer's six grammar premises, so the projection takes them as hypotheses naming the producer's remaining contract ([[FoldConsumerChainToProducerContract]]); at the real consume site they come from `WellTyped_prefix_some` (`WellBracketed.lean:1790`) and a `flowBracketBalance_interior_dyck` re-base (`:2118/2142`, the SAME floor `flowBracketBalance_matching_close_map` extracts), the SAME two sources the seq path uses; (3) the prefix witness is genuinely a PREFIX fact `[0,q]`, OUTSIDE the window `[q+1,hi)` the carrier and facts both live in, so no interior predicate projects it ([[PrefixGateReconstructedFromBoundary]]) — exactly why it must be a folded hypothesis. The lemma itself is a one-line composition `h_carrier (q+1) hi … (mapTypedInterior_of_opener …)`; axioms `[propext, Quot.sound]`, inherited verbatim through the R514 gate bridge. Demo (self-contained core Lean, no imports) models all three over a `Tok` toy: the R514 gate bridge, a toy guarded-universal carrier `MapInteriorSeparators := ∀ a b, lo'≤a → a≤b → b≤hi' → MapTypedInterior → MapGrammarFacts`, and the one-step `facts_of_root` composing them with prefix witness + floor folded as hypotheses; `demo` carries `[propext, Quot.sound]` (`Quot.sound` via `List.foldl_append`). Frontier still 4. Verified-but-unconsumed: its consumer — a future `flowSubrangesOk_of_seqRoot_and_mapRoot` reconciliation (map twin of R512) — does not exist yet. CLOSES the carrier→facts step of the map axis; consumes [[MapCarrierFoundation]] + [[MapGateBridge]]; instance of [[GuardedUniversalFoldRelocatesGuard]] + [[FoldConsumerChainToProducerContract]])
* `MirrorInheritsDependencyAxioms`       — Reflection 516 (a faithful proof-MIRROR inherits its DEPENDENCY's axiom profile, which can differ from its sibling's — the axiom-layer companion to landing brick (2)'s first sub-brick `mapWholeStreamWellTyped` + `mapFoldTotal_of_context` (the `h_fold_total` residual of the map fold `mapHRec_of_root_and_emit`, the `some false`/`{`/`}` dual of `seqWholeStreamWellTyped`/`seqFoldTotal_of_context`). The proofs are a faithful text-swap, yet `#print axioms` diverges: `seqWholeStreamWellTyped` is `[propext, Classical.choice, Quot.sound]` (clean) while `mapWholeStreamWellTyped` is `[propext, sorryAx, Classical.choice, Quot.sound]` — it carries `sorryAx`. The asymmetry is invisible in the proof TEXT; it comes entirely from the structure-lemma DEPENDENCY: the SEQ structure lemma `scanFiltered_emitSeq_nonempty_structure` had its `FlowSubrangesOk := sorry` residual RELOCATED out at R442, but the MAP one `scanFiltered_emitMap_nonempty_structure` still discharges its `ParseEntryFlowMapOk` conjunct with that `sorry` INLINE (`NonemptyStructure.lean:11208`, frontier sorry #4) — so the WHOLE map context-provider family inherits `sorryAx`, even though `mapWholeStreamWellTyped` reads ONLY the clean boundary/`WellTyped` fields, never the tainted conjunct. Two findings PINNED: (1) axiom inheritance is at CONSTANT-dependency granularity, not field-usage granularity — projecting only the CLEAN field off `⟨clean, tainted⟩` STILL inherits the taint, because `#print axioms` walks the syntactic dependency closure of every referenced constant and does not prune constructor fields the proof never reduces; so a "pure text-swap mirror" claim must be qualified by auditing the DEPENDENCIES' axioms, not just the proof body; (2) a cleanup that fixed one sibling may never have been mirrored on the other — when two siblings diverge in axiom profile despite identical proofs, look for an asymmetric upstream cleanup (here R442) and either mirror it (a separate relocation brick that would clean the whole map family at once) or state the inheritance honestly. Adds NO NEW sorry — routes through the existing #4 — and the `sorryAx` vanishes the moment the root carriers close #4; frontier still 4. Demo (self-contained core Lean, no imports) uses a custom `axiom relocated_residual` standing in for the real `sorryAx`: a `Struct` with a clean `boundary` field and a hard `parserOk` field proved via the axiom in the TAINTED sibling but `trivial`-y in the CLEAN one, and two readers `seqWhole`/`mapWhole` with BYTE-IDENTICAL bodies `·.boundary`; `#guard_msgs` pins `seq_clean` axiom-FREE while `map_tainted`/`demo` carry `[relocated_residual]` — though neither touches the hard field. Companion to [[MapRootProjection]] (the prior brick) and [[SeqRootReconciliation]] (R512, whose seq context pair this mirrors); sharpens [[MirrorCostDeltaAlphabet]] / [[MirrorReadsConjunctNotProjection]] by adding the axiom layer to the mirror-cost accounting)
* `MapProducersCollapse`                  — Reflection 520 (the brick (3) CORE: collapse the SIX map grammar producers onto the single map root carrier, the map mirror of how `seqHRec_of_root_and_emit` collapses `h_seq_rec`. Two lemmas land: `mapGrammarFacts_window_of_root` re-keys R515's `mapGrammarFacts_of_mapRoot` ([[MapRootProjection]]) from the opener position `q` to the producer's window START `lo` (`q := lo - 1`, `q + 1 = lo` by `Nat.sub_add_cancel` since `2 ≤ lo`), supplies the pre-opener prefix witness from whole-stream fold-totality, and — the R519 redirect ([[BracketGuardsAdmitCrossMatched]]) realized — DISCARDS the `.flowMappingEnd` closer guard while THREADING the Dyck floor (the eighth guard, now present on the slots); `mapProducers_of_mapRoot` bundles the six producers by projecting the matching `MapGrammarFacts` conjunct (`.1 … .2.2.2.2.2`) at every guarded window. PREREQUISITE landed first this turn: the six grammar producer slots of `flowSubrangesOk_of_window_producers` / `mapLocator_of_window_recmapbody` / `flowSubrangesOk_of_seqRoot_and_map_producers` were STRENGTHENED with the Dyck floor `∀ i ∈ [lo,hi], balance lo i ≥ 0` as their eighth guard (free at the consumer call sites — `mapLocator` already has `h_floor` in scope from the `MapLocated` output guard), so they match `h_seq_rec`/`h_map_rec` and the Dyck-gated carrier can fire. Three findings PINNED: (1) the NON-strict `lo ≤ hi` slot guard (the empty nested `{}` window `lo = hi`, vacuous but must type-check) FORCES the R515 `q`-keyed route, which needs only `q + 1 ≤ hi`, never `lo < hi` — the `FlowBodyWindow`-keyed `mapWindow_grammarFacts` (R518) would demand strict and could not; picking the route by which arithmetic it forces is the design decision; (2) the `q ↦ lo - 1` re-key is the ONLY new arithmetic over R515 — one `Nat.sub_add_cancel` rewrite carried through balance, floor, conclusion; (3) closer DISCARDED + floor THREADED makes the producer's eight-guard list and the carrier's three-conjunct gate line up exactly modulo the dropped marker. Feeding the six into `flowSubrangesOk_of_window_producers` collapses six of its seven map slots onto the carrier, leaving only `h_map_rec` (the `RecMapBody` recursion, brick (2)) raw — the exact map mirror of R512's seq asymmetry ([[SeqRootReconciliation]]). Both lemmas audit `[propext, Quot.sound]` (inherited through R515) — NO `sorryAx`, because the carrier is an ASSUMED hypothesis ([[MirrorInheritsDependencyAxioms]] R518: taint tracks the dependency, an assumed carrier is clean). Demo (self-contained core Lean) models the collapse over a tiny window arithmetic: a guarded-universal `Carrier` whose `Gate` requires a `floor`, the R515-style `facts_of_root` keyed on `q`, the R520 re-key `facts_window_of_root` with the `Nat.sub_add_cancel` bridge + closer-as-discarded-`True` + `lo = hi` admitted (`empty_window_admitted`), and the bundle collapse `producers_of_root`; `demo` carries `[propext, Quot.sound]` faithfully matching the real lemmas. Frontier still 4. Verified-but-unconsumed: its consumer — `flowSubrangesOk_of_seqRoot_and_mapRoot` (R512's map twin) — does not exist yet. CONSUMES [[MapRootProjection]] + [[BracketGuardsAdmitCrossMatched]]; mirror of [[SeqRootReconciliation]])
* `DelegatedNestingShedsGuardFields`     — Reflection 521 (brick (2)'s pivot: `FlowBodyContentDeepMap`, the map body content-navigation guard the map width-recursion `mapWindowRecMapBody_map_general` (the R415 analog) threads — the long-flagged "hard design decision". Two findings PINNED. (1) A deliverable whose recursion DELEGATES nesting needs a STRICTLY SIMPLER threading guard than one that INLINES it — read the delegation off the inductive. `RecSeqEntry` INLINES the seq item shapes, so the seq recursion DESCENDS into every nested `[ … ]` itself: `FlowBodyContentDeepSeq` carries THREE fields (`headContentStart`/`openerContentStart`/`feContentStart`) and supports BOTH descend + advance edges (`openerContentStart` is the fact descend reads to seat a nested child's head). `RecMapBody → RecMapPair → RecSeqEntry` DELEGATES: the key/value blocks are `RecSeqEntry`s navigated by the seq-entry oracles (`recmapentry_pair_located`), and the map body only ADVANCES past depth-`0` `.flowEntry` by BALANCE, never descending — so `FlowBodyContentDeepMap` SHEDS the opener field AND the descend edge: TWO fields (`headKey`, `feKey`), ONE edge (`flowBodyContentDeepMap_advance`). The inductive's delegation asymmetry propagates verbatim to the guard. (2) Dual-axis separator guards mirror by swapping the discriminator to the OTHER axis's separator-successor: seq's `feContentStart` reads `sep → next ≠ .key → content` (the `≠ key` premise excludes map-internal `,`s), map's `feKey` is the exact dual `sep → ¬ content → next = .key` (the `¬ content` premise excludes seq-internal `,`s) — discriminator = `.key` for seq, `content` for map, everything else a verbatim mirror; the gate is read off `MapBodyProps.after_fe` the driver supplies at advance. The map advance is strictly simpler: child head is the SUPPLIED successor (no parent-field read, unlike seq which reads its `feContentStart`), no opener field to restrict, no descend edge. Root probe `flowBodyContentDeepMap_root_holds_two_pairs` inhabits the guard NON-vacuously on `{a: b, c: d}` (`feKey` fires at the depth-`0` `.flowEntry` at index 6 → `.key` at 7 — the position the seq guard's root probe could not exercise). `advance` audits `[propext, Quot.sound]`, the probe adds `Classical.choice` + `native_decide` axioms — both NO `sorryAx` (neither touches the tainted `scanFiltered_emitMap_nonempty_structure`, [[MirrorInheritsDependencyAxioms]] R518). Demo (self-contained core Lean) models a stream as `f : Nat → Tok`, both guards, both advance edges (the map one visibly simpler), and `sample_mapGuard`/`demo` advancing past the depth-`0` `.sep`; `demo` carries `[propext, Quot.sound]`. Frontier still 4. Verified-but-unconsumed until the map driver wires it. Additive parallel guard ([[AdditiveParallelType]]) beside `FlowBodyContentDeepSeq`; mirror of the seq guard whose role this fills, the map twin of the recursion [[MapProducersCollapse]] collapses the grammar half of)
* `ThreadingFormVsAssembleForm`          — Reflection 522 (brick (2) advance: `mapWindow_mapBodyProps_general`, the carrier+deep-guard → `MapBodyProps` projection one layer UP from [[MapProducersCollapse]]'s `mapWindow_grammarFacts_general` — it composes the six carrier adjacency facts with `mapBodyProps_assemble` (which builds M5/M8/M9/M10 from the window's own balance/Dyck/`WellTyped` via the typed locators) and reads M1 `key_start` off the deep guard's `headKey`, producing the full ten-field `MapBodyProps` the map pair-boundary locate needs (M9/M10 place the value separator `kv` when the key is a nested bracket, not just a scalar). Finding PINNED: a per-window separator-successor fact has TWO non-interconvertible shapes — a THREADING form (CONDITIONAL: `,` whose successor is ¬content ⟹ key — `FlowBodyContentDeepMap.feKey`, what the recursion's advance edge re-establishes step-by-step, the `¬ content` premise letting it fire without proving content-exclusion) and an ASSEMBLE form (UNCONDITIONAL: `,` ⟹ key — `MapBodyProps.after_fe`, M2, what the one-shot assembler demands). The threading form does NOT imply the assemble form: deriving the unconditional from the conditional needs the `¬ content` premise FOR FREE — the very exclusion the threading form assumed. This forces the recorded seq/map carrier ASYMMETRY: the SEQ carrier `SeqInteriorSeparators` BUNDLES the unconditional fact (`noTrailingSepFact`) so the seq bridge self-sources it; the MAP carrier `MapInteriorSeparators` OMITS it (only the six `MapGrammarFacts`), so the map bridge takes `after_fe` as a SUPPLIED hypothesis — the lone non-carrier, non-guard input (M1 `headKey` comes from the deep guard on both axes; only the comma-successor splits asymmetrically). Real lemma audits `[propext, Classical.choice, Quot.sound]` (from `mapBodyProps_assemble`'s typed locators) — NO `sorryAx`: it never touches the tainted `scanFiltered_emitMap_nonempty_structure` ([[MirrorInheritsDependencyAxioms]] R517–R518: consumer of an ASSUMED carrier stays clean). Demo (self-contained core Lean) models a stream `f : Nat → Tok`, both fact shapes (`FeThreading`/`AfterFe`), the non-implication `threading_not_implies_afterFe` witnessed by a `seqLike` stream where the threading form holds vacuously yet the assemble form fails, and BOTH bridges (`mapBridge` takes `after_fe` as an arg, `seqBridge` reads it off the carrier `SeqCarrier`); `demo` carries `[propext]`. Frontier still 4. Verified-but-unconsumed until the map pair-boundary locate + driver `mapWindowRecMapBody_map_general` land. Builds on [[DelegatedNestingShedsGuardFields]] (R521 deep guard), [[MapProducersCollapse]] (R520 grammar collapse); the carrier internalize-vs-defer reading sharpens [[AdditiveFieldCostByKeying]])
* `BalanceInvisibleSplitGrammarLocated`   — Reflection 523 (brick (2): `mapPairSkeleton_locate`, the map analog of `matchingClose_full_seq` but for the pair's value separator — it PRODUCES the `h_skeleton` `∃ kv e, …` that `recmapentry_pair_located` (R282/R284) had to take SUPPLIED, from the per-window `MapBodyProps` [[ThreadingFormVsAssembleForm]] now delivers. Two findings. (1) **Balance-invisibility blocks a balance LOCATOR, not the location.** A pair `.key K .value V` returns balance to `0` at the depth-`0` `.value` AND at every nested-entry end, so the `.value` is balance-invisible (R282) — there is no balance-pure `kv` locator. But `kv` is read off the typed grammar: M1 `.key` head, M3 content-start at `lo+1`, dispatched by shape into M4 (scalar key ⟹ `kv = lo+2`) or M5 (bracket key ⟹ `kv = j+1`, the matching close). The pair end `e` is the SHARED half — least depth-`0` marker via the axis-agnostic `firstEntryBoundary` — carrying `balance lo e = 0` + the marker disjunct + minimality verbatim. (2) **The crux `kv < e` (value separator precedes the first boundary) has a proof cost that BIFURCATES by the key's head shape.** Both rule out a marker in `(lo, kv]`. For a FLAT (scalar) key the two interior positions fall to TOKEN IDENTITY ALONE (`lo+1` a scalar, `kv` the `.value`; neither `.flowEntry`, neither `hi`) — zero balance reasoning. For a NESTED (bracket) key the interior `[lo+2, j]` is genuinely depth-positive, so it is ruled out by the M5 positivity lifted through `lo` (`balance lo k = 1 + balance (lo+2) k ≥ 1 ≠ 0`) — one balance step the flat case never pays; endpoints still fall to token identity. So balance-invisibility ROUTES the location through the grammar, and the head's interior depth profile sets the proof cost. Real lemma audits `[propext, Classical.choice, Quot.sound]` (`Classical.choice` from `firstEntryBoundary`/`flowBracketBalance_compose`) — NO `sorryAx`: consumes only `firstEntryBoundary`, the `MapBodyProps` projections, and balance algebra, never the tainted structure lemma ([[MirrorInheritsDependencyAxioms]]). Demo (self-contained core Lean) models a toy `List Tok` with prefix-`bal`; the two `*_clean` no-marker lemmas (`scalar_clean` takes NO positivity hypothesis, `bracket_clean` takes and CONSUMES one — the bifurcation made textual), the two `kv_lt_e_*` crux lemmas, and concrete `sk`/`bk` streams whose `#guard`s witness balance-invisibility (`bal` returns to `0` at several positions, only the token distinguishing `kv`); `demo` carries `[propext, Quot.sound]`. Frontier still 4. Verified-but-unconsumed until the map width-recursion driver `mapWindowRecMapBody_map_general` threads it (then `recmapentry_pair_located`'s `h_skeleton` is a consequence of `MapBodyProps`, not a parameter). Sharpens [[EntryBoundaryLocator]]'s input/shape split (R282 supplied this fact; now derived))
* `SubblockNonemptyFromClassCollision`    — Reflection 524 (brick (2): `mapPairSubblocks_flowBodyWindow`, the map DRIVER's descend-into-pair narrower — it packages a map pair's KEY sub-block `[lo+1, kv)` and VALUE sub-block `[kv+1, e)` each as a `FlowBodyWindow`, the shape every `RecSeqEntry` key/value oracle the driver feeds `recmapentry_pair_located` consumes. Every input is a [[BalanceInvisibleSplitGrammarLocated]] skeleton output EXCEPT the one head-dispatched fact `h_kv_depth : balance lo kv = 0` (the value separator sits at depth 0, which `MapBodyProps` does NOT assert — M6/M7/M8 take it as a guard), ISOLATED as the lone hypothesis so the whole narrowing is head-shape-FREE. Two reusable moves. (1) **A sub-block's NON-emptiness is a token-CLASS collision off a grammar successor field, not a balance fact.** The key block is non-empty (`lo+1 < kv`) because M3 `key_content` puts a *content-start* at `lo+1` while `kv` holds a `.value` — and a content-start is never a `.value`, classes disjoint — so `lo+1 = kv` is impossible; symmetrically the value block (`kv+1 < e`) via M6 `value_content` vs the `.flowEntry`/end marker at `e`. No depth is measured: the collapse is refuted by the DISJOINTNESS of the token classes the grammar fields assert. (2) **Re-base the outer Dyck floor through the depth-`0` splits.** The `.key`/`.value` separators are bracket-delta `0`, so each split origin is at depth 0 (`balance lo a = 0`), hence each sub-block's running balance EQUALS the outer one re-based (`balance a i = balance lo i`) and the outer `dyck` transports verbatim; `WellTyped` via `WellTyped_subrange`. Head shape never enters — `.key`/`.value` deltas are `0` regardless of `K`/`V`. Real lemma audits `[propext, Classical.choice, Quot.sound]` — NO `sorryAx` (composes only `MapBodyProps` projections, balance algebra, `WellTyped_subrange`, never the tainted structure lemma [[MirrorInheritsDependencyAxioms]]). Demo (self-contained core Lean) models a toy `List Tok` with the content-start CLASS (`sc`/`op`/`cl`) vs structural tokens (`ky`/`vl`/`fe`); `key_nonempty`/`val_nonempty` PROVE the collision principle in general (no balance), concrete `scalarPair`/`bracketPair` `#guard`s witness the depth-`0` splits (and that a bracket key's INTERIOR `.fe` sits at depth `1`, invisible to the depth-`0` split); `demo` carries `[propext, Quot.sound]`. Frontier still 4. Verified-but-unconsumed until the driver `mapWindowRecMapBody_map_general` feeds each window to a `recseqentry_window_dispatch`-style oracle. Next brick supplies `h_kv_depth` (extend the [[BalanceInvisibleSplitGrammarLocated]] skeleton to emit `balance lo kv = 0`))
