MAINT-05 fix round 2: the refusal has to survive the NEXT start, and both marker guards have to be visible

REJECTED because the fix round's own load-bearing sentence was FALSE, and the
whole suite was blind to that. `_verify_moves()` produced the red the reviewer
reproduced - that half stood - but DECISIONS §2 claimed "`ok` gates the marker,
so a misdirected migration is not stamped and the next start runs it again ...
a re-run is recoverable". THE REFUSAL LASTED EXACTLY ONE START.

MEASURED, Controller level, ONE persisted store, roster ["garage","shed"], flat
last_completed 2026-08-07, call site still handing `inverter-a` on both starts:

    construction 1: ok=False misdirected=4 moved=4 kept=0   marker=<absent>
    construction 2: ok=True  misdirected=0 moved=0 kept=4   marker=1
    history parked under unit/inverter-a/...; marker stamped after ONE restart.

WHY. `_verify_moves()` graded only `rep.moved`. On start 2 the same wrong call
site finds the four keys already present, so rule 1 routes every one of them to
`rep.kept`, `rep.moved` is EMPTY, the roster loop iterates over nothing,
`misdirected` is empty and `ok` is True. Start 3 then takes the
`from_version >= MAINT_SCHEMA_VERSION` early return FOREVER - including after
the call site is fixed. Loud-and-recoverable became silent-and-permanent after
one restart: the exact state store.py's header says must never happen, reached
by the fix written to prevent it.

WHY THE CHECK MISSED IT - the recurring defect, this time INSIDE the remedy.
Part 9b's recovery check was `migrate_maint_keys(_m5, ROSTER[0], ROSTER)` - the
CORRECTED name. It measures recovery along the one path where the operator has
ALREADY fixed the bug. Nothing in the 19 files called `migrate_maint_keys()`
twice with the SAME WRONG `unit`. The check was true and passed for the wrong
reason.

WHAT CHANGED

1. app/store.py `_verify_moves()` grades `set(rep.moved) | set(rep.kept)`.
   Sound by construction: every entry in both lists is a `unit_key(unit,
   legacy)` built from the SAME `unit` argument, so grading `kept` grades the
   same namespace decision `moved` does. A correct call site's `kept` entries
   sit under a roster name and pass; a wrong one cannot launder its namespace by
   having already written it. `migrate_unit_keys()` passes `roster=None` and
   returns before the loop, so it is untouched.

2. test_maintenance.py part 9c - THE CHECK THAT WAS MISSING. Two starts, SAME
   wrong unit, ONE store: the marker is still withheld on the second, the
   refusal names the same roster, the flat history is still there to recover
   from, and a third start with the CORRECTED name still gets a run (which a
   stamped marker would have made impossible). Its PRECONDITION asserts the
   SHAPE of the second report - `moved` empty, `kept` full - so it cannot
   quietly revert to grading 9b's path. Counterfactual beside it: the same two
   calls with the right name are accepted, then skipped as `already at schema`.

3. test_maintenance.py part 9d - THE OTHER GUARD ON THE SAME LINE, and a
   survivor nothing in the repository could see. `if rep.ok:` is
   `not lost and not misdirected`; every check that reached the marker did so on
   a store whose `kept` was empty, so

       if rep.ok:        ->      if rep.ok or rep.kept:        (+12 B)

   stamped the marker on a migration that LOST A MONTH OF HISTORY - defeating
   the older, settled `lost` guard as well as the new one - and ALL 19 SUITES
   WERE GREEN on it (measured at 65cddf3, purged, :ro). 9d's fixture is the one
   shape that separates the guards: two keys already namespaced (`kept`
   non-empty, the mutant's `or` fires) and two whose write the store drops
   (`lost` non-empty), `misdirected` empty throughout.

