MAINT-05 fix round 2: the refusal has to survive the NEXT start, and both marker guards have to be visible

REJECTED because the fix round's own load-bearing sentence was FALSE, and the
whole suite was blind to that. `_verify_moves()` produced the red the reviewer
reproduced - that half stood - but DECISIONS §2 claimed "`ok` gates the marker,
so a misdirected migration is not stamped and the next start runs it again ...
a re-run is recoverable". THE REFUSAL LASTED EXACTLY ONE START.

MEASURED, Controller level, ONE persisted store, roster ["garage","shed"], flat
last_completed 2026-08-07, call site still handing `inverter-a` on both starts:

    construction 1: ok=False misdirected=4 moved=4 kept=0   marker=<absent>
    construction 2: ok=True  misdirected=0 moved=0 kept=4   marker=1
    history parked under unit/inverter-a/...; marker stamped after ONE restart.

WHY. `_verify_moves()` graded only `rep.moved`. On start 2 the same wrong call
site finds the four keys already present, so rule 1 routes every one of them to
`rep.kept`, `rep.moved` is EMPTY, the roster loop iterates over nothing,
`misdirected` is empty and `ok` is True. Start 3 then takes the
`from_version >= MAINT_SCHEMA_VERSION` early return FOREVER - including after
the call site is fixed. Loud-and-recoverable became silent-and-permanent after
one restart: the exact state store.py's header says must never happen, reached
by the fix written to prevent it.

WHY THE CHECK MISSED IT - the recurring defect, this time INSIDE the remedy.
Part 9b's recovery check was `migrate_maint_keys(_m5, ROSTER[0], ROSTER)` - the
CORRECTED name. It measures recovery along the one path where the operator has
ALREADY fixed the bug. Nothing in the 19 files called `migrate_maint_keys()`
twice with the SAME WRONG `unit`. The check was true and passed for the wrong
reason.

WHAT CHANGED

1. app/store.py `_verify_moves()` grades `set(rep.moved) | set(rep.kept)`.
   Sound by construction: every entry in both lists is a `unit_key(unit,
   legacy)` built from the SAME `unit` argument, so grading `kept` grades the
   same namespace decision `moved` does. A correct call site's `kept` entries
   sit under a roster name and pass; a wrong one cannot launder its namespace by
   having already written it. `migrate_unit_keys()` passes `roster=None` and
   returns before the loop, so it is untouched.

2. test_maintenance.py part 9c - THE CHECK THAT WAS MISSING. Two starts, SAME
   wrong unit, ONE store: the marker is still withheld on the second, the
   refusal names the same roster, the flat history is still there to recover
   from, and a third start with the CORRECTED name still gets a run (which a
   stamped marker would have made impossible). Its PRECONDITION asserts the
   SHAPE of the second report - `moved` empty, `kept` full - so it cannot
   quietly revert to grading 9b's path. Counterfactual beside it: the same two
   calls with the right name are accepted, then skipped as `already at schema`.

3. test_maintenance.py part 9d - THE OTHER GUARD ON THE SAME LINE, and a
   survivor nothing in the repository could see. `if rep.ok:` is
   `not lost and not misdirected`; every check that reached the marker did so on
   a store whose `kept` was empty, so

       if rep.ok:        ->      if rep.ok or rep.kept:        (+12 B)

   stamped the marker on a migration that LOST A MONTH OF HISTORY - defeating
   the older, settled `lost` guard as well as the new one - and ALL 19 SUITES
   WERE GREEN on it (measured at 65cddf3, purged, :ro). 9d's fixture is the one
   shape that separates the guards: two keys already namespaced (`kept`
   non-empty, the mutant's `or` fires) and two whose write the store drops
   (`lost` non-empty), `misdirected` empty throughout.

4. FOUND HERE AND CLOSED: THE SAME MUTATION ONE FUNCTION UP. `migrate_unit_keys()`
   - SAFETY-02's LATCH migration - gates its own marker the same way, and every
   check that reached it ran on a store with an empty `kept`. `if rep.ok or
   rep.kept:` at store.py:307 SURVIVED ALL 19 FILES. It stamps `schema_version`
   on a migration that DROPPED THE LATCH: the guard is off, the file still reads
   `sign_tripped: true`, and the store now says the migration finished, so the
   next start skips the one thing that would re-arm it. test_inverter.py part 10
   now drops the `sign_tripped` write BESIDE an already-namespaced
   `sign_reason`, with the accepted-baseline counterfactual. No source change -
   the shipped gate was right; nothing could see it. Mutation table 34 -> 35.

5. DECISIONS/MAINT-05 §2 CORRECTED. The paragraph that stated the false
   guarantee now states what was measured, why grading `moved` alone could not
   hold, and why the union is sound. §7 records the marker-gate hole found in
   `migrate_unit_keys()` and that it was closed. MUTATION.md gains habit 9 -
   "exercise a refusal a SECOND time with the SAME wrong input, not the
   corrected one" - and two survey rows.