* `DispatchPinsLocatedDepth`             — Reflection 525 (brick (2): the head dispatch that LOCATES a witness also PINS its depth, for free — discharging at its SOURCE the one fact [[SubblockNonemptyFromClassCollision]] (R524) had to isolate as `h_kv_depth : balance lo kv = 0`. R524 found `MapBodyProps` cannot supply it — M6/M7/M8 take the value separator's depth-`0`-ness as a GUARD, not an assertion, so it cannot be bootstrapped from the grammar bundle. This reflection extends the [[BalanceInvisibleSplitGrammarLocated]] skeleton `mapPairSkeleton_locate` to ALSO emit `balance lo kv = 0` in its output existential, FREE in each dispatch branch because the very case-split that PLACES `kv` walks over tokens whose bracket-deltas TELESCOPE to the depth: **scalar key** `kv = lo+2`, depth `= balance lo lo + δ(.key) + δ(scalar) = 0 + 0 + 0`; **bracket key** `kv = j+1`, depth `= 0 + δ(.key) + (opener `+1`) + (interior `0`, the locator's OWN `h_inner_bal`) + (close `-1`) = 0`. The bracket telescope is recovered by un-discarding the `h_close`/`h_inner_bal` conjuncts the R523 proof had dropped as `_`-binders — nothing is re-derived downstream. So the driver `obtain`s `⟨kv, e, …, h_kv_depth, …⟩` from ONE locator call and feeds `h_kv_depth` straight to the [[SubblockNonemptyFromClassCollision]] narrower while re-packaging the rest as `recmapentry_pair_located`'s `h_skeleton`. Real extended lemma still audits `[propext, Classical.choice, Quot.sound]` — sorryAx-free, the depth fact adds NO new dependency (pure balance algebra). Demo (self-contained core Lean) models a recursive prefix-`bal` whose single-step law `bal l (n+1) = bal l n + deltaAt l n` is DEFINITIONAL, proves both telescopes (`depth_scalar` two delta-0 steps, `depth_bracket` the opener+interior+close cancellation) and bundles each into a locator `locate_scalar`/`locate_bracket` that returns BOTH `kv` and `bal l kv = 0`; concrete `scalarPair`/`bracketPair` `#guard`s witness the depth returning to `0` at the located separator; `demo` carries `[propext, Quot.sound]`. Frontier still 4. Verified-but-unconsumed until the driver `mapWindowRecMapBody_map_general` threads it — the last skeleton input the driver needs is now bundled, leaving only the driver's own width recursion)
* `DescendTailDualUseSeparatorSuccessor` — Reflection 526 (brick (2): the map driver's DESCEND-TAIL edge, `recmapbody_map_descend_tail`, the map twin of `recseqbody_seq_descend_tail` (R511). After a body-recursion driver locates a depth-`0` `.flowEntry` pair/entry separator `m`, it must DESCEND the per-window guard to the suffix `[m+1, hi)` — TWO obligations: (O1) suffix non-degeneracy `m + 1 < hi` (no trailing separator), and (O2) re-establish the structural deep guard at the new head. The reflection: BOTH are discharged by ONE per-window fact — the separator's successor token CLASS — and the seq/map twins differ only in WHICH provider supplies it and its POLARITY. The **seq** edge reads `FlowBodyContent.feContentStart` (`.flowEntry` → content-start): O1 contradicts `tokens[hi] = .flowSequenceEnd` (a close is not content), O2 yields the deep advance's `≠ .key`. The **map** edge reads `MapBodyProps.after_fe` (`.flowEntry` → `.key`): O1 contradicts `tokens[hi] = .flowMappingEnd` (`.key ≠ .flowMappingEnd`), O2 IS `flowBodyContentDeepMap_advance`'s `tokens[m+1] = .key` child-head premise, supplied verbatim. So the map edge is structurally SIMPLER (advance-only deep guard, no `isFlowContentStart`-unfold to extract `≠ .key`) and takes `MapBodyProps` where the seq edge takes `FlowBodyContent`; the comma's delta-`0` re-basing and the `WellTyped` enclosure-frame segment are verbatim from the seq edge. Real lemma audits `[propext, Classical.choice, Quot.sound]` — sorryAx-free, never the tainted structure lemma ([[MirrorInheritsDependencyAxioms]]); cross-links [[ThreadingFormVsAssembleForm]] (the `after_fe` unconditional form) and [[MirrorReadsConjunctNotProjection]] (the map deep guard's positive `.key` head). Demo (self-contained core Lean) abstracts a `DeepGuard Succ` parameterized by the successor class, proves `no_trailing_sep` (O1) and `guard_advance` (O2) each consuming the lone `h_succ`, then the dual-use `descend_tail` that consumes `h_succ` TWICE; two polarity instances `descend_tail_map` (`· = .key` / `.mapEnd`) and `descend_tail_seq` (`isContent` / `.seqEnd`) differing only in `Succ`/`closeTok` + the `¬ Succ closeTok` side condition, plus a concrete two-pair map body `mapList` run through `mapSuffix`; `demo` carries `[propext, Quot.sound]`. Frontier still 4. Verified-but-unconsumed until the driver `mapWindowRecMapBody_map_general` threads it — this is the driver's per-window ADVANCE step, the last guard-threading brick before the width recursion itself)
* `DispatchFirstEntryToWholeWindow`      — Reflection 527 (brick (2): the bridge `recseqentry_whole_window_seq` that turns the seq entry DISPATCH into the WHOLE-window single-entry producer the map pair's key/value sub-block oracles need. `recseqentry_window_dispatch_seq` locates the FIRST entry of a body window `[lo, hi)` — its boundary `m` (depth-`0`, either the window end or a `.flowEntry`), minimality, and `RecSeqEntry ((take m).drop lo)`. But a map pair `.key K .value V` splits into a key block `[lo+1, kv)` and a value block `[kv+1, e)`, and `recmapentry_pair_located`'s two oracles each owe a SINGLE `RecSeqEntry` for the WHOLE sub-block. The reflection: these are the SAME producer once the window carries a no-interior-boundary certificate. A map key/value has no top-level comma, so its sub-block has no depth-`0` `.flowEntry` strictly inside; that single fact forces the dispatch's `m` to the window END (`m = hi`), so the first entry IS the whole window. The certificate is exactly the enclosing recursion's pair-end minimality — `mapPairSkeleton_locate` ([[BalanceInvisibleSplitGrammarLocated]]) returns the pair end `e` as the LEAST depth-`0` boundary after `lo`, so a separator inside a sub-block would be an earlier boundary, which cannot exist. The reusable shape: a body-recursion's first-entry dispatch becomes a whole-window single-item producer by adjoining a no-interior-boundary certificate that pins the located boundary to the window end — the SAME dispatch, the SAME IH (threaded UNTOUCHED), one extra hypothesis collapsing the existential. So this brick is SILENT on the driver's cross-deliverable knot (the map width-IH delivers `RecMapBody`, not the `RecSeqBody` this dispatch wants): it isolates boundary-pinning from IH-sourcing. Real lemma audits `[propext, Classical.choice, Quot.sound]` — sorryAx-free, inherits the dispatch's profile, never the tainted structure lemma ([[MirrorInheritsDependencyAxioms]]). Demo (self-contained core Lean) abstracts the dispatch output shape `FirstEntry Entry l lo hi` over a toy running-balance `bal` and entry predicate `Entry`, proves the bridge `whole_window` once (the marker-disjunct collapse verbatim), runs it on a concrete bracketed-scalar key block `[ sc ]` (`keyBlock_whole`), and exhibits the NEGATIVE — a two-entry body `sc , sc` whose interior `.fe` makes the certificate genuinely FALSE (`twoEntries_certificate_fails`); `demo` carries `[propext, Quot.sound]`. Frontier still 4. Verified-but-unconsumed until the driver `mapWindowRecMapBody_map_general` threads it — the sub-block ENTRY producer, downstream of the descend-tail ([[DescendTailDualUseSeparatorSuccessor]]) and skeleton ([[DispatchPinsLocatedDepth]]) bricks, awaiting the joint deliverable that sources its `RecSeqBody` IH)
* `MirrorNavigatorDriverStitch`          — Reflection 528 (brick (2): the map locate DRIVER `recmapbody_navigator_driver`, the symmetric mirror of `recseqbody_navigator_driver` (R510) across the R264 entry-boundary-input-shape split ([[EntryBoundaryInputShapeSplit]]). A body-recursion navigator has three already-proven parts: a width-recursion combinator (`windowWidth_strongRecOn`, strong induction on `hi - lo`), a window ASSEMBLER that folds the first item + tail oracle into the whole-window deliverable (`recmapbody_window_assemble`), and the per-window analytical work. The reflection: the *driver* is the STITCH that wires the three, and once stitched the entire navigator reduces to EXACTLY TWO abstract obligations — `locate` (the first item's extent `m`, marker `m = hi ∨ tokens[m] = .flowEntry`, and the single-item deliverable) and `descend_tail` (descend the guard `G` past the separator to `[m+1, hi)`). Everything else — the strong-rec plumbing, the marker-disjunct collapse (`resolve_left (by omega)`), the ADVANCE/TERMINATE selection — is collection-AGNOSTIC; the deliverable TYPES (`RecMapBody`/`RecMapPair` for `RecSeqBody`/`RecSeqEntry`) and the assembler are the SOLE knobs, so the map axis is the seq driver transported VERBATIM (a pure type-swap, no new analytical content). The `locate` obligation is where the cross-deliverable knot lives — the width-oracle delivers `RecMapBody` but a nested *sequence* inside a key/value needs `RecSeqBody` (consumed by `recseqentry_whole_window_seq`, R527 [[DispatchFirstEntryToWholeWindow]]) — resolved by a joint `P` dispatched on the window close token; `descend_tail` is the [[DescendTailDualUseSeparatorSuccessor]] brick (R526). Real lemma audits `[propext, Classical.choice, Quot.sound]` — sorryAx-free, identical to the seq driver (Classical via the reused `recmapbody_window_assemble` segment-split). Demo (self-contained core Lean) proves the abstract `navigator_driver` once — parametric in `(G, Item, Body, sep, assemble, locate, descend_tail)`, the verbatim marker-disjunct + strong-rec stitch — then instantiates it at TWO distinct deliverable triples (`SeqEntry`/`SeqBody` and `MapPair`/`MapBody`) as one-line `seqNav`/`mapNav` over a no-separator model, and runs each on a concrete window (`SeqBody 0 5`, `MapBody 0 5`); the mirror is literally a swap of the type/assembler arguments. `demo` carries `[propext, Quot.sound]`. Frontier still 4. Verified-but-unconsumed until the concrete `G`/`locate`/`descend_tail` are supplied — this is the map navigator's grammar-free spine, reducing the remaining residual to those two obligations on the map axis exactly as R510 did on the seq axis)
* `JointNavigatorDriverCrossDeliverable` — Reflection 529 (the JOINT map+seq body navigator driver `recbody_joint_navigator_driver`, the brick resolving the cross-deliverable IH knot the two single drivers (R510/R528) left open. Each single driver runs `windowWidth_strongRecOn` at a deliverable fixed to ONE collection (`RecSeqBody` *or* `RecMapBody`), so its width-oracle delivers only that one shape — but the real recursion is cross-deliverable: a map pair's key/value sub-block is one `RecSeqEntry`, and `RecSeqEntry.seq` stores `RecSeqBody interior` while `RecSeqEntry.mapRec` stores `RecMapBody interior`, so descending into a nested *sequence* under a map pair (or a nested *map* under a seq entry) needs the OTHER body deliverable than the one the single oracle carries; a single-collection oracle cannot supply it. The resolution: run ONE width-recursion at a close-token-dispatched JOINT deliverable `P lo hi := (tokens[hi] = .flowSequenceEnd → RecSeqBody …) ∧ (tokens[hi] = .flowMappingEnd → RecMapBody …)` — the window's close bracket selects which body it is, and the conjunction carries BOTH implications so the oracle delivers whichever a narrower window needs ([[ConsumerJointBeforeProducer]] at the deliverable layer). Each per-window step dispatches on the actual close token (`h_seqEnd`/`h_mapEnd`), locates the first item with the matching collection-specific `locate` (`locate_seq` → `RecSeqEntry`, `locate_map` → `RecMapPair`), folds it with the matching assembler, and draws the tail from the SAME joint oracle projected by the SAME close token (the suffix `[m+1, hi)` shares the window's close `tokens[hi]`, so its dispatch agrees — `.1 h_seqEnd`/`.2 h_mapEnd`). Both single drivers are now literally PROJECTIONS of this one: `recseqbody_navigator_driver` is `.1`, `recmapbody_navigator_driver` is `.2`. The proof is the two single-driver bodies run side by side under one `refine ⟨…, …⟩` sharing one recursion and one joint oracle — no new analytical content, the marker collapse (`resolve_left ∘ omega`) and `descend_tail` advance are the verbatim collection-agnostic stitch ([[MirrorNavigatorDriverStitch]] R528). Real lemma audits `[propext, Classical.choice, Quot.sound]` — sorryAx-free, identical to both single drivers. Demo (self-contained core Lean) proves the abstract `joint_navigator_driver` once — parametric in `(G, closeA, closeB, ItemA, ItemB, BodyA, BodyB, sep, assembleA, assembleB, locateA, locateB, descend_tail)`, the dual-half stitch — exhibits the two single drivers as the `.1`/`.2` projections `seqDriver`/`mapDriver`, instantiates at two DISTINCT body-type pairs (`SeqEntry`/`SeqBody`, `MapPair`/`MapBody`), and shows the cross-deliverable draw concretely (`cross_draw_reachable`: while producing a `SeqBody`, a `MapBody` for a narrower window is reachable off the joint oracle's `.2`). `demo` carries `[propext, Quot.sound]`. Frontier still 4. Verified-but-unconsumed until the concrete `G`/`locate_seq`/`locate_map`/`descend_tail` are supplied — the locate's first-item classify is the remaining analytical work, but it now receives the JOINT oracle, so its key/value sub-blocks draw `RecSeqBody`/`RecMapBody` from one source [[DispatchFirstEntryToWholeWindow]])
* `JointDescendTailDispatch` — Reflection 530 (the JOINT navigator DESCEND-TAIL `recbody_joint_descend_tail` — the `descend_tail` companion of the joint driver [[JointNavigatorDriverCrossDeliverable]] R529. A width-recursion navigator's `descend_tail` narrows the per-window guard from `[lo, hi)` to the suffix `[m+1, hi)` past a depth-`0` separator; the seq and map navigators each had their own edge (`recseqbody_seq_descend_tail` R511 / `recmapbody_map_descend_tail` R526), producing one collection's guard. The JOINT driver runs at a close-token-dispatched conjunctive deliverable, so it needs ONE `descend_tail` advancing WHICHEVER guard the close token selects — produced here by dispatching the two single edges on the window close token (`rcases` the close disjunction; per branch unpack the matching content pack, call the matching edge, reassemble). Two structural points: (1) **reproduced vs consumed** — the descend REPRODUCES `FlowBodyWindow` + the close-dispatched deep-content/enclosure pair (`FlowBodyContentDeepSeq ∧ SeqEnclosed` on seqEnd, `FlowBodyContentDeepMap ∧ MapEnclosed` on mapEnd) + the close disjunction (those advance), but each single edge CONSUMES a top-down content provider (`FlowBodyContent`/`MapBodyProps`) and the located separator's depth-`0` balance `h_bal_m`, which the recursion cannot thread top-down ([[WidthRecursionCannotThreadTopdownFact]]) and cannot reproduce at the suffix — so those appear as EXPLICIT close-gated hypotheses, the visible carrier debt (wiring needs the driver marker to carry `h_bal_m` and the carrier to feed the packs); (2) **vacuous off-branch** — the conjunctive goal carries BOTH close-keyed implications; in the seq branch the map implication's premise `tokens[hi] = .flowMappingEnd` contradicts `= .flowSequenceEnd`, discharged for ANY goal by close-token disjointness (`by decide` on the constructor equality), and symmetrically. Real lemma audits `[propext, Classical.choice, Quot.sound]`, sorryAx-free, identical to both single edges. Demo (self-contained core Lean) proves the abstract `joint_descend_dispatch` once — parametric in `(close, Win, DeepS, DeepM, EncS, EncM, PackS, PackM, advanceS, advanceM)`, the exact dual-branch dispatch with vacuous off-branch via a two-valued `Close` discriminator — then instantiates at toy guards and RUNS both branches (`hi = 3 → seqEnd` fires the seq advance + vacuous map; `hi = 4 → mapEnd` fires the map advance + vacuous seq). `demo` carries `[propext]`. Frontier still 4. [[MirrorNavigatorDriverStitch]] [[ConsumerJointBeforeProducer]])
