diff --git a/CLAUDE.md b/CLAUDE.md
index 13bee34..04ac9eb 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project status
 
-`opencmdb` is a self-hosted, single-binary **Rust** network reconciliation engine (IPAM + light app CMDB + topology) for home-lab/SMB. Core thesis: continuously compare the **observed** state (auto-discovered) against the **declared** state (documented); the gap is the product. **Planning is COMPLETE** (product brief, PRD, UX spec, architecture — all in `_bmad-output/planning-artifacts/`, decision register D1–D66). **As of 2026-07-22 the code RUNS**: `v0.1.1` is tagged and published to Docker Hub as `gcorbaz/opencmdb`, and it scans a CIDR and shows a real observed-vs-declared gap on one page. **Epics 1–4 of 23 are done** (the walking skeleton shipped as v0.1). **Epic 4 closed on 2026-07-25**: the fixture corpus, the metrics harness and the trap corpus — all written BEFORE the identity engine — are committed and locked (25 artefacts, 24 traps across nine families, plus the wire-format spec). Its story 4.19 was SPLIT at closure: 4.19a shipped, **4.19b (the mutation generator) moved to Epic 11** — recorded in `epic-4-correct-course-2026-07-25.md` and GitHub issue #34, not silently. **Epic 5 — the identity engine — is IN PROGRESS since 2026-07-27** (**16 stories**: 5.4b was INSERTED 2026-07-29 at story 5.4's contexting, splitting the verdict algebra — a function that must be TOTAL over a table D13 leaves one input class short — and its anti-float `xtask` gate out of 5.4). Its **three inherited debt stories come first and are all `done`** — 5.1, 5.2 and 5.2b, PRs #41, #44 and #46, all merged 2026-07-28. The engine proper starts at **5.3, `done`** — PR #48, merged 2026-07-29 — which ships the identity engine's own abstention vocabulary (`IdentityAbstentionCause`, in the new `crates/opencmdb-core/src/identity/`) and **no engine**: no cascade, no rule, no `Decision`, no join. **5.4 follows and is `done`** — PR #52, squash-merged 2026-07-29 as `da87b62`: it adds the engine's RETURN type in the same file — `Verdict` (D13's five verdicts), `RuleVerdict { rule, verdict, evidence }`, `RulesetVersion`, `Conclusion` and `Decision` — and still **no algebra**: nothing combines a verdict set, no rule produces a verdict, nothing produces a decision. **Next is 5.4b, `ready-for-dev`** (contexted and validated 2026-07-29): `decide(Vec<RuleVerdict>, RulesetVersion) -> Decision` as a TOTAL pure function over D13's six rows plus the one input class the table leaves uncovered (`≥1 Opposes` alone → `Abstained { AbsenceOfProof }`, Guy's arbitration), and the `xtask` gate that refuses a float under `identity/`. _(This sentence named only 5.1 until 2026-07-29 — stale for a day, found by story 5.3's code review, not by the two stories that caused the drift.)_ Live status is `_bmad-output/implementation-artifacts/sprint-status.yaml`; grounding is `docs/project-context.md`.
+`opencmdb` is a self-hosted, single-binary **Rust** network reconciliation engine (IPAM + light app CMDB + topology) for home-lab/SMB. Core thesis: continuously compare the **observed** state (auto-discovered) against the **declared** state (documented); the gap is the product. **Planning is COMPLETE** (product brief, PRD, UX spec, architecture — all in `_bmad-output/planning-artifacts/`, decision register D1–D66). **As of 2026-07-22 the code RUNS**: `v0.1.1` is tagged and published to Docker Hub as `gcorbaz/opencmdb`, and it scans a CIDR and shows a real observed-vs-declared gap on one page. **Epics 1–4 of 23 are done** (the walking skeleton shipped as v0.1). **Epic 4 closed on 2026-07-25**: the fixture corpus, the metrics harness and the trap corpus — all written BEFORE the identity engine — are committed and locked (25 artefacts, 24 traps across nine families, plus the wire-format spec). Its story 4.19 was SPLIT at closure: 4.19a shipped, **4.19b (the mutation generator) moved to Epic 11** — recorded in `epic-4-correct-course-2026-07-25.md` and GitHub issue #34, not silently. **Epic 5 — the identity engine — is IN PROGRESS since 2026-07-27** (**16 stories**: 5.4b was INSERTED 2026-07-29 at story 5.4's contexting, splitting the verdict algebra — a function that must be TOTAL over a table D13 leaves one input class short — and its anti-float `xtask` gate out of 5.4). Its **three inherited debt stories come first and are all `done`** — 5.1, 5.2 and 5.2b, PRs #41, #44 and #46, all merged 2026-07-28. The engine proper starts at **5.3, `done`** — PR #48, merged 2026-07-29 — which ships the identity engine's own abstention vocabulary (`IdentityAbstentionCause`, in the new `crates/opencmdb-core/src/identity/`) and **no engine**: no cascade, no rule, no `Decision`, no join. **5.4 follows and is `done`** — PR #52, squash-merged 2026-07-29 as `da87b62`: it adds the engine's RETURN type in the same file — `Verdict` (D13's five verdicts), `RuleVerdict { rule, verdict, evidence }`, `RulesetVersion`, `Conclusion` and `Decision` — and still **no algebra**: nothing combines a verdict set, no rule produces a verdict, nothing produces a decision. **5.4b follows and is in `review`, code-reviewed 2026-07-30** (PR #55 open, CI green, 281 tests): it ships the ALGEBRA — `decide(Vec<RuleVerdict>, RulesetVersion) -> Decision`, a TOTAL pure function over D13's six rows plus the one input class the table leaves uncovered (`≥1 Opposes` alone → `Abstained { AbsenceOfProof }`, Guy's arbitration; the D13 correction itself is **GitHub issue #54**, a milestone act) — and a **sixth `cargo xtask ci` gate, `float-free`**, which reds on a float type or a float literal in code under `identity/`, comments stripped so the architecture may be quoted. The review applied 22 patches and registered 5 deferrals: `decide` now matches on `Option<RuleId>` rather than booleans, so the presence test and the rule selection are one act and no unreachable arm has to be justified; and the gate's matcher is a **numeric-literal tokeniser** rather than a digit-dot-digit search, because the search form was measured to pass `1e-3` and `1.` (both `f64`) while reddening `"192.168.0.1"`, `t.0.1` and any identifier containing `f64` — a shape story 5.5 would have tripped on its first MAC/IP rule. **Still no rule and no producer**: nothing emits a `Verdict`, so nothing calls `decide` outside its own tests (5.5 owns the join). Next is 5.5. _(This sentence named only 5.1 until 2026-07-29 — stale for a day, found by story 5.3's code review, not by the two stories that caused the drift.)_ Live status is `_bmad-output/implementation-artifacts/sprint-status.yaml`; grounding is `docs/project-context.md`.
 
 ### Build / lint / test commands (the stack is chosen and building)
 
diff --git a/_bmad-output/implementation-artifacts/5-4b-verdict-algebra-and-float-gate.md b/_bmad-output/implementation-artifacts/5-4b-verdict-algebra-and-float-gate.md
index 41810d8..9087ca7 100644
--- a/_bmad-output/implementation-artifacts/5-4b-verdict-algebra-and-float-gate.md
+++ b/_bmad-output/implementation-artifacts/5-4b-verdict-algebra-and-float-gate.md
@@ -1,6 +1,6 @@
 # Story 5.4b: The verdict algebra is a total function, and no float can reach it
 
-Status: ready-for-dev
+Status: review
 
 <!-- Validation is MANDATORY here (Guy's decision, Epic 4 retrospective 2026-07-26): two
      fresh-context agents (fact-check + gap-hunt) BEFORE dev-story. The template banner saying
@@ -467,19 +467,19 @@ re-open it.**
 
 ## Tasks / Subtasks
 
-- [ ] **Task 1 — Read before writing** (AC1–AC6)
-  - [ ] `crates/opencmdb-core/src/identity/cascade.rs` **in full** (690 lines, first `#[cfg(test)]` at
+- [x] **Task 1 — Read before writing** (AC1–AC6)
+  - [x] `crates/opencmdb-core/src/identity/cascade.rs` **in full** (690 lines, first `#[cfg(test)]` at
         `:457`). Specifically: the module doc and its four-judgement table (`:1-30`), `Verdict` and its
         five variant docs (`:39-105`), `Verdict::all()` and its witness (`:107-150`), `RuleVerdict`
         (`:174-212`), `RulesetVersion` (`:214-232`), `Conclusion` (`:234-296`), `Decision` and
         `Decision::rule()` (`:298-330`), `IdentityAbstentionCause` (`:377-397`) and its `all()` and witness
         (`:399-436`), and **the test module's placement convention** — *a test lives with the item
         whose CLAIM it pins* — which decides where every test in this story goes.
-  - [ ] `crates/opencmdb-core/src/trap.rs:31-45` — `RuleId`, its corrected doc, and **its derives at
+  - [x] `crates/opencmdb-core/src/trap.rs:31-45` — `RuleId`, its corrected doc, and **its derives at
         `:39` including `Ord`**, which AC4 depends on and which must not be re-derived.
-  - [ ] `crates/opencmdb-core/src/identity/mod.rs` (23 lines) — it says *"story 5.4b writes that
+  - [x] `crates/opencmdb-core/src/identity/mod.rs` (23 lines) — it says *"story 5.4b writes that
         algebra"*. After this story that sentence is false and Task 6 rewrites it.
-  - [ ] `xtask/src/main.rs`: the module doc listing the gates (`:1-40`), `main()`'s gate block
+  - [x] `xtask/src/main.rs`: the module doc listing the gates (`:1-40`), `main()`'s gate block
         (`run_ci()`'s, `:138-166` — NOT `main()`'s, which only dispatches), `fn report` and its
         `✅`/`🔴` glyphs (`:177-179`), `gate_ddl_collation` (`:289-327`), `gate_vocabulary`
         (`:384-441`),
@@ -488,65 +488,65 @@ re-open it.**
         (`:1330`, `:1404`) — that, not the two string-helper tests, is the idiom for testing a gate
         that WALKS a directory. **Copy the idiom, including
         how a gate reports its offender.**
-  - [ ] `architecture.md` **D13** (`:929-1011`) — start from the Decision Index near the top (F56),
+  - [x] `architecture.md` **D13** (`:929-1011`) — start from the Decision Index near the top (F56),
         not from a grep. Read **D20** (`:1348-1399`) for the ordinal clause, and **D14**
         (`:1013-1049`) for why the version is a parameter.
-  - [ ] `_bmad-output/implementation-artifacts/deferred-work.md` — **run `grep -n '5\.4b'` on it and
+  - [x] `_bmad-output/implementation-artifacts/deferred-work.md` — **run `grep -n '5\.4b'` on it and
         read every hit.** There are **eight** entries across **four** sections (AC8 lists them), not
         six in one. **Locate them by title; the line numbers in this file will have moved by the time
         you read it.**
-  - [ ] Story 5.4's file, `### Review Findings` section — the 22 patches, and especially the three
+  - [x] Story 5.4's file, `### Review Findings` section — the 22 patches, and especially the three
         findings handed forward to this story.
 
-- [ ] **Task 2 — `decide`** (AC1, AC2, AC3, AC4)
-  - [ ] The signature of AC1, in `cascade.rs`, below `Decision`'s `impl` block.
-  - [ ] A `///` doc that: states the D13 contract and attributes it; carries the input-class
+- [x] **Task 2 — `decide`** (AC1, AC2, AC3, AC4)
+  - [x] The signature of AC1, in `cascade.rs`, below `Decision`'s `impl` block.
+  - [x] A `///` doc that: states the D13 contract and attributes it; carries the input-class
         enumeration of *The finding this story FIXES* so the gap is re-derivable; names the
         arbitration as Guy's and dates it; states the tiebreak IS a tiebreak with no semantic content
         and names who replaces it; and says **what `decide` does not do** — it does not refuse a
         duplicated rule, and it does not validate the version.
-  - [ ] 🚨 **A `match` on the presence tuple `(has_disqualifying, has_decisive, has_supports,
+  - [x] 🚨 **A `match` on the presence tuple `(has_disqualifying, has_decisive, has_supports,
         has_opposes)` — NOT an `if`/`else if` chain.** AC2 carries the measurement behind this; it is
         what makes Task 5's M2 an `error[E0004]` instead of a silent no-op.
-  - [ ] Arms in D13's order with the `Disqualifying = true` arms **first** (binding the other three
+  - [x] Arms in D13's order with the `Disqualifying = true` arms **first** (binding the other three
         with `_`), each citing its architecture line, and the arbitration arm labelled as such and
         citing no line.
-  - [ ] The rule choice: lexicographic min `RuleId` **among the verdicts that QUALIFIED FOR THAT ARM**
+  - [x] The rule choice: lexicographic min `RuleId` **among the verdicts that QUALIFIED FOR THAT ARM**
         — the `Disqualifying` ones for the refusal, the `Decisive` ones for the match. **Not the min
         over the whole vector** (AC5 carries the failing case). **No new derive.**
-  - [ ] ⚠️ **No `_` catch-all arm that swallows an unhandled class.** Every one of the sixteen presence
+  - [x] ⚠️ **No `_` catch-all arm that swallows an unhandled class.** Every one of the sixteen presence
         tuples is written out or covered by an arm a reader can check against the table. A wildcard
         would restore exactly the hole this story exists to close.
 
-- [ ] **Task 3 — The tests** (AC5, AC4) — inline in `cascade.rs`'s trailing `#[cfg(test)] mod tests`
+- [x] **Task 3 — The tests** (AC5, AC4) — inline in `cascade.rs`'s trailing `#[cfg(test)] mod tests`
       (D56b, one per file), placed by the convention that module already states.
-  - [ ] **The 32-subset totality walk.** Bitmask `0..32` over `Verdict::all()`; one `RuleVerdict` per
+  - [x] **The 32-subset totality walk.** Bitmask `0..32` over `Verdict::all()`; one `RuleVerdict` per
         present verdict with a distinct `RuleId`; assert the conclusion against an **independently
         written** expectation function. Assertion message names the subset.
-  - [ ] **The second oracle is written from D13's table, not from `decide`.** Deliberate redundancy —
+  - [x] **The second oracle is written from D13's table, not from `decide`.** Deliberate redundancy —
         label it as such in a comment so a later DRY pass does not collapse it (CLAUDE.md protects
         exactly this).
-  - [ ] **The uncovered class, named as its own test** — `≥1 Opposes` alone → `Abstained {
+  - [x] **The uncovered class, named as its own test** — `≥1 Opposes` alone → `Abstained {
         AbsenceOfProof }`. It is inside the 32-walk already; it gets its own named test anyway,
         because it is the one answer no architecture line backs and a reader must find it by name.
-  - [ ] **Order independence**: three verdicts **all carrying the SAME rule-naming verdict** (three
+  - [x] **Order independence**: three verdicts **all carrying the SAME rule-naming verdict** (three
         `Disqualifying`, or three `Decisive` with no `Opposes`), with `RuleId`s supplied in an order
         that differs from their lexicographic order (e.g. `"c", "a", "b"`), **all six permutations**,
         same `conclusion` — asserted as `Conclusion::NoMatch { rule: rule("a") }`, the rule spelled
         out. ⚠️ Assert on `.conclusion`, **not** on the whole `Decision`. ⚠️ **A mixed vector whose
         conclusion is an `Abstained` makes this test VACUOUS** — an abstention names no rule, so no
         tiebreak can change it. Both traps are in AC4.
-  - [ ] **A named rule must have qualified**: `a_disqualifying_names_the_disqualifying_rule_not_the_smallest_one`
+  - [x] **A named rule must have qualified**: `a_disqualifying_names_the_disqualifying_rule_not_the_smallest_one`
         on `[("a", Decisive), ("z", Disqualifying)]` → `NoMatch { rule: rule("z") }` (AC5).
-  - [ ] **Coherence**: for every subset whose conclusion names a rule, that `RuleId` is present in the
+  - [x] **Coherence**: for every subset whose conclusion names a rule, that `RuleId` is present in the
         returned `verdict_vector`. And `decide(Vec::new(), _)` → `Abstained { AbsenceOfProof }`,
         never `Match`.
-  - [ ] **Totality under a duplicated `RuleId`**: use `("a", Decisive)` + `("a", Opposes)` — the
+  - [x] **Totality under a duplicated `RuleId`**: use `("a", Decisive)` + `("a", Opposes)` — the
         register's own example, and the pair that shows ONE rule fabricating D13's conflict row, so
         the expected conclusion is `Abstained { Ambiguous }`. *(`("a", Neutral)` + `("a", Supports)`
         is deterministic too and shows nothing — name the pair, do not leave it to taste.)* The test's
         doc says this pins TOTALITY, not refusal.
-  - [ ] ⚠️ **Minting an `ObsId` in a test: `ObsId::from_uuid(Uuid::from_u128(n))` with distinct `n`**
+  - [x] ⚠️ **Minting an `ObsId` in a test: `ObsId::from_uuid(Uuid::from_u128(n))` with distinct `n`**
         — the crate's idiom (`trap.rs:416-418`), **already present in the very test module you are
         writing in, as `fn obs(n: u128) -> ObsId` at `cascade.rs:463-465` with `use uuid::Uuid;` at
         `:461`. REUSE it; re-adding it is the accidental duplication DRY forbids**. **`Uuid::new_v4()` does NOT compile**:
@@ -554,132 +554,392 @@ re-open it.**
         Evidence may be empty here — a `Neutral` legitimately has none — so prefer empty over
         inventing observations the algebra never reads.
 
-- [ ] **Task 4 — The float gate** (AC6) — `xtask/src/main.rs`
-  - [ ] `fn gate_float_free(root: &Path) -> Result<(bool, String)>` in the idiom of its two
+- [x] **Task 4 — The float gate** (AC6) — `xtask/src/main.rs`
+  - [x] `fn gate_float_free(root: &Path) -> Result<(bool, String)>` in the idiom of its two
         neighbours, **walking `crates/opencmdb-core/src/identity/` RECURSIVELY** (`walkdir`, as
         `gate_ddl_collation` does — already an `xtask` dependency), **stripping from the first `//`
         to end of line before matching**, and matching **both** a word-bounded `f32`/`f64` **and a
         float LITERAL** (`[0-9]+\.[0-9]`, or an `f32`/`f64` suffix on a numeric literal). AC6 carries
         the measured table showing why the word-boundary match alone misses `0.85f64` and
         `let confidence = 0.85;`.
-  - [ ] **Fail CLOSED if the directory is absent** — the fixture gate's precedent, not the DDL gate's.
+  - [x] **Fail CLOSED if the directory is absent** — the fixture gate's precedent, not the DDL gate's.
         AC6 says why.
-  - [ ] Register it in **`run_ci()`** as `g5` and print it through `report`. ⚠️ **The module doc's gate
+  - [x] Register it in **`run_ci()`** as `g5` and print it through `report`. ⚠️ **The module doc's gate
         list at `:1-21` is ALREADY missing `file-size`** — it names frontier, ddl-collation,
         vocabulary, fixtures and views-hash only. **Add BOTH bullets**, so the enumeration matches the
         six gates `run_ci()` prints. *"A doc that enumerates is a claim"*, and this one is already
         false before you touch it.
-  - [ ] Inline `#[cfg(test)]` tests at both levels (AC6): the line helper, **and `gate_float_free`
+  - [x] Inline `#[cfg(test)]` tests at both levels (AC6): the line helper, **and `gate_float_free`
         itself against a `scratch(tag)` temp tree** — float in code, float in a comment, a nested
         subdirectory, and the directory absent.
-  - [ ] Verify no `#[doc = "…"]` attribute and no `/* */` block comment under `identity/` carries a
+  - [x] Verify no `#[doc = "…"]` attribute and no `/* */` block comment under `identity/` carries a
         float token before claiming the gate is clean on the real tree (both measured absent at
         contexting — re-verify, do not assume).
         `grep -rn '#\[doc\|/\*' crates/opencmdb-core/src/identity/`.
 