4. FOUND HERE AND CLOSED: THE SAME MUTATION ONE FUNCTION UP. `migrate_unit_keys()`
   - SAFETY-02's LATCH migration - gates its own marker the same way, and every
   check that reached it ran on a store with an empty `kept`. `if rep.ok or
   rep.kept:` at store.py:307 SURVIVED ALL 19 FILES. It stamps `schema_version`
   on a migration that DROPPED THE LATCH: the guard is off, the file still reads
   `sign_tripped: true`, and the store now says the migration finished, so the
   next start skips the one thing that would re-arm it. test_inverter.py part 10
   now drops the `sign_tripped` write BESIDE an already-namespaced
   `sign_reason`, with the accepted-baseline counterfactual. No source change -
   the shipped gate was right; nothing could see it. Mutation table 34 -> 35.

5. DECISIONS/MAINT-05 §2 CORRECTED. The paragraph that stated the false
   guarantee now states what was measured, why grading `moved` alone could not
   hold, and why the union is sound. §7 records the marker-gate hole found in
   `migrate_unit_keys()` and that it was closed. MUTATION.md gains habit 9 -
   "exercise a refusal a SECOND time with the SAME wrong input, not the
   corrected one" - and two survey rows.

MUTATION LEDGER - 11 mutations, ALL RED on the final tree, every run on a fresh
copy with the bytecode cache purged (entry count printed before and after) and
the tree mounted :ro so none could be written. Two were survivors BEFORE this
commit and both are recorded as such. Full transcript on the PR.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/DECISIONS/MAINT-05-per-pack-maintenance.md

@@ -120,13 +120,76 @@ reported as `misdirected` — a **different** failure from `lost`:
   not information, whatever its value. So anything in it fails `ok` on its own.
 
 And **`ok` gates the marker**, so a misdirected migration is not stamped and the
-next start runs it again. That is the decision the fix round was asked to
-record, and the argument for it is asymmetric: a re-run is recoverable — rule 1
-makes it a no-op where keys did land, and rule 2 left the flat keys in the file
-to recover *from* — while a silent skip is not recoverable at all, because the
-store now claims the migration happened. `test_maintenance.py` part 9b measures
-the recovery rather than asserting it: the same store, re-run with the roster's
-own first name, comes back with its month of history.
+next start runs it again. The argument for it is asymmetric: a re-run is
+recoverable — rule 1 makes it a no-op where keys did land, and rule 2 left the
+flat keys in the file to recover *from* — while a silent skip is not recoverable
+at all, because the store now claims the migration happened.
+
+### ⚠️ THE PARAGRAPH ABOVE USED TO END HERE, AND AS IT STOOD IT WAS FALSE
+
+**The refusal lasted exactly one start. The second start stamped the marker.**
+That is a correction to what the first fix round wrote down, not a new
+qualification of it, and it is recorded here because a decision document that
+states a guarantee the code does not provide is worse than one that says
+nothing.
+
+`_verify_moves()` graded only `rep.moved`. Measured at Controller level over
+**one persisted store**, roster `["garage", "shed"]`, flat `last_completed`
+2026-08-07, with the call site still handing `inverter-a` on **both** starts:
+
+```
+construction 1: ok=False misdirected=4 moved=4 kept=0   marker=<absent>   (withheld)
+construction 2: ok=True  misdirected=0 moved=0 kept=4   marker=1          (STAMPED)
+history parked under unit/inverter-a/…; marker stamped after ONE restart.
+```
+
+On start 2 the same wrong call site finds the four keys it wrote already
+present, so **rule 1** — never overwrite a namespaced value — routes every one
+of them to `rep.kept`. `rep.moved` is empty, the roster-grading loop iterates
+over nothing, `misdirected` is empty, `ok` is True, the marker is stamped, and
+start 3 takes the `from_version >= MAINT_SCHEMA_VERSION` early return **forever
+— including after the call site is fixed**. Loud-and-recoverable became
+silent-and-permanent after one restart: exactly the state `store.py`'s header
+says must never happen, reached by the fix written to prevent it.
+
+**The remedy is one line**, and it is sound by construction rather than by
+argument: grade `set(rep.moved) | set(rep.kept)`. Every entry in *both* lists is
+a `unit_key(unit, legacy)` built from the **same** `unit` argument, so grading
+`kept` grades the same namespace decision `moved` does. A correct call site's
+`kept` entries are under a roster name and pass; a wrong one cannot launder its
+namespace by having already written it. `migrate_unit_keys()` passes
+`roster=None` and returns before the loop, so it is unaffected.
+
+**Why the check missed it, which is the part worth keeping.** Part 9b's recovery
+check was `migrate_maint_keys(_m5, ROSTER[0], ROSTER)` — the **corrected** name.
+It measures recovery along the one path where the operator has *already fixed
+the bug*. The real failure is a call site that is still wrong on the next start,
+and nothing in the 19 files called `migrate_maint_keys()` twice with the **same
+wrong** `unit`. The check was true, passed, and could not reach the failure its
+sentence named — MUTATION.md's third defect, this time sitting inside the fix
+written to close it. Part **9c** now drives two starts with the same wrong unit
+over one store, asserts the marker is still withheld on the second, and asserts
+the *shape* of the second report (`moved` empty, `kept` full) so it cannot
+quietly revert to 9b's path.
+
+### The marker gate is `rep.ok` and nothing weaker — both guards, each pinned
+
+`if rep.ok:` is `not lost and not misdirected`, and until this round only the
+`misdirected` half was reachable by a check that also had a non-empty `kept`.
+The mutation
+
+```
+if rep.ok:      ->      if rep.ok or rep.kept:
+```
+
+stamps the marker on a migration that **lost a month of history** — defeating
+the older, settled `lost` guard as well as the new one — and **all 19 suites
+were green on it**. Part **9d** is the fixture that separates them: two keys
+already namespaced (`kept` non-empty, so the mutant's `or` fires) and two keys
+whose write the store drops (`lost` non-empty, so `ok` is False), with
+`misdirected` empty throughout so the section cannot pass on the other guard by
+accident. Measured differential on it: shipped → marker absent; mutant → marker
+`1`, both reporting `ok=False lost=2 kept=2`.
 