* `JointContentPackFromCarrier` — Reflection 531 (the JOINT per-window CONTENT-PACK provider `recbody_joint_content_pack` — the carrier→content feed for the joint descend [[JointDescendTailDispatch]] R530. R530 takes its two close-gated content packs (`h_seq_pack : seqEnd → DeepSeq ∧ SeqEnc ∧ FlowBodyContent`, `h_map_pack : mapEnd → DeepMap ∧ MapEnc ∧ MapBodyProps`) as OPAQUE inputs because the width recursion cannot reproduce the content fact at a descended suffix ([[WidthRecursionCannotThreadTopdownFact]]); this lemma MANUFACTURES them, discharging the second of R530's two debts. Two structural points: (1) **pass-through vs manufacture** — of the three pack conjuncts, the deep + enclosure halves pass straight through from the navigator guard's close-gated pieces (`h_seq_guard`/`h_map_guard`, the shape R530 produces and the driver threads), and ONLY the content (`FlowBodyContent`/`MapBodyProps`) is built, per-window from a FIXED OUTER carrier seeded once at the root and narrowed in place ([[NarrowFromRootBreaksRederivationCycle]]) — composing `seqWindow_flowBodyContent_seq_general` (seq, `SeqInteriorSeparators` carrier) + `mapWindow_mapBodyProps_general` (map, `MapInteriorSeparators` carrier); so the provider is a guard→guard transform that bolts content on, its OUTPUT being precisely R530's pack INPUTS — the two compose end-to-end. (2) **the asymmetric deferred fact** — the seq provider needs only its carrier, but the MAP provider needs one extra fact `h_after_fe` (M2 — every depth-`0` comma is followed by a `.key`) that NEITHER carrier bundles (the seq carrier self-sources its comma-successor fact, the map carrier defers M2 — [[AdditiveFieldCostByKeying]]), kept as an EXPLICIT supplied hypothesis, the map-carrier debt made legible. Unlike R530 there is NO off-branch vacuity: each pack is an INDEPENDENT close-gated implication produced side by side (`refine ⟨fun .. => .., fun .. => ..⟩`), each opening its own gate — no shared discriminator to contradict. R530's OTHER debt (the located separator's depth-`0` balance `h_bal_m`) is orthogonal to content and stays the driver-marker brick. Real lemma audits `[propext, Classical.choice, Quot.sound]` (inherited from the map provider's typed-locator plumbing; the seq half is axiom-clean), sorryAx-free. Demo (self-contained core Lean) proves the abstract `joint_content_pack` once — parametric in `(close, Win, DeepS, DeepM, ContentS, ContentM, CarrierS, CarrierM, M2, EncS, EncM, provideS, provideM)`, the dual-pack assembly where the map provider alone consumes the close token + the deferred `M2` — then instantiates at toy guards and RUNS both packs (`hi = 3 → seqEnd`, `hi = 4 → mapEnd`). `demo` depends on NO axioms. Frontier still 4. Verified-but-unconsumed until the joint driver threads the two carriers + M2 per-window and pairs this with R530)
* `JointDescendTailCarrier` — Reflection 532 (the carrier-fed concrete JOINT descend-tail `recbody_joint_descend_tail_carrier` — the COMPOSITION of the two landed joint bricks: `recbody_joint_content_pack` (R531, [[JointContentPackFromCarrier]]) feeds its output into `recbody_joint_descend_tail` (R530, [[JointDescendTailDispatch]])'s OPAQUE content slot, yielding the concrete `descend_tail` the strengthened joint driver [[JointNavigatorDriverCrossDeliverable]] R529 needs. The lesson — **importing a provider into a consumer's opaque slot RETYPES the consumer's interface** ([[ReductionByImport]]): R530 stated bare takes two debts, the content packs (`FlowBodyContent`/`MapBodyProps`, top-down + irreproducible at the suffix, [[WidthRecursionCannotThreadTopdownFact]]) and the marker's depth-`0` balance `h_bal_m`; importing R531 DISCHARGES the content debt, so the composed edge's surviving inputs are the CARRIER interface — the two outer carriers `SeqInteriorSeparators`/`MapInteriorSeparators tokens lo0 hi0` (root-seeded, narrowed per window by the frame bounds `lo0 ≤ lo ∧ hi ≤ hi0`, [[NarrowFromRootBreaksRederivationCycle]]), the map-deferred fact `h_after_fe` (M2, [[AdditiveFieldCostByKeying]]), and the still-explicit `h_bal_m`. The descend no longer asks for the irreproducible content fact; it asks for the root carrier, which IS reproducible top-down. That swap — top-down content → root carrier — is the whole value: no sorry discharged, the interface RETYPED, and the retype is the progress. Because R531's OUTPUT type is conjunct-for-conjunct R530's pack INPUT type, the composition is a two-line `obtain ⟨h_seq_pack, h_map_pack⟩ := R531 …; exact R530 … h_seq_pack h_map_pack …`. Produces R530's deliverable at the suffix `[m+1, hi)`: `FlowBodyWindow` + the close-dispatched deep/enclosure pair + the close disjunction = the suffix value of the joint guard `G (m+1) hi`. Real lemma audits `[propext, Classical.choice, Quot.sound]` (inherited from R530/R531), sorryAx-free. Demo (self-contained core Lean) proves the abstract `descend_tail_carrier` once — parametric in `(close, Win, DeepS, DeepM, ContentS, ContentM, CarrierS, CarrierM, M2, Bal, EncS, EncM, Sep, descend, provide)`, the opaque-input edge `descend` ∘ the provider `provide` — then instantiates at toy edges and RUNS both close branches (`hi = 3 → seqEnd`, `hi = 4 → mapEnd`). `demo` carries `[propext, Quot.sound]` (the toy's `simp [close]` decidability machinery; the REAL lemma audits `[propext, Classical.choice, Quot.sound]`). Frontier still 4. Verified-but-unconsumed until the driver's `locate` markers carry `h_bal_m` and `G` is folded)
* `JointGuardDescendTail` — Reflection 533 (the JOINT navigator guard-FOLD: the named guard `RecBodyJointGuard` + the descend-at-guard lemma `recbody_joint_guard_descend_tail` — the guard-fold half of the joint-driver re-type, brick (2) piece (i). `recbody_joint_navigator_driver` [[JointNavigatorDriverCrossDeliverable]] R529 runs `windowWidth_strongRecOn` over an ABSTRACT guard `G : Nat → Nat → Prop`, and its `descend_tail` slot demands `G lo hi → … → G (m+1) hi`. The carrier-fed descend `recbody_joint_descend_tail_carrier` (R532, [[JointDescendTailCarrier]]) already advances the UNPACKED window facts — `FlowBodyWindow`, the two close-gated deep/enclosure halves, the close disjunction — to the suffix `[m+1, hi)`. **The fold** packs exactly those facts, PLUS the frame bounds `lo0 ≤ lo ∧ hi ≤ hi0` (the per-window carrier-narrowing witnesses, [[NarrowFromRootBreaksRederivationCycle]]), into one named conjunction `RecBodyJointGuard tokens lo0 hi0 lo hi` — the concrete `G` once `lo0`/`hi0` are fixed. Then the descend-at-guard lemma is a project-call-repack: destructure `G lo hi` to its six conjuncts, feed window/halves/close + carriers + M2 + marker into R532, re-pack the four-way suffix deliverable as `G (m+1) hi`. The ONE non-pass-through conjunct is the suffix frame LOWER bound `lo0 ≤ m+1`, re-established by `omega` from `lo0 ≤ lo` and `lo < m`; the upper bound `hi ≤ hi0` is shared with the window's close `hi` and carries verbatim. The lesson — **the fold sorts every fact by reproducibility**: what the recursion can reproduce per-window (window + close-gated halves + frame bounds) goes INSIDE `G`; what it cannot (the two fixed-at-root carriers, the map-deferred `M2`, the marker balance `Bal`) stays a named OUTER input — exactly the plumbing the driver must still thread ([[ReductionByImport]]: this packages R532's retyped edge against the named `G`, it does not discharge a sorry). Real lemma audits `[propext, Classical.choice, Quot.sound]` (inherited from R532), sorryAx-free. Demo (self-contained core Lean) defines the folded `Guard` parametric in `(close, Win, DeepS, DeepM, EncS, EncM)`, proves the abstract `guard_descend_tail` (one abstract `carrierEdge` standing for R532, projected-and-repacked against `Guard`), then instantiates at toy guards and RUNS both close branches end-to-end (input guard at `[0, hi)` → descended suffix guard at `[m+1, hi)`; `hi = 3 → seqEnd`, `hi = 4 → mapEnd`). `demo` carries `[propext, Quot.sound]`. Frontier still 4. Verified-but-unconsumed until the driver's `locate` markers carry `h_bal_m`, the carriers are threaded per-window, and `h_after_fe` is narrowed from a global M2)
* `JointNavigatorDriverCarrier` — Reflection 534 (the CARRIER-specialised JOINT body navigator driver `recbody_joint_navigator_driver_carrier` — the abstract joint driver [[JointNavigatorDriverCrossDeliverable]] R529 instantiated at the named guard `G := RecBodyJointGuard tokens lo0 hi0` [[JointGuardDescendTail]] R533, with the `descend_tail` slot DISCHARGED by `recbody_joint_guard_descend_tail` (R533) and the two root carriers + the map-deferred `h_after_fe` (M2) threaded as fixed inputs. Where R529 left `G`/`locate_seq`/`locate_map`/`descend_tail` all open, this brick fixes `G` and supplies `descend_tail`, so the remaining obligations shrink to exactly the two collection-`locate`s — each now STRENGTHENED to emit the located separator's depth-`0` balance `flowBracketBalance tokens lo m = 0`, the extra `∃`-conjunct R533's `h_bal_m` consumes. The lesson — **route a producer-fact to a consumer-slot THROUGH the agnostic recursion** ([[ReductionByImport]] consuming R533): `windowWidth_strongRecOn` and its `oracle` carry only `G`/the deliverable, never the balance; the balance is a producer-side fact (the locate knows where `m` sits and at what depth) needed at a consumer-side premise (the descend narrows the carrier there), and it reaches it purely by widening the locate's `∃` and the descend's premise in lockstep — the body merely carries it across the `oracle`/`assemble` stitch, cost exactly one new binder at three sites (existential, `obtain`, descend call). `h_hi_sz` is no longer a separate input — it is the trivial projection `(·.2.2.1.hi_lt)` off the guard's window invariant. Carriers keyed at the fixed outer span `lo0 hi0`, narrowed per window by the guard's frame bounds (R533); `h_after_fe` taken per-window-keyed ON the guard, deferring the global→per-window narrowing (the `flowBracketBalance tokens lo k` re-basing across windows) to a later brick. Real lemma audits `[propext, Classical.choice, Quot.sound]` (inherited from R532/R533 and the assemblers), sorryAx-free. Demo (self-contained core Lean): the agnostic `widthRec` combinator (toy of `windowWidth_strongRecOn`, never mentions the balance), the abstract `driver` (locate emits `Bal lo m`, body routes it into `descend` producing the guard `G (m+1) hi`) audited as `demo` → `[propext, Quot.sound]`, plus `routeOnce` — the routing in ISOLATION at one window — instantiated at toy types and RUN end-to-end (a full recursion run would hit locate's window-non-emptiness demand, a separate brick). Frontier still 4. Verified-but-unconsumed until the two strengthened `locate`s are supplied and M2 is narrowed from the global field)
* `JointOracleSeqIh` — Reflection 535 (the joint-oracle → seq-IH ADAPTER `recbody_joint_oracle_seq_ih` — the cross-deliverable knot's SEQ half and the first concrete brick of the two `locate`s [[JointNavigatorDriverCarrier]] R534 still takes as inputs. The carrier-specialised driver hands its per-window step a JOINT `oracle`: at every strictly-narrower sub-window `[lo', hi')` it delivers BOTH deliverables keyed on the close marker — `(seqEnd → RecSeqBody) ∧ (mapEnd → RecMapBody)`. But the seq first-entry dispatch `recseqentry_window_dispatch_seq` (R527) — and the map locate's single-entry sub-block producer `recseqentry_whole_window_seq` — consume a SEQ-ONLY induction hypothesis `h_ih` wanting a bare `RecSeqBody` from window facts plus an enclosure predicate `Q lo'`. This adapter is the bridge: instantiate the dispatch's `Q := SeqEnclosed tokens`, and it produces the exact `h_ih` from the joint oracle. The lesson — **adapt a joint oracle to an axis-specific IH by guard RECONSTRUCTION + one-side PROJECTION** ([[ReductionByImport]] read at the oracle interface): the oracle wants a `RecBodyJointGuard tokens lo0 hi0 lo' hi'`, the dispatch's `h_ih` hands over the loose pieces (`FlowBodyWindow`, `FlowBodyContentDeepSeq`, `SeqEnclosed` as `Q lo'`, the seq close, span/bounds), so the proof FOLDS them back into the guard — the two outer bounds compose by `omega`, the window verbatim, the seq conditional `⟨h_deep, h_encl⟩`, and crucially the OFF-axis (map) conditional is VACUOUS: its premise `tokens[hi']!.val = .flowMappingEnd` contradicts the seq close, so MARKER EXCLUSIVITY (`decide` on `.flowSequenceEnd = .flowMappingEnd`) discharges it with no map fact ([[ConverseForwardInvariantAsymmetry]] read as marker exclusivity). Folding done, the joint deliverable's `.1` applied to the seq close is the owed `RecSeqBody`. Why this is the seq HALF of the knot: `seqWindowRecSeqBody_seq_general` already produces `RecSeqBody` but only on the all-seq PATH domain (`SeqPathAllSeq`, every enclosing frame a `[`) because it sources nested deliverables from the seq CARRIER, which cannot speak for a `{`-enclosed frame; drawing the IH from the JOINT oracle instead lifts that restriction — the oracle delivers both bodies at EVERY narrower window regardless of enclosing-bracket type, so the dispatch threaded through this adapter is path-AGNOSTIC. Real lemma audits the minimal `[propext, Quot.sound]` (pure guard folding, no structure lemma, no choice), sorryAx-free. Demo (self-contained core Lean): a two-constructor `Marker` with `DecidableEq`, the toy `JointGuard` parametric in the predicates, the adapter `seqIhOfOracle` (the audited artifact, `[propext, Quot.sound]`), `reconstructGuard` — the guard fold in ISOLATION with the map conditional refuted by marker exclusivity — and a toy instance RUN end-to-end through the adapter. Frontier still 4. Verified-but-unconsumed until `locate_seq`/`locate_map` are assembled, each = its dispatch at `Q := SeqEnclosed` fed this adapter plus a per-window `FlowBodyContent` source)
* `LoopPushPointwise`                    — Reflection 592 (element-value join for `parseFlow{Sequence,Mapping}Loop_push_pointwise` (SS5.10.5). For each index `j < result.1.size` the loop makes at least one sub-call step that PUSHES `v = result.1[j]!` into the accumulator, with pre- and post-push sub-call witnesses bracketing the push. Relies on R591's indexed sub-call witness from `parseFlowSequenceLoop_step_subwit`. Axiom set `[propext, Classical.choice, Quot.sound]`.)
* `ScalarTokenPinned`                    — Reflection 593 (scalar token content pinning (SS5.12). `scanDoubleQuoted_tokens_push_content`: when the scanner input is `'"' :: escapeString content ++ '"' :: rest` in flow context, `scanDoubleQuoted` pushes exactly `.scalar content .doubleQuoted` -- content pinned, no existential. Derived by combining the existing `exists c` push (`scanDoubleQuoted_tokens_push`) with the `lastRealTokenVal?` pinning from `scanDoubleQuoted_flow_ok` and `YamlToken.scalar.inj`. `scanNextToken_flow_scalar_filtered_push_content` lifts this to the `scanNextToken` level. Axiom set `[propext, Classical.choice, Quot.sound]` plus `native_decide` axioms from `collectDoubleQuotedLoop_escapeString_succeeds` and its escape-character dependencies.)
* `ScalarComposeValue`                   — Reflection 594 (standalone scalar parse, composed value pin (SS5.12 continued). When `parseYamlRaw (emitScalar content)` succeeds with exactly one document, the composed first document's value is EXACTLY `.scalar (Scalar.mk content .doubleQuoted none none none)` -- the RIGHT SIDE of the per-element locality equation for scalar elements, verified-but-unconsumed until the outer-parse half (R595) lands.)
* `ComposeSeqItemsPointwise`             — Reflection 595 (outer-parse half of the scalar locality equation (SS5.12). `compose_seq_items_pointwise`: if `doc.value = .sequence .flow items' ..` and `doc.compose.value = .sequence .flow items'' ..`, then `items'' = items'.map (fun v => (v.resolveAliases anchors).stripAnchors)`. `compose_seq_scalar_item`: for anchor-free scalar items `items'[j]! = .scalar s`, the composed item is `items''[j]! = .scalar s` unchanged. Proof chains `resolveList_eq_map`/`stripList_eq_map` to collapse the sequence case, then `getElem!_pos` + `Array.getElem_map` + `congr 1`/`getElem!_pos.symm` (cf. [[ref_getelem_map_to_bang_congr1]]) to bridge the bound-proof index to the bang form. Axiom set `[propext, Quot.sound]`.)
* `ScannerSpanLocality`                  — Reflection 596 (scanner-span-locality body-content fact for all-scalar flow sequences (Front-B, SS5.12). `emitList_allScalar_body_content_at`: for a non-empty all-scalar flow sequence `emitList items` scanned from a flow-context state, produces a body block with `block.length = 2 * items.length - 1` and `block[2*j]!.val = .scalar items[j].content .doubleQuoted` at each even index. Proof by direct list induction parallel to `emitList_scans_safebody` in BlockProducers.lean: `scanNextToken_flow_scalar_filtered_push_content` pins the scalar head token; `scanNextToken_flow_comma_filtered_push` + `scanNextToken_preprocess_flow_ws1` absorb the `", "` separator; the IH provides the tail block and the indexing hops use `List.getElem!_cons_succ` twice to skip the two prefix tokens. Associativity fix: `rest_1 := ',' :: ...` named as a `let` binding so that `h_chars ▸ hcorr` produces `hcorr_h : ScannerSurfCorr s (esc ++ rest_1)` with `rest_1` as an opaque parameter -- avoids the `++` left-vs-right associativity mismatch that `rw` at `hcorr` would leave. Axiom set: R593's set (propext, Classical.choice, Quot.sound, plus native_decide axioms from double-quoted scanner and escape functions).)
* `ComposeMapPairsPointwise`             — Reflection 604 (outer-parse half of the per-pair locality equation for MAPPING values (SS5.18). `compose_map_pairs_pointwise`: if `doc.value = .mapping .flow pairs' ..` and `doc.compose.value = .mapping .flow pairs'' ..`, then `pairs'' = pairs'.map (fun (k, v) => ((k.resolveAliases doc.anchors).stripAnchors, (v.resolveAliases doc.anchors).stripAnchors))`. `compose_map_scalar_pair`: for anchor-free scalar pairs `pairs'[j]! = (.scalar sk, .scalar sv)`, the composed pair is `pairs''[j]! = (.scalar sk, .scalar sv)` unchanged. Mirror of `compose_seq_items_pointwise` / `compose_seq_scalar_item` (R595/SS5.17) for the mapping axis: uses `resolvePairs_eq_map` / `stripPairs_eq_map` in place of `resolveList_eq_map` / `stripList_eq_map`, and `YamlValue.mapping.injEq` to extract `pairs''`. Verified-but-unconsumed until scanner-span-locality for mapping pairs lands; then closes the per-pair equation at `EmitterScannability.lean:1147`. Axiom set `[propext, Quot.sound]`.)