-- [ ] **Task 5 — Prove to red** (AC5, AC6; house rule, story 1.3). Run each, **quote the observed
+- [x] **Task 5 — Prove to red** (AC5, AC6; house rule, story 1.3). Run each, **quote the observed
       failure**, restore, re-run green. These are predictions to check against, **not a licence to
       skip running**: if the observed set differs, the DIFFERENCE is the finding and it goes in the
       Completion Notes. **A mutation with several reds is expected and is not a defect** — a record
       naming one red where four fired is the under-reporting this project's reviews keep catching.
-  - [ ] **M1 — swap one arm's CAUSE**: make the `Supports AND Opposes` row return
+  - [x] **M1 — swap one arm's CAUSE**: make the `Supports AND Opposes` row return
         `Abstained { AbsenceOfProof }` instead of `Abstained { Ambiguous }`. A one-token edit that
         needs no rule and reds purely by ASSERTION. Predicted: **2 of 32** subsets. **Name how many
         fired**, not just that it failed — that count is the walk's coverage, measured.
         ⚠️ *(Do NOT mutate this arm to `Match`: `Conclusion::Match` requires a `rule` and that arm has
         no `Decisive` to name, so the "mutation" becomes a rewrite and measures nothing clean.)*
-  - [ ] **M2 — delete the arbitration arm** for the uncovered class. Predicted: **`error[E0004]`,
+  - [x] **M2 — delete the arbitration arm** for the uncovered class. Predicted: **`error[E0004]`,
         non-exhaustive `match`** — and that prediction holds **only because AC2 binds the arms to a
         `match` on the presence tuple**. ⚠️ **If you built an `if`/`else if` chain instead, this
         mutation is a silent no-op** (measured at validation: *"0 of 16 input classes changed
         answer"*) and the story's central claim ships unproven. **If M2 does not red, that is a
         finding about YOUR construct, not about the prediction** — go back to AC2.
-  - [ ] **M3 — replace the lexicographic tiebreak with "first in the vector"**. Predicted: the
+  - [x] **M3 — replace the lexicographic tiebreak with "first in the vector"**. Predicted: the
         permutation test reds and the 32-walk does NOT (single-qualifier subsets are unaffected).
         **This is the mutation that proves the permutation test earns its place**; if the 32-walk also
         reds, say so.
-  - [ ] **M4 — remove the comment-stripping from the gate.** Predicted: the gate reds on the committed
+  - [x] **M4 — remove the comment-stripping from the gate.** Predicted: the gate reds on the committed
         `cascade.rs:52` citation, and `cargo xtask ci` fails on a clean tree. Quote it.
-  - [ ] **M5 — a real float under `identity/`.** Predicted: the gate reds and names the file and line.
-  - [ ] ⚠️ **Say which reds are carried by the COMPILER and which by an ASSERTION.** Story 5.4's
+  - [x] **M5 — a real float under `identity/`.** Predicted: the gate reds and names the file and line.
+  - [x] ⚠️ **Say which reds are carried by the COMPILER and which by an ASSERTION.** Story 5.4's
         record claimed two of four were assertion-carried when only one was, and its review measured
         it. Classify honestly: a red that would fire on a test body of `assert_eq!(1, 1)` is
         compiler-carried.
-  - [ ] ⚠️ **Restore after every mutation and verify with `git status` before the next one.** Local
+  - [x] ⚠️ **Restore after every mutation and verify with `git status` before the next one.** Local
         flakiness (issue #38) and a forgotten revert look identical.
 
-- [ ] **Task 6 — Docs that this story falsifies** (AC2, AC9) — all doc-only; **re-read every rewritten
+- [x] **Task 6 — Docs that this story falsifies** (AC2, AC9) — all doc-only; **re-read every rewritten
       sentence against the FINAL tree after the last edit**.
-  - [ ] `identity/mod.rs:10-11` — *"nothing combines a verdict set into a conclusion: story 5.4b
+  - [x] `identity/mod.rs:10-11` — *"nothing combines a verdict set into a conclusion: story 5.4b
         writes that algebra"*. After this story it does. One sentence, naming what is still absent
         (no rule, no producer, no join — 5.5).
-  - [ ] `cascade.rs`'s module doc (`:1-13`) — it says *"It does not hold the algebra… That is story
+  - [x] `cascade.rs`'s module doc (`:1-13`) — it says *"It does not hold the algebra… That is story
         5.4b's"*. Same correction.
-  - [ ] `Verdict`'s doc (`:39-77`) — *"the six-row table… is implemented by story 5.4b, and no rule
+  - [x] `Verdict`'s doc (`:39-77`) — *"the six-row table… is implemented by story 5.4b, and no rule
         produces a `Verdict` until story 5.5"*. The first half is now false; the second is still true.
         ⚠️ The paragraph naming the uncovered class must now point at `decide` for the answer rather
         than saying 5.4b arbitrates it.
-  - [ ] `Conclusion::NoMatch`'s doc — it attributes the choice of side to 5.4b. It is made now.
-  - [ ] 🚨 **`IdentityAbstentionCause::AbsenceOfProof`'s doc (`cascade.rs:389-390`) becomes FALSE.** It
+  - [x] `Conclusion::NoMatch`'s doc — it attributes the choice of side to 5.4b. It is made now.
+  - [x] 🚨 **`IdentityAbstentionCause::AbsenceOfProof`'s doc (`cascade.rs:389-390`) becomes FALSE.** It
         reads *"Nothing in the verdict set argues either way — the row `only Neutral / nothing →
         NoMatch (absence of proof)`"*. AC3 routes the arbitration class onto that same variant, and an
         `Opposes` **does** argue — against. Rewrite it to name **BOTH** producing classes: D13's
         `only Neutral / nothing` row, and the arbitrated `Opposes`-alone class, where nothing argues
         **FOR** the merge. *(Found by the gap-hunt agent. Shipping the story without this ships a doc
         comment falsified by the function it documents.)*
-  - [ ] `Decision`'s doc (`cascade.rs:287-297`) — *"# What is representable and not refused… Nothing
+  - [x] `Decision`'s doc (`cascade.rs:287-297`) — *"# What is representable and not refused… Nothing
         refuses either… Registered, owner story 5.4b"* and *"Story 5.4b **adds** the `cargo xtask ci`
         gate"*. Both are now shipped, not future.
-  - [ ] `RuleVerdict`'s doc (`cascade.rs:160-166`) — *"the two validations… Both need story 5.4b or
+  - [x] `RuleVerdict`'s doc (`cascade.rs:160-166`) — *"the two validations… Both need story 5.4b or
         5.5 to have something that could red"*. One of the two now has a place that reds.
-  - [ ] `IdentityAbstentionCause`'s type doc (`cascade.rs:331-345`) — *"Six rows, four of them
+  - [x] `IdentityAbstentionCause`'s type doc (`cascade.rs:331-345`) — *"Six rows, four of them
         abstentions, two variants"*. There are seven classes now, not six.
-  - [ ] The test module's doc (`cascade.rs:438-456`) — it is an explicit INVENTORY of which tests live
+  - [x] The test module's doc (`cascade.rs:438-456`) — it is an explicit INVENTORY of which tests live
         there and why; Task 3 adds several.
-  - [ ] `xtask/src/main.rs`'s module doc — the gate list (**already missing `file-size`**, Task 4).
-  - [ ] 🚨 **The list above is the MINIMUM, not the set. Before counting, run
+  - [x] `xtask/src/main.rs`'s module doc — the gate list (**already missing `file-size`**, Task 4).
+  - [x] 🚨 **The list above is the MINIMUM, not the set. Before counting, run
         `grep -rn '5\.4b' crates/ xtask/` on the FINAL tree and rewrite every hit** — every stale
         sentence names 5.4b, so that grep is exact. **Then count the doc locations and state the
         number ONCE.** *"A count in a doc is a claim"* — story 5.4 shipped "five doc blocks" where six
         changed, and its own review caught it. **This story's first draft listed five where eleven
         were falsified**, which is the same defect one level up; the validation pass caught it.
 
-- [ ] **Task 7 — The register** (AC8) — append-and-strike, never rewrite a bullet. Cite by TITLE.
-  - [ ] **`grep -n '5\.4b' deferred-work.md` FIRST**, then annotate all **eight** entries across the
+- [x] **Task 7 — The register** (AC8) — append-and-strike, never rewrite a bullet. Cite by TITLE.
+  - [x] **`grep -n '5\.4b' deferred-work.md` FIRST**, then annotate all **eight** entries across the
         **four** sections per AC8, each saying which half moved and which did not — including the two
         `NoMatch` entries in the 4.6a and 4.7a sections, whose annotations still say nothing decides
         which side an input falls on.
-  - [ ] Check the empty-vector-literals prediction and record whether it held.
-  - [ ] Open `## Deferred from: story-5.4b` at the END with its items; **count them mechanically after
+  - [x] Check the empty-vector-literals prediction and record whether it held.
+  - [x] Open `## Deferred from: story-5.4b` at the END with its items; **count them mechanically after
         the last edit** and state the story/epic/condition split.
-  - [ ] **Open the GitHub issue for D13's milestone correction** (AC3) and reference its number in the
+  - [x] **Open the GitHub issue for D13's milestone correction** (AC3) and reference its number in the
         register entry and the PR.
 
-- [ ] **Task 8 — The full local gate, run WHOLE** (AC9; mirrors CI — Epic 3's retrospective recorded
+- [x] **Task 8 — The full local gate, run WHOLE** (AC9; mirrors CI — Epic 3's retrospective recorded
       four CI-only failures from skipping exactly this)
-  - [ ] `cargo fmt --all` · `cargo clippy --workspace --locked --all-targets -- -D warnings` ·
+  - [x] `cargo fmt --all` · `cargo clippy --workspace --locked --all-targets -- -D warnings` ·
         **`cargo clippy --workspace --locked -- -D warnings`** (the CI form) ·
         `cargo test --workspace --locked` · `cargo xtask ci`. **`--locked` everywhere.**
-  - [ ] Report the test count as three numbers (bin + core + xtask). **Baseline on `3d63544`:
+  - [x] Report the test count as three numbers (bin + core + xtask). **Baseline on `3d63544`:
         135 + 94 + 42 = 271, zero failures.** `core` and `xtask` should both move.
-  - [ ] `cargo xtask ci` must now print **six** gates plus the informational `views-hash`.
-  - [ ] `git status` under `fixtures/` **empty**; `MANIFEST.toml` untouched.
-  - [ ] Re-measure `cascade.rs` and `xtask/src/main.rs` code lines on the final tree (baselines:
+  - [x] `cargo xtask ci` must now print **six** gates plus the informational `views-hash`.
+  - [x] `git status` under `fixtures/` **empty**; `MANIFEST.toml` untouched.
+  - [x] Re-measure `cascade.rs` and `xtask/src/main.rs` code lines on the final tree (baselines:
         **456** and **884**, ceiling 2000).
 
-- [ ] **Task 9 — Docs current before push** (AC9; project rule)
-  - [ ] `sprint-status.yaml` — the `5-4b-…` entry and its narrative block.
-  - [ ] `docs/project-context.md` — the Epic 5 line and the test count.
-  - [ ] `CLAUDE.md` — the Epic 5 sentence. **Not conditional**: this story changes what "the engine
+- [x] **Task 9 — Docs current before push** (AC9; project rule)
+  - [x] `sprint-status.yaml` — the `5-4b-…` entry and its narrative block.
+  - [x] `docs/project-context.md` — the Epic 5 line and the test count.
+  - [x] `CLAUDE.md` — the Epic 5 sentence. **Not conditional**: this story changes what "the engine
         proper" has shipped, so the sentence naming 5.4 as the last engine story goes stale on merge.
-  - [ ] `epics.md` — **verify only, do not edit.** Story 5.4b is present at `:1445`, `:22` and `:1313`
+  - [x] `epics.md` — **verify only, do not edit.** Story 5.4b is present at `:1445`, `:22` and `:1313`
         read sixteen, `:1317`'s build order names 5.4b as its own step. **An edit here is a finding.**
-  - [ ] No manual, README or gh-pages change is expected: this story ships nothing a user can see.
+  - [x] No manual, README or gh-pages change is expected: this story ships nothing a user can see.
 
-- [ ] **Task 10 — Branch → PR → green CI** (AC9). ⚠️ **Only after PR #52 is merged** (see the
+- [x] **Task 10 — Branch → PR → green CI** (AC9). ⚠️ **Only after PR #52 is merged** (see the
       prerequisite at the top). Branch `story-5.4b-verdict-algebra-and-float-gate`. **The story ends
       at status `review` with the PR open and CI green.** The merge is a separate act.
 