MUTATION LEDGER - 11 mutations, ALL RED on the final tree, every run on a fresh
copy with the bytecode cache purged (entry count printed before and after) and
the tree mounted :ro so none could be written. Two were survivors BEFORE this
commit and both are recorded as such. Full transcript on the PR.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwRLw7eKYj2byVdwB6kbjU

goodwe_controller/test_inverter.py

@@ -572,6 +572,58 @@ check("...and a store that only fails to persist a DEFAULT is not reported as "
       "dismiss before the real one arrives",
       migrate_unit_keys(LosesTheLatch(), UNIT_A).ok is True)
 
+# ⚠️ AND THE MARKER GATE, ON A STORE WHERE SOMETHING WAS ALREADY NAMESPACED.
+# FOUND BY MAINT-05's ROUND-3 BATTERY, AND IT WAS A SURVIVOR OF ALL 19 FILES.
+# `migrate_unit_keys()` gates `SCHEMA_KEY` on `rep.ok`, and every check above
+# reaches that gate on a store where NOTHING was already under `unit/...` - so
+# `rep.kept` is empty in all of them, and the mutation
+#
+#     if rep.ok:            ->    if rep.ok or rep.kept:
+#
+# stamped the marker on a migration that DROPPED THE LATCH, with the whole suite
+# green. That is a disarmed safety guard plus a store that says the migration
+# finished, so the next start skips the one thing that would have re-armed it -
+# DEV-02's own worst case with the paper trail filed under "done".
+#
+# The fixture is the one shape that separates them: `sign_reason` ALREADY
+# namespaced (so `kept` is non-empty and the mutant's `or` fires) and the
+# `sign_tripped: true` write dropped on the floor (so `lost` is non-empty and
+# `ok` is False). `migrate_unit_keys()` is passed no roster, so `misdirected`
+# cannot be what refuses this - it is the `lost` guard or nothing.
+_kept_reason = "SIGN_DISAGREEMENT: already namespaced by a later version"
+_broken_kept = LosesTheLatch({
+    "sign_tripped": True,
+    "sign_reason": "SIGN_DISAGREEMENT: measured",
+    unit_key(UNIT_A, "sign_reason"): _kept_reason})
+_rep_kept = migrate_unit_keys(_broken_kept, UNIT_A)
+print(f"    a dropped latch write beside an already-namespaced reason: "
+      f"{_rep_kept.explain()}")
+print(f"    lost={len(_rep_kept.lost)} kept={len(_rep_kept.kept)} "
+      f"ok={_rep_kept.ok}; marker "
+      f"{_broken_kept.data.get(SCHEMA_KEY, '<<absent>>')!r}")
+check("PRECONDITION: this fixture reaches the marker gate through the `lost` "
+      "guard with a NON-EMPTY `kept`, which is the combination none of the "
+      "checks above has. One key dropped, one key left alone, `ok` False. If a "
+      "later edit empties `kept` here the mutation goes invisible again, so the "
+      "shape is asserted rather than assumed",
+      _rep_kept.ran and len(_rep_kept.lost) == 1 and len(_rep_kept.kept) == 1
+      and not _rep_kept.ok
+      and _broken_kept.data[unit_key(UNIT_A, "sign_reason")] == _kept_reason)
+check("⚠️ AND THE STORE IS NOT MARKED MIGRATED. The key that was ALREADY there "
+      "does not buy a marker for the latch that was not: stamping here would "
+      "tell the next start that the migration which dropped `sign_tripped` had "
+      "finished, so it would never run again and the guard would stay off on an "
+      "install whose file still reads `sign_tripped: true`",
+      SCHEMA_KEY not in _broken_kept.data)
+check("...and the counterfactual, one property different: the SAME store shape "
+      "on a store that does not drop writes IS marked migrated. So the refusal "
+      "above is about the latch that was lost, not about `kept` being non-empty",
+      migrate_unit_keys(
+          MemStore({"sign_tripped": True,
+                    "sign_reason": "SIGN_DISAGREEMENT: measured",
+                    unit_key(UNIT_A, "sign_reason"): _kept_reason}),
+          UNIT_A).ok is True)
+
 _broken2 = LosesTheLatch({"sign_tripped": True,
                           "sign_reason": "SIGN_DISAGREEMENT: measured"})
 _c2d, _ = built(store=_broken2)
@@ -2149,6 +2201,16 @@ MUTATIONS = [
     ("validate.py allowing two roster entries with the SAME name",
      "part 10: 'two entries with the SAME name are refused' - one Store "
      "namespace for two units is DEV-02's defect rebuilt in YAML"),
+    ("`migrate_unit_keys()`'s marker gate `if rep.ok:` -> `if rep.ok or "
+     "rep.kept:` - the schema marker stamped on a migration that DROPPED THE "
+     "LATCH, because one key happened to be namespaced already",
+     "part 10: 'AND THE STORE IS NOT MARKED MIGRATED'. ⚠️ THIS ONE SURVIVED "
+     "ALL 19 FILES and was found by MAINT-05's round-3 battery, not by this "
+     "card: every migration check here reached the gate on a store where "
+     "NOTHING was namespaced yet, so `rep.kept` was empty in all of them and "
+     "the `or` never fired. Stamping there disarms the latch AND tells the "
+     "next start the migration finished, so it never re-arms - DEV-02's own "
+     "worst case filed under 'done'"),
 ]
 # ⚠️ FOUR OF THESE SURVIVED THE FIRST TIME AND THE CHECKS WERE CHANGED, NOT THE
 # TABLE - two in DEV-02, two more in CFG-04, and the CFG-04 pair are recorded in
@@ -2167,7 +2229,7 @@ for what, caught in MUTATIONS:
 check(f"all {len(MUTATIONS)} defeats of this card are caught by a named check "
       f"above. A guard whose checks survive its own defeat is not a guard, and "
       f"this repository has three separate records of exactly that",
-      len(MUTATIONS) == 34)
+      len(MUTATIONS) == 35)
 
 
 print()