* `FlowMapLoopWitness`                   — Reflection 605 (loop witness for mapping outer-shape recovery (SS5.8b). `parseStream_flowMapStart_loop_witness`: given a successful `parseStream` with `.flowMappingStart` at `tokens[1]!`, exposes the underlying `parseFlowMappingLoop` call at `pos = 2`, fuel `4 * tokens.size + 2`, whose result IS the first raw document's pair array `pairs'`. Mirror of R602 (`parseStream_flowSeqStart_loop_witness`, SS5.8a) for the mapping axis: traces `parseStream_first_doc_at_pos_one` --> `prepareDocumentState` --> `parseNode` --> `parseFlowMapping` --> `parseFlowMappingLoop`. This witness bridges `h_parse` to the per-pair value pins needed by the all-scalar branch of `emit_roundtrip_mapping_content_eq`: R605 exposes `pairs'`; scanner-span-locality for mapping pairs will pin `pairs'[j]!`; `compose_map_scalar_pair` (R604) then closes `(pairs''[j]!).fst/snd`. Axiom set `[propext, Classical.choice, Quot.sound]`.)
* `ProducerDualOfConsumer`               — Reflections 245 + 246 + 247 + 248 (the producer's per-level assembler is the constructive dual of the consumer joint — same positional bridge, opposite direction, constructor vs. eliminator; its symmetric MIRROR transports the plumbing verbatim but sheds at the constructor exactly the field the additive parallel type projects instead of stores: seq `SEntry.seq` stores `WB`, map `MEntry.map` omits-and-projects it; the BUNDLE assembler `bundleLocatedSeq`/`bundleLocatedMap` lifts the field-level dual to the consumer's bundled deliverable `SLocated`/`MLocated` — only the recursive `entry` field is non-trivial, the rest are window-guard pass-throughs, and the map bundle threads one extra stored primitive `keyF` the entry producer never supplies; and R248 — that storage asymmetry is SCALE-FREE: the same projected-vs-stored mechanism SHRINKS the entry constructor and GROWS the bundle, opposite signs, witnessed by `wb_recovered` (post-hoc projection at the shrunk constructor) vs `mlocated_key` (the grown-in stored field projected back out))
* `FreeProjectionInvariant`              — Reflections 253 + 254 (a consumer-bundle field that is definitionally a CONJUNCT of a property the recursive deliverable already PROJECTS to is a FREE field, not a threaded obligation — read the deliverable's projection family before deciding what the recursion threads: `WB l := balance l = 0 ∧ ∀ i, 0 ≤ balance (l.take i)`, the recursive `Rec` projects to `WB` (`Rec.toWB`, `wrap` case = `WB_wrap`), so the bundle `Located`'s `dyck` field is `(Rec.toWB h).2` for free — `located_of_rec` takes only the `wt : WT` hypothesis and no `h_dyck`; the CONTRAST is `WT` (typed bracket matching), which `Rec` does NOT project to — `rec_mismatched : Rec [os,a,cm]` holds yet `not_wt_mismatched : ¬ WT [os,a,cm]`, so `dyck_mismatched_free` is still derivable but no `Located [os,a,cm]` is — the R244 stored-vs-projected split surfacing at the locate's invariant SET rather than a constructor's fields. **R254**: the one invariant with no local projection (`WT`) is recovered all the same — *non-locally*, from the OUTER window's `WT` via a subrange interface `WTsub` (the toy of `WellTyped_subrange`) whose two side conditions are the window's *free* balance + Dyck off `Rec.toWB`; the outer assembler `located_of_rec_outer` (toy of `seqLocated_of_recseqbody_outer`) threads ONE outer `WT`, recovers the window's `wt` through `WTsub`, and takes no per-window `WT` and no `dyck` — only the structural `Rec`; `wtsub_concrete`/`located_window_via_outer` witness it on `{ { a } } ⊃ { a }`, so Dyck is free LOCALLY and `WT` is free NON-LOCALLY, neither threaded per window)
* `StoredVsProjectedRecursionEdge`       — Reflections 251 + 252 (a recursive-deliverable inductive's STORAGE choices set the PRODUCER's recursion graph — `Entry.seq` stores the recursive `Body interior` so the producer's `seq` case recurses (`buildEntry` → `buildBody`), while `Entry.map` projects only the flat `bal interior = 0` so the producer's `map` case is a LEAF (`buildEntry` → `bal_emitList`, never `buildBody`), severing the recursion edge; witnessed by `mapLeaf` (a flat leaf builder for the projecting member, with no `seqLeaf` counterpart) and by `built_map_empty : Entry [om,cm]` (the projecting member accepts an interior with NO `Body`, even though `not_body_nil` shows `Body []` is uninhabited and the storing member therefore needs a dedicated `seqEmpty`); the producer targeting only projecting members is strictly smaller and dependency-light — a single self-contained induction — and in a producer family the projection severs the cross-producer edge, ordering the family. **R252**: the *dependent* member's IH is dead — `KeyEntry e := Entry e ∧ bal e = 0` (a saved-key-style twin deliverable) is built by the *non-recursive* `buildKeyEntry := ⟨buildEntry v, bal_emit v⟩`, which routes the recursive `Entry` part to the BASE sibling `buildEntry` and the extra flat fact to `bal_emit`, never calling itself — so the base carries the family's only live self-recursion and each dependent consumes it as a black box; `key_projects_to_entry` recovers the base `Entry` back out)
* `BoundaryBoundRecovery`                 — Reflections 255 + 256 (a consumer-joint-before-producer move has TWO boundaries — when the consumer quantifies a window UNBOUNDEDLY but the producer/assembler needs positional BOUNDS, hoist the bound-recovery into one joint that recovers the bounds ONCE from boundary invariants the enclosing context already owns, rather than re-proving them at every recursive call: `bound_lo` derives `2 ≤ lo` from the stream-start token `toks[0]! = SS` + the opener guard `toks[lo-1]! = OB` (the `OB ≠ SS` distinctness rules out `lo ≤ 1`, where `lo-1 = 0`), `bound_hi` derives `hi ≤ length-2` from `toks[length-1]! = SE`, and `locator_of_window_recbody` (toy of `seqLocator_of_window_recseqbody`) collapses the unbounded locator to the bounded per-window producer `h_rec`; the boundary token is load-bearing — `bad = [OB,A,CB]` with no `SS` frame satisfies the opener guard at `lo = 1` yet `¬ (2 ≤ 1)`, the window the missing boundary token would have excluded, witnessed by `neg_no_ss`. **R256 map mirror**: `bound_lo_map`/`bound_hi_map` are the verbatim twins over the map brackets `MB`/`ME`, reading the SAME `SS`/`SE` frame tokens (the recovery is bracket-agnostic — the stream frame does not know which collection a window opens); the R246 storage asymmetry surfaces as ONE extra per-window producer hypothesis `h_prim` (toy of the six pair primitives) on `locator_of_window_recmapbody`, which recovers the bounds ONCE and feeds them to BOTH `h_rec` and `h_prim` — `pos_lo_map`/`pos_hi_map`/`mapPrim goodMap 2 3` positive, `neg_no_ss_map` negative)
* `FoldConsumerChain`                     — Reflection 257 (fold a joint-by-joint consumer chain into ONE lemma keyed only on the producer's contract, before writing the producer — the fold costs nothing and cannot regress but converts a scattered residual into one typed boundary: `jBound` (boundary-anchoring, recovers `2 ≤ lo` from the frame token `toks[0]! = SS`) and `jPack` (universal packaging) compose into `targetOfProducer`, keyed only on the abstract producer `hProd` and the in-scope frame fact `hSS`; `located_via_fold` shows an arbitrary-window `Located` then follows from the producer + frame alone; positive `prod_good : Producer good 2 3 := by decide` on `good = [SS,OB,A,CB,SE]`, negative `neg_no_ss` on `bad = [OB,A,CB]` where the opener guard holds at `lo = 1` yet `2 ≤ 1` is false — the frame token is load-bearing for the fold)
* `UniversalProducerRootSeed`              — Reflections 258 + 259 (a universal producer's first brick is its ROOT SEED — the positional packaging of its one already-available instance, built as a faithful mirror of the flat-deliverable characterization with the payload swapped: once the consumer is folded (R257), the producer starts at the recursion's base case, not the recursion. `charRec` is the verbatim mirror of `charFlat` — same `subst`/`drop_pre` body, the flat payload `Flat` swapped for the recursive `Rec`; `root_instance` shows the seed IS the `lo = pre.length` (outer-window) instance of the universal `UnivRec`, the rest deferred to the navigation recursion (so `UnivRec` is left open). Positive `rec_good`/`seed_root` on `good = [OB,A,CB]` with a length-1 prefix recovered by `drop 1`; negative `not_rec_empty` on `empty = []` via the `Rec ⟹ Flat` projection — the recursive deliverable can never produce an empty block, so the seed never fires there. **R259 map extension**: the seed mirrors verbatim across the seq→map collection axis — `charMap` is the *verbatim* copy of `charRec` (payload `Rec` swapped for the parallel `RecMap`), the positional packaging step being collection-agnostic; the only deltas live in the *feed*, the R246 storage asymmetry one tier up at the seed's hypothesis count — `MapFeed` carries an extra `ska` precondition (toy of `simpleKeyAllowed`) and an extra `floor : 3 ≤ length` (toy of the R250 `3 ≤ n` map floor), BOTH absent on `SeqFeed`, and `seedMap` ignores them exactly as the real lemma ignores `_h_n3`. The floor is load-bearing: `seqfeed_singleton : SeqFeed [A]` is inhabited but `no_mapfeed_singleton : ¬ MapFeed [A]` (`3 ≤ 1` false), the seq side having no such floor; positive `seed_map_root` on `good`, negative `not_recmap_empty` via the `RecMap ⟹ Flat` projection)
* `DescendStepConsumerJoint`                — Reflections 260 + 261 (the navigation recursion's *descend step* IS a consumer joint's internal computation, truncated: returned as a value instead of consumed — and its symmetric map mirror. A consumer joint that peels/decomposes a located entry, descends one nesting level, then *consumes* the descended sub-deliverable into a terminal already contains the producer-side descend primitive its dual recursion needs — the recursion needs that sub-deliverable *as a value* for its IH, not the consumed terminal, so the descend step is the same proof body truncated before the consume step. Toy `RecEntry`/`RecBody` (mutual): `seq_interior` is the shared single-level descent; `recbody_of_entry` is the descend primitive returning `RecBody interior ∨ interior = []`; `flat_of_entry` is the consumer joint — defined literally as `(recbody_of_entry …).imp RecBody.toFlat id`, so the factoring is manifest: the joint = the descend primitive followed by the `toFlat` consume step, the primitive = the joint with that step truncated. Positive `descend_one` returns the recursable `RecBody [A]` while `consume_one` keeps only the projected `Flat [A]`; `descend_twice` descends the doubly-nested `[OB,OB,A,CB,CB]` two levels using only the primitive (the joint's `Flat` cannot be re-descended); negative `no_descend_scalar` — a scalar entry `[A]` has no `OB :: (… ++ [CB])` bracket shape, so the descent never fires. **R261 map mirror** (`## The map mirror` section): `MapEntry`/`MapBody` is the seq toy with NO scalar constructor — every entry is a bracket frame — so `map_interior` is *one case shorter* than `seq_interior` (no scalar to exclude), the toy reflection of the real map descend mirror's *dropped `h_op` opener-guard hypothesis*; `mapbody_of_entry`/`flat_of_map_entry`/`descend_map_one`/`descend_map_twice` are verbatim mirrors of the seq witnesses, and negative `no_mapentry_scalar` — a bare scalar `[A]` is not a `MapEntry` at all (the structural fact behind the dropped guard))
* `StructuralMovesAdvance`                  — Reflection 262, 263, 269 & 270 (the locate recursion's *structural moves* — descend + build + advance + terminate — one positional window lift per CONSTRUCTOR of the deliverable, base case included. A recursion producing a recursive-deliverable inductive needs exactly one positional move per *constructor* of the deliverable — not merely per way the constructors compose; for a body-of-entries deliverable (`single`/`cons`) that is DESCEND (into a nested entry's interior, eliminator side), BUILD (the same composition, constructor side — descend's dual), ADVANCE (chain entries via `RBody.cons`), and TERMINATE (the `single` base constructor). Once every constructor's lift lands — each a cheap verified brick — the recursion's residual collapses to the purely *analytical* entry-boundary location (the split points the moves consume). Subsidiary: the `RBody.cons` side-fields `h_ne`/`h_head` are free structural projections of the entry (`REntry.ne_nil`/`REntry.head_cstart`), not threaded obligations. Toy `REntry`/`RBody` (mutual) with a real `cons` body constructor: `recbody_of_entry` is DESCEND, `entry_of_recbody` is BUILD, `recbody_cons` is ADVANCE (discharging the two projections). The positives compose all moves on a *multi-entry* nested body — `body_AFA` builds `[A,FE,A]` by ADVANCE, `entry_AFA` wraps it by BUILD into `[OB,A,FE,A,CB]`, `descend_multi` DESCENDs back to the multi-entry interior, `body_full` ADVANCEs again; negatives `no_entry_empty`/`no_entry_separator` — an entry is never empty and never a bare separator, so the moves never misfire. **Extended by Reflection 263** with the *map mirror* of the advance step: a toy `MBody`/`MPair` (a body chains *pairs* `KY :: (block_k ++ VL :: block_v)` along `FE`), `mbody_cons` is the verbatim seq→map mirror of `recbody_cons` — only the terminal constructor (`MBody.cons` over an `MPair`) and the head side-field differ; the R246/R263 storage asymmetry surfaces as the *simpler* head projection `MPair.head_key` (one `cases`, single equality `= KY`, vs `REntry.head_cstart`'s four-case `CStart` disjunction); positives `pairAA`/`mbodyAA`/`mbody_two` (ADVANCE builds a two-pair body), negatives `no_mpair_empty`/`no_mpair_no_key` — a pair is never empty and its head is pinned to `KY`. **Extended by Reflection 269** with the *TERMINATE* move the original trio missed: `RBody` has two constructors (`single`/`cons`) but only `cons` had a lift, so the recursion had a step and no base; `recbody_single` lifts the `single` base constructor — the move ADVANCE defers to (its `h_rest` is dischargeable only at the last item). It is the cheapest move: `RBody.single` is indexed by the entry list *verbatim*, so it needs **no** positional plumbing (vs `recbody_cons`'s `e ++ FE :: rest`) and is axiom-clean `[propext]` — the complexity law that a move's cost = the gap between its constructor's index and the raw window, here nil. `body_AFA`/`body_AFAFA` now show the genuine recursion shape ADVANCE ∘ … ∘ TERMINATE; `mbody_single` is the verbatim map mirror, the R263 storage asymmetry recurring at the base move's head projection. **Extended by Reflection 270** (the map TERMINATE move's real-code landing, `recmapbody_single_window`): a base-case mirror is *free* — a mirror's cost is the plumbing it transports, and a base case has none, so the map terminate differs from the seq one only in the leaf constructor + projection family (axiom profile read off the original: both `[propext]`). `mbody_PFPFP` is the map-side recursion-shape witness — ADVANCE ∘ ADVANCE ∘ TERMINATE over a three-pair body, the structural twin of the seq `body_AFAFA`, identical move composition with `MBody`/`MPair`/`mbody_*` swapped for `RBody`/`REntry`/`recbody_*`)
* `TwoFloorRelayCloseBound`                — Reflection 314 (a located matching-close's containment bound is a TWO-FLOOR RELAY — a single underflow witness at `close+1`, refuted by whichever of two ADJACENT-domain floors tiles it — the toy of `seqClose_of_located_and_enclosing`. The descent locates the enclosing opener `p` and its matching close `j` (`balance (p+1) j = 0`, close delta `-1`); the consumer needs the close to CONTAIN the gated window `[a,b)` (`a ≤ j ∧ b ≤ j`), but the matching-close locator only returns `j < hi`. The bounds come from the consumer's OWN floors. The close underflows the next step for ANY base `β ≤ j`: `balance β (j+1) = balance β j − 1`. The span `[p+1, b]` is TILED by two separately-sourced floors — the locator floor over `[p+1,a]` and R313's gate floor over `[a,b]` — and you case-split on which domain `close+1` lands in: `a ≤ j` (else `j+1 ≤ a`, locator floor gives `balance (p+1)(j+1) = −1 < 0`, contradiction), then `b ≤ j` (else `j+1 ≤ b`; having `a ≤ j` ⇒ `a ≤ j+1`, gate floor gives `balance a (j+1) = −1 < 0` with `balance a j = 0` by composition). No unified floor needed — adjacent floors that tile suffice; the first bound is the ordered GUARD for the second floor's lower edge. **PROVEN** (`located_close_bounds`, the abstract nugget over any `bal` with additivity + the close-underflow step): `a ≤ j ∧ b ≤ j`. **POSITIVE (`#guard`)** on `W = op op ct cl op ct cl cl` (`[[1],[2]]` skeleton, first inner seq `p=1`, close `j=3`): `bal 2 3 = 0`, `d W[3] = −1`, `bal 2 4 = −1` (the close+1 underflow), genuine window `[2,3)` has `a=2 ≤ 3 ∧ b=3 ≤ 3`. **NEGATIVE (`#guard`)**: the cross-sibling `[2,6)` is balanced but dips to `bal 2 4 = −1` (gate floor over `[2,6]` fails) and `6 > j=3` — so `b ≤ j` would be FALSE without the gate floor. This is the general mechanism behind R313's "the floor discharges `b ≤ hiS` for free", generalized to two floors ([[ref-two-floor-relay-close-bound]]); the seq-specialized `flowBracketBalance_matching_close_seq` already bundled matching-close + typed-close (search the SPECIALIZED packaged lemma before composing the generic primitives, echoing [[ref-metric-bridge-is-composition]]))