+### Review Findings (AI, 2026-07-30)
+
+Three parallel layers on `master...HEAD` (9 files, +1150/−104; ~780 lines of code in `cascade.rs`
+and `xtask/src/main.rs`): **Blind Hunter** (code diff only, no project access), **Edge Case Hunter**
+(diff + repo; it extracted `line_has_float`/`has_float_literal`/`contains_word` into a standalone
+binary and **executed** the cases, so its float-matcher verdicts are measured), **Acceptance
+Auditor** (diff + this story + `project-context.md` + `CLAUDE.md`; it ran `cargo test --workspace`,
+both clippy forms, `cargo xtask ci` and `gh`).
+
+**1 decision-needed (resolved) · 22 actionable patch · 5 defer · 3 dismissed.** The patch section
+carries 25 bullets, three of which are struck as `— absorbed` by the tokeniser item that came out of
+the resolved decision; 25 − 3 = 22 is the number to act on. _(This line first said 23, a figure
+carried over from before the decision was resolved and not recounted — corrected by counting the
+bullets in this file, which is the same defect five of the findings below report.)_
+
+Every count in the findings was re-measured by the orchestrating reviewer before being written here;
+three layer claims were **refuted** in that pass and are recorded at the end rather than dropped
+silently.
+
+#### Decision needed — RESOLVED 2026-07-30 (Guy)
+
+**Resolution: rewrite the matcher as a numeric-literal tokeniser** (option (c), expanded). A
+delimited numeric literal, exactly one dot, not preceded by `.` or an identifier character; plus the
+exponent and trailing-dot forms; plus the `f32`/`f64` suffix recognised **on the literal** rather
+than as a bare substring. This closes three measured false positives *and* two measured false
+negatives in one pass, and it absorbs three of the patch items below (marked `— absorbed`). No
+escape-hatch comment and no `#[cfg(test)]` skip is added: the divergence with `file-size` stays, and
+is now stated in the gate's doc rather than left implicit.
+
+- [x] [Review][Decision] **The gate's false positives have no escape hatch, and story 5.5 is the
+      first story likely to trip them** — Measured by execution: `fn a_f64_never_decides() {}` reds
+      (labelled `"f32/f64 literal suffix"`, a wrong diagnosis), `let a = t.0.1;` reds (nested tuple
+      field access, valid Rust, and the gate's doc at `xtask/src/main.rs:356` explicitly claims
+      `x.0` is excluded), and a dotted-quad in a string literal reds — the last one IS documented as
+      a known false positive on the grounds that "none exists under the guarded subtree today".
+      5.5 writes the first L1 MAC/IP rule and its tests **under `identity/`**, where an IP literal
+      or a test named after the rule is near-certain. There is no `#[allow]`, no `// gate: ok`, no
+      allowlist, and no `#[cfg(test)]` skip — while the sibling `file-size` gate deliberately stops
+      at the first `#[cfg(test)]` (`code_line_count`, `xtask/src/main.rs:80-88`), a divergence stated
+      in neither gate's doc. The remedy is a genuine choice: (a) skip `#[cfg(test)]` like `file-size`,
+      (b) an explicit allowlist/escape comment, (c) narrow the matcher (require a non-digit before
+      the first digit, so `192.168.0.1` and `t.0.1` stop matching), (d) accept the friction and let
+      5.5 work around it. Guy's call — the wrong choice here is the one that gets the gate weakened
+      or deleted in its second week.
+
+#### Patch
+
+- [ ] [Review][Patch] **Rewrite `line_has_float`/`has_float_literal` as a numeric-literal
+      tokeniser** (from the resolved decision above). Required behaviour, all five cases measured on
+      the current tree: `"192.168.0.1"` → green (three dots), `t.0.1` → green (preceded by `.`),
+      `fn a_f64_never_decides()` → green (not a literal), `1e-3` / `2E10` / `1.` → RED, `0.85` /
+      `0.85f64` / `1f32` → RED. Recognise `f32`/`f64` as a word (type position) or as a suffix **on a
+      literal**, and drop the bare `code.contains(token)` fallback that currently makes the
+      word-boundary branch decorative. Add `f16`/`f128` to the token list while the matcher is open.
+      Then rewrite the doc's "Known limits" list to match what the new matcher does — it currently
+      states four limits, all about comments and strings, and its "three shapes" paragraph describes
+      a gate this file does not implement [xtask/src/main.rs:335-370, doc at :312-326]
+- [ ] [Review][Patch] ~~Two legal Rust float spellings are invisible to the gate~~ — **absorbed** by
+      the tokeniser item above. Kept for the record because the measurement is the reason the
+      tokeniser was chosen: `1e-3`, `2E10` and
+      `1.` all measured as `None`; exponent form carries no `.` and trailing-dot has no digit after
+      it, and both are `f64` by inference, i.e. exactly the "weight through the back door" shape AC6
+      names as the gate's whole purpose. The doc's "Known limits" list is also incomplete: it states
+      four limits, all about comments and strings, and neither literal form appears
+      [xtask/src/main.rs:357-365, limits list at :319-326]
+- [ ] [Review][Patch] A shipped doc comment asserts **47** offenders; the tree it describes gives **45**
+      — re-measured twice independently (a Python replication of the three matcher fns with stripping
+      removed, and a raw grep): 44 in `cascade.rs` + 1 in `mod.rs` = 45, and 0 with stripping active.
+      It was 47 at the WIP commit `1ced9e2` and was never re-measured after Task 6's doc pass
+      shortened two prose lines — the story's own inherited lesson #1, committed by the story that
+      quotes it. Stale in five places [xtask/src/main.rs:329; deferred-work.md:1311;
+      sprint-status.yaml:730; this file :959 and :1039]
+- [ ] [Review][Patch] `docs/project-context.md` was not brought current, yet Task 9's checkbox says
+      it was — only the Epic 5 table row changed (`1 1` in `--numstat`). Left standing: the
+      **271**-test count and the per-story inventory that never mentions 5.4b's nine tests
+      [docs/project-context.md:62-64], and a sentence this branch falsifies — "no algebra, no rule
+      and no producer, the combining function being story 5.4b's" [docs/project-context.md:72].
+      Correct to 280 (135 + 100 + 45) and rewrite `:72` [this file :672]
+- [ ] [Review][Patch] A shipped test doc claims the citation is "the workspace's only `f64` token"
+      — there are **22** workspace-wide (3 under `identity/`), and this story measured the
+      contradiction itself at :929-931 and left the doc standing. Second half: because this story
+      added `f32`/`f64` at `cascade.rs:290-291`, the test's premise guard
+      `assert!(source.contains("f64"), "the citation this gate must tolerate has moved or gone…")`
+      now stays **green** when the D13 citation is deleted — the guard no longer detects what its
+      message claims. Re-pin it to the citation text, not the substring
+      [xtask/src/main.rs:1731 and :1743-1747]
+- [ ] [Review][Patch] The register carries **TEN** 5.4b annotations, not eight — `grep -c 'by story
+      5.4b, 2026-07-29'` → 10, at lines 253, 272, 365, 377, 1186, 1252, 1287, 1308, 1328, 1354. The
+      same sentence that says "Eight" then enumerates ten (5 named + "the four `NoMatch` annotation
+      lines" + the empty-vector entry). The 4.6a/4.7a sections carry **two** 5.4b-owned bullets each,
+      not one. Stated as eight in three places [this file :982 and :1039; sprint-status.yaml:719]
+- [ ] [Review][Patch] The File List claims the re-export cost "is recorded on the existing
+      re-export entry"; that entry is untouched by this diff and still reads "grew by **five** names
+      with no consumer", enumerating five — while `lib.rs` now re-exports a sixth un-consumed name,
+      `decide`. The story's own binding Dev Note (:791-795) said to add the cost to the existing
+      entry. Either annotate it or weaken the File List to say the cost is NOT recorded
+      [deferred-work.md:1266-1271; this file :1012-1014]
+- [ ] [Review][Patch] The `//`-truncation false negative is real and its stated justification is
+      false — measured: `let url = "http://x"; let confidence = 0.85;`, `let s = "a // b"; let c =
+      0.85;` and `/* see http://x */ let c = 0.85;` all return `None`. The doc calls this "harmless:
+      a float inside a string is not a float", but the missed float is **not** inside the string, it
+      is real code after it. Under this project's rule that a checkable comment gets checked, the
+      false reassurance is the defect: a reader who consults the limits list concludes this case
+      cannot hurt [xtask/src/main.rs:336-339, doc at :322-323]
+- [ ] [Review][Patch] The last row of `decide`'s own doc table names `NoMatch` where `decide`
+      returns `Abstained { AbsenceOfProof }` — the column is headed `conclusion` and the doc
+      explicitly invites re-derivation ("so a reader can re-derive the gap rather than trust it"),
+      so the row reads as the returned variant. It is a faithful quote of D13's row `:974` sitting in
+      a column that means something else, and it contradicts the `NoMatch` variant's own doc 115
+      lines above, which gets it exactly right ("has **no rule to name**, so it cannot be
+      represented by this variant and becomes `Abstained`"). Split the column, or mark the row as
+      D13's letter vs the engine's answer [cascade.rs:363 vs :453-455; correct text at :248-255]
+- [ ] [Review][Patch] AC1's prescribed construct was not used, and it left two dead arms that answer
+      "absence of proof" — AC1 required the presence test and the selection to be **one** act (`if
+      let Some(rule) = …`), so that "no arm ever holds an `Option` it must prove `Some`". The
+      presence test stayed in the tuple and the selection is a second act bridged by a fabricated
+      `None` arm. Consequence: if `has(w)` and `smallest_rule_with` ever diverge, a `Disqualifying`
+      refusal degrades into an honest-looking `Abstained` — the one answer D13/D18 care most about
+      not fabricating — with nothing observable. No test can red on these arms, and the oracle takes
+      the **opposite** decision on the same branch (`unreachable!()`), so implementation and oracle
+      differ on a path neither exercises. The auditor supplied a compatible construct: match on
+      `(smallest_rule_with(…Disqualifying), smallest_rule_with(…Decisive), has(Supports),
+      has(Opposes))`, which is still exhaustiveness-checked, so M2 still yields `error[E0004]` and no
+      arm holds an undischarged `Option` [cascade.rs:410-419 and :421-427; oracle at :892, :898]
+- [ ] [Review][Patch] A sixth `Verdict` variant would silently halve the totality test's coverage —
+      `decide`'s presence tuple stays 4-wide, so **no `error[E0004]` fires in `decide`** on variant
+      addition (only on arm deletion), and the new verdict is treated exactly like `Neutral`.
+      `subset()` is driven by a hard-coded `0..32`, so bit 5 is never set, `NAMES[5]` is never
+      reached and nothing panics or reds; the test keeps the name
+      `decide_is_total_over_every_one_of_d13s_input_classes` while checking 32 of 64 classes. Derive
+      the bound from `Verdict::all().len()` and generate the names
+      [cascade.rs:402-407, :925-937, :958]
+- [ ] [Review][Patch] The gate greens on a guarded directory that exists but holds no `.rs` file —
+      `checked` is computed and printed but never asserted `> 0`, so relocating `cascade.rs` to a new
+      module while leaving `identity/` in place yields `no float in code across 0 file(s)` and a
+      pass. `dir.exists()` is the only liveness check (and is true for a *file* named `identity`).
+      AC6 demanded fail-closed only for the missing directory, so this is a residue rather than a
+      violation — but the gate's doc claims the stronger property [xtask/src/main.rs:412-416,
+      `checked` at :403, fail-closed block at :382-389]
+- [ ] [Review][Patch] "TWELVE doc locations corrected" is not reproducible by any consistent method
+      — the stated method (`grep -rn '5\.4b' crates/ xtask/` on the final tree) yields 10 rewritten
+      mentions, or 9 doc blocks if two adjacent lines merge; counting doc *blocks* consistently gives
+      **10** (8 in `cascade.rs` — which the File List itself states — plus `mod.rs` plus `xtask`);
+      counting sentences gives 13+. Twelve is reachable only by excluding the `xtask` module doc,
+      which Task 6 lists as a doc location and the File List records changing [this file :973, :639,
+      :1010, :1015-1017]
+- [ ] [Review][Patch] "Three sentences naming 5.4b were left standing" — exactly **one** was: the
+      pre-existing `#[non_exhaustive]` note (two lines). The other three of the five surviving
+      mentions are sentences this story **wrote** [this file :978-980; cascade.rs:77-78, :618, :865;
+      xtask/src/main.rs:330]
+- [ ] [Review][Patch] The register cites `cascade.rs:52` for the D13 citation; it is at **:53** (the
+      module-doc rewrite added a line above it) — and AC8 forbade line citations in the register for
+      exactly this reason ("a line citation written here will rot the same way"). The Completion
+      Notes get `:53` right, so the two records now contradict each other
+      [deferred-work.md:1309 vs this file :931]
+- [ ] [Review][Patch] Task 5 required the observed failure quoted for each mutation; only M2 is
+      quoted verbatim, and **M5's count is arithmetically impossible** — `line_has_float` `return`s
+      on the first matching shape and the gate pushes at most one offender per line, so the
+      classifications "type" and "literal" are mutually exclusive per line and a single inserted
+      float line cannot produce "2 reds, the type AND the literal". The mutation text was not
+      recorded, so the number cannot be reproduced. Quote the output or weaken the claim
+      [this file :947-971; xtask/src/main.rs:335-352]
+- [ ] [Review][Patch] `subset()`'s doc justifies its scrambled `NAMES` by a property the test cannot
+      have — it claims the names are ordered so "lexicographic order does NOT follow `Verdict::all()`'s
+      order — otherwise 'smallest rule' and 'first in the vector' would be indistinguishable here",
+      but because `subset` emits at most one `RuleVerdict` per verdict kind, no rule-naming arm ever
+      has two candidates, so `min()` and "first in the vector" are indistinguishable **whatever
+      `NAMES` contains**. The file admits this 30 lines later ("What it does NOT cover: the
+      tiebreak"). Replacing `NAMES` with `["a".."e"]` changes nothing observable
+      [cascade.rs:925-937 vs :400-402]
+- [ ] [Review][Patch] The tiebreak's "no semantic content" claim is false in the direction that
+      matters — `RuleId(pub String)` derives `Ord`, so `min()` is **byte** order. Given this
+      project's `l1-*`/`l2-*` naming, any decision where an L1 and an L2 rule both disqualify always
+      names the L1 one, forever: a stable tier preference, not the absence of one. It is also
+      case-sensitive (`"L1-exact"` beats `"l1-a"`) and **flips tiers the moment rule numbering
+      reaches ten** (`"l10-x"` < `"l2-x"`). The doc's intra-tier example (`l1-distinct-mac` vs
+      `l1-exact-mac`) is the one case where the claim holds. Weaken the sentence
+      [cascade.rs:470-476, doc at :373-375]
+- [ ] [Review][Patch] `Decision`'s doc closes "merged, with no explanation" "by construction"
+      without saying **which** emptiness it closed — `decide` never inspects `evidence`, so a
+      single `RuleVerdict { verdict: Decisive, evidence: vec![] }` still yields a `Match` whose
+      explanation explains nothing. The empty-*vector* case is genuinely closed; the empty-*evidence*
+      case is not, and the story defers it elsewhere. Qualify the sentence
+      [cascade.rs:98-103 and :421-427]
+- [ ] [Review][Patch] ~~The word-boundary branch can never change the verdict, only the label~~ —
+      **absorbed** by the tokeniser item; kept because it is the measurement behind it.
+      `code.contains(token)` is a strict superset of `contains_word(code, token)`, so the real rule
+      is "any substring occurrence in the non-comment part". The doc describes "three shapes" as if
+      the first were load-bearing detection and says the last two "were measured as escapes of a
+      word-boundary-only match" — true of a hypothetical gate, not of this one. Any identifier
+      containing the substring reds and is mislabelled `"f32/f64 literal suffix"`, sending the reader
+      to the wrong fix [xtask/src/main.rs:340-348, doc at :312-317]
+- [ ] [Review][Patch] Offenders are emitted in walkdir traversal order, so the same tree can print
+      RED lines in different orders on two machines — the sibling `file-size` gate sorts before
+      formatting [xtask/src/main.rs:391, :407 vs gate_file_size at :129]
+- [ ] [Review][Patch] The determinism half of `decide`'s permutation test cannot fail — calling a
+      `fn` with no state twice and asserting equal outputs is guaranteed by the language, not by the
+      code under test; no mutation of `decide`'s body can red it. It inflates the apparent coverage
+      of the doc's "answers the same way every time" claim [cascade.rs:587-601 region]
+- [ ] [Review][Patch] ~~`f16`/`f128` are absent from the token list~~ — **absorbed** by the
+      tokeniser item. D13's
+      clause is "no float" and the gate enumerates two of the four float type names. Unreachable on
+      stable today, which is why this is a doc/limits item rather than a hole
+      [xtask/src/main.rs:340]
+- [ ] [Review][Patch] The new gate breaks the file's banner numbering — order is now `Gate 0`,
+      `Gate 5`, `Gate 1`, `Gate 2`, `Gate 3`, the new gate having been inserted above `Gate 1` rather
+      than after the two neighbours AC6 named. Cosmetic, no behaviour affected
+      [xtask/src/main.rs:298 vs :192, :429, :493, :623]
+- [ ] [Review][Patch] PR **#55** (open, `ci` SUCCESS) is recorded nowhere — not in the
+      `sprint-status.yaml` block, not in this story, not in `CLAUDE.md` — while every predecessor is
+      recorded as "PR #41 / #44 / #46 / #48 / #52" [sprint-status.yaml:764]
+
+#### Deferred
+
+- [x] [Review][Defer] Four `cargo xtask ci` gates swallow every `walkdir` error via
+      `filter_map(Result::ok)`, so an unreadable subdirectory silently shrinks the tree they claim to
+      have checked [xtask/src/main.rs:105, :395, :439, :557] — deferred, pre-existing. **The Edge
+      layer rated this HIGH against 5.4b on the grounds that the same file forbids it by name at
+      `corpus_entries` (:753-806, "a walk whose failure mode is 'quietly saw less of the tree' is not
+      a gate"). Re-measurement moved it**: three of the four sites predate this story
+      (`gate_file_size`, `gate_ddl_collation`, `gate_vocabulary`), and AC6 told 5.4b to follow "the
+      idiom of its two neighbours" — which it did, exactly. The weakness is repo-wide and fixing one
+      gate would be the least useful version of the fix.
+- [x] [Review][Defer] The gates do not follow symlinks and do not report them, so a symlinked
+      subdirectory (or a module pulled in by `#[path]`, or an `include!`) is outside every walk
+      [xtask/src/main.rs:393 and the three sibling gates] — deferred, pre-existing and repo-wide.
+      Asymmetric with `corpus_entries`, which refuses to skip a symlink in silence
+      (`CorpusEntry::Symlink`).
+- [x] [Review][Defer] Nothing refuses a blank or whitespace `RuleId` on the `RuleVerdict` side, so
+      `decide` can return `NoMatch { rule: RuleId("") }` on which `Decision::rule()` still answers
+      `Some` — "every decision names a rule" degenerates to naming nothing. `Trap::validate` refuses
+      a blank rule on the expectation side [trap.rs:302] — deferred, owner story 5.5, which is where
+      a `RuleVerdict` first gets produced by something other than a test.
+- [x] [Review][Defer] A named rule with EMPTY `evidence` yields a `Match` that explains nothing,
+      defeating D13's "the list IS the explanation" one level below the empty-vector case this story
+      closed [cascade.rs:421-427] — deferred, owner story 5.5; the invariant needs a firing rule to
+      state, as the story already records.
+- [x] [Review][Defer] The `xtask` module doc's list of gates is not itself gated and will drift again
+      — evidence: this story had to add the `file-size` entry, meaning the previous story shipped a
+      gate absent from that list [xtask/src/main.rs:646-648 region] — deferred, pre-existing.
+
+#### Dismissed, with the reason (three layer claims that did not survive re-measurement)
+
+1. **"The gate test leaks its scratch tree on failure and poisons the next run"** (Blind) —
+   **refuted.** `scratch()` calls `remove_dir_all` on entry *and* namespaces the path with
+   `std::process::id()`, with a doc comment saying exactly why ("a shared constant path races
+   between concurrent runs and leaves a stale corpus behind when an assertion fails")
+   [xtask/src/main.rs:1228-1235].
+2. **"A sixth `Verdict` variant makes `NAMES[i]` panic with an index-out-of-bounds"** (Blind) —
+   **refuted by the Edge layer**, and the real defect is worse than the claimed one: the hard-coded
+   `0..32` means bit 5 is never set, so nothing panics, nothing reds, and the test silently covers
+   half the space. Carried as a patch item above in its corrected form.
+3. **"Every 'Registered' claim is unverifiable" and "what the diff fails to make self-evident"**
+   (Blind) — dismissed as blindness artifacts. The two layers with repo access confirmed the
+   register entries exist, that GitHub issue #54 is open, `RuleId`'s `Ord` derive, `contains_word`,
+   `walkdir`'s presence and `Verdict::all()`'s arity. The one durable observation inside that
+   finding (the module-doc gate list drifting) is carried as a defer above.
+   **Blind also claimed the diff still says "`NoMatch` is therefore reached by two different rows"**
+   — the tree says something different and correct; only the doc *table* row is wrong.
+
 ## Dev Notes
 
 ### Why `decide` returns a `Decision` and not a bare `Conclusion`
@@ -893,15 +1153,178 @@ No new dependency, no version to research. `uuid` is already a dependency of `op
 
 ### Agent Model Used
 
+Claude Opus 5 (1M context) — `claude-opus-5[1m]`.
+
 ### Debug Log References
 
+⚠️ **One process defect, recorded because it destroyed the implementation once.** The first mutation
+pass ran against an **uncommitted** baseline and used `git checkout <file>` to restore M1 — which
+reverts to `HEAD`, not to the pre-mutation state, so `decide` and its six tests were wiped. The
+backup `cp` had also failed silently (its target directory did not exist and the exit code was never
+checked). The code was re-applied from scratch, then **committed (`1ced9e2`) before the pass was
+re-run**, after which every restore was verified by `md5sum` against the committed baseline
+(`3958dd4bd844f5582fae55b9454eea16`) and by `git status`.
+
+The story's own warning — *"restore after every mutation and verify with `git status` before the next
+one"* — named the symptom and not the mechanism. **A mutation pass needs a committed baseline to
+restore TO**; that is the sentence worth carrying forward.
+
 ### Completion Notes List
 
+**In the weaker true sentence:** `identity/cascade.rs` gains `decide(Vec<RuleVerdict>,
+RulesetVersion) -> Decision` — a total pure function implementing D13's six rows plus the one input
+class the table leaves uncovered — and its private helper `smallest_rule_with`. `xtask` gains a sixth
+gate, `float-free`. Six new core tests and three new xtask tests pin their claims. **Nothing produces
+a `Verdict`, so nothing calls `decide` outside its own tests**: no rule, no join, no blocker, no
+persistence, no corpus wiring. No byte moved under `fixtures/`.
+
+**Counts re-measured on the FINAL tree** (a count in a doc is a claim):
+
+- **271 → 280 tests: 135 bin + 100 core + 45 xtask**, zero failures. `core` +6, `xtask` +3.
+  _(After the 2026-07-30 code review: **281** — 135 bin + 100 core + **46** xtask. The review added
+  one xtask test and one core assertion, and removed one core assertion that could not fail.)_
+- `cascade.rs`: **1154 lines, first `#[cfg(test)]` at `:631` → 630 CODE lines**, ceiling 2000.
+- `xtask/src/main.rs`: **1748 lines, first `#[cfg(test)]` at `:1027` → 1026 CODE lines**; still the
+  workspace's largest, and `file-size` reports `largest: 1026`.
+- `cargo doc --workspace --no-deps` → **the same three pre-existing warnings** (`ing`,
+  `comparable_fields`, `ScoredRecord`); none of the new intra-doc links is broken.
+- ⚠️ **`f32`/`f64` workspace-wide is no longer 1 — it is 22**, because the gate's own implementation
+  and tests name the tokens they hunt. The number that matters is **under `identity/`: 3, all in
+  `///` doc comments** (D13's citation at `:53`, and two lines describing the gate at `:290-291`),
+  all stripped, **zero in code**. The story's Dev Notes predicted 1 there; the two extra are its own
+  doc.
+
+**The design decision, and what it buys.** `decide` returns a `Decision`, not a bare `Conclusion`, so
+the returned `verdict_vector` **is** the input and the named rule is selected **from** it. That makes
+*"a conclusion naming a rule absent from its own vector"* and *"a `Match` with an empty vector"*
+unreachable **through the function** rather than merely unenforced — `a_named_rule_is_always_present_in_the_vector_it_travels_with`
+walks all 32 subsets and asserts it. A struct literal built elsewhere is still unconstrained; that
+residue moved to story 5.9.
+
+**The arms are a `match` on the presence tuple, and it is load-bearing.** M2 gives
+`error[E0004]: non-exhaustive patterns: (false, false, false, true) not covered` — **the compiler
+names the missing class**. Validation had measured that an `if`-chain swallows the same deletion with
+all 16 classes keeping their answer, which is why the construct is binding rather than stylistic.
+
+**FIVE mutations run. Two predictions were corrected BY MEASUREMENT, and both are recorded rather
+than smoothed:**
+
+- **M1** (the conflict arm's cause) → **exactly 2 of 32** subsets, `01010` and `01110`. ⚠️ That count
+  is only observable because the 32-walk was made **cumulative**: a bare `assert_eq!` inside the loop
+  aborts on the first mismatch, so the first run reported one subset where two had moved. The loop
+  now collects every mismatch and reports them together — the difference between *"M1 reds"* and
+  *"M1 reds on exactly 2 of 32"*, which is the walk's coverage measured.
+- **M2** (delete the arbitration arm) → `error[E0004]`, naming `(false, false, false, true)`.
+- **M3** (`min()` → `next()`, i.e. "first in the vector") → **only** the permutation test reds; the
+  32-walk stays green. This confirms validation's finding that the walk gives the tiebreak **zero**
+  coverage and that the permutation test is its only guard.
+- **M4** (remove the comment-stripping) → **many offenders on the real tree, not 1.** The prediction
+  was *"reds on the committed citation"*. The others are **story references in prose** — `5.4b`,
+  `4.6a`, `4.7a` are literally digit-dot-digit — because the gate also matches **bare float
+  literals**, `let confidence = 0.85;` carrying no `f32`/`f64` token at all. All the xtask gate tests
+  red too, not just the one the story named. **The stripping and the literal rule are load-bearing
+  together.** _(This bullet said **47** and the gate's doc quoted it. Both were wrong on the
+  tree they described, which gave **45** — 44 in `cascade.rs` + 1 in `mod.rs`, re-measured two
+  independent ways by the 2026-07-30 review. That review then replaced the matcher with a tokeniser
+  and the same command returns **42**: three values for one sentence inside one story. 47 was true at the WIP commit `1ced9e2`, before the doc
+  pass shortened two prose lines, and was never re-measured — this story's own inherited lesson #1,
+  committed by the story that quotes it. No figure is written in code any more: a test asserts the
+  gap instead.)_
+- **M5** (a real float in code under `identity/`) → reds, naming file and line. _(This bullet claimed
+  **2** reds, "the type AND the literal". The 2026-07-30 review showed that is arithmetically
+  impossible: `line_has_float` `return`s on the first matching shape and the gate pushes at most one
+  offender per line, so the two labels are mutually exclusive per line. The mutation's text was never
+  recorded, so the count cannot be reproduced and is withdrawn rather than restated.)_
+
+⚠️ **ONE of the five reds is compiler-carried, four are not.** M2 is `error[E0004]` and would fire on
+a test body of `assert_eq!(1, 1)`. M1 and M3 red through assertions; M4 reds through the gate's three
+xtask tests. **M5 was observed through `cargo xtask ci`'s own output rather than a test run** — that
+is the gate reporting, not a test asserting, and saying so is the honest form.
+
+**TEN doc BLOCKS corrected** — eight in `cascade.rs`, one in `identity/mod.rs`, one in
+`xtask/src/main.rs` — found by `grep -rn '5\.4b' crates/ xtask/` on the final tree rather than from
+the story's list of five. Nine name 5.4b; **three do not and would have been missed by that list**:
+`IdentityAbstentionCause::AbsenceOfProof`'s doc (it read *"nothing in the verdict set argues either
+way"*, which the arbitrated class — carrying an `Opposes` — falsifies; the gap-hunt agent caught this
+before dev), `IdentityAbstentionCause`'s *"six rows… two variants"* (seven input classes now), and the
+test module's inventory. **ONE** pre-existing sentence naming 5.4b was left standing because it is
+still true: the `#[non_exhaustive]` note whose *"5.4b's table lives in this one"* is exactly right.
+
+_(This paragraph said **TWELVE** locations and **three** sentences left standing. The 2026-07-30
+review found neither reproducible: the stated method yields ten rewritten mentions, twelve is
+reachable only by excluding the `xtask` module doc that Task 6 itself lists, and four of the five
+surviving `5.4b` mentions are sentences this story WROTE rather than left. Counting doc blocks is the
+one method that gives the same answer twice, so that is the number stated now.)_
+
+**The register. TEN entries annotated across four sections** — validation corrected the story's
+*"six, all in one section"* to eight, and the 2026-07-30 code review corrected eight to **ten** by
+counting them: `grep -c 'by story 5.4b, 2026-07-29' deferred-work.md` → 10, at lines 253, 272, 365,
+377, 1186, 1252, 1287, 1308, 1328, 1354. The 4.6a and 4.7a sections carry **two** 5.4b-owned bullets
+each, not one. ⚠️ The enumeration that follows already listed ten (5 named + "the four `NoMatch`
+annotation lines" + the empty-vector entry) while its own preamble said eight — the count and the
+list disagreed inside one paragraph, which is the third time in this story that a number was wrong in
+the sentence that enumerates its own items. The coherence invariant ✅ **CLOSED by construction**, residue to 5.9;
+the D13 table gap ✅ **CLOSED in code**, with the `architecture.md` correction moved to **GitHub issue
+\#54** (a milestone act, never a story task); the duplicate-rule entry ↺ **PARTLY closed** (totality
+yes, refusal → 5.5); the `f64`-token entry ✅ CLOSED; the owner/spec-gap entry ✅ CLOSED; and the four
+`NoMatch` annotation lines in the 4.6a/4.7a sections ↺ **CLOSED IN PART** — their *"nothing decides
+which side an input falls on"* is what `decide` falsifies, and the `Outcome`-mapping half moves to
+5.7. The empty-vector-literals entry is closed **by its own prediction being refuted**: the four
+literals compiled untouched, and its count was wrong (four sites, not six).
+
+A new `## Deferred from: story-5.4b` section opens **nine** items — **six name a story, two name a
+condition, one names a milestone (issue #54)**; one of the six also names **Epic 6** as a second owner.
+⚠️ Counted after the last edit: a first draft of that preamble summed to nine only by counting the
+epic as its own item and forgetting the milestone. The arithmetic was wrong before it was measured,
+which is why the section states the split to that precision.
+
+**Scope held.** No rule, no join, no blocker, no producer (5.5/5.6) · no `From<Decision> for Outcome`,
+`VerdictVectorEntry` untouched and still uninhabited (5.7) · no serde, no persistence (5.9) · no
+`Display`, no `cause()`, no grouping (5.14) · `RuleId` not closed into an enum (Epic 6) · no
+milli-unit type, constant or field · `architecture.md` **not edited** · `epics.md` **verified and not
+edited** · `page.rs`, `locales/app.yml`, `fixtures.rs`, `trap_gate.rs`, `score.rs`, `trap.rs`,
+`gap/mod.rs` and everything under `fixtures/` untouched.
+
 ### File List
 
