The debt
FullField.require_member(x, *, mesh, context) (landing with CS4c step 6 item 6.3, 2026-09-07) is a runtime guard: it refuses a foreign carrier with a typed TypeError and a space-content mismatch with a ValueError ("space-content invariant"), at five matvec entries — StreamingOperator.apply / apply_transpose, StreamingCollisionOperator.apply / apply_transpose, and SNBoundaryOperator._apply_faces (the R6 row of the monomorphic-leaves ledger, flipped by that item). It is tagged ELEGANCE-DEBT[guard] in its docstring per .claude/rules/coding-standards.md ("A guard is elegance debt — tag it, and name what retires it"; [R] user 2026-09-07: "guards are a signal that the architecture failed the elegance standard of making a mistake unspellable; we are creating a protection, but the ultimate state is to not need a guard").
What retires it (the structural change)
The guard compares the operand against a space DERIVED FROM THE OPERAND (x.interior.space_on(mesh) — "does your space agree with what your family would be on MY carrier?"), because L and B_a accept more than one carrier family on the same end: B_a is fed the moment iterate (HarmonicMomentFlux-interior composites, [M] 59/58/47 per 2-D windowed solve) as well as the angular composite its bound end names. The mistake becomes unspellable when every leaf is bound on the end it actually acts on — R18's B reshape (plan .claude/plans/cs4c_binding_design.md §18 / §22.5, the consumers campaign): B bound on its own trace end, the windowed arm's moment iterate handed to a B bound on the moment composite (an on_moment_domain() sibling, as S/N2N already have), and L's ends typed FullFieldSpace (item 6.4 makes the annotation honest). Then the admission is the ordinary composability guard on the BOUND end (transport/operators/lift.py::admit_composite), no per-operand re-derivation exists, and require_member — with its tag — is deleted in the same commit, with a mutation battery showing the mistake is now unspellable, not merely refused.
Done-when
grep -rn "ELEGANCE-DEBT\[guard\]" orpheus/ no longer lists FullField.require_member, and the harness gate tests/_harness/test_elegance_debt_is_tagged.py still finds ≥ 1 tagged guard or is retired with the last one;- the ledger
tests/sn/architecture/test_monomorphic_leaves.py G1.3 rows stay green with the refusal coming from the bound-end guard;
tests/sn/operators/test_boundary_carrier_admission.py's moment-carrier acceptance rows are re-posed on the moment-bound B sibling (the acceptance witness moves with the binding).
Filed with the carve, not before (coding-standards: a guard without its retirement plan is an unpriced debt; a plan without its guard is a promise).
The debt
FullField.require_member(x, *, mesh, context)(landing with CS4c step 6 item 6.3, 2026-09-07) is a runtime guard: it refuses a foreign carrier with a typedTypeErrorand a space-content mismatch with aValueError("space-content invariant"), at five matvec entries —StreamingOperator.apply/apply_transpose,StreamingCollisionOperator.apply/apply_transpose, andSNBoundaryOperator._apply_faces(the R6 row of the monomorphic-leaves ledger, flipped by that item). It is taggedELEGANCE-DEBT[guard]in its docstring per.claude/rules/coding-standards.md("A guard is elegance debt — tag it, and name what retires it";[R]user 2026-09-07: "guards are a signal that the architecture failed the elegance standard of making a mistake unspellable; we are creating a protection, but the ultimate state is to not need a guard").What retires it (the structural change)
The guard compares the operand against a space DERIVED FROM THE OPERAND (
x.interior.space_on(mesh)— "does your space agree with what your family would be on MY carrier?"), becauseLandB_aaccept more than one carrier family on the same end:B_ais fed the moment iterate (HarmonicMomentFlux-interior composites,[M]59/58/47 per 2-D windowed solve) as well as the angular composite its bound end names. The mistake becomes unspellable when every leaf is bound on the end it actually acts on — R18's B reshape (plan.claude/plans/cs4c_binding_design.md§18 / §22.5, the consumers campaign):Bbound on its own trace end, the windowed arm's moment iterate handed to aBbound on the moment composite (anon_moment_domain()sibling, as S/N2N already have), andL's ends typedFullFieldSpace(item 6.4 makes the annotation honest). Then the admission is the ordinary composability guard on the BOUND end (transport/operators/lift.py::admit_composite), no per-operand re-derivation exists, andrequire_member— with its tag — is deleted in the same commit, with a mutation battery showing the mistake is now unspellable, not merely refused.Done-when
grep -rn "ELEGANCE-DEBT\[guard\]" orpheus/no longer listsFullField.require_member, and the harness gatetests/_harness/test_elegance_debt_is_tagged.pystill finds ≥ 1 tagged guard or is retired with the last one;tests/sn/architecture/test_monomorphic_leaves.pyG1.3 rows stay green with the refusal coming from the bound-end guard;tests/sn/operators/test_boundary_carrier_admission.py's moment-carrier acceptance rows are re-posed on the moment-boundBsibling (the acceptance witness moves with the binding).Filed with the carve, not before (coding-standards: a guard without its retirement plan is an unpriced debt; a plan without its guard is a promise).