@@ -1,6 +1,6 @@
 {
   "_note": "SHRINK-ONLY RATCHET (#4956). A liveness-ledger entry on a CONTAINER property carries ONE blanket verdict for the whole subtree beneath it. That is a legal granularity — inventing per-key verdicts without evidence would be worse — but it must be DECLARED, because silence is indistinguishable from having looked. `dashboard.widgets` asserted in prose that its widget keys were 'classified in the DashboardWidgetSchema subtree', no such subtree had ever existed, and the gate had no way to disagree — so `widgets[].responsive` rode straight through the #3896 inert-key sweep that removed both its sibling `widgets[].performance` and its literal namesake `view.responsive` (#4956; retired four days late in #4876 / PR #4995).",
-  "_containers": "`containers`: the child keys under these coordinates are classified NOWHERE — not in this ledger, not in another file, nowhere. Each row is a recorded, countable gap and a candidate for drilling. The gate prints the total on every run; `check:liveness --undrilled` prints the worklist. A row leaves by being DRILLED (add `children` with a status + evidence per key, the way `view.list` / `view.form` are drilled), never by being deleted for convenience — a row whose container has since been drilled FAILS the gate, so the debt cannot be overstated either. Adding a row is legitimate only when you have no per-key evidence to record, and it is deliberately a visible edit to a file named for the debt, because the alternative it replaced (a reassuring sentence in a `note`) cost nothing to write and could not be checked. ⚠️ DEPTH-TWO MIGRATION (#17424): 51 rows arrived at once when the walk learned to recurse. They are not new debt — every one of them was already riding on a blanket verdict, below a DRILLED container, where the one-level walk could not see it and therefore never counted it. Reading the jump as a regression is the wrong reading: the instrument's denominator grew to match the surface it always covered. Each of these rows is a `<type>/<prop>.<child>` coordinate, and each leaves the same way any other does — by being drilled, deferred, or by its property going away. [#18582] One row arrived with the `connector` ledger: `connector/webhooks`. It is a container whose blanket verdict is `dead` — a connector's nested webhook array never becomes a `webhook` metadata item, so the `sys_webhook` materializer never sees it (the ledger row carries the census). It is RECORDED rather than deferred because `WebhookConfigSchema` is `WebhookSchema.extend({ events, signatureAlgorithm })`, so the gate's key-set EQUALITY check would correctly refuse a `deferred` row pointing at the governed `webhook` type; and rather than drilled because 8 of its 21 child keys are the ADR-0010 protection envelope this gate auto-classifies `live` everywhere else, and the other 13 would each repeat one sentence — fabricated granularity over a container that is dead as a whole.",
+  "_containers": "`containers`: the child keys under these coordinates are classified NOWHERE — not in this ledger, not in another file, nowhere. Each row is a recorded, countable gap and a candidate for drilling. The gate prints the total on every run; `check:liveness --undrilled` prints the worklist. A row leaves by being DRILLED (add `children` with a status + evidence per key, the way `view.list` / `view.form` are drilled), never by being deleted for convenience — a row whose container has since been drilled FAILS the gate, so the debt cannot be overstated either. Adding a row is legitimate only when you have no per-key evidence to record, and it is deliberately a visible edit to a file named for the debt, because the alternative it replaced (a reassuring sentence in a `note`) cost nothing to write and could not be checked. ⚠️ DEPTH-TWO MIGRATION (#17424): 51 rows arrived at once when the walk learned to recurse. They are not new debt — every one of them was already riding on a blanket verdict, below a DRILLED container, where the one-level walk could not see it and therefore never counted it. Reading the jump as a regression is the wrong reading: the instrument's denominator grew to match the surface it always covered. Each of these rows is a `<type>/<prop>.<child>` coordinate, and each leaves the same way any other does — by being drilled, deferred, or by its property going away. [#18582] One row arrived with the `connector` ledger: `connector/webhooks`. It was a container whose blanket verdict was `dead` — a connector's nested webhook array never became a `webhook` metadata item, so the `sys_webhook` materializer never saw it. It was RECORDED rather than deferred because `WebhookConfigSchema` was `WebhookSchema.extend({ events, signatureAlgorithm })`, so the gate's key-set EQUALITY check would correctly have refused a `deferred` row pointing at the governed `webhook` type; and rather than drilled because 8 of its 21 child keys were the ADR-0010 protection envelope this gate auto-classifies `live` everywhere else, and the other 13 would each have repeated one sentence — fabricated granularity over a container that was dead as a whole. That row has since LEFT by the third route above, its property going away: `connector.webhooks` was retired under ADR-0049 and is now a `retiredKey()` tombstone rather than a container, so the gate reported the row stale and it was deleted (the `connector` ledger's `webhooks` row carries the census).",
   "_deferred": "`deferred`: containers whose subtree IS classified elsewhere — and the reference is RESOLVED, not believed. This is the same claim that caused #4956, which is exactly why it may only be made as DATA: the gate requires the target to exist (a governed type root, or a drilled `type/prop` coordinate) and its classified key set to EQUAL the container's child key set. A dangling target fails; so does a drifted one — equality rather than subset, because a container that grows a key its target never classifies is #4956 reappearing one level down. Without this list the file's own header would have been a false claim: these six cover 248 child keys, nearly half the population. A `to` target may itself be a dotted coordinate (`dashboard/widgets.chartConfig`) since the walk recurses; the resolution rule is unchanged.",
   "_excluded": "ADR-0010 framework overlay fields (`protection`, `_lock*`, `_provenance` — auto-classified live, they never consult the ledger) and container properties with NO ledger row at all (already reported UNCLASSIFIED by the forward pass).",
   "_issue": "https://github.com/objectstack-ai/objectstack/issues/4956",