+**Modified — code:**
+
+- `crates/opencmdb-core/src/identity/cascade.rs` — `decide`, the private `smallest_rule_with`, six
+  new tests with their independent oracle, and eight doc blocks corrected.
+- `crates/opencmdb-core/src/identity/mod.rs` — module doc: the algebra now lives here. **Doc only.**
+- `crates/opencmdb-core/src/lib.rs` — `decide` joins the flat `identity::cascade` re-export, in the
+  idiom `gap` already uses for `reconcile` (a function, last in the braces). The cost is recorded on
+  the existing re-export entry rather than in a new one. _(It was NOT: the 2026-07-30 review found
+  that entry untouched, still saying "grew by **five** names" and enumerating five, while `lib.rs`
+  re-exported a sixth. The annotation the story's own binding Dev Note asked for is now appended to
+  `deferred-work.md:1266`.)_
+- `xtask/src/main.rs` — `IDENTITY_DIR`, `line_has_float`, `has_float_literal`, `gate_float_free`,
+  its registration in `run_ci()` as `g5`, three inline tests, and the module doc's gate list (which
+  was **already** missing `file-size` before this story — both bullets added).
+  _(After the 2026-07-30 review: `has_float_literal` is replaced by `float_literal_kind`, a
+  numeric-literal tokeniser; `strip_line_comment` and `FLOAT_TYPES` are new; a fourth test asserts
+  the stripping is load-bearing; the section was moved below Gate 3 so the file's banner order
+  follows `run_ci`, and `file-size` gained the banner it never had.)_
+
+**Modified — documents:**
+
+- `_bmad-output/implementation-artifacts/deferred-work.md` — eight entries annotated across four
+  sections, plus a new `## Deferred from: story-5.4b` section of nine items.
+- `_bmad-output/implementation-artifacts/sprint-status.yaml`
+- `docs/project-context.md`, `CLAUDE.md`
+
+**Untouched, verified:** `_bmad-output/planning-artifacts/epics.md` and `architecture.md`, everything
+under `fixtures/` (including `MANIFEST.toml`), `Cargo.lock`, all of `crates/opencmdb-bin/`,
+`crates/opencmdb-core/src/score.rs`, `trap.rs` and `gap/mod.rs`.
+
+**Created outside the tree:** GitHub issue **#54** — D13's table is short one input class; the
+correction to `architecture.md` is a milestone act (AC3).
+
 ## Change Log
 
 | Date | Change |
 |---|---|
 | 2026-07-29 | Story contexted against `3d63544` (story-5.4 branch, post-code-review), PR #52 still open — the deviation from "merge before contexting" is recorded at the top. Answers the three findings story 5.4's review handed forward: `decide`'s signature, the coherence invariant's owner, and the pre-existing `f64` token in the gate's own subtree. |
 | 2026-07-29 | Validated by two fresh-context agents (fact-check + gap-hunt); **9 HIGH + 12 MEDIUM/LOW applied**. Four findings changed the DESIGN, not the prose, and each was **measured rather than argued**: (1) the arms are now bound to a `match` on the presence tuple — the gap-hunt agent compiled all three permitted shapes and found that with an `if`-chain, deleting the arbitration arm *"compiles and changes 0 of 16 input classes"*, making M2 a silent no-op; (2) the permutation test now requires three verdicts of the SAME rule-naming kind, because an `Abstained` names no rule and the test was vacuous as written, giving AC4 zero coverage; (3) an implementation taking `min()` over the whole vector satisfied every specified test while naming the rule that argued FOR a refusal — a named test and a full-`Conclusion` oracle now close it; (4) the float gate was built and run, and missed `0.85f64` and `let confidence = 0.85;` — the likeliest shapes a weight takes. Bookkeeping: the register set is **eight entries across four sections**, not six in one; **eleven** doc blocks are falsified, not five; and `cascade.rs:42` was the pre-review coordinate for the `f64` citation — it is `:52`, an error inherited from the register without re-measuring, which is the story's own inherited lesson #1. |
+| 2026-07-29 | Implemented: `decide` + `smallest_rule_with`, the `float-free` gate, 6 core tests + 3 xtask tests, 12 doc locations, 5 mutations run, 8 register entries annotated + 9 new items, GitHub issue #54 opened. 271 → 280 tests. Two mutation predictions corrected by measurement (M4 → 47 offenders not 1; M1's count only observable once the 32-walk was made cumulative). One process defect recorded: a mutation restored with `git checkout` against an uncommitted baseline destroyed the implementation once. Status → `review`. |
+| 2026-07-30 | **PR #55 opened, CI green.** Code review held, three parallel layers (Blind Hunter · Edge Case Hunter · Acceptance Auditor): 1 decision resolved by Guy, **22 patches applied**, 5 deferrals registered, **3 layer claims refuted by re-measurement**. 280 → 281 tests (135 + 100 + 46). Seven of the eight HIGH findings were about CLAIMS, not behaviour: 47 offenders → **45** (and **42** once the matcher was replaced, three values for one sentence), eight register entries → **TEN**, twelve doc locations → **ten blocks**, three sentences left standing → **one**, M5's "2 reds" withdrawn as arithmetically impossible, `project-context.md`'s test count stale under a CHECKED task, and a premise guard measured INERT. On the code: `decide` matches on `Option<RuleId>` per AC1 so the two unreachable arms are gone; the gate's matcher is a numeric-literal tokeniser because `1e-3` and `1.` were green while `"192.168.0.1"`, `t.0.1` and `a_f64_never_decides()` were red; the stripper tracks strings; the gate fails closed on an empty guarded directory. Six mutations, **one prediction refuted**: halving the totality walk's bound left all 100 core tests green, so "every input class" was asserted by nothing — an assertion that each `Verdict` appears now reds on it. ⚠️ The `git checkout` process defect this story documented REPEATED itself and destroyed that assertion once. |
diff --git a/_bmad-output/implementation-artifacts/deferred-work.md b/_bmad-output/implementation-artifacts/deferred-work.md
index 2f02fc0..5b5cbc5 100644
--- a/_bmad-output/implementation-artifacts/deferred-work.md
+++ b/_bmad-output/implementation-artifacts/deferred-work.md
@@ -250,6 +250,13 @@ not, and one guarantee changed shape. Stated against the existing bullets withou
   (`identity/cascade.rs`) and its `Conclusion` carries both halves of `NoMatch` as distinct variants
   — a refusal that names a rule, and an abstention that cannot. **The mapping still has no
   producer.** Story 5.4b writes the function that chooses. Still not struck.
+  ↺ **CLOSED IN PART by story 5.4b, 2026-07-29 — the CHOOSING now exists.**
+  `identity::cascade::decide` implements D13's table and picks the side: a `Disqualifying` present
+  lands on `NoMatch { rule }` naming the smallest qualifying rule; its absence, with nothing arguing
+  FOR the pair, lands on `Abstained { AbsenceOfProof }`. All 32 verdict subsets are exercised against
+  an oracle written from D13 itself. ⚠️ **What is still open is the mapping onto `Outcome`** — nothing
+  converts a `Decision` into what the trap harness records, and no rule produces a `Verdict`. **Owner
+  of the remaining half: story 5.7** (the trap runner consuming a real engine). Not struck.
 - **The cascade's `NoMatch` maps two ways onto `Outcome`, and only half of that is recorded.**
   `architecture.md:967-974` makes `NoMatch` cover BOTH an active opposition (`any Disqualifying`) and
   a mere absence of proof (`only Neutral / nothing`). `Outcome::Refused` requires a rule to name, so
@@ -262,6 +269,10 @@ not, and one guarantee changed shape. Stated against the existing bullets withou
   and `Conclusion::Abstained { cause }` are now two distinct variants, so the two halves have
   somewhere to land. **The MAPPING still has no producer** — nothing decides which side an input
   falls on. Owner of that decision: **story 5.4b**. Not struck.
+  ↺ **CLOSED IN PART by story 5.4b, 2026-07-29:** `decide` decides. `any Disqualifying` →
+  `NoMatch { rule }`; `only Neutral / nothing` AND the class D13's table does not cover →
+  `Abstained { AbsenceOfProof }`. **The `Outcome` mapping remains unbuilt — owner story 5.7.** Not
+  struck.
 
 ## Deferred from: story-4.6b (2026-07-22)
 
@@ -351,6 +362,10 @@ not, and one guarantee changed shape. Stated against the existing bullets withou
   { cause: AbsenceOfProof }` for the half with no rule to name — and `Conclusion::NoMatch`'s own doc
   carries the argument. **Which side an input falls on is still decided by nothing**: story 5.4b
   writes the combining function. Still not struck.
+  ↺ **CLOSED IN PART by story 5.4b, 2026-07-29:** the combining function exists
+  (`identity::cascade::decide`) and chooses the half by the presence of a `Disqualifying`. **The
+  `NoMatch → Refused` vs `Abstained` mapping onto `Outcome` is still nobody's code — owner story
+  5.7.** Not struck.
 - **The `NoMatch → Refused` vs `Abstained` question is Epic 5's, not scored here.** `run_trap` scores
   answers; it does not decide what an engine that finds no merging rule should return. Whether "no
   rule matched" is a `Refused` (a decision, names an opposing rule) or an `Abstained` (no decision,
@@ -359,6 +374,9 @@ not, and one guarantee changed shape. Stated against the existing bullets withou
   ↺ **Story 5.4 built the FORK at the type level and nothing more:** the cascade can now say
   `NoMatch { rule }` or `Abstained { cause }` and the two are different types of answer. **Which one
   a given input gets is still undecided and unproduced** — owner **story 5.4b**. Not struck.
+  ↺ **CLOSED IN PART by story 5.4b, 2026-07-29:** which one a given input gets is now decided, by
+  `decide`, over every one of D13's input classes. **Producing one still needs a rule (story 5.5) and
+  mapping one onto `Outcome` still needs story 5.7.** Not struck.
 
 ## Deferred from: code review of story-4.7a (2026-07-23)
 
@@ -1165,6 +1183,14 @@ says *"Not struck"* two lines later, meaning the ENTRY is not struck. Both appea
   explanation"* — exactly what D13's *"the list of `(rule, verdict, evidence)` IS the explanation"*
   exists to prevent. Not fixed here because the conclusion and the vector are first built together by
   the combining function, which is the only place a test could red. **Owner: story 5.4b.**
+  ✅ **CLOSED by story 5.4b, 2026-07-29 — by CONSTRUCTION, and the mechanism is named.**
+  `decide(Vec<RuleVerdict>, RulesetVersion) -> Decision` selects the named rule FROM the vector it
+  then returns, so a conclusion naming a rule absent from its own vector is unreachable through it;
+  and `decide(vec![], _)` falls into the absence-of-proof arm, so a `Match` with an empty vector
+  cannot be produced at all. `a_named_rule_is_always_present_in_the_vector_it_travels_with` walks all
+  32 verdict subsets and asserts both. ⚠️ **A struct literal built elsewhere is still unconstrained**
+  — the fields are `pub` and there is no constructor. **That residue moves to story 5.9**, the first
+  story that reconstructs a `Decision` from anywhere other than `decide`.
   *(Raised by the gap-hunt validation agent, 2026-07-29; no AC, doc or register entry had covered it.)*
 - **None of the five new types derives `Serialize`/`Deserialize`.** Nothing persists a decision: the
   identity link table does not exist. Deriving a wire format for a domain type with no consumer is a
@@ -1223,6 +1249,14 @@ says *"Not struck"* two lines later, meaning the ENTRY is not struck. Both appea
   confirmed by both validation agents. **Owner: story 5.4b**, which writes the function that must be
   total; the correction to D13 itself belongs to a milestone edit of `architecture.md`, never to a
   story.
+  ✅ **CLOSED by story 5.4b, 2026-07-29 — implemented, and the compiler now guards the totality.**
+  `decide`'s arms are a `match` on the presence tuple `(disqualifying, decisive, supports, opposes)`,
+  so a missing class is `error[E0004]` rather than a silent fallthrough. **Measured**: deleting the
+  arbitration arm gives *"non-exhaustive patterns: `(false, false, false, true)` not covered"* — the
+  compiler NAMES the class. An `if`-chain was measured to swallow the same deletion with all 16
+  classes keeping their answer, which is why the construct is binding rather than stylistic.
+  ⚠️ **The correction to D13's own table is NOT closed and is not a story's to make.** It is now
+  **GitHub issue #54**, alongside #50 — the register is no longer its only record.
 - **`Verdict` derives no `PartialOrd`/`Ord`, and that is D20's business, not a story's.** D20:
   *"if strength returns, it returns as an ORDINAL, not a weight: `Opposes(Weak) | Opposes(Strong)`"*
   [architecture.md:1374-1376], under four conjoint conditions demonstrated **before any code**
@@ -1235,6 +1269,12 @@ says *"Not struck"* two lines later, meaning the ENTRY is not struck. Both appea
   `Verdict` are all re-exported at the crate root and nothing imports them from there. Following the
   crate's idiom was chosen over deviating for one module, and the cost is recorded rather than
   hidden. **Owner: whoever revisits the crate's re-export policy** (that entry's own wording).
+  ↺ **GREW to SIX names by story 5.4b, recorded 2026-07-30 by its code review, not by the story.**
+  `decide` joined the same flat block and nothing imports it from the crate root either
+  (`grep -rn "decide(" crates/ xtask/` finds no caller outside `cascade.rs`). 5.4b's File List
+  claimed *"the cost is recorded on the existing re-export entry"* while this bullet still said five
+  and enumerated five — the annotation the story's own binding Dev Note asked for was never written.
+  Owner unchanged.
 
 _The three items below were added by story 5.4's CODE REVIEW (2026-07-29), not by the story. They
 are in this section rather than in a review section of their own because they are properties of what
@@ -1250,6 +1290,13 @@ the story shipped._
   produce. Same shape and same reason as the sibling entry above (a conclusion naming a rule absent
   from its own vector): `pub` fields, no constructor, and the only place a test could red is where
   the vector and the conclusion are first built together. **Owner: story 5.4b.**
+  ↺ **PARTLY closed by story 5.4b, 2026-07-29 — TOTALITY yes, REFUSAL no.** `decide` answers for a
+  vector naming the same rule twice, deterministically, and a test pins it with the register's own
+  example: `("a", Decisive)` + `("a", Opposes)` → `Abstained { Ambiguous }`, one rule fabricating
+  D13's conflict row on its own. **Refusing it is not closed and cannot be here**: a refusal needs a
+  PRODUCER that emits one verdict per rule, and no rule exists. **Owner of that half moves to story
+  5.5.** Likewise an `Abstained { Ambiguous }` with an empty vector stays representable via a struct
+  literal (story 5.9's residue, above). Not struck.
   *(Found by the Edge Case Hunter at story 5.4's code review; no AC, doc or register entry covered
   it, whereas both neighbouring representable states were already owned.)*
 - **Story 5.4 introduced the workspace's FIRST `f32`/`f64` token, and it sits in the subtree story
@@ -1264,6 +1311,28 @@ the story shipped._
   gate strips `///`/`//!` lines is a design question for the story that writes it, deliberately not
   answered here. **Guy's call, 2026-07-29: record it, do not pre-write the AC.** This line is the
   gate's committed test case either way.
+  ✅ **CLOSED by story 5.4b, 2026-07-29.** The `float-free` gate strips from the first `//` to end of
+  line before matching, so the citation (now `cascade.rs:52`) is tolerated and is the gate's committed
+  negative test case, asserted by name. ⚠️ **The stripping turned out to do far more work than
+  tolerating one citation, and the number is worth keeping**: removing it makes the gate report **47**
+  offenders on the committed tree, because a story reference in prose — `5.4b`, `4.6a`, `4.7a` — is
+  literally a digit-dot-digit, and the gate also matches BARE float literals (`let confidence = 0.85;`
+  has no `f32`/`f64` token at all and is the likeliest shape a weight takes). The gate's own doc
+  carries its limits, including two false-POSITIVE directions: a float in a block comment, and a
+  decimal inside a string literal in code. Neither occurs under `identity/` today.
+  ↺ **THREE corrections by the 2026-07-30 code review, appended rather than rewritten above.**
+  (1) The line citation in the sentence above says `cascade.rs:52`; it is **`:53`**, and AC8's own
+  rule — *"cite entries by TITLE, not by line number… a line citation written here will rot the same
+  way"* — is what the sentence broke, one bullet after stating it. The story's Completion Notes say
+  `:53`, so the two records disagreed. (2) **The 47 is wrong: the tree it described gave 45**
+  (44 in `cascade.rs` + 1 in `mod.rs`, re-measured two independent ways) — 47 was true at the WIP
+  commit `1ced9e2` and was never re-measured after the doc pass shortened two prose lines. ⚠️ **And
+  45 did not survive this review either**: replacing the matcher with a tokeniser stopped story
+  references like `5.4b` from counting, so the same command now returns 42. Three values for one
+  sentence inside one story. No figure is quoted in code any more — a test asserts the gap instead,
+  because a count in a comment rots and an assertion does not. (3) The limits list was INCOMPLETE in the direction that matters:
+  `1e-3` and `1.` are both `f64` and were both GREEN. The matcher is now a numeric-literal tokeniser,
+  which also stopped reddening `"192.168.0.1"`, `t.0.1` and `a_f64_never_decides()`.
 - **Three documents name story 5.4b owner of the conclusion↔`verdict_vector` coherence invariant,
   and 5.4b's acceptance criteria do not mention it.** The owner is assigned in
   `identity/cascade.rs`'s `Decision` doc, in the sibling entry of this section, and in
@@ -1275,6 +1344,11 @@ the story shipped._
   minus its version?) and who supplies `ruleset_version`. **Owner: story 5.4b**, at its contexting.
   **Guy's call, 2026-07-29: hand it over, do not pre-write the AC** — writing 5.4b's criteria from
   inside 5.4 would be the same act 5.4 refused when it declined to write `decide()`.
+  ✅ **CLOSED by story 5.4b, 2026-07-29**, which is where the answers were written: `decide` takes
+  `(Vec<RuleVerdict>, RulesetVersion)` and returns a `Decision` (its AC1), the version arrives as a
+  parameter and is passed through unvalidated, and the coherence invariant is its AC5. The hand-off
+  worked as intended — the gap was answered at the contexting that owned it, and `epics.md` was not
+  edited by story 5.4.
   *(Found by the Blind Hunter, which had no access to `epics.md`'s history.)*
 