* `NarrowFromRootBreaksRederivationCycle`  — Reflection 318 (re-deriving a SUBSET-RESTRICTION carrier per recursion-window is CIRCULAR if its per-window input comes from the recursion's own output; seed it ONCE at the root from the FLAT producer and narrow down — the toy of `seqRoot_seqInteriorSeparators` and the de-risk that corrected R317. The seq `windowWidth_strongRecOn` step needs `SeqInteriorSeparators tokens lo hi` per window (it supplies the separator facts `flowBodyContent_of_deep` cannot project). R317 planned to RE-DERIVE the carrier per window via a dispatcher needing that window's own `SafeBodyUnit` — but at a descended window the only `SafeBodyUnit` source is `RecSeqBody.toSafeBodyUnit` of that window's own `RecSeqBody`, the VERY OUTPUT the step produces: circular. The carrier is a subset restriction (`SeqInteriorSeparators_narrow`), so seed it once at the root from the FLAT `seqRoot_safeBodyUnit` (no recursion ⇒ no cycle) and narrow to every sub-window; the per-window helper (`RecSeqBody.toSafeBodyUnit`, the circular edge) is DROPPED. **PROVEN nugget**: `C lo hi := ∀ a b, lo ≤ a → a ≤ b → b ≤ hi → Q a b`; `C_narrow` (the subset-restriction edge, two `Nat.le_trans`); `C_all_of_root` (root `[0,N]` ⇒ every `[lo,hi]` with `hi ≤ N`); `flat_root` (the root seed, established directly with no recursion). **POSITIVE** (`example : C 2 4`): the root seed at `[0,5]` covers the nested sub-window `[2,4)` for free (the de-risk coverage claim — the window lies WITHIN the root span). **NEGATIVE (`#guard`)**: model the step `P w := step (C w)` reading the carrier; the FLAT path `pFromFlat w = step (flatC w)` is window-AWARE (`pFromFlat 3 = 4`, `pFromFlat 7 = 8`), while the CIRCULAR re-derivation `pCirc` (`C w := extract (P w)`, `P w := step (C w)`, fuel-exposed) is window-BLIND — `pCirc 100 3 = pCirc 100 7 = 1`, the same regardless of `w` and never the genuine value (`!(pCirc 100 3 == pFromFlat 3)`): the cycle injects no real data, only the flat root seed carries the per-window datum. Circularity rider on [[ref-universal-producer-root-seed-first]] + [[ref-window-absolute-gate-subset-restriction]] ([[ref-narrow-from-root-breaks-rederivation-cycle]]))
* `ImportForcedParametricGuard`            — Reflection 322 (thread a recursion guard through an IH-supplying lemma that is UPSTREAM of the guard's definition by making the upstream lemma PARAMETRIC over an abstract predicate `Q` — the toy of the R322 `Q`-parametric IH re-versioning across `recseqentry_seqbracket_oracle` / `recseqentry_window_dispatch` / `seqChild_safeBodyUnit` / `seqDescent_provider_of_located`. The real blocker: the seq recursion must thread `SeqEnclosed tokens lo` through its IH, but the oracle/dispatch live in `NonemptyStructure`, UPSTREAM of `SeqEnclosed` (`SeqInteriorSeparators` imports `NonemptyStructure`) — so the oracle CANNOT name the guard, and the de-risk's "edit the IH type in place" plan is impossible. Modeled with two namespaces: `Upstream` (declared FIRST — `oracle`/`dispatch` parametric over `Q : Nat → Prop`, taking the descend output `Q (lo+1)` as an OPAQUE hypothesis, naming no concrete guard) and `Downstream` (the concrete `Enc n := 1 ≤ n`, its push-blind descend `enc_descend`, and the `fixpoint` that binds `Q := Enc` — the ONLY site that names the guard, filling the opaque hyp with `enc_descend`). POSITIVE: `fixpoint 2 5 _ : RecBody 2 5` builds the deliverable end-to-end via `widthRec` (a self-contained `windowWidth_strongRecOn` toy), the step's width-IH re-packaged into the dispatch's `Q`-parametric IH verbatim. NEGATIVE: `enc_not_universal : ¬ ∀ n, Enc n` (`Enc 0` false) — a guard-BLIND adapter cannot INVENT `Q lo'` for a general `lo'`, so the guard must be THREADED, never dropped. The de-risk lesson: check the IMPORT DIRECTION of the guard's definition vs the IH-supplying lemma before assuming an in-place IH edit is local. Sharpens [[ref-parametric-assembler-extraction]] (the universal is over the GUARD predicate, forced by imports); complements [[ref-additive-parallel-type-over-shared-edit]] (GENERALIZE the upstream lemma, don't specialize it); the descend output is the [[ref-push-blind-frame-dependent]] (R321) edge supplied at the instantiation site ([[ref-import-forced-parametric-guard]]))
* `VacuousPositiveCannotExclude`           — Reflection 323 (a guard/carrier fact of shape `prem → pos` proven VACUOUSLY — its premise refuted internally — gives the consumer ONLY `pos`, never `¬ prem`, so it CANNOT exclude `prem` downstream when `pos` is consistent with the `prem`-case; thread a DISCRIMINATOR that directly contradicts `pos`. The toy of `seqWindowRecSeqBody`'s no-trailing-separator obligation `m + 1 < hi`: the carrier's `noTrailingSepFact` is `(window ends on a depth-`0` separator) → isFlowContentStart tokens[hi]`, proven vacuously (no trailing comma), but its conclusion is CONSISTENT with the trailing-comma window the three-conjunct `G` genuinely admits — so the carrier alone cannot rule out `m + 1 = hi`. Modeled with a tiny `Tok` alphabet (`content`/`sep`/`close`), the vacuous-positive `noTrailingSep lastIsSep bnd := lastIsSep → isContentStart bnd`, and the window-END discriminator `windowEnd bnd := bnd = .close`. **NEGATIVE** (`carrier_cannot_exclude`): `∃ lastIsSep bnd, noTrailingSep lastIsSep bnd ∧ lastIsSep` — take `bnd = .content`, the positive holds WHILE the bad case holds, so the carrier has no exclusion power. **POSITIVE** (`exclude_with_discriminator`): `noTrailingSep` PLUS `windowEnd` (the discriminator, via `close_not_contentStart : windowEnd → ¬ isContentStart`) yields `¬ lastIsSep` — exactly the O1 discharge, where the fourth `G`-conjunct `tokens[hi]! = .flowSequenceEnd` collides with the boundary `isFlowContentStart tokens[hi]`. Sharpens [[ref-probe-deferred-universal-before-producing]] (a draft-`sorry` on the suspected obligation surfaced the gap the plan narrative hid); complements [[ref-downstream-derisk-restores-upstream]] (the window-END invariant restored into the guard / IH-thread, not the producer body) ([[ref-vacuous-positive-cannot-exclude]]))
* `PushBlindFramePreserveDependent`        — Reflection 321 (an accumulator-guard threaded down a recursion has TWO edges with OPPOSITE parent-dependence — the toy of `SeqEnclosed` and its edges `seqEnclosed_descend` / `seqEnclosed_advance`. The guard reads the TOP of an accumulator stack (`Enclosed s := s.bind (·.head?) = some true`, toy of the enclosing btFold-top fact). **DESCEND = PUSH** (`push b s := s.map (b :: ·)`, toy of `btStep` on an opener): pushing a new frame OVERWRITES the top, so the edge is parent-value-BLIND — `descend_push` needs only `∃ l, s = some l` (the parent is DEFINED), NOT that the parent is `Enclosed`. **ADVANCE = FRAME** (`frame s := s`, toy of `WellTyped_frame`: a balanced segment returns the accumulator unchanged): the top is PRESERVED, so the edge is parent-value-DEPENDENT — `advance_frame` needs the parent `Enclosed` and carries it forward. **PROVEN nugget**: `descend_push` (from definedness alone, `rfl` after `obtain`) and `advance_frame` (`:= h`, the frame preserves). **POSITIVE/NEGATIVE (`#guard`)** exhibiting the asymmetry: over the SAME non-enclosed parent `some [false]` (top `false`), the PUSH edge ENCLOSES (`isEnclosed (push true (some [false])) = true` — blind to the parent) while the FRAME edge does NOT (`isEnclosed (frame (some [false])) = false` — cannot manufacture enclosure), so `isEnclosed (push true (some [false])) != isEnclosed (frame (some [false]))`; and `isEnclosed (push true none) = false` shows DESCEND still needs DEFINEDNESS. Distinct from [[ref-converse-forward-invariant-asymmetry]] (property vs CONVERSE); the accumulator-guard analogue of R288's `GuardEdgeFloorAsymmetry` (balance guard's edges need different FLOORS — here the split is whether the parent's value is read at all) ([[ref-push-blind-frame-dependent]]))
* `FloorBlindGateAdmitsCrossSibling`      — Reflection 313 (a FLOOR-BLIND gate — depth-`0`-balanced only — admits CROSS-SIBLING windows the deliverable cannot inhabit, so the carrier is FALSE on a valid witness; the missing local-Dyck floor excludes EXACTLY those windows and discharges the consumer's containment bound `b ≤ hiS` for free — the toy of the R313 strengthening of `SeqTypedInterior`. The forward-CLOSE brick's de-risk found that the gate `balance a b = 0 ∧ seq-enclosed` admitted the cross-sibling window `[3,7)` of `[[1],[2]]` (from inside the first inner seq to inside the second), on which `bodySuccFact` is FALSE — so `SeqInteriorSeparators` was false on a valid value. Toy alphabet `op`/`cl`/`ct` (`+1`/`-1`/`0`); witness `W = op op ct cl op ct cl cl` (skeleton of `[[1],[2]]`); `bal` the running balance. **NEGATIVE (`#guard`-backed)**: window `[2,6)` has `bal 2 6 = 0` (passes the BARE gate) yet DIPS to `bal 2 4 = -1` (floor violated) and `bodySucc [2,6)` is FALSE (`ct` at `2` is depth-`0`-complete but `W[3] = cl`, not a separator); the floor SEPARATES it. **floored ⟹ bodySucc** at every balanced sub-window (`#guard`-enumerated), and a genuine entry window `[2,3)` is floored AND satisfies bodySucc. **POSITIVE (proven, `floored_window_cannot_cross`, `[propext, Quot.sound]`)**: a window satisfying the local-Dyck floor cannot cross a close that underflows its balance — `bal a (m+1) < 0` contradicts the floor at `m+1` — which is exactly the consumer's `b ≤ hiS = j` for free. This is [[ref-probe-provider-head-blind-gate]] for a FLOOR-blind gate, and the gate-domain dual of [[ref-downstream-derisk-restores-upstream]] (R311 restored a dropped PRODUCER conjunct; here the missing conjunct is in the GATE). Sharpens [[ref-window-absolute-gate-subset-restriction]] (the floor is window-absolute, so the carrier stays a subset restriction))
* `TypeBlindInvariantTransportsViaConverseFrame` — Reflection 312 (a TYPE-BLIND numeric invariant (the floor) cannot CREATE a typed fact — fold-definedness — only LICENSE its transport across a frame boundary; moving definedness from a verified LARGER context to a SMALLER sub-context needs the CONVERSE of the forward framing lemma, not the forward one — the toy of `seqOpenerType_of_located_and_gate` / `btFold_frame_inv`. The 159th "Next step" predicted route (B): prove the singleton-frame interior fold returns to `[b]` *from the floor*, then extend by the FORWARD frame. Authoring corrected it. A 5-symbol typed-bracket alphabet (`os`/`om` push `true`/`false`, `cs`/`cm` pop a *matching* head or fail, `nt` neutral); `step`/`fold` the typed machine, `pbal` the numeric balance. **Correction 1 (NEGATIVE, `#guard`-backed — the floor is type-blind)**: `[os, cm]` (the `[ }` analog) has every prefix balance `≥ 0` and total `0` (passes BOTH the floor and balance-0 that route (B) relied on) yet `fold (some []) [os, cm] = none` — the `}` cannot pop the `[`; so no floor/balance reasoning gives fold-definedness, a typed fact only the real stream supplies. **Correction 2 (POSITIVE, the forward/converse asymmetry)**: `fold_frame` (forward) needs NO numeric hypothesis (carries a proven SMALL fold up); `fold_frame_inv` (the CONVERSE) DOES need the floor (transports DEFINEDNESS down — dropping frame elements would underflow unless the floor forbids it). `step_frame_inv`'s `0 ≤ s.length + delta t` is the no-pop-into-frame guard; the floor re-relativizes per step via `step_length`. **The brick (`opener_bit_via_converse_frame`)**: the gate gives `fold (some (b::s_p)) interior = some S` (definedness in the LARGE context), `fold_frame_inv` (+ floor) pushes it down so the interior folds from `[]` to length-`pbal`-`= 0` = `[]`, hence `S = b :: s_p` — head `= b`, fixed by the gate. A property and its converse over one structure need DIFFERENT invariant strengths — forward free, converse floor-guarded ([[ref-converse-forward-invariant-asymmetry]]); the de-risk's route-(B) error was expecting the floor to do the FORWARD lemma's job. Sharpens [[ref-probe-deferred-universal-before-producing]])
* `DownstreamDeriskRestoresUpstream`        — Reflection 311 (a downstream consumer's de-risk can FALSIFY a deliberately-narrowed UPSTREAM deliverable; when a minimal pair shows the dropped conjunct is the discriminator AND it is independent of the producer's other outputs, restore it in the PRODUCER — the toy of the floor restored to `flowBracketBalance_backward_open_locate`. R309 sized the locator's deliverable DOWN to its rebase consumer, dropping the Dyck FLOOR; R311 is the sequel — the opener-TYPE consumer re-opens it. Tokens are a delta stream `d : Nat → Int` with opener type `ty : Nat → Bool`; `bal` is cumulative-difference balance, so composition is free. **Correction 1 (NEGATIVE, `#guard`-backed)**: the toy of `[{}, ["9"]]` (deltas `[1, 1, -1, 0, 1, 0]`) at window start `a = 5` admits BOTH `p = 4` (the true innermost `[`, `ty = true`) AND `p = 1` (a spurious `{`, `ty = false`, body `} , [` nets `0`) under the THREE BARE facts (`p < a`, `d p = 1`, `bal (p+1) a = 0`) — and they DISAGREE on type (`ty 1 ≠ ty 4`), so no consumer of the bare existential can pin `ty p`; the FLOOR separates them (`bal 5 5 = 0 ≥ 0` vs `bal 2 3 = -1`). This sharpens R309's `[ ] [` pair (same TYPE there; DIFFERENT type here — which is exactly why the *type* brick forces the floor back). **Correction 2 (POSITIVE `floor_unique`)**: adding the floor makes the located opener UNIQUE (any two floored witnesses coincide) by pure balance composition — if `p < q` then `bal (p+1) (q+1) = 0` yet `= bal (p+1) q + d q = (≥0) + 1`, absurd; uniqueness ⇒ the gate's innermost type IS `ty p`. The floor is INDEPENDENT of the three facts (the minimal pair satisfies them yet only `p = 4` is floored), so it cannot be re-derived at the consume site — the producer must deliver it. The DUAL of [[ref-backward-locator-mirrors-forward]] correction 2's size-DOWN: a deliverable is sized to the UNION of consumers, and a new consumer's de-risk can size it back UP. Sharpens [[ref-minimal-pair-extracts-the-gate]] and [[ref-probe-deferred-universal-before-producing]])
* `MetricBridgeIsComposition`               — Reflection 310 (a feared "bridge between two PARALLEL metrics" is often ALREADY a theorem: a STRUCTURAL count and a NUMERIC count that share a substrate are equated by COMPOSITION, not a new per-step induction — the toy of `flowBracketBalance_pos_of_btFold_head`, the gate→hypothesis bridge of `(i'-b-locator-glue-gate-bridge)`. A token stream (`op b` pushes a `Bool`, `cl` pops, `neu` neutral) carries two metrics: the NUMERIC `bal` (fold of `{+1, -1, 0}`) and the STRUCTURAL `fold` (a `List Bool`, its LENGTH the metric). The de-risk feared they might DIVERGE (push map vs seq differently), needing a per-step induction relating pushes to deltas. **Correction 1 (POSITIVE `bridge`)**: they do not — both reduce to the SAME substrate `bal` via `foldLen` (`stack length = bal`), so `bridge` (non-empty stack ⇒ `bal ≥ 1`) is `foldLen` + "non-empty ⇒ length ≥ 1" + `omega`; the per-step reconciliation the de-risk feared IS `foldLen`, which already exists. **Type-agnostic dividend (POSITIVE)**: `bridge` takes `= some hd` for an ARBITRARY `hd : Bool` — the proof is blind to the head value, so ONE lemma serves both axes (`bridgeTrue`/`bridgeFalse`, seq/map). **Correction 2 (NEGATIVE, `#guard`-backed)**: the fear is legitimate IN GENERAL — a WRONG metric `wfold` (pushes only on `op true`, ignoring `op false`) genuinely diverges: on `diverge = [op false, op true]`, `#guard (fold …).map (·.length) == some 2` and `bal == 2` (real metrics coincide) but `#guard (wfold …).map (·.length) == some 1` (≠ `bal`). So VERIFY the substrate is shared (every `op _` pushes uniformly AND contributes `+1`); don't assume divergence (author an induction) NOR coincidence (skip the check). Sharpens [[ref-probe-deferred-universal-before-producing]] on the metric-unification axis, as [[ref-backward-locator-mirrors-forward]] did on the machinery axis)
* `BackwardLocatorMirrorsForward`           — Reflection 309 (a backward locator mirrored from a forward one needs NO standalone backward-matching-open primitive, and its DELIVERABLE is sized to the consumer's reads — the toy of `flowBracketBalance_backward_open_locate`, the HARD CORE of the `(i'-b-backward-locator)` descent. Tokens are abstracted to a delta stream `d : Nat → Int` (each delta in `{-1,0,1}`); `bal d n` is the running balance from `0`. **Correction 1 (POSITIVE `backwardLocate`)**: the locator `∃ p, p < a ∧ d p = 1 ∧ bal d (p+1) = bal d a` is proved by `Nat.strongRecOn` on `a`, casing the last delta `d (a-1)` into opener/neutral/closer; the closer case does NOT author a standalone backward-matching-open lemma (the mirror of a forward matching-close scan) — the IH at `a-1` IS the closer's matching opener `p'`, and a one-line `pairSkip` (`bal d a = bal d p'`, toy of `flowBracketBalance_bracket_pair_skip`) jumps the matched block, then the IH at `p'` walks outward. The recursion structure IS the backward matching-open; mirroring a locator backward SHEDS machinery ([[ref-near-leaf-mirror-sheds-machinery]] on the matched-block-skip axis), it does not add it. **Correction 2 (NEGATIVE, `#guard`-backed)**: the deliverable carries NO Dyck FLOOR, even though the real forward lemma has a symmetric one — the consumer (`Located`/the FROM-LOCATED assembler) reads only `loS := p+1`, `loS ≤ a`, `bal d loS = bal d a` (`locatorAssembles` builds it in one line). On `[ ] [` (`dd = [1,-1,1]`, `bal dd 3 = 1`) the pruned existential is satisfied by BOTH the true innermost opener `p=2` AND a SPURIOUS outer opener `p=0` whose floor dips negative — `#guard floorOK dd 3 3 == true` vs `#guard floorOK dd 1 3 == false`; the floor would separate them, but the consumer needs neither innermost-ness nor the floor, only `bal d loS = bal d a`, so dropping the floor (≈ half the proof: the closer case's floor-extension across the skipped block) loses nothing the assembler consumes. The locator's deliverable shape is set by what the assembler READS ([[ref-from-located-assembler-direction]]: the assembler's hypotheses ARE the locator's exact contract), not by the forward lemma's symmetric conclusion-set. The de-risk was honestly pessimistic — the feared new infrastructure never materialized — so authoring is the real test of a de-risk's hardness prediction, sharpening [[ref-probe-deferred-universal-before-producing]])
