branch has no stated contract: handler keywords, the syntax words of one conditional, and goto count as decisions in some languages and not in others #2822

Part of #2812 (Phase 3; the branch row of standards/signal_contracts.py is draft). Found by the Phase 0 cause triage on 2026-09-06: keyword-rosetta's string-literal-selective-shielding ledger entry had been excusing 12 red branch cells by cross-product, and when its signal was narrowed to what a danger-only literal can actually move, five of those cells had no explanation at all. Each turned out to be documented in the language's manifest notes and never filed.

What the corpus reads

Planted: 3 decisions per language (if / else / a loop), plus 2 safety constructs. 38 languages read branch 3. These do not:

27 of the 46 branch rules name catch, rescue, except or goto; most languages simply plant their safety construct with a token their branch rule does not happen to match. The rules disagree, and the schema comment ("Includes: if, else, switch, for, while, catch, try …") says the handler keywords should count — which 38 languages contradict.

The contract question

One sentence, in the #2730 shape: branch matches a statement that chooses between control-flow paths at runtime. The three corollaries the audit above needs:

1. A handler is not a decision. catch/rescue/except/finally/ensure mark where control arrives after a throw; the decision was made by the throw. They are safety's (count contract corollary 4: a token owned by another rule is not a second signal). Retire them from every branch rule and from the schema comment.
2. One conditional is one hit. else, elsif, end if, then, WHEN/THEN/END, a guard's own else — the continuation and closing words of a construct already counted. Anchor on the opening keyword only. (ada, sqlite, swift, shell, livecode.)
3. An unconditional transfer is not a decision — already decided for assembly's jmp/call/ret (assembly/agc_assembly: branch counts unconditional transfers — 23 of 25 hits are call/ret/jmp, not decisions (#2545's shape) #2764/fix(core-engine): assembly + agc_assembly branch counts decisions, not unconditional transfers (#2764) #2779) and for return (kotlin: branch rule counts 'return' — inconsistent with java/swift/c siblings #2545/fix(standards): stop counting bare return as branch in 6 languages (closes #2545) #2634); goto is the same shape (csharp, fortran, cpp's rule).

typescript has the mirror finding on safety (3 against a plant of 2): unknown ×2 and never — type keywords counted as runtime guards. It rides here because it is the same corollary-4 question from the other side, and the two rules must be audited together.

Consumers

branch feeds _calc_cog_load (cognitive load), control_flow_ratio, the cascading-flux proximity weight (spatial_correlation.py Block 6 — a handler within 150 chars of a write currently triples it in the weighted view) and the Silencer Region pairs. Corpus: risk_cognitive_load is 80% in band; the eight cells above are its low-hanging residue.

Method

The rule-contract-audit skill (worked example: #2765 / docs/state_mutation_rule_contract.md). Expect most languages to narrow by one token, the corpus cells above to land on 3 without a re-plant, and risk_cognitive_load to tighten. Corpus side: the ledger entries branch-counts-non-decision-keywords and typescript-type-keywords-count-as-safety (keyword-rosetta, Phase 0 triage PR) record the cells and cite this issue; retire them with the fix.