Make every conjunct say whose requests it narrows

[xmap]

Why

test_actor_kind_blindness.py pins the door: no gate branches on whether a principal is a machine. It says nothing about the envelope, and the two do not imply each other.

A gate that never reads a kind can still bind agents on eight axes and humans on two, because the narrowing arrives through the instrument a principal holds rather than through a branch on what they are. Every step of that drift is legal under the existing test and individually documented, and the endpoint is a system whose symmetry describes a doorway and nothing else.

That endpoint is the current trajectory, not a hypothetical: the mandate design carries eight axes and the human envelope binds two.

The rule

An axis may be bound only from an instrument the facility actually issues. Where a conjunct binds some principals and not others, the gap is not an oversight to disclose after the fact; it is an entry that must name the gesture the facility does not perform, and the trigger that would retire it.

• _REACH_LEDGER classifies every Conjunct member, asserted against the enum in both directions, so a new conjunct fails as unclassified and a removed one fails as stale.
• _CARVE_OUT_LEDGER holds the exceptions. A _CarveOut cannot be written without saying which principals the conjunct narrows, why that is acceptable meanwhile, which facility gesture is absent for everyone else, and what would end the entry. A blank field fails.

The load-bearing field is missing_gesture, because it separates an asymmetry the world imposes from one CORA invented. An asymmetry with no nameable missing gesture is usually a conjunct keyed on the principal that should have been keyed on the request, and that reframing is cheaper before the conjunct ships.

Why ship it empty

Both ledgers are as small as they can be: one classification, no carve-outs, and every test passes trivially. That is the point, and it is the reason Conjunct itself shipped with one member. Answering "whose requests does this narrow" costs nothing while writing a conjunct and nearly everything once twenty exist. A ledger written afterwards is an audit.

One structural backing

Unlike the kind-blindness sweep, this records a declaration rather than a discovery, since no syntax reveals which principals a conjunct narrows. So the one live classification does not rest on its author's word: Policy can narrow every principal alike only while it holds nothing to tell them apart by, and a kind-shaped field on it now fails rather than silently falsifying the entry.

Verification

• architecture 30,195 passed / 620 skipped
• uv run pyright src tests 0 errors, ruff clean
• Each of the six tests was mutated into its failure mode and confirmed to go red. An empty ledger would otherwise pass a test with no teeth.
• Naming reviewed against R1-R6; four renames applied as a result, and the three cited precedents were checked against the tree rather than taken on trust.

🤖 Generated with Claude Code

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.