* `FromLocatedAssemblerDirection`           — Reflection 308 (after the root seed lands, FACTOR the descent before authoring it: a FROM-LOCATED assembler discharges the existential trivially and makes the root a corollary; the de-risk then reveals the locator's DIRECTION is the residual's true shape — the toy of `seqEnclosingFacts_provider_of_located` (and `seqEnclosingFacts_provider_root` rewritten as its corollary), the producer-side parametric-assembler split of the `(i'-b-locator)` descent. A universal producer `∀ window, Gate → Deliverable`, already split into a ROOT seed + a DESCENT (R307), is factored ONE MORE TIME at the PRODUCER side: lift the locator's eventual output — a located enclosing `e` + its deliverable witness — as hypotheses into `assemble (w e) (h_seq) (h_reseat) : Deliverable w := ⟨e, h_seq, h_reseat⟩`, ONE line. The ROOT seed becomes a COROLLARY — `rootSeed w h := assemble w rootWin rootInfra h` ([[ref-parametric-assembler-extraction]] on the producer, [[ref-probe-provider-satisfiable-before-assembler]] for non-vacuity). Toy `Win` = `depth` + `seqTyped` (the gate, true at any depth); `Deliverable w := ∃ e, e.seqTyped ∧ w.depth = e.depth`. POSITIVE: `assemble nestedWin nestedEncl rfl rfl : Deliverable ⟨2,true⟩` (the located enclosing exists at the nested window — the assembler is satisfiable). NEGATIVE (1): `root_wrong_for_nested : ¬ (nestedWin.depth = rootWin.depth)` — the root witness is the WRONG enclosing for a nested window, so the descent is genuine. NEGATIVE (2) — the locator's DIRECTION: the producer NEEDS `locateEnclosing` (BOTTOM-UP, inner→outer: an interior window → its enclosing BODY, same depth) but the existing recursion provides `descendChild` (TOP-DOWN, outer→inner, strictly deepening); `#guard descendChild innerBody == none` ∧ `#guard locateEnclosing innerBody != none` — the top-down operation returns `none` exactly where the producer must return a witness, so the descent's residual is NEW inner→outer infrastructure (a backward last-crossing scan), not a reuse of the outer→inner descend oracle. Builds on [[ref-root-seed-discriminator-not-from-gate]] + [[ref-parametric-assembler-extraction]] + [[ref-probe-provider-satisfiable-before-assembler]]; the direction asymmetry echoes [[ref-near-leaf-mirror-sheds-machinery]])
* `RootSeedDiscriminatorNotFromGate`        — Reflection 307 (the ROOT seed of a universal-over-gated-windows producer carries a DISCRIMINATOR the gate cannot supply — the toy of `seqEnclosingFacts_provider_root`, the `(i'-b-locator)` base case. A universal producer `∀ window, Gate window → Deliverable window` is split into a ROOT seed + a DESCENT (per [[ref-universal-producer-root-seed-first]]); at the root the deliverable is infra-supplied. The non-obvious part: the root seed does NOT consume the universal's `Gate` — the gate is satisfied by seq-typed windows at ANY depth, including the descent's own targets, so it cannot tell a root-level window from a nested one. The root seed instead carries the top-level discriminator `AtRoot` (toy `flowBracketBalance tokens 2 a = 0`), strictly STRONGER than `Gate` and NOT derivable from it — correct, because it is the SAME quantity the descent re-establishes per level. Toy `Win` carries `bal` (balance from the outer origin; `0` ⇒ root level) + `seqTyped` (the gate); `Deliverable w := ∃ encl, encl.seqTyped ∧ w.bal = encl.bal` (an enclosing seq window at whose level `w` sits — the re-seated discriminator). `descentStep` takes the LOCATED enclosing as a hypothesis (in reality `recseqentry_seqbracket_oracle`); `rootSeed := descentStep … outerWin … hr` makes the shared discriminator literal — the root seed IS the descent step specialised to the outer window, `AtRoot` plugged into the re-seat slot. POSITIVE: `rootSeed rootWin atRoot_root` on `⟨0,true⟩`; `#guard rootWin.bal == 0`. NEGATIVE (the gate does not supply the discriminator): `gate_nested : Gate ⟨2,true⟩` holds yet `not_atRoot_nested : ¬ AtRoot ⟨2,true⟩`, and `outer_wrong_for_nested : ¬ (nestedWin.bal = outerWin.bal)` — the outer window is the WRONG enclosing for a nested window, so the root seed is inapplicable and the nested case needs the descent's located enclosing (`descentStep nestedWin ⟨2,true⟩ rfl rfl`). Contrast [[ref-guarded-universal-fold-relocates-guard]] (there the guard is the producer's GIFT narrowing its domain; here the discriminator is the seed's DEBT, a hypothesis it cannot discharge locally))
* `CoerceToWeakerReuseWrapper`              — Reflection 306 (reuse the WEAKER structure's existing wrapper via a strong→weak COERCION, not a mirrored wrapper — the toy of `SafeBodyUnit_safeBody` + `seqInteriorFeContentStart_of_windowed_safebodyunit`, the `(i'-b-encfacts)` move. A needed fact has the shape of an EXISTING wrapper proven on a WEAKER structure (`SafeBody`/`BodyW`), but the substrate in hand is the STRONGER `SafeBodyUnit`/`BodyS` the producer naturally delivers; the better move is COERCE strong→weak and reuse the wrapper, not MIRROR the wrapper onto the stronger type. Cheap because the strong refinement is *more of the same constraint* (`EntS`/`EntryUnit`'s `≥ 1` for ALL proper prefixes subsumes `EntW`/`EntrySafe`'s `≥ 1` only at separators) everywhere except the head, and the inductive's own `Q`-head field (with `hQ : Q v → ¬ sep`) closes that one gap. Toy substrate reuses the R304 `Tok`/`psum`/`isSep`. PER-ENTRY `entS_entW` (the coercion's half, only the `i = 0` head obligation is non-vacuous, closed by `hQ`); STRUCTURAL `bodyS_bodyW` (toy `SafeBodyUnit_safeBody`, two-constructor induction reusing `entS_entW`); WRAPPER `bodyW_headQ` proven ONCE on `BodyW`; PAYOFF `bodyS_headQ := bodyW_headQ ∘ bodyS_bodyW` — the fact for the strong body by reuse, not re-proof. POSITIVE: `bodyS_good` on `[con,sep,con]` + the reused wrapper `example`. NEGATIVE (the head gap is real): `entS_sep : EntS [sep]` holds (a lone separator IS a unit entry) yet `not_entW_sep : ¬ EntW [sep]` (its head is a depth-`0` separator) — so without `hQ` the coercion is FALSE, `hQ` load-bearing. The dual of [[ref-reduction-by-import]]: there wire an unconsumed consumer to retype a residual; here weaken a substrate to consume an existing producer-lemma)
* `ProbeProviderSatisfiableBeforeAssembler` — Reflection 305 (factor a heavy locate boundary as an EXISTENTIAL `provider`, discharge the ASSEMBLE via the proven rebase, and PROBE the provider is satisfiable before committing — the toy of `seqInteriorSeparators_of_enclosing_provider`, the `(i'-b-locate-enclosing)` factoring. The R304 rebase is the CONSUME side; the PRODUCE side — *locate* the enclosing window + *supply* its fact — is heavy, so it is lifted into a `∀ window, gate → ∃ enclosing, preconditions ∧ encFact` hypothesis. KERNEL `carrier_of_provider`: the carrier reduces to that provider by one `obtain` + the imported `succ_rebase` — the assemble is trivial, the locate isolated as the residual. The NEW lesson over plain [[ref-parametric-assembler-extraction]]: the lifted hypothesis is an EXISTENTIAL the locator must later satisfy, so PROBE it is *satisfiable* on a concrete witness before committing — a perfectly-proven assembler over an UNSATISFIABLE provider is a vacuous dead-end. Reuses the R304 toy substrate (`bal`/`Succ`/`succ_rebase`/`seqT`/`mapT`/`succB`/`not_succ_map`). POSITIVE: `ProviderAt seqT 1 4` (the enclosing IS the outer seq `[1,4)`, `loS = lo`, so the rebase precondition `bal loS a = 0` is exactly the gate's re-seating conjunct `hg.2`, the enclosing fact `succ_seqT`); the assembler yields `CarrierAt seqT 1 4` and a concrete `Succ seqT 3 4`; the satisfiability probe `#guard succB seqT 1 4 = true`. NEGATIVE (the lesson): on the map body `{ con : con }` the gated window `[1,4)` has a FALSE enclosing `Succ` (`#guard succB mapT 1 4 = false`), so `provider_mapT_unsat : ¬ ProviderAt mapT 1 4` — any provider would, through the CORRECT assembler, derive the false `Succ mapT 1 4`. The positive complement of [[ref-probe-provider-head-blind-gate]]: R303 probes a provider universal for FALSITY to ABANDON a route; R305 probes an extracted provider for SATISFIABILITY to VALIDATE the residual hypothesis the assembler stands on)
* `RebaseFactFromEnclosingWindow`           — Reflection 304 (a window-relative carrier fact RE-BASES from its ENCLOSING window's same fact by balance-`0` composition; the rebase precondition is load-bearing — the toy of `bodySuccFact_rebase`/`noTrailingSepFact_rebase`, the R303 redirect's first brick. R303 killed the per-gated-window `SafeBodyUnit` provider; the redirect: the carrier's separator facts at an arbitrary gated sub-window `[a,b)` instead re-base from the ENCLOSING seq interior `[loS,hiS)`'s own facts, no `SafeBodyUnit`. A `#guard`-backed probe confirmed the facts hold at EVERY gated window of `[[1,2],9]` (incl. the spurious separator-headed ones) and — on `[{a: 1}, 2]` — that the gate's enclosing-seq conjunct excludes EXACTLY the `bodySucc`-failure windows (the nested-mapping keys, where a key is followed by `:`/`val` not a separator). Toy substrate: tokens `opn`/`cls`/`sep`/`con`/`val`, `bal` a telescoping prefix-sum difference so composition `bal_compose` is UNCONDITIONAL and free, `Succ` the toy `bodySuccFact`. KERNEL `succ_rebase`: from the enclosing `Succ T loS hiS` + `loS ≤ a` + `b ≤ hiS` + `bal T loS a = 0`, derive `Succ T a b` — pure compose + `omega`, the enclosing close disjunct `k+1 = hiS` collapsing to `k+1 = b` because `k < b ≤ hiS`. POSITIVE: the seq body `[ con , con ]` — `succB seqT 1 4 = true` (enclosing), `succB seqT 3 4 = true` (rebased sub-window), `bal seqT 1 3 = 0` (start at top level); usability `example` feeds an enclosing `Succ` to `succ_rebase`. NEGATIVE (load-bearing): the map body `{ con : con }` — `succB mapT 1 4 = false` (the key at `1` is followed by `val`, not a separator) and `bal mapT 0 1 = 1 ≠ 0` (the failing window's start is NOT at the enclosing top level, so the rebase precondition correctly does not hold), capstone `not_succ_map : ¬ Succ mapT 1 4`. The lesson: when a carrier fact must hold at every gated sub-window but the per-window deliverable route is false, derive the fact by RE-BASING the enclosing window's same fact across the depth-`0` re-seating — composition + the gate's enclosing-type conjunct, which is load-bearing precisely because it supplies the `bal loS a = 0` precondition that excludes the failure windows)
* `ProbeDeferredProviderHeadBlindGate`      — Reflection 303 (probing a deferred `provider` universal BEFORE producing it catches a FALSE universal: a HEAD-BLIND gate admits spurious windows where the body-structure route is undischargeable — the toy of the de-risk that re-scoped `(i'-b-descend-root-provider-descent)`, behind `SafeBodyUnit_head_Q` / `not_safeBodyUnit_of_head_flowEntry`. The planned descent would prove the seq carrier via a `provider` universal delivering a `SafeBodyUnit` at EVERY window the gate `SeqTypedInterior` admits; but the gate (balance-`0` ∧ enclosing-seq) is HEAD-BLIND — it never inspects whether the window's first token is a content start — so it ADMITS separator-headed windows, where a `SafeBodyUnit` is impossible (its head must be a content start). The real minimal pair: on `scanFiltered (emit [[1,2],9])` = `SS [ [ "1" , "2" ] , "9" ] SE`, the two depth-`0` commas at indices `4`, `7` BOTH satisfy the gate at `[a,a+1)` yet their `[comma]` slice is no `SafeBodyUnit` — so `provider 4 5` / `provider 7 8` are unprovable. Toy substrate: tokens are `Nat`s (`0` = separator, `n>0` = content), `Gate l := l ≠ [] ∧ (l.map delta).sum = 0` (head-blind — every token is delta-`0`, mirroring `flowEntry`/scalar both `flowBracketDelta = 0`), `Body` = nonempty content-headed entries separated by single `0`s (toy `SafeBodyUnit`). KERNEL `Body_head_content` (a `Body` forces a positive head, toy of `SafeBodyUnit_head_Q`) and `not_Body_of_head_zero` (the dead-end guard). MINIMAL PAIR: `gate_good ∧ body_good` on `[1,0,2]` (content-headed: gate AND body) vs `gate_bad ∧ not_body_bad` on `[0]` (lone separator: gate STILL holds head-blind, but NO body). NECESSARY-BUT-NOT-SUFFICIENT `gate_trailing ∧ not_body_trailing` on `[1,0]` — a CONTENT-headed window can still fail `Body` (trailing separator), so content-start-alignment alone would not rescue the provider. CAPSTONE `provider_is_false : ¬ (∀ l, Gate l → Body l)` (witnessed at `[0]`) vs `good_window_discharges` (the carrier is true where the recursion actually instantiates it). Decidable `#guard`s: the gate accepts `[0]` and `[1,0,2]` alike (head-blind), the head differs (`1` vs `0`) yet `[1,0]`'s content head still fails `Body`. The lesson: when a deferred universal will be produced over a gate, `#eval`-probe a minimal pair FIRST — a head-blind gate that admits a window the deliverable cannot inhabit makes the producer's hypothesis FALSE; catching it before producing converts a planned multi-brick recursion into a retargeted direct discharge, and the false intermediate is fenced off by a proven lemma rather than a discovered sorry)
* `RootSeedRecursiveProducerSwap`           — Reflection 302 (the ROOT SEED of a recursive-deliverable producer reuses the FLAT derivation's slice/decomposition verbatim and swaps only the body producer; the slice bridge is PRODUCER-AGNOSTIC — the toy of `seqRoot_safeBodyUnit`. A `wrap body := 0 :: (body ++ [99])` container framing and its `windowSlice l := (l.take (l.length-1)).drop 1`; KEY `windowSlice_wrap : windowSlice (wrap body) = body` is about the CONTAINER SHAPE, never any property of `body` — so the ROOT SEED `rootSeed (P) (h : P body) : P (windowSlice (wrap body))` is generic over the producer `P` (mirror of `h_take_eq` transporting any body fact). `Flat` = all-positive (toy `WellTyped`), `Rec` = the structural all-positive chain (toy `RecSeqBody`), `Rec.toFlat` the projection. `flatRoot`/`recRoot` are the two instances — swap only `P`; `recRoot_reprojects` (nothing lost — `Rec.toFlat` re-projects the flat fact). KEY agnosticism witnesses `slice_agnostic_offFlat : windowSlice (wrap [0,5]) = [0,5]` + `flat_fails_offFlat : ¬ Flat [0,5]` (the slice holds for a body where `Flat` FAILS — it is about the framing, not the content). The lesson: to land the root seed of a recursive-deliverable producer, find the existing flat-fact derivation, observe its slice identity is producer-agnostic, re-run it swapping the recursive body producer for the flat one, project through the unchanged slice — one chain-replay you already have a template for, not a new induction)
* `GuardedUniversalFoldRelocatesGuard`      — Reflection 301 (the consumer fold collapses a GUARDED universal carrier to a single provider, and the guard RELOCATES — producer's gift, consumer's debt — the toy of `seqInteriorSeparators_of_safebody_provider`, the first brick of `(i'-b-descend-root)`. A carrier `Carrier lo hi := ∀ n, lo ≤ n → n ≤ hi → Gate n → Fact n` is a GUARDED universal; the per-element discharge `factOfUnit : Unit n → Fact n` (the R299 analog) folds under the `∀` into `carrier_of_provider`, whose sole hypothesis `provider` (deliver `Unit` at each gated `n`) IS the producer's remaining contract. The decisive point: the gate `Gate n` is the body's ANTECEDENT, so proving the carrier `intro`s it — the producer CONSUMES the gate, never produces it. Toy substrate `Gate` = even (the "seq-typed" context gate), `Unit = ∃ m, n = m + m` (the deliverable, "SafeBodyUnit"), `Fact = ∃ m, n = 2 * m` (the "separator fact"). POSITIVE `carrier_of_provider` (faithful mirror, `intro`s the gate, feeds the provided `Unit` through `factOfUnit`); `provider_concrete`/`carrier_concrete` (the root-instance analog — emission delivers `Unit` at every even `n ≤ 6`). KEY WITNESS `gate_gifts_narrower_domain`: `3 ∈ [0,6]` with `¬ Fact 3` AND `¬ Gate 3`, yet `Carrier 0 6` holds — the off-gate failure is GATED OUT, never reaching the provider (mirrors the R297 map-window where `bodySucc` FAILS but the seq gate excludes it) — the gate is the producer's GIFT (a narrower domain). DUAL WITNESS `consume_needs_gate`: instantiating `Carrier 0 6` at `4` requires SUPPLYING `Gate 4` — the gate is the consumer's DEBT, and this is where R300's `seqTypedInterior_of_opener` lives: at the consume/`assemble` site that instantiates the carrier, NOT in the root seed that proves it. Decidable `#guard`s: on-gate `4`/`6` even, off-gate `3` odd (gated out), `Unit` at `4` (`4 = 2 + 2`). The lesson: for a guarded universal `∀ x, G x → P x`, folding its consumer chain into a provider lemma `(∀ x, G x → Q x) → carrier` is the FIRST producer brick — it pins the contract AND relocates the guard `G` to its true home, the consume site; the guard is never the producer's burden, it is the producer's gift and the consumer's debt)