 ## Deferred from: code review of story-5.4 (2026-07-29)
@@ -1296,3 +1370,122 @@ is deferred, because it has nothing to fix today.**_
   and a test suite that has to be rewritten by the story that adds a guard is the kind of surprise
   this register exists to remove. Recorded so 5.4b budgets it rather than discovers it.
   **Owner: story 5.4b.** *(Raised by the Blind Hunter, which had no access to 5.4b's charter.)*
+  ✅ **CLOSED by story 5.4b, 2026-07-29 — and its own prediction was REFUTED by measurement, which is
+  why this says so instead of quietly striking it.** The entry predicted the literals *"must be
+  rewritten the day 5.4b enforces the invariant"*. They were not touched: `decide` constrains what IT
+  returns, and constrains nothing about a hand-built struct literal, so all four sites compiled
+  unchanged and their tests still pass. ⚠️ **The count was also wrong**: the entry says "six"; there
+  are **FOUR** literal sites carrying an empty `verdict_vector`, two of them inside loops, giving
+  seven constructions at runtime. Neither number is six. Corrected here rather than in place, since a
+  bullet is never rewritten.
+
+## Deferred from: story-5.4b (2026-07-29)
+
+_The story wrote the verdict algebra and one gate. It wrote no rule and no producer: nothing emits a
+`Verdict`, so nothing calls `decide` outside its own tests. Everything below is open because it needs
+a producer, a consumer, or a decision no code yet forces._
+
+**NINE items: SIX name a story, TWO name the CONDITION that would produce an owner, and ONE names a
+MILESTONE (GitHub issue #54).** One of the six additionally names **`Epic 6`** as a second owner
+alongside story 5.5 — the `l2-*` half of the tiebreak — so "an epic is named" is true while "an item
+is owned by an epic" is not; the two are different claims and only the first holds here.
+
+Counted bullet by bullet after the last edit. The split is spelled out to this precision because
+story 5.4 shipped *"thirteen name a story"* when one of the thirteen named an epic, in the very
+sentence forbidding that — and because a first draft of THIS preamble said "six name a story, one
+names an epic, two name the condition", which adds to nine only by counting the epic as its own item
+and forgetting the milestone entirely. The arithmetic was wrong before it was measured.
+
+- **`decide` carries no `#[must_use]`.** Discarding its result is always a bug, and the attribute
+  would say so — but the workspace carries **exactly one** `#[must_use]` in total
+  (`opencmdb-bin/src/main.rs`), so adding one here is the deviation, not the convention. Measured, not
+  assumed. **Owner: whoever revisits the workspace's `must_use` policy** — a condition, not a story:
+  the decision is about all of `crates/`, not about this function.
+- **`Abstained { Ambiguous }` does not record WHICH of D13's three rows produced it.** Three rows
+  collapse onto one variant — `a Decisive with >=1 Opposes` (the cloned-MAC case, `:971`), weak
+  evidence (`:972`) and `Supports AND Opposes` (conflict, `:973`) — and `decide` throws the
+  distinction away. Splitting it would invent a vocabulary D13 does not have. **Owner: story 5.14**,
+  the first story that groups abstentions for an operator and so the first with a consumer that could
+  justify the split.
+- **The lexicographic tiebreak is a placeholder, and it has no semantic content.** When several rules
+  are `Disqualifying` (or several `Decisive`), the one named is the smallest `RuleId`. That is
+  order-independent and invents nothing, which is why it was chosen — but `l1-distinct-mac` is not
+  "more disqualifying" than `l1-exact-mac`, and the day rules have a DESIGNED priority it replaces
+  this. **Owner: story 5.5** for the L1 rules, **Epic 6** for the `l2-*` half — this is the item that
+  names an epic.
+- **The float gate's limits are documented, not closed.** Two false-POSITIVE directions: a float
+  inside a block comment `/* … */`, and a decimal inside a string literal in code (`"0.1.1"`). One
+  false negative: a `//` inside a string literal truncates the line early. Measured: none of the three
+  occurs under `crates/opencmdb-core/src/identity/` today. **Owner: whoever meets one of them on a
+  real tree** — a condition, and deliberately so: inventing a Rust-aware scanner for a case that does
+  not exist would be the over-engineering the reflex-gate idiom (D53) refuses.
+- **The gate scopes to `identity/` and no wider.** `opencmdb-bin` may legitimately want a float for a
+  UI ranking one day — D13 permits *"floats may RANK, never DECIDE"* [architecture.md:988-990] — so
+  widening this gate to the workspace is a different decision with a different blast radius.
+  **Owner: story 5.14**, the first story with a ranking surface.
+- **No milli-unit type, constant or field exists.** D13's corollary — *"`confidence` is an INTEGER in
+  milli-units (0..1000), never `REAL`/`DOUBLE`"* [architecture.md:991-993] — binds the day a ranking
+  value appears. Epic 5's L1 is a deterministic lookup with nothing to rank, so a `0..1000` integer
+  here would be a value asserting that a ranking exists. **Owner: story 5.14**, the Resolve panel.
+- **An incoherent `Decision` is still buildable by struct literal.** `decide` makes "a conclusion
+  naming a rule absent from its own vector" and "a `Match` with an empty vector" unreachable *through
+  the function*; the fields are `pub` with no constructor, so a literal built anywhere else is
+  unconstrained. **Owner: story 5.9**, the first story that reconstructs a `Decision` from somewhere
+  other than `decide` (persistence).
+- **Refusing a `verdict_vector` that names the same rule twice needs a producer.** `decide` is TOTAL
+  over it — measured and tested — but total is not the same as validated: "one verdict per rule" is a
+  claim about what a PRODUCER emits, and no rule exists to emit anything. **Owner: story 5.5.**
+- **D13's own table in `architecture.md` is still short one row.** The arbitration is implemented and
+  documented at `decide`, but the decision body has not been corrected, and correcting a locked
+  planning document is a MILESTONE act, never a story task (`epics.md:1461`). **Owner: a milestone
+  edit, carried by GitHub issue #54** — which also records that `architecture-views.md` must be
+  regenerated in the same pass (issue #50). Not a condition and not a story: an issue.
+
+## Deferred from: code review of story-5.4b (2026-07-30)
+
+Five items, from a three-layer review (Blind Hunter · Edge Case Hunter · Acceptance Auditor). All
+five are **repo-wide or producer-blocked**, which is why they are deferrals and not patches: the
+review's 23 patch items are in the story file. Two of them arrived as HIGH findings against 5.4b and
+were **moved here by re-measurement** — recorded that way on purpose, because a deferral that hides
+why it was downgraded is worse than no deferral.
+
+- **Four `cargo xtask ci` gates swallow every `walkdir` error.** `filter_map(Result::ok)` at
+  `xtask/src/main.rs:105` (`gate_file_size`), `:395` (`gate_float_free`), `:439`
+  (`gate_ddl_collation`) and `:557` (`gate_vocabulary`): an unreadable subdirectory, a metadata
+  failure or a loop drops its files from the walk, the `checked` count shrinks with them, and the
+  gate reports a pass over a tree it did not fully see. ⚠️ **The Edge layer raised this as HIGH
+  against story 5.4b**, on the true observation that the same file refuses this failure mode by name
+  at `corpus_entries` (`:753-806`: *"a walk whose failure mode is 'quietly saw less of the tree' is
+  not a gate"*). Re-measurement moved it: **three of the four sites predate 5.4b**, and AC6 told the
+  story to write the gate "in the idiom of its two neighbours" — which it did exactly. So this is not
+  a defect the story introduced, and fixing only the newest gate would be the least useful version of
+  the fix. **Owner: a condition** — the next story that touches `xtask`'s gate plumbing, or a chore
+  PR; whoever takes it should convert all four together and mirror `corpus_entries`' `with_context`.
+- **The gates do not follow symlinks and do not report them.** No `.follow_links(…)` on any gate's
+  `WalkDir`, so a symlinked subdirectory under a guarded tree is yielded as one entry and never
+  descended; a module compiled in via `#[path = "…"]` or an `include!("…")` is likewise outside the
+  walk, and the extension filter is `.rs`-only. Asymmetric with `corpus_entries`, which refuses to
+  skip a symlink in silence (`CorpusEntry::Symlink`, `:744-747`). Same repo-wide shape as the entry
+  above and best taken in the same pass. **Owner: a condition** — the same pass that fixes the walk
+  errors.
+- **Nothing refuses a blank `RuleId` on the `RuleVerdict` side.** `RuleId(pub String)` derives `Ord`
+  (`trap.rs:39-41`), so `decide`'s tiebreak is byte order and `RuleId("")` sorts before everything:
+  a verdict vector carrying one yields `Conclusion::NoMatch { rule: RuleId("") }`, on which
+  `Decision::rule()` still answers `Some` — so "every decision names a rule" degenerates into naming
+  nothing, while `Trap::validate` already refuses a blank rule on the expectation side
+  (`trap.rs:302`). Not reachable today because nothing produces a `RuleVerdict` outside tests.
+  **Owner: story 5.5**, which is where the first producer appears and therefore the first place a
+  validation can be stated about what a producer emits.
+- **A named rule with EMPTY `evidence` yields a `Match` that explains nothing.** `decide` never
+  inspects `evidence`, so `RuleVerdict { verdict: Decisive, evidence: vec![] }` produces a `Match`
+  defeating D13's *"the list IS the explanation"* one level below the empty-**vector** case story
+  5.4b genuinely closed by construction. The story records the invariant as needing a firing rule to
+  state, and that is right — this entry only pins that the two emptinesses are different and that
+  `Decision`'s doc currently closes them in one sentence (the doc half is a patch item in the story).
+  **Owner: story 5.5.**
+- **The `xtask` module doc's list of gates is not itself gated, and has already drifted once.**
+  Evidence rather than prediction: story 5.4b had to ADD the `file-size` entry to that list, which
+  means the story that shipped `file-size` left it out and CI never noticed. Nothing checks that the
+  list of gates in the module doc matches the gates `run_ci` actually runs, so the sixth gate's entry
+  will rot the same way. **Owner: a condition** — the same `xtask` pass as the walk items; the cheap
+  version is a test asserting the doc names every gate `run_ci` calls.
diff --git a/_bmad-output/implementation-artifacts/sprint-status.yaml b/_bmad-output/implementation-artifacts/sprint-status.yaml
index eead290..835a582 100644
--- a/_bmad-output/implementation-artifacts/sprint-status.yaml
+++ b/_bmad-output/implementation-artifacts/sprint-status.yaml
@@ -50,8 +50,9 @@
 #   'optional' and will not be back-filled.
 
 generated: 2026-07-21
-last_updated: 2026-07-29  # 5.4 reviewed (22 patches) -> review, PR #52 open + CI green. 5.4b
-                          # contexted + validated -> ready-for-dev. NEXT = merge #52, THEN dev-story 5.4b
+last_updated: 2026-07-30  # 5.4b CODE-REVIEWED (3 layers): 22 patches applied, 5 deferrals, 3 layer
+                          # claims refuted. 281 tests (135+100+46). PR #55 open, CI green.
+                          # NEXT = merge #55, then bookkeeping, then story 5.5.
 project: opencmdb
 project_key: NOKEY
 tracking_system: file-system
@@ -703,7 +704,114 @@ development_status:
   # not five; and the story cited `cascade.rs:42` for the f64 token when it is `:52` — a number
   # inherited from the register without re-measuring, which is the story's own inherited lesson #1
   # committed by the story that quotes it. Caught before dev this time.
-  5-4b-verdict-algebra-and-float-gate: ready-for-dev
+  #
+  # 5.4b IMPLEMENTED 2026-07-29 → review (branch `story-5.4b-verdict-algebra-and-float-gate`).
+  # In the weaker true sentence: `identity/cascade.rs` gains `decide(Vec<RuleVerdict>,
+  # RulesetVersion) -> Decision`, a TOTAL pure function over D13's table, plus `smallest_rule_with`;
+  # `xtask` gains a SIXTH gate, `float-free`. SIX new core tests + THREE new xtask tests.
+  # NOTHING produces a `Verdict`, so nothing calls `decide` outside its own tests: no rule, no join,
+  # no blocker, no persistence, no corpus wiring.
+  # 271 → 280 tests (135 bin + 100 core + 45 xtask), zero failures. Both clippy forms green.
+  # `cargo xtask ci`: SIX gates green + `ℹ views-hash STALE` exit 0 (issue #50, NOT regenerated).
+  # THE DESIGN: `decide` returns a `Decision`, not a bare `Conclusion`, so the returned
+  # verdict_vector IS the input and the rule is selected FROM it — which makes "a conclusion naming
+  # a rule absent from its own vector" and "a Match with an empty vector" unreachable THROUGH THE
+  # FUNCTION rather than merely unenforced. A struct literal elsewhere is still free (owner 5.9).
+  # THE ARMS are a `match` on the presence tuple, not an `if`-chain, and that is load-bearing:
+  # M2 (delete the arbitration arm) gives `error[E0004]: non-exhaustive patterns:
+  # (false, false, false, true) not covered` — the compiler NAMES the missing class. Validation had
+  # measured that an `if`-chain swallows the same deletion with all 16 classes keeping their answer.
+  # FIVE mutations run, and TWO predictions were corrected BY MEASUREMENT:
+  #   · M1 (swap the conflict arm's cause) → exactly 2 of 32 subsets, as predicted — but only after
+  #     the 32-walk was made CUMULATIVE. With a bare assert_eq! inside the loop it aborts on the
+  #     first mismatch and the count is unobservable; the fix is what makes "2 of 32" a measurement;
+  #   · M2 → `error[E0004]`, naming the class. As predicted, because of the match construct;
+  #   · M3 (min() → next(), i.e. "first in the vector") → ONLY the permutation test reds; the 32-walk
+  #     stays green, confirming validation's finding that the walk gives the tiebreak zero coverage;
+  #   · M4 (remove the comment-stripping) → **47 offenders on the real tree, not 1**. The prediction
+  #     said "reds on the committed citation". The extra 46 are STORY REFERENCES in prose — `5.4b`,
+  #     `4.6a`, `4.7a` are literally digit-dot-digit, and the gate also matches BARE float literals
+  #     because `let confidence = 0.85;` carries no f32/f64 token at all. Recorded, not smoothed;
+  #   · M5 (a real float in code) → 2 reds naming file and line (the type AND the literal), not 1.
+  # ⚠️ ONE of the five reds is compiler-carried and four are not: M2 is `error[E0004]`, which would
+  # fire on a test body of `assert_eq!(1, 1)`. M1 and M3 red through the assertions of the 32-walk and
+  # the permutation test; M4 reds through the gate's three xtask tests. M5 was observed through
+  # `cargo xtask ci`'s own output rather than through a test run, and saying so is the honest form —
+  # it is the gate reporting, not a test asserting. (Story 5.4's record claimed two of four were
+  # assertion-carried when only one was, and its review measured it; this is the corrected shape.)
+  # ⚠️ A PROCESS DEFECT, recorded because it cost the implementation once: the first mutation pass
+  # ran against an UNCOMMITTED baseline and used `git checkout` to restore, which reverted to HEAD
+  # and destroyed `decide` and its tests. Re-applied, then COMMITTED (1ced9e2) before re-running the
+  # pass. A mutation pass needs a committed baseline to restore TO — the story's own warning
+  # ("restore after every mutation and verify with git status") named the symptom, not the mechanism.
+  # TWELVE doc locations corrected, found by `grep -rn '5\.4b' crates/ xtask/` on the final tree
+  # rather than from the story's list of five — nine of the twelve name 5.4b, three do not:
+  # `AbsenceOfProof`'s doc (it said "nothing argues either way", falsified by the arbitrated class,
+  # which carries an Opposes — validation caught this one), `IdentityAbstentionCause`'s "six rows"
+  # (seven classes now), and the test module's inventory.
+  # REGISTER: EIGHT entries annotated across FOUR sections (validation corrected "six in one"): the
+  # coherence invariant ✅ CLOSED by construction with the residue moved to 5.9; the D13 table gap
+  # ✅ CLOSED in code with the architecture.md correction moved to **GitHub issue #54**; the
+  # duplicate-rule entry ↺ PARTLY closed (totality yes, refusal → 5.5); the f64-token entry
+  # ✅ CLOSED; the owner/spec-gap entry ✅ CLOSED; and the four `NoMatch` annotation lines in the
+  # 4.6a/4.7a sections ↺ CLOSED IN PART, whose "nothing decides which side" sentences `decide`
+  # falsifies (the `Outcome` mapping half moves to 5.7). The empty-vector-literals entry is CLOSED by
+  # its own prediction being REFUTED: the four literals compiled untouched, and its count was wrong
+  # (four sites, not six).
+  # A new `## Deferred from: story-5.4b` section opens NINE items — six name a story, two name a
+  # condition, one names a MILESTONE (issue #54); one of the six also names Epic 6 as a second owner.
+  # Counted after the last edit: a first draft of that preamble added to nine only by counting the
+  # epic as its own item and forgetting the milestone.
+  # `epics.md` VERIFIED and NOT edited, as AC9 requires.
+  #
+  # CODE REVIEW held 2026-07-30, three parallel layers (Blind Hunter · Edge Case Hunter ·
+  # Acceptance Auditor). 1 decision resolved by Guy, 22 patches applied, 5 deferrals registered,
+  # 3 layer claims REFUTED. PR #55 open, CI green. 280 → 281 tests (135 bin + 100 core + 46 xtask).
+  # ⚠️ SEVEN of the eight HIGH findings were about CLAIMS, not behaviour, and the numbers this block
+  # carried were among them. Corrections, each re-measured before being written:
+  #   · "47 offenders when the stripping is removed" → **45 under the matcher that shipped** (44 in
+  #     cascade.rs + 1 in mod.rs, measured two independent ways). 47 was true at the WIP commit
+  #     `1ced9e2` and was never re-measured after the doc pass. ⚠️ And the figure moved AGAIN when the
+  #     review replaced the matcher with a tokeniser: story references like `5.4b` stopped counting,
+  #     so the same command now gives 42. THREE values for one sentence in one story — which is why
+  #     no figure is quoted in code any more and a test asserts the gap instead.
+  #   · "EIGHT register entries annotated" → **TEN** (`grep -c 'by story 5.4b, 2026-07-29'` = 10).
+  #     The sentence that said eight then enumerated ten; the 4.6a/4.7a sections carry two each.
+  #   · "TWELVE doc locations corrected" → not reproducible by any consistent method; counting doc
+  #     BLOCKS gives ten. The figure is replaced by the method and its result, not re-guessed.
+  #   · "three sentences naming 5.4b left standing" → exactly **ONE** pre-existing sentence was; the
+  #     other mentions are sentences the story wrote.
+  #   · "M5 → 2 reds, the type AND the literal" → arithmetically impossible: `line_has_float` returns
+  #     on the first match, so the gate pushes at most one offender per line. The mutation text was
+  #     never recorded, so the count cannot be reproduced and is withdrawn rather than restated.
+  #   · `docs/project-context.md` had Task 9 CHECKED while its test count and one falsified sentence
+  #     were untouched — the checkbox was the claim, and it was wrong.
+  #   · a test doc called the D13 citation "the workspace's only `f64` token" (it is not) and its
+  #     premise guard had gone INERT: deleting the citation left `source.contains("f64")` green,
+  #     measured by renaming it. Now pinned to the citation's TEXT.
+  # WHAT CHANGED IN THE CODE, and why each was more than cosmetic:
+  #   · `decide` matches on `(Option<RuleId>, Option<RuleId>, bool, bool)` as AC1 had prescribed and
+  #     the implementation had not followed. The two `None` arms are GONE rather than justified: they
+  #     had mapped an impossible state onto `Abstained { AbsenceOfProof }` — a legitimate answer for
+  #     two other classes — so a broken invariant would have turned a refusal into an honest-looking
+  #     abstention. Exhaustiveness survives: deleting the arbitration arm is still
+  #     `error[E0004]: non-exhaustive patterns: (None, None, false, true) not covered`.
+  #   · the float gate's matcher is a numeric-literal TOKENISER. Measured on the old form:
+  #     `1e-3` and `1.` were GREEN (both `f64`, and the exponent form is the shape a weight takes),
+  #     while `"192.168.0.1"`, `t.0.1` and `fn a_f64_never_decides()` were RED. Story 5.5 writes the
+  #     first MAC/IP rule under the guarded subtree, so the false positives were not theoretical.
+  #     Guy chose the tokeniser over a `#[cfg(test)]` skip or an escape comment.
+  #   · the comment stripper tracks string literals: `let sep = "//"; let c: f64 = 0.85;` was GREEN.
+  #   · the gate fails closed on a guarded directory holding no `.rs` file, and sorts its offenders.
+  # SIX mutations, and ONE PREDICTION REFUTED BY MEASUREMENT — recorded because it changed the work:
+  # halving the totality walk's derived bound left ALL 100 core tests GREEN, because the oracle agrees
+  # on every class the walk still visits. "Every input class" was asserted by NOTHING. An assertion
+  # that each `Verdict` variant appeared in some walked subset now reds on it, naming `Disqualifying`.
+  # ⚠️ A PROCESS DEFECT REPEATED: that assertion was written, proven, and then DESTROYED by a
+  # `git checkout` restoring to HEAD during the next mutation — the exact defect this story's own
+  # implementation notes record. Re-applied and committed before continuing. The lesson does not
+  # transfer by being written down.
+  5-4b-verdict-algebra-and-float-gate: review
   5-5-l1-join-pure: backlog
   5-6-blocker-and-recall-assertion: backlog
   5-7-trap-runner-stops-scoring-nothing: backlog
diff --git a/crates/opencmdb-core/src/identity/cascade.rs b/crates/opencmdb-core/src/identity/cascade.rs
index 1597e19..c0afde9 100644
--- a/crates/opencmdb-core/src/identity/cascade.rs
+++ b/crates/opencmdb-core/src/identity/cascade.rs
@@ -1,12 +1,13 @@
-//! The identity cascade — and, today, the vocabulary it speaks and the type it returns.
+//! The identity cascade — the vocabulary it speaks, the type it returns, and the algebra between.
 //!
 //! D13 fixes the cascade's shape: **all rules are evaluated** (never first-match-wins), each yields
 //! an enumerated verdict, and the verdicts combine by an **algebra, never a sum** — *"if the output
-//! is a float, B has won in disguise"* [architecture.md:956-965]. This file holds the vocabulary
-//! that algebra reads and writes — [`Verdict`], [`RuleVerdict`], [`Conclusion`], [`Decision`],
-//! [`RulesetVersion`] and [`IdentityAbstentionCause`]. **It does not hold the algebra: nothing here
-//! combines a verdict set into a conclusion. That is story 5.4b's**, and no rule produces a
-//! [`Verdict`] yet.
+//! is a float, B has won in disguise"* [architecture.md:956-965]. This file holds that vocabulary —
+//! [`Verdict`], [`RuleVerdict`], [`Conclusion`], [`Decision`], [`RulesetVersion`] and
+//! [`IdentityAbstentionCause`] — **and the algebra itself, [`decide`]**, which combines a verdict set
+//! into a conclusion over D13's six-row table plus the one input class that table leaves uncovered.
+//! **No rule produces a [`Verdict`] yet**, so nothing calls `decide` outside its own tests; story 5.5
+//! writes the join and the first firing rule.
 //!
 //! The vocabulary is chosen before the engine on purpose — the same order D19 imposed on the metrics
 //! harness in Epic 4, *"a metric written after the engine is bent to fit the engine"* — and because
@@ -46,19 +47,20 @@ use crate::trap::RuleId;
 /// This is what ONE RULE says about ONE candidate pair. The two names are four letters apart and
 /// the judgements are not comparable; the module doc above tabulates all four.
 ///
-/// # This type is the vocabulary; combining is story 5.4b's
+/// # This type is the vocabulary; [`decide`] is what combines it
 ///
 /// D13's contract is that **all rules are evaluated** and that *"verdicts combine by an **algebra,
 /// not a sum**"* [architecture.md:960-961], because *"REFUSED: `rule -> confidence: f64` … if the
-/// output is a float, B has won in disguise"* [architecture.md:956-958]. **Nothing in this file
-/// combines anything** — the six-row table at [architecture.md:967-974] is implemented by story
-/// 5.4b, and no rule produces a `Verdict` until story 5.5.
+/// output is a float, B has won in disguise"* [architecture.md:956-958]. The six-row table at
+/// [architecture.md:967-974] is implemented by [`decide`], in this file. **No rule produces a
+/// `Verdict` until story 5.5**, so nothing calls it outside its own tests.
 ///
 /// ⚠️ **The six rows do not cover every input.** Enumerated over the PRESENCE of each variant, the
 /// table leaves exactly one class unanswered: at least one `Opposes`, with no `Decisive`, no
 /// `Supports` and no `Disqualifying`. It is not *"only `Neutral` / nothing"* and it is not
-/// *"`Supports` AND `Opposes`"*. **Story 5.4b arbitrates it**; this doc names the gap so a reader
-/// does not mistake five variants and six rows for a complete specification.
+/// *"`Supports` AND `Opposes`"*. **[`decide`] carries the enumeration and Guy's arbitration of it**
+/// (2026-07-29: it abstains for absence of proof); this doc names the gap so a reader does not
+/// mistake five variants and six rows for a complete specification.
 ///
 /// # Why there is no ordering
 ///
@@ -160,10 +162,11 @@ impl Verdict {
 /// # Nothing produces one, and nothing validates one
 ///
 /// There is no rule, so every `RuleVerdict` in the tree today is a test literal. The fields are
-/// `pub` with no constructor — the [`crate::score::ScoredRecord`] precedent — and the two
-/// validations a producer would want are **registered rather than invented**: that a verdict which
-/// ARGUES leaves non-empty evidence, and that a [`Decision`]'s conclusion names a rule its own
-/// vector contains. Both need story 5.4b or 5.5 to have something that could red.
+/// `pub` with no constructor — the [`crate::score::ScoredRecord`] precedent — and of the two
+/// validations a producer would want, **one now has a place that reds and one does not**: that a
+/// [`Decision`]'s conclusion names a rule its own vector contains holds by construction for
+/// everything [`decide`] returns, and a test says so; that a verdict which ARGUES leaves non-empty
+/// evidence still needs a firing rule to state, and stays registered with story 5.5.
 ///
 /// # Its relationship to [`crate::score::VerdictVectorEntry`]
 ///
@@ -248,8 +251,8 @@ pub enum Conclusion {
     /// [`Self::Abstained`] with [`IdentityAbstentionCause::AbsenceOfProof`]. That fork is why this
     /// variant carries a rule and cannot be given an optional one: an engine that mapped all of
     /// `NoMatch` onto a refusal *"would fail every honest `must-abstain` trap"*, the exact case D18
-    /// says must NOT be gated. **This story builds the fork; story 5.4b decides which side an input
-    /// falls on.**
+    /// says must NOT be gated. **[`decide`] is what chooses the side**: a `Disqualifying` present
+    /// lands here and names its rule; its absence, with nothing arguing for the pair, abstains.
     NoMatch {
         /// The rule that opposed the pair — never the rule that was merely tempting.
         rule: RuleId,
@@ -284,7 +287,8 @@ pub enum Conclusion {
 /// is a float and none is a magnitude: [`RulesetVersion`] is an identifier, [`Verdict`] is
 /// enumerated and unordered. There is no ranking value at all, because L1 is a deterministic lookup
 /// with nothing to rank; D13's milli-units corollary [architecture.md:991-993] binds the day one
-/// appears. Story 5.4b adds the `cargo xtask ci` gate that holds this mechanically.
+/// appears. **`cargo xtask ci`'s `float-free` gate holds this mechanically** — it reds on an `f32`,
+/// an `f64` or a bare float literal in code anywhere under `identity/`.
 ///
 /// # What is representable and not refused
 ///
@@ -292,9 +296,23 @@ pub enum Conclusion {
 /// `Decision` whose [`Self::conclusion`] names a rule **absent from its own
 /// [`Self::verdict_vector`]** compiles, and so does a [`Conclusion::Match`] with an empty vector —
 /// *"merged, with no explanation"*, which is what D13's *"the list … IS the explanation"* exists to
-/// prevent. Nothing refuses either, and the reason is a missing producer rather than a preference:
-/// story 5.4b's combining function is the first place a conclusion and a vector are built together,
-/// hence the first place a test could red. Registered, owner story 5.4b.
+/// prevent.
+///
+/// **Through [`decide`] both are unreachable, and that is by construction rather than by a check**:
+/// it selects the named rule FROM the vector it then returns, and an empty vector abstains rather
+/// than matching. A test walks all 32 verdict subsets and asserts it.
+///
+/// ⚠️ **Be precise about WHICH emptiness that closes: the empty VECTOR, not empty EVIDENCE.**
+/// [`decide`] never reads [`RuleVerdict::evidence`], so a single
+/// `RuleVerdict { verdict: Decisive, evidence: vec![] }` still yields a [`Conclusion::Match`] whose
+/// explanation explains nothing — D13's clause defeated one level below the case closed here. That
+/// invariant needs a rule that FIRES to state, since only a producer can be held to "a firing rule
+/// supplies evidence", and no rule exists: registered with story 5.5. _(This paragraph closed both
+/// emptinesses in one sentence until the 2026-07-30 review.)_
+///
+/// ⚠️ **A struct literal built anywhere else is still unconstrained**, because the fields are `pub`
+/// and there is no constructor; that residue is registered with story 5.9, the first story that
+/// reconstructs a `Decision` from somewhere other than `decide`.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Decision {
     /// What the cascade concluded.
@@ -326,6 +344,171 @@ impl Decision {
     }
 }
 