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	"_note": "SHRINK-ONLY RATCHET (#4956). A liveness-ledger entry on a CONTAINER property carries ONE blanket verdict for the whole subtree beneath it. That is a legal granularity — inventing per-key verdicts without evidence would be worse — but it must be DECLARED, because silence is indistinguishable from having looked. `dashboard.widgets` asserted in prose that its widget keys were 'classified in the DashboardWidgetSchema subtree', no such subtree had ever existed, and the gate had no way to disagree — so `widgets[].responsive` rode straight through the #3896 inert-key sweep that removed both its sibling `widgets[].performance` and its literal namesake `view.responsive` (#4956; retired four days late in #4876 / PR #4995).",
`3`		- "_containers": "`containers`: the child keys under these coordinates are classified NOWHERE — not in this ledger, not in another file, nowhere. Each row is a recorded, countable gap and a candidate for drilling. The gate prints the total on every run; `check:liveness --undrilled` prints the worklist. A row leaves by being DRILLED (add `children` with a status + evidence per key, the way `view.list` / `view.form` are drilled), never by being deleted for convenience — a row whose container has since been drilled FAILS the gate, so the debt cannot be overstated either. Adding a row is legitimate only when you have no per-key evidence to record, and it is deliberately a visible edit to a file named for the debt, because the alternative it replaced (a reassuring sentence in a `note`) cost nothing to write and could not be checked. ⚠️ DEPTH-TWO MIGRATION (#17424): 51 rows arrived at once when the walk learned to recurse. They are not new debt — every one of them was already riding on a blanket verdict, below a DRILLED container, where the one-level walk could not see it and therefore never counted it. Reading the jump as a regression is the wrong reading: the instrument's denominator grew to match the surface it always covered. Each of these rows is a `<type>/<prop>.<child>` coordinate, and each leaves the same way any other does — by being drilled, deferred, or by its property going away. [#18582] One row arrived with the `connector` ledger: `connector/webhooks`. It is a container whose blanket verdict is `dead` — a connector's nested webhook array never becomes a `webhook` metadata item, so the `sys_webhook` materializer never sees it (the ledger row carries the census). It is RECORDED rather than deferred because `WebhookConfigSchema` is `WebhookSchema.extend({ events, signatureAlgorithm })`, so the gate's key-set EQUALITY check would correctly refuse a `deferred` row pointing at the governed `webhook` type; and rather than drilled because 8 of its 21 child keys are the ADR-0010 protection envelope this gate auto-classifies `live` everywhere else, and the other 13 would each repeat one sentence — fabricated granularity over a container that is dead as a whole.",
	`3`	+ "_containers": "`containers`: the child keys under these coordinates are classified NOWHERE — not in this ledger, not in another file, nowhere. Each row is a recorded, countable gap and a candidate for drilling. The gate prints the total on every run; `check:liveness --undrilled` prints the worklist. A row leaves by being DRILLED (add `children` with a status + evidence per key, the way `view.list` / `view.form` are drilled), never by being deleted for convenience — a row whose container has since been drilled FAILS the gate, so the debt cannot be overstated either. Adding a row is legitimate only when you have no per-key evidence to record, and it is deliberately a visible edit to a file named for the debt, because the alternative it replaced (a reassuring sentence in a `note`) cost nothing to write and could not be checked. ⚠️ DEPTH-TWO MIGRATION (#17424): 51 rows arrived at once when the walk learned to recurse. They are not new debt — every one of them was already riding on a blanket verdict, below a DRILLED container, where the one-level walk could not see it and therefore never counted it. Reading the jump as a regression is the wrong reading: the instrument's denominator grew to match the surface it always covered. Each of these rows is a `<type>/<prop>.<child>` coordinate, and each leaves the same way any other does — by being drilled, deferred, or by its property going away. [#18582] One row arrived with the `connector` ledger: `connector/webhooks`. It was a container whose blanket verdict was `dead` — a connector's nested webhook array never became a `webhook` metadata item, so the `sys_webhook` materializer never saw it. It was RECORDED rather than deferred because `WebhookConfigSchema` was `WebhookSchema.extend({ events, signatureAlgorithm })`, so the gate's key-set EQUALITY check would correctly have refused a `deferred` row pointing at the governed `webhook` type; and rather than drilled because 8 of its 21 child keys were the ADR-0010 protection envelope this gate auto-classifies `live` everywhere else, and the other 13 would each have repeated one sentence — fabricated granularity over a container that was dead as a whole. That row has since LEFT by the third route above, its property going away: `connector.webhooks` was retired under ADR-0049 and is now a `retiredKey()` tombstone rather than a container, so the gate reported the row stale and it was deleted (the `connector` ledger's `webhooks` row carries the census).",
`4`	`4`	"_deferred": "`deferred`: containers whose subtree IS classified elsewhere — and the reference is RESOLVED, not believed. This is the same claim that caused #4956, which is exactly why it may only be made as DATA: the gate requires the target to exist (a governed type root, or a drilled `type/prop` coordinate) and its classified key set to EQUAL the container's child key set. A dangling target fails; so does a drifted one — equality rather than subset, because a container that grows a key its target never classifies is #4956 reappearing one level down. Without this list the file's own header would have been a false claim: these six cover 248 child keys, nearly half the population. A `to` target may itself be a dotted coordinate (`dashboard/widgets.chartConfig`) since the walk recurses; the resolution rule is unchanged.",
`5`	`5`	"_excluded": "ADR-0010 framework overlay fields (`protection`, `_lock*`, `_provenance` — auto-classified live, they never consult the ledger) and container properties with NO ledger row at all (already reported UNCLASSIFIED by the forward pass).",
`6`	`6`	`"_issue": "https://github.com/objectstack-ai/objectstack/issues/4956",`