* `PrefixGateReconstructedFromBoundary`     — Reflection 300 (a PREFIX-quantified gate is NEVER projectable from an interior-only window guard — the toy of `enclosingMark_true_of_opener` / `seqTypedInterior_of_opener`, the Q2 discharge for `(i'-b-descend-root)`. The carrier's gate `SeqTypedInterior`'s `btFold`-stack-top conjunct quantifies over the window's PREFIX `[0,a)`, not its interior `[a,b)` — so `FlowBodyWindow` (whose `wellTyped` field only sees the interior) cannot project it. But it RECONSTRUCTS in place from two boundary facts the recursion already supplies: the opener at `q = a-1` is a `.flowSequenceStart` (push-`true`), and the pre-opener prefix folds to *some* typed stack. A `seqOpen` pushes `true`, so the stack top after the opener is `true`. Toy substrate `Tok` (`seqOpen` pushes `true`, `mapOpen` pushes `false`, `other` inert), `tfold`, and `enclosingMark l q := (tfold (some []) (l.take (q+1))).bind (·.head?)`. POSITIVE `enclosingMark_true_of_opener` (faithful mirror, same `take_add_one` split + single push + `head?_cons`): from a `seqOpen` opener + prefix folding to `some s`, the mark is `some true`. `enclosingMark_false_of_mapOpener`: the same shape with `mapOpen` yields `some false` — the discriminator (R297's minimal pair) is real. KEY NEGATIVE `opener_determines_mark_not_interior`: two lists with IDENTICAL interior (`drop 1`) but opposite openers have opposite marks, so the gate is provably NOT a function of the interior — it must be reconstructed from the boundary, not projected. Decidable `#guard`s: `seqOpen`-fronted ⇒ `some true`, `mapOpen`-fronted ⇒ `some false`, same interior either way, a nested `[` after a `[` still read off correctly. The lesson: when a consume-time gate quantifies over a window's PREFIX or boundary rather than its interior, do not look to project it from the interior-shaped guard — reconstruct it from the boundary token(s) + a global well-formedness fact restricted to the prefix; the reconstruction lemma's hypotheses ARE the per-step thread list the producing induction owes — proving the discharge both retires the de-risk and itemizes the producer's contract)
* `BoundaryResidualEndDual`                 — Reflection 299 (the BOUNDARY residual is the INTERIOR fact's END-dual, discharged VACUOUSLY — the toy of `SafeBodyUnit_last_not_sep` / `SafeBodyUnit_array_last_not_sep_window` and the per-window discharge `seqSeparatorFacts_of_windowed_safebodyunit`. A producer-guard residual splits into an INTERIOR fact (every separator is followed by content) and a BOUNDARY fact (the body never ENDS in a separator). The boundary fact is the END-dual of the interior one over the SAME inductive substrate, and it discharges VACUOUSLY: the conclusion is unprovable directly — it asserts something about the token PAST the window, which the window's substrate cannot see — but it is reached only via a premise "the last in-window token is a separator", which the boundary lemma REFUTES, so the conclusion follows by `absurd`. Toy substrate `UBody`: positive "unit" tokens (content) separated by single `0`s (the separator, like `.flowEntry`). POSITIVE `UBody_ends_pos`: the structural END-dual — every `UBody` is `pre ++ [n]` with `0 < n`. POSITIVE `UBody_last_not_sep` (the faithful mirror of `SafeBodyUnit_last_not_sep`, same `getElem?_append_right` index bridge): the last token (`k + 1 = length`) is `≠ 0`. POSITIVE `UBody_noTrailing`: assuming the last token IS the separator yields `False` — the vacuous discharge, the toy of `noTrailingSepFact` via `absurd`. Decidable model: `ubodyB`/`endsInSepB`; `#guard ubodyB [3,0,5] ∧ !endsInSepB [3,0,5]` (well-formed, no trailing separator) and NEGATIVE `#guard !ubodyB [3,0,5,0] ∧ endsInSepB [3,0,5,0]` plus `!ubodyB [3,0]` — a body ending in a separator is NOT well-formed, so the boundary the `noTrailing` premise speaks of is never reached (`trailing_sep_rejected`). The lesson: when a producer-guard residual splits into an interior and a boundary fact, suspect the boundary is the interior's END-dual over the same substrate, discharging vacuously by refuting that the boundary is a separator — prove the dual rather than survey derivability; the proof answers the question, lands the brick, and reveals both facts flow from one deliverable (`seqSeparatorFacts_of_windowed_safebodyunit`: one windowed `SafeBodyUnit` ⇒ both carrier facts))
* `WindowAbsoluteGateSubsetRestriction`     — Reflection 298 (a WINDOW-ABSOLUTE gate makes the carrier a SUBSET restriction — the toy of `SeqInteriorSeparators` and its three-line `_narrow`/`_descend`/`_advance` edges. When a guard conjunct quantifies over sub-windows `[a,b) ⊆ [lo,hi)` under a gate, push the outer origin OUT of the quantifier body into the domain bounds: a body keyed only on `a,b` (never `lo`/`hi`) restricts to any sub-interval verbatim, so ONE monotonicity lemma is the whole descend/advance edge; a body that re-bases a fact on the origin BREAKS under narrowing (the `ref-non-restriction-residual-root-seed` failure). Gated positions `gate a := a % 2 = 0`. POSITIVE `carrierAbs_narrow`: the abstract window-absolute carrier `∀ a b, lo ≤ a → a ≤ b → b ≤ hi → gate a → factAbs a` restricts to `[lo',hi')` by two `Nat.le_trans` — the entire edge. POSITIVE `abs_survives_narrowing`: `carrierAbsB 0 4 = true ∧ carrierAbsB 1 4 = true` (the window-absolute fact `a % 2 = 0` survives moving the origin `0 → 1`). NEGATIVE `rel_breaks_under_narrowing`: the origin-relative fact `factRel lo a := (a - lo) % 2 = 0` gives `carrierRelB 0 4 = true` (offsets `{0,2,4}` of the gated even positions are even) but `carrierRelB 1 4 = false` (the SAME gated positions `{2,4}` now have odd offsets `{1,3}` — `#guard (2-0)%2=0` vs `(2-1)%2=1` is the re-basing flip). The lesson: choosing where the window origin lives is the whole game — origin in the bounds ⇒ subset restriction for free; origin in the body ⇒ a per-edge descent proof that may be impossible. The remaining cost is the ROOT seed, which no body-design makes free)
* `MinimalPairExtractsTheGate`              — Reflection 297 (probe a gated `∀`-over-sub-windows as a MINIMAL PAIR; the gate is read off, not invented — the toy of the `BodySuccSeqDiscriminator` concrete-emitter probe. When a deferred universal is FALSE in general but you suspect a gate rescues it, do not probe a single (holding) instance — probe a minimal pair inside one object: one window that HOLDS the property and a sibling that FAILS it. The object `[ { k : v } , x ]` (`tok`/`stream`) holds a seq interior `[1,8)` and a map interior `[2,5)`. POSITIVE `seq_window_holds ∧ seq_window_is_seq_typed`: `succHolds 1 8 = true` (toy of `bodySucc` — the nested map is invisible, balance `> 0` there) and the gate classifies it `enclosingMark 0 = some true`. NEGATIVE `map_window_fails ∧ map_window_is_map_typed`: `succHolds 2 5 = false` (the key at `k=2` is a depth-`0` end followed by `colon`, not a `comma` separator) and the gate classifies it `enclosingMark 1 = some false`. The probe does triple duty: confirms the gate SUFFICIENT (holding window), proves it NECESSARY (failing sibling), and NAMES it as the existing typed-stack-top computation (`stFold`/`enclosingMark`, toy of `WellTyped`/`btFold`: `seqOpen ↦ true`, `mapOpen ↦ false`) that SEPARATES the pair. The lesson: the structural feature that differs between the holding and failing windows IS the discriminator — read it off the pair, do not invent it)
* `NonRestrictionResidualNeedsRootSeed`     — Reflection 296 (a non-restriction residual needs a ROOT SEED, not a stronger local invariant — the toy of `flowBodyContent_bodySucc_of_part6`, the certain root-seed half of (i'-b). The recursion's guards thread cleanly only because their fields are all-depth and balance-FREE, making each edge a pure SUBSET restriction; a depth-`0`-balance-keyed field (`bodySucc`) has no such form, so no LOCAL carrier descends. POSITIVE `afterOpener_restrict`: an all-depth `AfterOpener` (toy of `FlowBodyContentDeep`'s opener/separator fields) restricts to any sub-window by `omega` — the three-line descend/advance edges. NEGATIVE `parent_holds ∧ child_fails`: the depth-`0` `Depth0Sep` (toy of `bodySucc`) holds on the parent window `[0,4)` of `wt = opn scal scal cls` (`[ a b ]`, its only balanced-prefix end the close at `k=3`) yet FAILS on the descended interior `[1,3)` (there `bal 1 2 = 0` fires on the scalar at `k=1` — the child's depth-`0` = the parent's depth-`1`, which the parent never speaks of — not followed by a separator); same `tok`, parent holds, child fails, so it is NOT a subset restriction. POSITIVE `bridge_checked_to_bang`: the root-seed move — infra delivers the fact with bounds-checked indexing `T[k]'h`, the consumer wants panic `T[k]!`, the bridge is a pure `getElem!_pos` conversion. The lesson: when a needed fact is provably NOT a subset-restriction, do not chase a stronger local invariant — seed its ROOT instance from existing infra now, and recognize the descended instances as a bracket-TYPE-context problem)
* `IncompleteProjectionStillFactors`        — Reflection 295 (an INCOMPLETE guard-projection still factors — the toy of `flowBodyContent_of_deep`, the assembler that PRODUCES the head-dispatch's `FlowBodyContent` from the threaded deep guard. When a strengthened carrier projects MOST of a target structure but not all, build the ASSEMBLER that projects the covered part and NAMES the residual, not a heavier carrier. The projection is partial in TWO grains: `head` is a WHOLE-FIELD free projection (`DeepGuard.head` and `Content.head` are the SAME proposition), `sepNext` is a CASE-SPLIT projection — the carrier covers its INTERIOR (`k+1 < n`, the `sepNextInterior` field gated `k+1 < n`) but not its BOUNDARY (`k+1 = n`). POSITIVE: `assemble` builds `Content` from `DeepGuard` plus two named residual hypotheses — the `head` arm a free projection, the `sepNext` arm `rcases`-split into projected-interior / residual-boundary. NEGATIVE: `valSep_not_derivable` — the carrier is SEPARATOR-BLIND, `DeepGuard 2 twoScalars` holds (two adjacent scalars `[a b]`) yet `valSep` (comma-separation, toy of `bodySucc`) FAILS, so it is genuinely owed; `boundary_not_reachable` — `DeepGuard 2 trailingComma` holds (`[a ,]`) yet `sepNext` FAILS at the boundary `k+1 = n` (trailing comma, `tok 2 = cls` not content-start), so the interior-gated carrier field cannot reach it. The lesson: the residual you isolate — here one whole field (`valSep`) PLUS one missing CASE of another (`sepNext` boundary) — is precisely the data the carrier semantically cannot encode; name it, the names are the real owed primitives)
* `ThreadedGuardPrunesCaseTree`             — Reflection 294 (a threaded guard PRUNES the case tree — the toy of `recseqentry_window_dispatch`, the per-window head-shape dispatch the dependency map wrote as a FOUR-way split that is actually THREE. The dispatch reads the head off `isContentStart` (THREE shapes — scalar / `sopen` / `mopen`, never the closer); the deep guard's `OpenerContentStart` (after a `sopen`, the next token is content-start) makes the empty-bracket leaf `[ ]` unreachable, so it is EXCLUDED, not handled — folded into the nested-`[ … ]` branch. POSITIVE: `dispatch` is TOTAL over the three content-start heads (its `sclose` case vacuous, `isContentStart sclose = False` via `h.elim`); `empty_excluded` shows under the guard a `sopen`-headed window never has `sclose` next. NEGATIVE: `not_content_start_sclose : ¬ isContentStart sclose` (the closer is no head); `empty_reachable_without_guard` shows the empty bracket IS a genuine fourth shape absent the guard — so it is the GUARD, not the deliverable's type, that prunes the branch (the `Shape` type still carries `emptyBracket` distinct from `nestedSeq`). The lesson: a threaded recursion guard is not only a source of premises — a guard strengthened for one purpose can be strong enough to DELETE a branch the deliverable still anticipates, so the structural moves completing a recursion can be fewer than the constructor count)
* `NearLeafMirrorShedsMachinery`            — Reflection 293 (a near-leaf mirror SHEDS the recursion machinery its recursive sibling needed — the toy of `recseqentry_mapbracket_oracle`, the `{ … }` mirror of the recursive seq oracle. The R244 storage asymmetry has OPPOSITE signs on the two sides of the boundary: a near-leaf is the CONSUMER's complication but the PRODUCER's simplification, so mirroring a near-leaf oracle is a hypothesis-DROPPING exercise. `RBody` is the recursive deliverable (inhabited only by its constructors, UNINHABITED on `[]`), `WB l := pbal l = 0 ∧ ∀ i, pbal (l.take i) ≥ 0` the near-leaf (flat prefix-balance, inhabited on `[]`). POSITIVE: `seq_oracle` is discharged ONLY with the IH AND non-emptiness (both load-bearing); `map_oracle` produces the same-shape deliverable from balance facts ALONE — both hypotheses GONE — and `map_fires_empty : WB []` fires on the degenerate empty interior the recursive sibling cannot represent. NEGATIVE: `not_rbody_empty : ¬ RBody []` shows the empty case is a HOLE for the recursive sibling (so the seq oracle's non-emptiness guard is real), FREE for the near-leaf (`WB []` holds) — the storage asymmetry's two opposite signs on one input; `not_wb_opn : ¬ WB [opn]` confirms `WB` is not vacuous, the near-leaf oracle being IH-free, not content-free. The lesson: write the recursive sibling first (it forces the full machinery), then mirror the near-leaf by DELETING the IH and the descend/non-emptiness guard, not adding to them)
* `ProducerGuardedOracleReconstruct`        — Reflection 292 (discharge a producer-guarded oracle by RECONSTRUCTING the descended guard in place from the locator's own facts — never by re-running the *locating* descend-lemma, which finds its own witness `j'` and saddles you with a `j = j'` matching-close uniqueness proof; the toy of `recseqentry_seqbracket_oracle`. The oracle hands in the close `j` WITH the facts that pin it (`lo+1 < j`, `bal l (lo+1) j = 0`), so `win_reconstruct` builds the descended guard `Win l (lo+1) j` at THAT `j` directly — parametric in `j`, no re-location — and `oracle_discharge` feeds it to the IH (`reconstruct_fires : P nested 1 3` on the nested bracket `[opn,opn,cls,cls]`, the outer close `j = 3`). NEGATIVE: the naive re-locator `firstClose nested = 2` finds the INNER close, not the outer matching close `3` the oracle was handed (`#guard firstClose nested != 3`), and `bal nested 1 2 = 1 ≠ 0` shows the guard at that re-located witness targets the WRONG, unbalanced window — substituting the re-located witness is unsound without uniqueness, which reconstruct-in-place never incurs. SECOND FACET — the field the strengthened guard DROPPED resurfaces as a hypothesis: `Deep` (toy of `FlowBodyContentDeep`, balance only, the `succ`/`bodySucc` field dropped because its descend edge was unprovable) `deep_holds` on `noSep = [opn,cls,val]` yet `deep_lacks_succ` (the successor at `2` is `val`, not `sep`) — so the dispatch's trailing-separator successor is unrecoverable from `Deep` and must come from `Full` (toy of `FlowBodyContent`, carrying `succ`), `full_supplies_succ`. The lesson: locate ONCE in the consumer, RECONSTRUCT (don't re-locate) in the producer; and a guard's deliberately-shed field returns as the consumer's own owed hypothesis)
* `LiftOnceMirrorEasyEdge`                  — Reflection 291 (lift once, then MIRROR the easy edge — the dividend-collection sequel to [[ref-easy-edge-guard-fails-hard-edge]] / R290 and the resolution step of [[ref-converse-forward-invariant-asymmetry]]. R290 diagnosed that a guard sized to its easy (ADVANCE) edge can be structurally incapable of its hard (DESCEND) edge, and lifted the content guard to the all-depth, balance-FREE `Deep`; R291 is the dividend: once lifted, the easy edge is ALREADY PAID FOR. A balance-free guard is a pure RESTRICTION of itself on every sub-window, and that property is direction-agnostic, so the advance edge restricts the same all-depth quantifiers to the tail `[m+1, hi)` exactly as the descend edge restricts them to the interior `[k+1, j)` — the ONLY difference is which field re-seats the child head (OPENER at `k` for descend, SEPARATOR at `m` for advance). POSITIVE: `deep_descend` (toy of `flowBodyContentDeep_descend`) and `deep_advance` (toy of `flowBodyContentDeep_advance`) have the IDENTICAL proof skeleton (`obtain ⟨_, h_op, h_fe⟩; refine ⟨?_, ?_, ?_⟩`; head off one field; the two quantifier fields the parent's restricted by `omega`), differing only in the one head-seating line (`h_op k …` vs `h_fe m …`) — and `deep_advance` takes NO balance hypothesis and NO size side condition; `deep_descend_good` fires descend on `[ a a ]` → `[1,3)`, `deep_adv`/`deep_advance_good` fire advance on `a , a` → `[2,3)`, re-seating `hdAdv 2 = scal` with zero arithmetic (`#guard`ed). NEGATIVE: re-deriving advance from the depth-`0` PROJECTION `Shallow` costs the balance gate — on `[ , , ]` (`hdNeg = opn sep sep cls`, separators at depth `1`), `shallow_holds_neg` shows the shallow guard HOLDS vacuously (its gate `bal 0 k = 0` is false at the depth-`1` separators), yet `interior_after_sep_not_content` shows the post-separator head `hdNeg 2 = sep` is NOT content-start, so the shallow guard gives nothing toward advancing there; `not_deep_neg` confirms the deep guard's UN-gated separator field is exactly the repair (it rejects the stream). The lesson: after lifting a guard to carry its hard edge, do NOT re-derive the easy edge with the old projection-level machinery — write it as the hard edge's mirror, swapping only the head-seating field)