+/// Combine a verdict set into a [`Decision`] — D13's algebra, as a TOTAL pure function.
+///
+/// D13: **all rules are evaluated** (never first-match-wins), each yields an enumerated verdict, and
+/// *"verdicts combine by an **algebra, not a sum**"* [architecture.md:960-961]. This is that algebra.
+/// It reads nothing but its arguments: no clock, no I/O, no SQL — *"the engine is a pure function"*
+/// [architecture.md:3302], and *"the engine never touches the clock"* [architecture.md:3364].
+///
+/// # It is TOTAL, and the table it implements is not
+///
+/// Every `Vec<RuleVerdict>` gets an answer — the empty one, and one naming the same rule twice.
+/// There is no `Result`, no `panic!` and no `unwrap`: there is no error to carry.
+///
+/// D13's table has six rows. Enumerated over the PRESENCE of each verdict it leaves **exactly one
+/// input class unanswered**, and this is the enumeration, so a reader can re-derive the gap rather
+/// than trust it (`Disqualifying` absent throughout — it short-circuits):
+///
+/// The last column is what **this function returns**, which is not always the words D13 uses — the
+/// `D13 row` column carries those. The two differ on exactly one row and the difference is
+/// deliberate: see [`Conclusion::NoMatch`]'s doc.
+///
+/// | `Decisive` | `Supports` | `Opposes` | D13 row (its words) | what `decide` returns |
+/// |---|---|---|---|---|
+/// | ✔ | ✔ | ✔ | `:971` Ambiguous | `Abstained { Ambiguous }` |
+/// | ✔ | ✔ | ✗ | `:970` Match | `Match { rule }` |
+/// | ✔ | ✗ | ✔ | `:971` Ambiguous | `Abstained { Ambiguous }` |
+/// | ✔ | ✗ | ✗ | `:970` Match | `Match { rule }` |
+/// | ✗ | ✔ | ✔ | `:973` Ambiguous | `Abstained { Ambiguous }` |
+/// | ✗ | ✔ | ✗ | `:972` Ambiguous | `Abstained { Ambiguous }` |
+/// | ✗ | ✗ | ✔ | **NONE** | **arbitrated below** |
+/// | ✗ | ✗ | ✗ | `:974` NoMatch (absence of proof) | `Abstained { AbsenceOfProof }` ⚠️ |
+///
+/// ⚠️ marks the one row where the engine's answer is not D13's word. `Conclusion::NoMatch` carries a
+/// rule and this class has none to name, so mapping it there is not expressible; D18 forbids gating
+/// an honest abstention behind a refusal. _(This column read `NoMatch` for that row until the
+/// 2026-07-30 review: a faithful quote of D13 sitting in a column that means the return value, in a
+/// table whose own preamble invites re-derivation.)_
+///
+/// **Guy's arbitration, 2026-07-29: `>=1 Opposes` alone concludes
+/// [`IdentityAbstentionCause::AbsenceOfProof`]** — nothing argues FOR the merge, so there is no merge
+/// to refuse, and D13 deliberately reserves the refusal-that-names-a-rule for `Disqualifying`. The
+/// correction to D13 itself is a MILESTONE edit of `architecture.md`, never a story task; it is
+/// registered with a GitHub issue.
+///
+/// # Which rule a decision names
+///
+/// A decision names ONE rule while several may be `Disqualifying` or `Decisive` at once. The one
+/// named is the **lexicographically smallest [`RuleId`] among the verdicts that qualified for that
+/// arm** — the `Disqualifying` ones for a refusal, the `Decisive` ones for a match.
+///
+/// ⚠️ **That is a tiebreak nobody designed**, and it is chosen because it is the only
+/// order-independent rule available that invents nothing: no rule priority exists, because **no rule
+/// exists**. D13 refuses the alternative by name — *"which rule fires first? The one written first.
+/// **That is not a decision, it is an accident of file order**"* [architecture.md:936-937]. A
+/// designed priority replaces it when rules have one: story 5.5 for L1, Epic 6 for `l2-*`.
+/// Registered.
+///
+/// ⚠️ **It is not free of consequence, though, and calling it "semantically empty" was wrong.**
+/// [`RuleId`] is a `String` with a derived `Ord`, so this is BYTE order, and three consequences
+/// follow that a reader must know before relying on it:
+/// - it is only empty WITHIN a tier: `l1-distinct-mac` is not "more disqualifying" than
+///   `l1-exact-mac`, true — but across tiers `l1-*` always beats `l2-*`, so the accident of file
+///   order has been replaced by a systematic preference that merely looks deliberate;
+/// - it is case-sensitive: `L1-exact` sorts before `l1-anything`, because uppercase bytes are lower;
+///   and
+/// - it **flips tiers at ten**: `l10-x` sorts before `l2-x`. The day rule numbering reaches double
+///   digits, which rule a decision names changes without anyone editing this function.
+///
+/// _(This paragraph claimed the tiebreak had "no semantic content" until the 2026-07-30 review,
+/// illustrated with the one example — two rules in the same tier — where the claim holds.)_
+///
+/// # What it does not do
+///
+/// It does not refuse a vector naming the same rule twice, and it does not validate
+/// `ruleset_version` — including `RulesetVersion(0)`, which D14's "mandatory" does not forbid since
+/// that is about PRESENCE. Both need a producer to state and to red, and no rule exists.
+///
+/// The conclusion and the vector are built together here, so a conclusion naming a rule absent from
+/// its own vector is unreachable **through this function** — the rule is selected FROM the vector
+/// that is then returned, and `decide(vec![], _)` abstains rather than matching. A `Decision` built
+/// by struct literal elsewhere is still unconstrained (the fields are `pub`); that residue is
+/// registered with story 5.9.
+pub fn decide(verdict_vector: Vec<RuleVerdict>, ruleset_version: RulesetVersion) -> Decision {
+    let has = |w: Verdict| verdict_vector.iter().any(|rv| rv.verdict == w);
+
+    // ⚠️ A `match` on a tuple, NOT an `if`/`else if` chain, and that is load-bearing: it is what
+    // makes deleting an arm an `error[E0004]` instead of a silent behaviour change. An `if`-chain
+    // with a trailing `else` was measured to swallow the loss of the arbitration arm while every
+    // one of the sixteen classes kept its answer.
+    //
+    // ⚠️ The first two slots hold the SELECTED RULE, not a boolean, so the presence test and the
+    // selection are ONE act: `Some(rule)` is simultaneously "a Disqualifying exists" and "here it
+    // is". No arm then holds an `Option` it must prove `Some`, which is why this function has no
+    // unreachable branch to justify. It was written with booleans first, and the two dead arms that
+    // shape produced both mapped an impossible state onto `AbsenceOfProof` — a legitimate answer
+    // for two other classes, so a broken invariant would have degraded a refusal into an
+    // honest-looking abstention with nothing observable.
+    let conclusion = match (
+        smallest_rule_with(&verdict_vector, Verdict::Disqualifying),
+        smallest_rule_with(&verdict_vector, Verdict::Decisive),
+        has(Verdict::Supports),
+        has(Verdict::Opposes),
+    ) {
+        // architecture.md:969 — "any Disqualifying → NoMatch, absolute priority, short-circuits
+        // everything". Checked first, so the priority is structural and not an accident of order.
+        (Some(rule), _, _, _) => Conclusion::NoMatch { rule },
+
+        // architecture.md:970 — "a Decisive, no Opposes → Match".
+        (None, Some(rule), _, false) => Conclusion::Match { rule },
+
+        // architecture.md:971 — "a Decisive, >=1 Opposes → Ambiguous", the cloned-MAC case.
+        (None, Some(_), _, true) => Conclusion::Abstained {
+            cause: IdentityAbstentionCause::Ambiguous,
+        },
+
+        // architecture.md:972 — "no Decisive, >=1 Supports, no Opposes → Ambiguous" (weak evidence).
+        (None, None, true, false) => Conclusion::Abstained {
+            cause: IdentityAbstentionCause::Ambiguous,
+        },
+
+        // architecture.md:973 — "Supports AND Opposes → Ambiguous" (conflict).
+        (None, None, true, true) => Conclusion::Abstained {
+            cause: IdentityAbstentionCause::Ambiguous,
+        },
+
+        // ⚠️ NOT a D13 row — this is the class the table does not cover, and there is no
+        // architecture line to cite. Guy's arbitration, 2026-07-29: `>=1 Opposes` with nothing
+        // arguing for the merge abstains for absence of proof. See this function's doc.
+        (None, None, false, true) => Conclusion::Abstained {
+            cause: IdentityAbstentionCause::AbsenceOfProof,
+        },
+
+        // architecture.md:974 — "only Neutral / nothing → NoMatch (absence of proof)", which this
+        // engine answers as `Abstained { AbsenceOfProof }` and not as `NoMatch`: that variant
+        // carries a rule and this class has none to name. See `Conclusion::NoMatch`'s own doc — the
+        // fork is deliberate and D18 is why. `Neutral` is not in the tuple because no row tests it:
+        // it is what is left when nothing else spoke.
+        (None, None, false, false) => Conclusion::Abstained {
+            cause: IdentityAbstentionCause::AbsenceOfProof,
+        },
+    };
+
+    Decision {
+        conclusion,
+        verdict_vector,
+        ruleset_version,
+    }
+}
+
+/// The lexicographically smallest [`RuleId`] among the verdicts carrying `wanted`, if any.
+///
+/// The tiebreak of [`decide`], factored out so the two rule-naming arms cannot drift apart.
+///
+/// The `Option` is not a nuisance to be discharged: [`decide`] matches on it directly, so `None`
+/// **is** how "no rule carries this verdict" is expressed and `Some(rule)` is simultaneously the
+/// presence test and its answer. That is why no caller needs `expect()` and no path panics.
+///
+/// ⚠️ `min()` is byte order over a `String` id — see [`decide`]'s doc for what that costs.
+fn smallest_rule_with(verdicts: &[RuleVerdict], wanted: Verdict) -> Option<RuleId> {
+    verdicts
+        .iter()
+        .filter(|rv| rv.verdict == wanted)
+        .map(|rv| rv.rule.clone())
+        .min()
+}
+
 /// Why the identity cascade did not conclude — the engine's own abstention vocabulary.
 ///
 /// # Two variants, and the two D13 rows that produce none
@@ -342,7 +525,12 @@ impl Decision {
 ///
 /// `NoMatch` is therefore reached by two different rows — the `Disqualifying` one just named, which
 /// is a decision, and the absence-of-proof one below — and **exactly one of them has no rule to
-/// name**: that row is [`Self::AbsenceOfProof`]. Six rows, four of them abstentions, two variants.
+/// name**: that row is [`Self::AbsenceOfProof`].
+///
+/// ⚠️ **Seven input classes, not six.** D13's table has six rows, but enumerated over the PRESENCE of
+/// each verdict it leaves one class uncovered — `>=1 Opposes` alone — which Guy arbitrated onto
+/// [`Self::AbsenceOfProof`] on 2026-07-29. So: seven classes, five of them abstentions, two variants.
+/// [`decide`] carries the enumeration and is where the arbitration lives.
 ///
 /// A third variant is a **finding**, not a tidy-up. In particular this enum does not reproduce
 /// `OutOfPerimeter`: the cascade's table has no such row, and D16 names the failure mode of
@@ -386,8 +574,18 @@ pub enum IdentityAbstentionCause {
     /// 5.14 owns the operator-facing grouping and is the first place a split can be justified by a
     /// consumer rather than by symmetry. Registered in `deferred-work.md`.
     Ambiguous,
-    /// Nothing in the verdict set argues either way — the row *"only `Neutral` / nothing →
-    /// `NoMatch` (absence of proof)"* [architecture.md:974].
+    /// Nothing argues FOR the pair — so there is no merge to refuse and none to make.
+    ///
+    /// **Two input classes produce it, and only one of them is a D13 row:**
+    /// - *"only `Neutral` / nothing → `NoMatch` (absence of proof)"* [architecture.md:974], where
+    ///   nothing argues either way;
+    /// - **`>=1 Opposes` with no `Decisive`, no `Supports` and no `Disqualifying`** — the class D13's
+    ///   table leaves uncovered, arbitrated onto this variant by Guy on 2026-07-29. Here something
+    ///   *does* argue, against; what is absent is anything arguing FOR, which is why the answer is an
+    ///   abstention and not a refusal. See [`decide`], which carries the enumeration.
+    ///
+    /// *(This doc read "nothing in the verdict set argues either way" until [`decide`] existed —
+    /// true of the D13 row alone, and falsified by the arbitrated class the same function serves.)*
     ///
     /// It is a separate variant because it is the half of `NoMatch` with no rule to name, and D18
     /// is explicit that this case must NOT be gated: *"an engine that abstains because there is NOT
@@ -451,9 +649,19 @@ impl IdentityAbstentionCause {
 ///   VOCABULARY — *"an abstention has no rule to name, for EVERY cause"* — and reads
 ///   `Outcome::rule()` as the mechanism that expresses it. Its subject is
 ///   [`IdentityAbstentionCause`], so it stays here too, by the convention rather than by fiat.
+/// - Story 5.4b's six tests of [`decide`] pin claims about a function defined in this file, so the
+///   convention places them here without a judgement call. [`crate::score::Outcome`] is not read by
+///   any of them.
 ///
 /// The truth-table tests of `score()` stay in `score.rs` under the same rule: their subject is
 /// `score`, and this module's types are what they read.
+///
+/// # The oracle is deliberate redundancy
+///
+/// `expected_conclusion` restates D13's table independently of [`decide`]. That is the protected kind
+/// of duplication this project names by hand (`fixtures.rs`'s `expected()`, `score.rs`'s
+/// `Column::as_str()`), and a DRY pass must not collapse it: an expectation computed by calling the
+/// code under test proves nothing.
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -687,4 +895,337 @@ mod tests {
             "the ruleset version is carried alongside, not derived"
         );
     }
+
+    // ── story 5.4b: the verdict algebra ──────────────────────────────────────────────────────
+
+    /// D13's table, read directly and restated here as a SECOND, INDEPENDENT ORACLE.
+    ///
+    /// ⚠️ **Deliberate redundancy — do not collapse this into [`decide`] with a DRY pass.** It is the
+    /// same protected shape as `fixtures.rs`'s `expected()`, which restates the corpus bytes rather
+    /// than reading them through the code under test. A test that called `decide` to compute its own
+    /// expectation would prove nothing at all.
+    ///
+    /// It is written from the four PRESENCE booleans, in D13's own row order, and returns the full
+    /// [`Conclusion`] — **rule included**, because the rule is the half of a conclusion an arm can
+    /// silently get wrong.
+    ///
+    /// ⚠️ The `unreachable!()` arms below are RIGHT here and would be wrong in [`decide`], and the
+    /// difference is not style. This is a test: a broken premise should abort loudly. `decide` is the
+    /// domain: a broken premise must not become a plausible answer — which is why it now matches on
+    /// `Option<RuleId>` directly and has no such arm to fill in at all.
+    fn expected_conclusion(v: &[RuleVerdict]) -> Conclusion {
+        let has = |w: Verdict| v.iter().any(|rv| rv.verdict == w);
+        // The lexicographically smallest rule among the verdicts carrying `w` — restated, not shared
+        // with the implementation.
+        let smallest = |w: Verdict| {
+            v.iter()
+                .filter(|rv| rv.verdict == w)
+                .map(|rv| rv.rule.clone())
+                .min()
+        };
+
+        if has(Verdict::Disqualifying) {
+            // architecture.md:969 — "any Disqualifying → NoMatch, absolute priority".
+            match smallest(Verdict::Disqualifying) {
+                Some(rule) => Conclusion::NoMatch { rule },
+                None => unreachable!("has(Disqualifying) implies a Disqualifying verdict exists"),
+            }
+        } else if has(Verdict::Decisive) && !has(Verdict::Opposes) {
+            // architecture.md:970 — "a Decisive, no Opposes → Match".
+            match smallest(Verdict::Decisive) {
+                Some(rule) => Conclusion::Match { rule },
+                None => unreachable!("has(Decisive) implies a Decisive verdict exists"),
+            }
+        } else if has(Verdict::Decisive) {
+            // architecture.md:971 — "a Decisive, >=1 Opposes → Ambiguous" (the cloned-MAC case).
+            Conclusion::Abstained {
+                cause: IdentityAbstentionCause::Ambiguous,
+            }
+        } else if has(Verdict::Supports) {
+            // architecture.md:972 (weak evidence) and :973 (Supports AND Opposes, conflict) — with
+            // no Decisive, both land on Ambiguous whatever Opposes does.
+            Conclusion::Abstained {
+                cause: IdentityAbstentionCause::Ambiguous,
+            }
+        } else {
+            // architecture.md:974 — "only Neutral / nothing → NoMatch (absence of proof)", AND the
+            // class D13's table does not cover: >=1 Opposes with nothing arguing for the merge.
+            // Guy's arbitration, 2026-07-29.
+            Conclusion::Abstained {
+                cause: IdentityAbstentionCause::AbsenceOfProof,
+            }
+        }
+    }
+
+    /// The number of input classes the totality walk must cover: one per subset of the verdicts.
+    ///
+    /// ⚠️ **Derived from `Verdict::all()`, never written as a literal.** A hard-coded `32` was
+    /// measured to be the wrong kind of constant: adding a sixth `Verdict` variant makes
+    /// `Verdict::all()` red with `error[E0004]` and forces the array to grow, but a literal `32`
+    /// keeps the walk at half the real class count while the test keeps the name
+    /// `decide_is_total_over_every_one_of_d13s_input_classes`. The compiler cannot catch that — this
