[squid-protocol]

Sections 1 and 2 of #59, plus the re-bless squid-protocol/gitgalaxy#2754 owes.

Section 3 is blocked — gitgalaxy#2748–#2753 are open issues with no engine PRs, so their
pairings cannot land yet. Nothing in this PR depends on them.

Section 1 — the three plantable safety cells

All three read safety 1 against the SPEC's 2 and a corpus median of 2: out of band, and carried by
the collective morphology entries as authoring gaps rather than engine findings. Every candidate was
screened against the live compiled rules before it was written down.

language	was	plant	screen
css	@supports only — @keyframes probe-safety was an empty block	from { contain: strict; } inside it	safety 1, nothing else (the existing at-rule already owned its func_start/structural_boundaries)
yaml	continue-on-error: false	workflow-level permissions: / contents: read	clean
dockerfile	HEALTHCHECK, counting dual func_start+safety	USER probe	structural_boundaries only, which the manifest does not gate

All three now read 2 = the median, green. safety's out-of-band set drops to the three high
outliers (embedded_python 4, haskell 3, typescript 3).

One placement detail worth recording: USER probe goes before the RUN instructions, not after.
Dockerfile slices Mode A — each instruction runs to the next func_start match — so a USER line
placed after them is swallowed into the preceding RUN's body. Measured both ways.

Section 2 — both owed plants declined, with the call recorded

#59 says "needs the call recorded either way", so both reasons are written into the ledger rather
than left implicit.

DISP=OLD (gitgalaxy#2742). The design question is decided — #2733 shipped, narrowed to
OLD|MOD only — so jcl-sync-locks-disp-enq-question moves upstream-question →
engine-semantic. The plant is declined, on measurement:

• sync_locks is in the report's ungated unplanted-input set, so jcl's measured 0 costs nothing;
• the proposed DD line screens sync_locks 1 and io 1 — and jcl's io is 3 against a median
  of 3, so +1 takes it to 4, out of band, and gated.

One ungated 0 traded for one gated red cell is the wrong direction. AGENTS.md rule 8 asks for a
paired plant when a new rule turns an honest n/a into a manufactured red cell; it didn't here, and
planting would create the very cell the rule exists to prevent. Worth revisiting if gitgalaxy#2749
lands a cleanup rule on DISP=(…,DELETE) — the same DD line would then pay two signals, and the
io cost is worth re-pricing against two rather than one.

%union (gitgalaxy#2737). Also declined. yacc reads class_start 0 — on the median, in
band, green. A plant takes it to 1 and out of band, i.e. into
container-construct-reads-as-class-start as a fifth language: the plant would manufacture the
deviation rather than pay one off. It would also disable SPEC.md rule 2's class_start == 0
false-positive tripwire for yacc, and the four languages already in that entry are there because
their file cannot exist without a container declaration — a yacc grammar can, %union is optional.
Rule 8 doesn't require it either: #2737 converted no n/a into a red cell, because class_start was
already comparable for yacc and already 0. The rule is exercised by the engine's strict tests and by
the language-crucible, which is where an optional construct belongs.

Also: the re-bless gitgalaxy#2754 owes

4 cells, and I bisected rather than assumed — the corpus is clean at 0e521e8d (#2754's parent)
and fails exactly these at #2754 itself:

• dockerfile/a.dockerfile api_orphan_credit 1 → 0 — its RUN/HEALTHCHECK igniter-keyword
  buckets no longer enter the orphan check (#2728 half), so there are no orphans left to convert.
• scheme/{a,b,c}.scm api_orphan_credit 3 → 0 — the old census tokenised with \b\w+\b, which
  cannot produce a token containing a hyphen, so every probe-globals counted zero occurrences
  and read as an orphan however many times it was named. The probes are now correctly seen in their
  own (export probe-x) lines.

Both join api-declared-orphans-are-not-new-surface, whose verdict now carries the second cause as
well as #2731's — same visible cell, two different engine fixes, and a reader chasing
api_orphan_credit == 0 needs both in one place.

Verification

• verify_language.py — 46/46 PASS
• na_check.py --ci — clean
• bias_report.py --gate — exit 0, 0 unexplained

Ledgered cells 180 → 172: eight fewer need excusing, because the three safety cells came into
band rather than being explained. The length-leak check also clears, 1 leak → 0.

Cross-repo

Closes the re-bless owed by squid-protocol/gitgalaxy#2754 (merged, labelled rosetta:rebless-owed).
No engine change is needed for anything in this PR; gitgalaxy#2748–#2753 remain open and their
corpus pairings are still owed once those rules land.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WfeHRWra1d6Z5uSReFajSq