* `DescendStrengthInvariant`                — Reflection 290 (a guard sized to its easy (ADVANCE) edge can be structurally incapable of its hard (DESCEND) edge — the sequel to R289 and a fresh instance of [[ref-converse-forward-invariant-asymmetry]] fused with [[ref-probe-deferred-universal-before-producing]]. R289's content guard landed its ADVANCE edge cheaply, and that ease MASKED that the guard cannot carry the DESCEND edge: descending into a nested bracket `[k .. j]` must hand the interior head `hd (k+1)` as content-start, but that head sits at balance `1` while every field of the depth-`0` guard is gated by `bal lo k = 0` — no outer field even mentions the interior head. The edge is not hard to *prove*; the guard is too weak to *carry*. `Shallow f hd lo hi := isContentStart (hd lo) ∧ ∀ k, … hd k = .sep → bal f lo k = 0 → isContentStart (hd (k+1))` toys R289's `FlowBodyContent` (depth-`0`, no opener field); `Deep hd lo hi := isContentStart (hd lo) ∧ (∀ k, … tokDelta (hd k) = 1 → isContentStart (hd (k+1))) ∧ (∀ k, … hd k = .sep → isContentStart (hd (k+1)))` toys `FlowBodyContentDeep` — content at ALL depths, balance-FREE. POSITIVE: `deep_descend` (toy of `flowBodyContentDeep_descend`) transports `Deep` into the interior `[k+1, j)` as a pure RESTRICTION — child head off the parent's opener field at `k`, child fields the parent's quantifiers restricted, no re-basing/no bracket arithmetic; `deep_good`/`deep_descend_good` fire it on the nested `[ a a ]`, yielding the interior guard on `[1, 3)` with head `scal`. NEGATIVE: on the leading-separator interior `[ , a ]` (`hdBad = opn sep scal cls`), `shallow_holds` shows the shallow guard HOLDS (its only separator sits at balance `1`, so its depth-`0` gate `bal 0 1 = 0` is vacuous), yet `interior_head_not_contentstart` shows the interior head `hdBad 1 = sep` is NOT content-start — so the shallow guard, though true, gives nothing toward the interior guard; `not_deep` confirms the DEEP guard correctly REJECTS the same stream (its opener field at `0` demands exactly the interior head be content-start). The lesson: probe the hard edge's provability against the guard AS DEFINED — the remedy is a stronger invariant (lift to the descend edge's depth), not more proof effort)
* `AdditiveParallelGuard`                   — Reflection 289 (a too-weak shared guard's missing content is its own additive parallel guard — the guard-layer instance of [[ref-additive-parallel-type-over-shared-edit]]. The head-shape dispatch needs "head is content-start", and that is NOT derivable from the bracket guard `FlowBodyWindow` (balance/dyck/WellTyped): a separator-headed window is still balanced+dyck+WellTyped. `BracketWin f lo hi := bal f lo hi = 0 ∧ ∀ i, bal f lo i ≥ 0` toys the bracket guard; `dyck_excludes_closer` shows the dyck floor genuinely forbids a leading CLOSER (`tokDelta (hd lo) ≥ 0`), but `separator_head_passes_dyck` (`0 ≥ 0`) + `separator_head_not_contentstart` show a separator head clears the SAME floor while not being content-start, and `bracketwin_sep_head`/`sep_head_not_cs` exhibit a whole window passing the bracket guard whose head is a separator — so content-start is not a function of the guard. The fix: name the missing content as a parallel guard `ContentWin f hd lo hi := isContentStart (hd lo) ∧ ∀ k, … hd k = .sep → bal f lo k = 0 → isContentStart (hd (k+1))` (toy of `FlowBodyContent`'s `headContentStart` + `feContentStart`), defined as what the consumer already eats. POSITIVE: `content_advance` (toy of `flowBodyContent_advance`) transports `ContentWin` to the tail `[m+1, hi)` by pure re-basing — the tail head re-seated from `feContentStart` at the separator; `content_window_good`/`content_advance_good` fire it on `scal sep scal`, re-seating `hdGood 0 = scal` to `hdGood 2 = scal` across the separator at `1` (`#guard`ed). NEGATIVE: `not_contentwin_bad` — the empty-entry body `scal sep sep scal` is NOT a `ContentWin` (the separator at `1` is followed by another separator, not a content-start head), so `feContentStart` is the load-bearing field whose failure would break ADVANCE re-seating; the recursive DESCEND content edge — interior heads a nesting level down — is left as the isolated residual)
* `GuardEdgeFloorAsymmetry`                 — Reflection 288 (the DESCEND edge completes R287's guard-threading skeleton, and its lesson is that the SAME guard field needs DIFFERENT invariant strengths on different recursion edges — an instance of [[ref-converse-forward-invariant-asymmetry]] *within one recursion*. `bal f a b = f b − f a` toys `flowBracketBalance`; `advance_dyck` (toy of `flowBodyWindow_advance`'s `dyck`) derives the tail `dyck ≥ 0` from JUST the OUTER `dyck ≥ 0` because the tail re-bases onto a *balanced* prefix (`bal lo (m+1) = 0`); `descend_dyck` (toy of `flowBodyWindow_descend`'s `dyck`) needs the strictly-stronger FLOOR `bal lo i ≥ 1` because the interior sits a level DOWN (the opener pushes the balance to `1`, `bal (k+1) i = bal lo i − 1`) — the floor being what `flowBracketBalance_matching_close` threads through its forward scan, NOT recoverable from the guard's outer `dyck`. POSITIVE on a real matched bracket `fNest = "[ [ ] ]"`: `nest_offset`/`nest_floor`/`nest_interior_dyck` (floor holds ⇒ interior `dyck` follows). NEGATIVE on `fFlat = "[ ] [ ]"`: `flat_outer_dyck` (outer `dyck ≥ 0` holds everywhere) yet `flat_interior_dips` (`bal fFlat 1 2 = −1` dips below 0) and `not_flat_interior_dyck` (the descend conclusion is outright FALSE), because `flat_floor_fails` (`bal fFlat 0 2 = 0`, not `≥ 1`) — so the advance edge's weaker hypothesis cannot be reused on the descend edge; `#guard`s confirm both edges strictly narrow the width metric)
* `GuardThreadingSkeleton`                  — Reflection 287 (the per-window `step` has a *guard-threading skeleton* below its grammar core: Reflection 286's combinator left its guard `G` abstract, and driving it requires `G` made concrete and shown preserved across each recursion edge *before* the head-shape grammar can run — that layer is grammar-free and, because a well-chosen `G` names no collection-specific deliverable type, SHARED across both axes. `BodyWin` (toy of the real `FlowBodyWindow`) bundles frame bounds + non-emptiness `lo < hi` + balanced/Dyck + a content predicate `wt`, naming NO deliverable type; `bodyWin_advance` (toy of `flowBodyWindow_advance`, its proof the real one verbatim) transports the WHOLE guard from `[lo, hi)` to the tail `[m+1, hi)` given only the separator's three transport certificates — tail balanced, depths re-base to the outer origin (toy of `advanceTail_invariant`), content carries to the subrange (toy of `WellTyped_subrange`) — with the only non-trivial field, `Dyck`, closed by re-basing each tail prefix to `lo` then applying the outer `Dyck`; the non-emptiness premise `m+1 < hi` (no trailing separator) is DEFERRED to the caller (the head-shape grammar's burden). One guard, both axes: `feedSeq`/`feedMap` (stand-ins for producing a `RecSeqBody`/`RecMapBody`) are gated by the SAME `BodyWin`. Positives `win_2_6` (a concrete guard) and `win_4_6` (`bodyWin_advance` firing to the tail), `#guard feedSeq/feedMap win_2_6 == 4`; negatives `not_bodyWin_empty` (the `lo < hi` field is LOAD-BEARING — the R285 echo — so the guard EXCLUDES the empty window the deliverable cannot inhabit) and `#guard (6 - (3+1)) < (6 - 2)` (the ADVANCE edge strictly NARROWS the window, so the combinator's width metric decreases))
* `WidthRecursionCombinator`               — Reflection 286 (the single-named "strongRecOn width-metric driver" is TWO bricks entangled — the grammar-free recursion plumbing and the per-window grammar step; cut the plumbing off as an abstract width-metric combinator `widthRec` (over arbitrary `P`/`G`, proved by the codebase's span-bound `Nat.strongRecOn` idiom). It pins the per-window step's IH interface exactly (`hi' - lo' < hi - lo → G lo' hi' → P lo' hi'`) so the step is a *non-recursive* lemma carrying no well-founded-recursion risk, and (naming no collection-specific deliverable type) it does NOT re-split across seq/map — the SAME `widthRec` drives two structurally-different toy deliverables verbatim: `Reach` (descends from `lo`) and `Reach2` (descends from `hi`), each via a non-recursive per-window `reachStep`/`reach2Step` that REQUIRES the combinator's oracle (`reach_all`/`reach2_all`, `reach_0_3`/`reach2_0_3` positive). The guard is load-bearing (the R285 echo): `Reach lo hi` is inhabited only for `lo ≤ hi` (`reach_le`), so `G := (· ≤ ·)` keeps the recursion inside the inhabitable region — outside it the deliverable is uninhabited (`not_reach_3_0`), exactly the empty-window region R285 peeled away to make the driver's interface satisfiable; negatives also `#guard` that the per-window step's recursive call genuinely DECREASES the shared width metric `hi - lo` on both axes)
* `EntryBoundaryLocator`                    — Reflections 264, 265, 266, 267, 268 & 271 (the analytical entry-boundary location splits into an *input side* — locate the split point — and a *shape side* — classify the item; the input side is a single axis-agnostic combinatorial brick, because the body-separator token is shared across seq and map. A general constructive least-witness locator `exists_least_in_range` (for a decidable `P` holding at `start + gap`, the least witness with its minimality certificate; structural induction on the gap, decidability-driven upward scan — no `Nat.find`, no classical choice, no well-founded recursion — *verbatim* the real lemma) and its specialization `firstEntryBoundary`: for a balanced window (`bal l l.length = 0`) the least depth-`0` boundary marker `m` (balance returns to 0, and `m` is the window end or a separator) with the certificate that no earlier interior position is such a marker. This pins *where* the first item ends, separate from the shape side (the matching-close analysis that *consumes* `m`). **The discriminator**: a navigation brick mirrors across seq/map exactly when it names a collection-specific *deliverable type*; one phrased over the shared *token stream* (balance, the separator `FE`) is written once — the input side does NOT mirror, the shape side will. Input-side positives `firstMarker_l1` (the locator fires on the balanced `[a],b`, the first marker being the separator at `m = 3`, witnessed concretely by `#guard bal l1 3 == 0`/`isFE (tokAt l1 3)`, minimality by `bal l1 1 == 1`/`bal l1 2 == 1`) and `firstMarker_l2` (the *last-item* branch — the window end `m = 3 = length` on the single item `[a]`, no separator); `least_ge3` exercises the helper on a pure-`Nat` predicate; input-side negatives `not_marker_inside` (an interior depth-≥1 position is not a marker) and `cl_is_not_separator` (the boundary token is `FE`, not the close bracket). **Reflection 265 (shape side)**: the shape side is the *family of per-constructor window-lifts* on the entry inductive `Entry` (`scalar` leaf / `seq` recursive), and the recursive constructor's lift is the BUILD structural move (already landed), so the new work is the non-recursive leaf — `entry_scalar_window` (toy of `recseqentry_scalar_window`): the one-token window at a scalar head is an `Entry.scalar` (window-singleton identity via `List.getElem_cons_drop`/`List.getElem_take`/`List.drop_eq_nil_of_le`, head value off `tokAt` via `List.getElem_eq_getD`). Shape-side positives `scalar_window_l1_1`/`scalar_window_l1_4` (the leaf fires at each scalar head of `l1`, witnessed by `#guard (l1.take 2).drop 1 == [sc]`); shape-side negatives `op_head_is_not_scalar_leaf` (an `op` head is the recursive constructor's job, not the leaf's) and `#guard (l1.take 3).length == 3` (the bracketed first item is not the one-token leaf shape). This is where the seq/map mirror re-splits — the lemma names the entry inductive, so the map shape side's leaf is a heavier key/value *pair*. **Reflection 266 (the leaf *family*)**: the non-recursive leaves come as a family — `entry_seqempty_window` (toy of `recseqentry_seqempty_window`) is the scalar leaf *scaled by one token*: the empty bracket `[ ]` at an `op`-then-`cl` head is an `Entry.seqEmpty` over the two-token window `(l.take (lo+2)).drop lo` (`m = lo + 2`, still non-recursive), proven by the same `List.getElem_cons_drop` peel run twice (`[lo]` then `[lo+1]`) with the same trailing-`drop`-nil and `getElem_take`/`getElem_eq_getD` — only the arity moved; once the first leaf is proven the rest are the same proof at a different arity. Positive `seqempty_window_l3_0` (the leaf fires at the head of `l3 = [op, cl, fe, sc]`, witnessed by `#guard (l3.take 2).drop 0 == [op, cl]`); negatives `#guard (l3.take 2).drop 0 != [op]` (two-token shape ≠ the scalar leaf's one-token shape — distinct family members) and `l1_head_is_not_empty_bracket` (the empty leaf needs `cl` immediately after `op`; in `l1` the token after the opener is `sc`, the recursive `seq` constructor's job). **Reflection 267 (the family's last member — the near-leaf)**: `entry_map_window` (toy of `recseqentry_map_window`) is the nested-mapping near-leaf — the recursive `seq` BUILD move *minus one field*. A distinct map-bracket pair `mo`/`mc` (toy of `.flowMappingStart`/`.flowMappingEnd`) and a flat well-bracketed predicate `WB l := bal l l.length = 0` model the storage decision: the `Entry.map` constructor STORES only `WB interior` (not a recursive body, R244), so it is a *near*-leaf (variable-width interior) that still terminates the dispatch. Its proof transports the recursive `seq` build's window plumbing verbatim — rest-decomposition `(take (hi+1)).drop (lo+1) = (take hi).drop (lo+1) ++ [l[hi]]` (`List.take_add_one`/`List.drop_append_of_le_length`), opener peel (`List.getElem_cons_drop`/`List.getElem_take`) into `op :: (interior ++ [cl])` shape, head values off `tokAt` — differing only in the terminal constructor (`Entry.map`) and the one bare `WB` field (the one-field arity delta *is* the store-vs-project decision). Positive `map_window_l4_0` (the near-leaf fires at the head of `l4 = [mo, sc, mc]`, witnessed by `#guard (l4.take 3).drop 0 == [mo, sc, mc]` and `interior_l4_is_wb : WB ((l4.take 2).drop 1)`); negatives `#guard (l4.take 3).drop 0 != [mo]` (≥2-token shape, not the scalar leaf's one-token), `unbalanced_interior_not_wb` (the stored `WB` fails for the unbalanced `[mo]` — the flat fact stored in place of a body), and `cl_is_not_map_close` (the near-leaf needs the *map* closer `mc`, distinct from the sequence `cl`). With scalar + seqEmpty + map + the BUILD-move `seq`, the seq shape side's four-way head dispatch is complete. **Reflection 268 (the map shape side — one assembler, not a dispatch)**: the shape side re-splits across seq/map (it names the collection-specific `Pair` inductive), but the map side is *not* a per-constructor dispatch — a map item is always a whole key/value *pair* `ky <block_k> vl <block_v>` (`Pair`, sole constructor `Pair.mk`), so there is nothing to classify. `pair_window` (toy of `recmappair_window`) is ONE assembler that (i) *consumes the complete seq dispatch as its two sub-blocks* — the key/value blocks are arbitrary `Entry`s, taken as hypotheses, so the map side adds zero per-constructor classification — and (ii) supplies the one new piece, the pair glue, as a *composition of two already-landed plumbing patterns*: the segment split at the `vl` separator (the ADVANCE plumbing `List.take_append_drop`/`take_take`/`drop_drop`, splitting `[lo+1, m)` at `kv`) and the opener peel of `l[lo]` (the BUILD/leaf peel `List.getElem_cons_drop`/`List.getElem_take`), terminated by `Pair.mk`. New tokens `ky`/`vl` (toy of `.key`/`.value`, delta 0). Positive `pair_window_l5` (the assembler glues two scalar `Entry` blocks — both produced by the *seq* scalar leaf — into a `Pair` of `l5 = [ky, sc, vl, sc]`, witnessed by `#guard (l5.take 4).drop 0 == [ky, sc, vl, sc]` and the sub-blocks `#guard (l5.take 2).drop 1 == [sc]`/`#guard (l5.take 4).drop 3 == [sc]`); negatives `#guard (l5.take 4).drop 0 != [sc]`/`!= [ky]` (the pair is a heavier four-token composite, not a single `Entry`), `seq_head_is_not_key` (an `op` sequence head is not a `ky` map head), and `fe_is_not_value` (the seq separator `fe` is distinct from the pair's `vl` marker). So the seq/map re-split surfaces as *composition* — ADVANCE-split ∘ BUILD-peel — not a fresh family. **Reflection 271 (the ADVANCE-step *invariant-preservation* certificate — structural-complete ≠ runnable)**: the moves + locator + shape side make the recursion structurally complete, but it is not *runnable* until one more fact is proved — after ADVANCEing past a depth-`0` separator at `m`, the tail `[m+1, hi)` is *itself a valid recursive sub-instance*. The structural moves are all *assembly* lemmas (given the pieces, build the constructor); none certifies the recursive call's *precondition*. `advanceTail_invariant` (toy of the real `advanceTail_invariant`) is that certificate — and like `firstEntryBoundary` it is axis-agnostic (names no deliverable type), so it sharpens R264's input/shape split: the input side is *locate the point* **and** *certify the tail*, both written once. It needs a *range* balance `balR l lo hi` (toy of `flowBracketBalance`), its additivity `balR_compose` (the slice split `take (hi-lo) (drop lo) = take (mid-lo) (drop lo) ++ take (hi-mid) (drop mid)` via `List.take_add`/`List.drop_drop` fed to `sumD_append`/`foldl_add_shift`) and the single-token value `balR_single`; then, given a balanced window with a depth-`0` `fe` at `m`, it delivers (a) prefix-through-separator balanced, (b) tail balanced, (c) the tail *re-bases* (`balR lo p = balR (m+1) p` for `m+1 ≤ p ≤ hi`) — all by `balR_compose` split at `m`/`m+1` plus the separator's zero delta, no induction. Positive `advanceTail_l6` (the invariant fires on `l6 = [op, sc, cl, fe, op, sc, cl]`, the separator at depth `0` position `3` splitting `[a],[b]`; re-basing exercised *mid-bracket* by `#guard balR l6 0 5 == balR l6 4 5` — both `1` inside the tail's `[b]`, the outer origin `0` and new origin `4` agreeing precisely because the prefix is balanced — and `#guard balR l6 0 4 == 0`/`balR l6 4 7 == 0` for the two balance facts); negatives `interior_sep_not_depth0` (an `fe` *inside* a bracket, `l7 = [op, fe, cl]`, has `balR l7 0 1 = 1 ≠ 0`, so the depth-`0` hypothesis correctly excludes it — a separator token at depth ≥ 1 is not a body boundary) and `#guard balR l6 0 2 != balR l6 4 2` (re-basing is not a free identity — *before* the new origin the two frames disagree, it holds on the tail only because the prefix is balanced))
-/