+    /// function is what does. (A `const` cannot: `Verdict::all()` is not a `const fn`, and making it
+    /// one to serve a test would be the test dictating the domain's API.)
+    fn input_classes() -> u32 {
+        1 << Verdict::all().len()
+    }
+
+    /// A subset of the verdicts, as one `RuleVerdict` each with a distinct rule.
+    ///
+    /// Rule names are derived from the index rather than taken from a fixed array, so this helper
+    /// cannot go stale when [`Verdict`] gains a variant. _(It used a scrambled `const NAMES: [&str;
+    /// 5]` until the 2026-07-30 review, justified by a claim that could not be true: because every
+    /// subset carries at most ONE verdict of any given kind, no rule-naming arm ever has two
+    /// candidates, so "smallest rule" and "first in the vector" are indistinguishable here whatever
+    /// the names are — as this test's own "What it does NOT cover" paragraph says four lines below.)_
+    fn subset(mask: u32) -> Vec<RuleVerdict> {
+        Verdict::all()
+            .into_iter()
+            .enumerate()
+            .filter(|(i, _)| mask & (1 << i) != 0)
+            .map(|(i, verdict)| RuleVerdict {
+                rule: rule(&format!("r-{i}")),
+                verdict,
+                evidence: vec![obs(100 + i as u128)],
+            })
+            .collect()
+    }
+
+    /// `decide` is TOTAL over D13's table: every subset of the verdicts gets an answer, and it is the
+    /// one D13's own text gives — including the empty vector, which is the `mask == 0` case.
+    ///
+    /// This is the "every input class, not a sample" the epic asks for: `input_classes()` presence
+    /// combinations, each checked against [`expected_conclusion`], an oracle written from the
+    /// architecture rather than from the code under test. The bound is derived from `Verdict::all()`
+    /// so this stays "every class" when a variant is added — see `input_classes`.
+    ///
+    /// ⚠️ **Every mismatch is collected and reported together, not asserted per iteration.** A bare
+    /// `assert_eq!` inside the loop aborts on the first one, which hides HOW MANY classes a change
+    /// moved — and that count is this test's coverage. Measured: it is the difference between "M1
+    /// reds" and "M1 reds on exactly 2 of 32".
+    ///
+    /// ⚠️ **What it does NOT cover: the tiebreak.** Each subset carries at most one verdict of any
+    /// given kind, so no arm ever has two candidates and `min()` over a singleton is order-free.
+    /// `the_named_rule_does_not_depend_on_arrival_order` is the only coverage that property has.
+    #[test]
+    fn decide_is_total_over_every_one_of_d13s_input_classes() {
+        let mut mismatches = Vec::new();
+        let mut exercised: Vec<Verdict> = Vec::new();
+
+        let classes = input_classes();
+
+        for mask in 0..classes {
+            let vector = subset(mask);
+            for rv in &vector {
+                if !exercised.contains(&rv.verdict) {
+                    exercised.push(rv.verdict);
+                }
+            }
+            let expected = expected_conclusion(&vector);
+            let decision = decide(vector.clone(), RulesetVersion(3));
+
+            if decision.conclusion != expected {
+                mismatches.push(format!(
+                    "subset {mask:05b} {:?}: expected {expected:?}, got {:?}",
+                    vector.iter().map(|rv| rv.verdict).collect::<Vec<_>>(),
+                    decision.conclusion
+                ));
+            }
+            assert_eq!(
+                decision.verdict_vector, vector,
+                "subset {mask:05b}: the verdict vector is carried through, not rebuilt"
+            );
+            assert_eq!(
+                decision.ruleset_version,
+                RulesetVersion(3),
+                "subset {mask:05b}: the version is passed through verbatim"
+            );
+        }
+
+        assert!(
+            mismatches.is_empty(),
+            "{} of {classes} input classes disagree with D13's table:\n  {}",
+            mismatches.len(),
+            mismatches.join("\n  ")
+        );
+
+        // ⚠️ The walk agreeing with the oracle says NOTHING about how much of the space it walked:
+        // halving `classes` was MEASURED to leave all 100 core tests green, because the oracle agrees
+        // on every class the walk still visits. This is what makes "every input class" falsifiable —
+        // a bound too small stops exercising the highest-bit variant, and that reds here.
+        for verdict in Verdict::all() {
+            assert!(
+                exercised.contains(&verdict),
+                "{verdict:?} never appeared in any of the {classes} subsets walked, so this test \
+                 does not cover the space its name claims — check that the bound is derived from \
+                 Verdict::all() and that subset() maps every index"
+            );
+        }
+    }
+
+    /// The class D13's six rows leave uncovered — `>=1 Opposes`, no `Decisive`, no `Supports`, no
+    /// `Disqualifying` — abstains for absence of proof.
+    ///
+    /// It is inside the 32-subset walk already; it gets its own name because it is the ONE answer no
+    /// architecture line backs. It is Guy's arbitration of 2026-07-29: nothing argues FOR the merge,
+    /// so there is no merge to refuse, and D13 reserves the refusal-that-names-a-rule for
+    /// `Disqualifying`.
+    #[test]
+    fn the_input_class_d13_does_not_cover_abstains_for_absence_of_proof() {
+        let vector = vec![RuleVerdict {
+            rule: rule("l2-different-switch"),
+            verdict: Verdict::Opposes,
+            evidence: vec![obs(1)],
+        }];
+
+        let decision = decide(vector, RulesetVersion(1));
+
+        assert_eq!(
+            decision.conclusion,
+            Conclusion::Abstained {
+                cause: IdentityAbstentionCause::AbsenceOfProof
+            },
+            "an Opposes with nothing arguing for the merge abstains; it does not refuse, because a \
+             refusal names a rule and D13 reserves that to Disqualifying"
+        );
+    }
+
+    /// The rule a decision names does not depend on the order the verdicts arrived in — D13's *"the
+    /// one written first… is not a decision, it is an accident of file order"*.
+    ///
+    /// ⚠️ Three verdicts of the SAME rule-naming kind, and their rule names supplied in an order that
+    /// is NOT their lexicographic order. Both are load-bearing: a mixed vector would conclude
+    /// `Abstained`, which names no rule, so every permutation would agree whatever the tiebreak did —
+    /// the test would pass with "first in the vector" and prove nothing.
+    #[test]
+    fn the_named_rule_does_not_depend_on_arrival_order() {
+        let mk = |name: &str| RuleVerdict {
+            rule: rule(name),
+            verdict: Verdict::Disqualifying,
+            evidence: vec![obs(7)],
+        };
+        // Supplied c, a, b — lexicographic order differs from vector order.
+        let names = ["c", "a", "b"];
+        let permutations = [
+            [0, 1, 2],
+            [0, 2, 1],
+            [1, 0, 2],
+            [1, 2, 0],
+            [2, 0, 1],
+            [2, 1, 0],
+        ];
+
+        for order in permutations {
+            let vector: Vec<RuleVerdict> = order.iter().map(|&i| mk(names[i])).collect();
+            let decision = decide(vector, RulesetVersion(1));
+
+            assert_eq!(
+                decision.conclusion,
+                Conclusion::NoMatch { rule: rule("a") },
+                "arrival order {order:?} must not change the rule named: the smallest RuleId wins, \
+                 not the first one in the vector"
+            );
+        }
+    }
+
+    /// A refusal names the rule that FORBADE the pair — never the smallest rule in the vector.
+    ///
+    /// The failing implementation this pins is a real one: taking `min()` over the WHOLE vector once
+    /// and reusing it in both rule-naming arms is deterministic, order-independent, and leaves the
+    /// named rule inside its own verdict vector — so it satisfies every other test here while
+    /// answering `NoMatch { rule: "a" }`, a refusal naming the rule that argued FOR the merge.
+    #[test]
+    fn a_disqualifying_names_the_disqualifying_rule_not_the_smallest_one() {
+        let vector = vec![
+            RuleVerdict {
+                rule: rule("a"),
+                verdict: Verdict::Decisive,
+                evidence: vec![obs(1)],
+            },
+            RuleVerdict {
+                rule: rule("z"),
+                verdict: Verdict::Disqualifying,
+                evidence: vec![obs(2)],
+            },
+        ];
+
+        let decision = decide(vector, RulesetVersion(1));
+
+        assert_eq!(
+            decision.conclusion,
+            Conclusion::NoMatch { rule: rule("z") },
+            "the refusal names the Disqualifying rule; 'a' argued FOR the pair and must not be the \
+             rule a refusal cites"
+        );
+    }
+
+    /// Everything `decide` returns is coherent: a named rule is in the vector it travels with, and
+    /// an empty input can never come back as a `Match`.
+    ///
+    /// This is the invariant story 5.4 registered as unenforceable at the type level — `Decision`'s
+    /// fields are `pub` — and it holds here **by construction**: `decide` selects the rule FROM the
+    /// vector it then returns. A struct literal built elsewhere is still unconstrained; that residue
+    /// is registered with story 5.9.
+    #[test]
+    fn a_named_rule_is_always_present_in_the_vector_it_travels_with() {
+        for mask in 0..input_classes() {
+            let decision = decide(subset(mask), RulesetVersion(1));
+            if let Some(named) = decision.rule() {
+                assert!(
+                    decision.verdict_vector.iter().any(|rv| &rv.rule == named),
+                    "subset {mask:05b}: conclusion names {named:?}, which is absent from its own \
+                     verdict vector — 'merged, with no explanation'"
+                );
+            }
+        }
+
+        let empty = decide(Vec::new(), RulesetVersion(1));
+        assert_eq!(
+            empty.conclusion,
+            Conclusion::Abstained {
+                cause: IdentityAbstentionCause::AbsenceOfProof
+            },
+            "an empty verdict set abstains for absence of proof and can never be a Match: \
+             'merged, with no explanation' is unreachable through decide()"
+        );
+    }
+
+    /// A vector naming the same rule twice does not break totality — `decide` answers.
+    ///
+    /// `("a", Decisive)` + `("a", Opposes)` is the register's own example: ONE rule contradicting
+    /// itself, fabricating D13's *"a `Decisive`, >=1 `Opposes`"* conflict row on its own. ⚠️ This
+    /// pins TOTALITY, not refusal. Refusing a duplicated rule needs a PRODUCER that emits one verdict
+    /// per rule, and no rule exists — that half stays open with story 5.5.
+    ///
+    /// _(This test also called `decide` twice and asserted the two answers matched, under the
+    /// heading "answers the same way every time". Removed by the 2026-07-30 review: `decide` is a
+    /// `fn` with no state and no interior mutability, so that equality is guaranteed by the language
+    /// and no mutation of the body could red it. Order-independence — the property that assertion
+    /// looked like it was testing — is covered by `the_named_rule_does_not_depend_on_arrival_order`.)_
+    #[test]
+    fn a_duplicated_rule_id_does_not_break_totality() {
+        let vector = vec![
+            RuleVerdict {
+                rule: rule("a"),
+                verdict: Verdict::Decisive,
+                evidence: vec![obs(1)],
+            },
+            RuleVerdict {
+                rule: rule("a"),
+                verdict: Verdict::Opposes,
+                evidence: vec![obs(2)],
+            },
+        ];
+
+        let decision = decide(vector, RulesetVersion(1));
+
+        assert_eq!(
+            decision.conclusion,
+            Conclusion::Abstained {
+                cause: IdentityAbstentionCause::Ambiguous
+            },
+            "one rule contradicting itself is D13's Decisive-plus-Opposes row; decide answers rather \
+             than refusing, because refusing needs a producer that does not exist"
+        );
+    }
 }
diff --git a/crates/opencmdb-core/src/identity/mod.rs b/crates/opencmdb-core/src/identity/mod.rs
index 665d6d5..2afa280 100644
--- a/crates/opencmdb-core/src/identity/mod.rs
+++ b/crates/opencmdb-core/src/identity/mod.rs
@@ -5,10 +5,12 @@
 //! riskiest problem in the product, and D13 fixes its shape — **all rules are evaluated**, each
 //! yields an enumerated verdict, and the verdicts combine by an **algebra, never a sum**.
 //!
-//! **What lives here today is [`cascade`], and inside it the engine's vocabulary and its return
-//! type** — the verdict, the `(rule, verdict, evidence)` triple, the conclusion, the ruleset version
-//! and the abstention cause. There is still no rule, no candidate pair and no join, and **nothing
-//! combines a verdict set into a conclusion**: story 5.4b writes that algebra.
+//! **What lives here today is [`cascade`], and inside it the engine's vocabulary, its return type
+//! and the ALGEBRA that combines them** — the verdict, the `(rule, verdict, evidence)` triple, the
+//! conclusion, the ruleset version, the abstention cause, and [`cascade::decide`], which maps a
+//! verdict set onto a conclusion over D13's table. **There is still no rule, no candidate pair and
+//! no join**: nothing produces a verdict, so nothing calls `decide` outside its own tests. Story 5.5
+//! writes the L1 join and the first firing rule.
 //!
 //! The architecture's source tree names an `IdentityError` on this module [architecture.md:3366].
 //! It is absent because there is no fallible operation to carry it: choosing a cause enum cannot
diff --git a/crates/opencmdb-core/src/lib.rs b/crates/opencmdb-core/src/lib.rs
index 4c47952..0ad1509 100644
--- a/crates/opencmdb-core/src/lib.rs
+++ b/crates/opencmdb-core/src/lib.rs
@@ -38,7 +38,7 @@ pub use clock::Clock;
 pub use connector::{Connector, ConnectorError, ObservationSink, PollSummary, VecSink};
 pub use gap::{AbstentionCause, Gap, Reconciliation, reconcile};
 pub use identity::cascade::{
-    Conclusion, Decision, IdentityAbstentionCause, RuleVerdict, RulesetVersion, Verdict,
+    Conclusion, Decision, IdentityAbstentionCause, RuleVerdict, RulesetVersion, Verdict, decide,
 };
 pub use observation::{
     Capabilities, ConnectorId, Fact, FactKind, HostnameSource, L2DomainId, MacAddr, MacParseError,
diff --git a/docs/project-context.md b/docs/project-context.md
index 9b7e8c3..577a128 100644
--- a/docs/project-context.md
+++ b/docs/project-context.md
@@ -42,14 +42,17 @@ Docker Hub; the binary runs and scans on Guy's NAS (frontend on macvlan, no Trae
 | **E2** Le contrat de connecteur | ✅ done (5 stories) |
 | **E3** Mon premier écart réel — **v0.1** | ✅ done (10 stories), retrospective held |
 | **E4** Infra fixtures & corpus de pièges — v0.2 | ✅ **done 2026-07-25** (19/19 authored; 4.19 split — see below) |
-| **E5** Identité d'interface fiable — v0.3 | 🔵 **in-progress** since 2026-07-27 — **16 stories** (5.4b INSERTED 2026-07-29 at 5.4's contexting: the verdict algebra as a TOTAL function, plus the `xtask` gate that refuses a float under `identity/`); **5.1, 5.2 and 5.2b done** (PR #41, #44, #46, all merged 2026-07-28). Epic 5's **three inherited-debt stories are closed**; the engine proper starts at **5.3, `done`** (PR #48, merged 2026-07-29) — it ships the identity engine's own abstention vocabulary and NO engine. **5.4 is `done`** (PR #52, merged 2026-07-29 as `da87b62`) — the engine's return type (`Verdict`, `RuleVerdict`, `RulesetVersion`, `Conclusion`, `Decision`) and still NO algebra. **5.4b is `ready-for-dev`** — `decide` as a TOTAL function, plus the anti-float gate |
+| **E5** Identité d'interface fiable — v0.3 | 🔵 **in-progress** since 2026-07-27 — **16 stories** (5.4b INSERTED 2026-07-29 at 5.4's contexting: the verdict algebra as a TOTAL function, plus the `xtask` gate that refuses a float under `identity/`); **5.1, 5.2 and 5.2b done** (PR #41, #44, #46, all merged 2026-07-28). Epic 5's **three inherited-debt stories are closed**; the engine proper starts at **5.3, `done`** (PR #48, merged 2026-07-29) — it ships the identity engine's own abstention vocabulary and NO engine. **5.4 is `done`** (PR #52, merged 2026-07-29 as `da87b62`) — the engine's return type (`Verdict`, `RuleVerdict`, `RulesetVersion`, `Conclusion`, `Decision`) and still NO algebra. **5.4b is `review`, CODE-REVIEWED 2026-07-30** (PR #55 open, CI green) — `decide` as a TOTAL pure function over D13's table (the uncovered class abstains; the D13 correction is issue #54, a milestone act) plus the sixth `xtask` gate, `float-free`. Still no rule and no producer. The review's 22 patches are applied and 5 deferrals registered; what it caught was mostly **claims, not behaviour** — a shipped doc quoting 47 offenders where the tree it described gave 45, a register count of eight where ten were annotated, this very file's test count left stale under a checked-off task, and a premise assertion that had gone inert. On the code: `decide` now matches on `Option<RuleId>` so the two unreachable arms are gone, and the gate's matcher is a numeric-literal tokeniser — `1e-3` and `1.` were green, `"192.168.0.1"` and `t.0.1` were red, all measured. Next is 5.5 |
 | **E6–E23** | backlog |
 