 **Why the fixtures had to change, and this is the part that got the card
 rejected.** Nothing in the repository could see whether any of the above was
@@ -297,3 +360,29 @@ It is pinned as a running check (`test_maintenance.py` part 13) rather than left
 as a comment. ⚠️ **Its assertions state the WRONG behaviour on purpose** — read
 them as the specification of a defect; the card that fixes it should expect them
 to go red and should replace them.
+
+### And its MARKER GATE had the round-3 hole too — found here, closed here
+
+Separate from the namespace hole above, and **fixed** rather than recorded,
+because closing it cost one test fixture and no source change.
+`migrate_unit_keys()` gates `schema_version` on `rep.ok` exactly as
+`migrate_maint_keys()` gates its own marker, and every check that reached that
+gate ran on a store where **nothing** was namespaced yet — so `rep.kept` was
+empty in all of them and
+
+```
+if rep.ok:      ->      if rep.ok or rep.kept:
+```
+
+**survived all 19 files**. What it does is stamp the schema marker on a
+migration that DROPPED THE LATCH: the guard is off, the state file still reads
+`sign_tripped: true`, and because the store now says the migration finished, the
+next start skips the one thing that would have re-armed it. DEV-02's own worst
+case, filed under *done*.
+
+`test_inverter.py` part 10 now drops the `sign_tripped` write **beside an
+already-namespaced `sign_reason`** — `lost` non-empty *and* `kept` non-empty,
+which is the one shape none of the existing fixtures had — and asserts the
+marker is withheld, with the accepted-baseline counterfactual beside it (habit
+7). The shipped gate was correct throughout; what changed is that a check can
+now see it.