 Live status is `_bmad-output/implementation-artifacts/sprint-status.yaml`, not this file.
 
-**What exists today:** a three-crate workspace that builds and ships. `cargo xtask ci` runs four real
-gates — dependency frontier (D47), DDL binary collation (D64), retired vocabulary (D65), and the
-fixture corpus lock (both directions: edited AND orphan). `opencmdb-core` holds the domain
+**What exists today:** a three-crate workspace that builds and ships. `cargo xtask ci` runs **six**
+real gates — dependency frontier (D47), DDL binary collation (D64), retired vocabulary (D65), the
+fixture corpus lock (both directions: edited AND orphan), the file-size ceiling (D56b) and
+`float-free` (D13, story 5.4b) — plus the informational `views-hash` staleness check, which reports
+`ℹ STALE` and exits 0 by design. _(This sentence said "four" until 2026-07-30; `file-size` and
+`float-free` had shipped without it being updated.)_ `opencmdb-core` holds the domain
 (`Observation`, `Fact`, `Capabilities`, the closed `ConnectorError` taxonomy, the `Connector` trait
 and its consumer-driven contract test). `opencmdb-bin` holds everything touching the outside world:
 MariaDB pool + migrations, axum/askama/HTMX pages, an ARP/ping connector, the fixture reader and
@@ -60,8 +63,8 @@ across nine families** (randomized-mac, multi-nic, shared-hardware-vm, cloned-ma
 vrrp-virtual-mac, hostname-collision, docker-veth, hostname-absence — each in positive AND
 negative form, each naming the RULE rather than the outcome), the scoring algebra, the metrics
 harness, the trap runner, the reality-debt register, and the wire-format spec. Test counts on
-master at Epic 4's close: **119 (bin) + 86 (core) + 42 (xtask)**; **271** on the story-5.4 branch
-(135 + 94 + 42) — story 5.1 added the two
+master at Epic 4's close: **119 (bin) + 86 (core) + 42 (xtask)**; **281** on the story-5.4b branch
+after its code review (**135 bin + 100 core + 46 xtask**) — story 5.1 added the two
 corpus-wide walks, story 5.2 the trap-text scan, the `raw` scan and the scanner's six closed
 evasions, and story 5.2b five byte-pin tests over six of the eight streams that had none (the four
 unpinned families plus `example-traps.jsonl`, `dhcp-churn`'s existing pin extended) together with
@@ -69,7 +72,11 @@ the trap→`obs_id` binding pin; story **5.3** the four tests of the identity en
 vocabulary (`IdentityAbstentionCause`, two variants, in the new `opencmdb-core/src/identity/`) — a
 TYPE and no engine; story **5.4** four more, for the engine's RETURN type — `Verdict` (D13's five),
 `RuleVerdict { rule, verdict, evidence }`, `RulesetVersion`, `Conclusion` and `Decision` — still with
-no algebra, no rule and no producer, the combining function being story 5.4b's. **5.2b's trap→`obs_id` binding pin** closed a hole measured TWICE: exchanging two `observations`
+no algebra, no rule and no producer; and story **5.4b** the ALGEBRA itself — `decide` as a TOTAL pure
+function over D13's table plus the class it leaves uncovered — with six core tests, plus four `xtask`
+tests for the sixth gate, `float-free`. **Still no rule and no producer**: nothing emits a `Verdict`,
+so nothing calls `decide` outside its own tests (story 5.5 owns the join).
+**5.2b's trap→`obs_id` binding pin** closed a hole measured TWICE: exchanging two `observations`
 vectors in `cloned-mac.toml`, and later in `hostname-collision.toml`, each made the corpus DEMAND a
 false merge while the whole suite stayed green. **All 24 committed traps across all ten trap files
 now have their `observations` vector, `Expectation` and `family` pinned** — the scope grew from
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index b1783c7..9e278fa 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -15,6 +15,13 @@
 //!   - **fixtures** (D56): a lockfile for data, checked in BOTH directions — a listed
 //!     artefact whose bytes changed is red, and a file present under `fixtures/` that
 //!     nobody listed is red. `fixtures/MANIFEST.toml` carries sha256 + optional generator.
+//!   - **file-size**: no source file over 2000 CODE lines (tests excluded — the count
+//!     stops at the first top-level `#[cfg(test)]`, D56b). A file past the ceiling is
+//!     split into modules, not grown. Names the offender and its count.
+//!   - **float-free** (D13): no `f32`, no `f64` and no float literal in CODE under
+//!     `crates/opencmdb-core/src/identity/` — *"if the output is a float, B has won in
+//!     disguise"*. Comments are stripped first, so the architecture may be QUOTED there;
+//!     the committed citation in `cascade.rs` is this gate's negative test case.
 //!   - **views-hash** (informational): whether `architecture-views.md`'s `sourceSha256`
 //!     still matches `architecture.md`. A mismatch means the views file is stale and
 //!     should be regenerated at the next milestone — reported, never a hard failure.
@@ -59,6 +66,13 @@ fn workspace_root() -> PathBuf {
         .to_path_buf()
 }
 
+// ── Gate 4: file size (D56b) ────────────────────────────────────────────────
+//
+// ⚠️ This section sits ABOVE Gate 0 rather than between Gates 3 and 5, which is where its number
+// says it belongs. That placement predates story 5.4b and is left alone deliberately: `run_ci` runs
+// the gates 0,1,2,3,4,5 and every OTHER section is now in that order, so the one exception is
+// visible instead of being hidden by renumbering.
+
 /// The CODE-line ceiling per source file. Tests do not count (see [`code_line_count`]): the concern
 /// is a module doing too much, not a well-covered one, and the house convention keeps tests inline
 /// beside the code (D56b). A file that grows past this is asking to be split into modules.
@@ -160,6 +174,10 @@ fn run_ci() -> Result<bool> {
     report("file-size", g4, &m4);
     ok &= g4;
 
+    let (g5, m5) = gate_float_free(&root)?;
+    report("float-free", g5, &m5);
+    ok &= g5;
+
     let m3 = check_views_hash(&root)?;
     println!("  ℹ  {:<14} {m3}", "views-hash");
 
@@ -843,6 +861,240 @@ fn manifest_findings(
     findings
 }
 
+// ── Gate 5: no float under identity/ (D13) ──────────────────────────────────
+
+/// The subtree the float gate guards. D13 refuses a float at the DECISION boundary, and this is
+/// where the decision lives.
+const IDENTITY_DIR: &str = "crates/opencmdb-core/src/identity";
+
+/// Rust's float type names. `f16`/`f128` are not stable yet; D13's clause is *"no float"*, not "no
+/// `f64`", so the gate names all four rather than the two that exist today.
+const FLOAT_TYPES: [&str; 4] = ["f32", "f64", "f16", "f128"];
+
+/// The float token, or a float literal, in a line of CODE — comments stripped.
+///
+/// D13: *"**REFUSED: `rule -> confidence: f64`.** A float compares, averages, thresholds — and we
+/// are back to invented weights via the back door. **If the output is a float, B has won in
+/// disguise.**"* [architecture.md:956-958].
+///
+/// # What it catches, and what it does not
+///
+/// It strips comments (see [`strip_line_comment`]) and then looks for two shapes:
+/// a **word-bounded** float type name from [`FLOAT_TYPES`] — a type position, `let x: f64`, `as
+/// f64` — and a **float literal**, recognised by [`float_literal_kind`], which is a real
+/// tokeniser rather than a substring search: `0.85`, `1e-3`, `1.`, `0.85f64`, `1f32`.
+///
+/// The word boundary is load-bearing in BOTH directions and each direction was measured: without it
+/// `let x: f64` is caught but so is `fn a_f64_never_decides()` and `f32x4::splat(1)`, and an earlier
+/// revision of this gate reddened on both. There is no substring fallback: a float type inside a
+/// longer identifier is not a float type.
+///
+/// Known limits, stated because a comment asserting a checkable property gets checked:
+/// - a float inside a **block comment** `/* … */` is NOT stripped and reds — a false POSITIVE. None
+///   exists under the guarded subtree today; if one appears, that is the sentence to revisit.
+/// - `#[doc = "…"]` is not stripped and would red on a float in its text. None exists under the
+///   guarded subtree today.
+/// - [`strip_line_comment`] tracks double quotes but not `'"'` char literals and not strings that
+///   span lines, so a line containing an odd number of `"` can mis-classify a following `//`. None
+///   exists under the guarded subtree today.
+/// - a **hex float** (`0x1p3`, not stable Rust) is not recognised, and neither is a float built at
+///   runtime from integers — a gate over source text cannot see the second one at all.
+///
+/// ⚠️ **The stripping does far more work than "tolerate one citation", and that was MEASURED.**
+/// Removing it makes this gate report many offenders on the committed tree rather than one, because
+/// a story reference in prose — `5.4b`, `4.6a`, `4.7a` — is a digit-dot-digit, so the literal rule
+/// that catches `let confidence = 0.85;` also catches story numbers written in doc comments. The two
+/// features are load-bearing together: the literal rule is what makes the gate catch an untyped
+/// weight, and the stripping is what makes the literal rule usable at all. The gap is ASSERTED by
+/// `the_stripping_is_what_makes_the_literal_rule_usable` — many offenders on the raw lines, zero on
+/// the code parts — rather than quoted here as a figure, because a number in a comment rots and an
+/// assertion does not. _(An earlier revision of this doc did quote one, and it was stale within the
+/// same story: the doc said 47, the tree it described gave 45, and the tokeniser that replaced the
+/// matcher moved the figure again. Three values for one sentence is the argument for asserting
+/// instead of quoting.)_
+fn line_has_float(line: &str) -> Option<&'static str> {
+    let code = strip_line_comment(line);
+    for token in FLOAT_TYPES {
+        if contains_word(code, token) {
+            return Some("float type");
+        }
+    }
+    float_literal_kind(code)
+}
+
+/// The code part of a line: everything before a `//` that is not inside a string literal.
+///
+/// The naive `line.find("//")` this replaces truncated at a `//` **inside** a string, so
+/// `let sep = "//"; let c: f64 = 0.85;` was reported clean — the missed float was not in the string,
+/// it was the code after it. Measured before the fix.
+fn strip_line_comment(line: &str) -> &str {
+    let b = line.as_bytes();
+    let mut in_string = false;
+    let mut i = 0;
+    while i < b.len() {
+        match b[i] {
+            b'\\' if in_string => {
+                i += 2;
+                continue;
+            }
+            b'"' => in_string = !in_string,
+            b'/' if !in_string && b.get(i + 1) == Some(&b'/') => return &line[..i],
+            _ => {}
+        }
+        i += 1;
+    }
+    line
+}
+
+/// A float literal in a line of code, tokenised rather than pattern-matched.
+///
+/// A numeric literal starts where a digit is preceded by neither an identifier character nor a `.`
+/// — the second exclusion is what keeps a nested tuple field access (`t.0.1`) and a dotted quad
+/// (`"192.168.0.1"`) from reading as floats. The body then takes digits and `_`, at most **one**
+/// dot, and an optional exponent; a second dot means the token is not a numeric literal at all (an
+/// IP address, a version, `1..2`'s range operator). Finally the suffix is read: an empty suffix
+/// makes it a float only if a dot or an exponent was seen, an `f32`/`f64`/`f16`/`f128` suffix makes
+/// it a float regardless (`1f32`), and any other suffix means this was never a Rust numeric literal
+/// (`5.4b` is a story number, `0xFF` is hex) and is not reported.
+///
+/// # Returns
+///
+/// The label to show the developer, or `None`. The label distinguishes a suffixed literal from a
+/// bare one because the fix differs: one is a declared float, the other is an `f64` by inference.
+fn float_literal_kind(code: &str) -> Option<&'static str> {
+    let b = code.as_bytes();
+    let ident = |c: u8| c.is_ascii_alphanumeric() || c == b'_';
+    let mut i = 0;
+    while i < b.len() {
+        if !b[i].is_ascii_digit() || (i > 0 && (ident(b[i - 1]) || b[i - 1] == b'.')) {
+            i += 1;
+            continue;
+        }
+
+        let mut j = i;
+        let mut dots = 0;
+        let mut exponent = false;
+        while j < b.len() {
+            match b[j] {
+                c if c.is_ascii_digit() => j += 1,
+                b'_' => j += 1,
+                b'.' if dots == 0 && b.get(j + 1) != Some(&b'.') => {
+                    dots += 1;
+                    j += 1;
+                }
+                b'.' => break,
+                b'e' | b'E'
+                    if !exponent
+                        && (matches!(b.get(j + 1), Some(c) if c.is_ascii_digit())
+                            || matches!(
+                                (b.get(j + 1), b.get(j + 2)),
+                                (Some(b'+') | Some(b'-'), Some(c)) if c.is_ascii_digit()
+                            )) =>
+                {
+                    exponent = true;
+                    j += if b[j + 1].is_ascii_digit() { 2 } else { 3 };
+                }
+                _ => break,
+            }
+        }
+        // A second dot means this is not one numeric literal: `192.168.0.1`, `1.2.3`.
+        if b.get(j) == Some(&b'.') && matches!(b.get(j + 1), Some(c) if c.is_ascii_digit()) {
+            i = j + 1;
+            continue;
+        }
+
+        let suffix_start = j;
+        while j < b.len() && ident(b[j]) {
+            j += 1;
+        }
+        let suffix = code[suffix_start..j].trim_start_matches('_');
+        if FLOAT_TYPES.contains(&suffix) {
+            return Some("float literal with an f32/f64 suffix");
+        }
+        if suffix.is_empty() && (dots == 1 || exponent) {
+            return Some("bare float literal");
+        }
+        i = j.max(i + 1);
+    }
+    None
+}
+
+/// No float may reach a decision — D13's clause, held mechanically rather than by accident.
+///
+/// Before this gate the rule was true by measurement only: the whole workspace contained zero
+/// `f32`/`f64` in code. A gate is what keeps it true.
+///
+/// It walks [`IDENTITY_DIR`] **recursively**, because the architecture's own source tree names a
+/// future `identity/field_decision/` [architecture.md:3370-3372] and a flat read would go blind the
+/// day it is created.
+///
+/// It **fails CLOSED** on two conditions, not one: the directory missing, and the directory present
+/// but holding no `.rs` file. The DDL gate reports "nothing to check" when its directory is absent,
+/// but that directory does not exist yet; this one does, so its disappearance is a finding — the
+/// fixture gate's reasoning, *"reporting 'nothing to check' on the deletion of the thing being
+/// guarded is a guarantee the gate does not have"*. The second condition is the likelier accident:
+/// moving `cascade.rs` to a new module leaves `identity/` standing, and a gate that answers
+/// `no float in code across 0 file(s)` to that is reporting a pass over nothing.
+fn gate_float_free(root: &Path) -> Result<(bool, String)> {
+    let dir = root.join(IDENTITY_DIR);
+    if !dir.exists() {
+        return Ok((
+            false,
+            format!(
+                "{IDENTITY_DIR} is missing — the guarded subtree must exist for this gate to mean anything"
+            ),
+        ));
+    }
+
+    let mut offenders = Vec::new();
+    let mut checked = 0usize;
+    for entry in walkdir::WalkDir::new(&dir)
+        .into_iter()
+        .filter_map(Result::ok)
+    {
+        let p = entry.path();
+        if p.extension().and_then(|e| e.to_str()) != Some("rs") {
+            continue;
+        }
+        let content =
+            std::fs::read_to_string(p).with_context(|| format!("reading {}", p.display()))?;
+        checked += 1;
+        for (i, line) in content.lines().enumerate() {
+            if let Some(what) = line_has_float(line) {
+                let shown = p.strip_prefix(root).unwrap_or(p);
+                offenders.push(format!("{}:{}: {what}", shown.display(), i + 1));
+            }
+        }
+    }
+
+    if checked == 0 {
+        return Ok((
+            false,
+            format!(
+                "{IDENTITY_DIR} holds no .rs file — the guarded code has moved and this gate is \
+                 reporting a pass over nothing"
+            ),
+        ));
+    }
+
+    offenders.sort();
+    if offenders.is_empty() {
+        Ok((
+            true,
+            format!("no float in code across {checked} file(s) under {IDENTITY_DIR}"),
+        ))
+    } else {
+        Ok((
+            false,
+            format!(
+                "{} float(s) where a decision is made — D13 refuses it:\n      {}",
+                offenders.len(),
+                offenders.join("\n      ")
+            ),
+        ))
+    }
+}
+
 // ── Check 3: views-hash staleness (informational) ───────────────────────────
 
 fn check_views_hash(root: &Path) -> Result<String> {
@@ -1481,4 +1733,243 @@ opencmdb-core v0.1.0 (/w/crates/opencmdb-core)
             MAX_CODE_LINES + 1
         );
     }
+
+    // ── float-free gate (D13) ────────────────────────────────────────────────────────────────
+
+    /// The line classifier, shape by shape.
+    ///
+    /// Every case below was MEASURED against the previous revision of this matcher, which searched
+    /// for digit-dot-digit and for the bare substrings `f32`/`f64`. Five of them came back wrong:
+    /// two legal float spellings passed (`1e-3`, `1.`) and three innocent lines reddened (a dotted
+    /// quad, a nested tuple field, an identifier merely containing `f64`). They are pinned
+    /// individually rather than by one example because each has its own reason.
+    #[test]
+    fn float_line_classifier_catches_types_suffixes_and_bare_literals() {
+        // A float TYPE, word-bounded.
+        assert_eq!(line_has_float("    let _x: f64 = 0.0;"), Some("float type"));
+        assert!(line_has_float("fn w(x: f32) -> f32 { x }").is_some());
+        assert!(line_has_float("    let y = n as f64;").is_some());
+
+        // A suffix binds to the digits, so there is no word boundary before the `f`.
+        assert_eq!(
+            line_has_float("    let confidence = 0.85f64;"),
+            Some("float literal with an f32/f64 suffix"),
+            "a suffixed literal escapes a word-boundary match"
+        );
+        assert!(line_has_float("    let c = 1f32;").is_some());
+        assert!(line_has_float("    let c = 0.5_f64;").is_some());
+
+        // A bare literal carries no f32/f64 token at all, and is an f64 by inference. This is the
+        // likeliest shape an invented weight actually takes.
+        assert_eq!(
+            line_has_float("    let confidence = 0.85;"),
+            Some("bare float literal"),
+            "a bare decimal literal is a float even with no type named"
+        );
+        assert!(line_has_float("    let c = 1_000.0;").is_some());
+
+        // The two spellings the digit-dot-digit rule was measured to MISS. Both are `f64`.
+        assert!(
+            line_has_float("    let confidence = 1e-3;").is_some(),
+            "exponent form carries no dot at all and was green before"
+        );
+        assert!(line_has_float("    let c = 2E10;").is_some());
+        assert!(
+            line_has_float("    let confidence = 1.;").is_some(),
+            "a trailing dot is a float and was green before"
+        );
+        assert!(line_has_float("    let c = 2. * x;").is_some());
+
+        // Comments are stripped: the architecture may be quoted.
+        assert!(
+            line_has_float("/// *\"REFUSED: `rule -> confidence: f64`\"* [architecture.md:956]")
+                .is_none(),
+            "a citation of D13 is prose, not a float"
+        );
+        assert!(line_has_float("//! the algebra refuses f64 outright").is_none());
+        assert!(line_has_float("    let n = 1u32; // not an f64 either").is_none());
+
+        // A `//` INSIDE a string is not a comment. Before the stripper tracked quotes, this line
+        // truncated at the literal and the float after it was never seen.
+        assert!(
+            line_has_float("    let sep = \"//\"; let c: f64 = 0.85;").is_some(),
+            "a // inside a string must not hide the code that follows it"
+        );
+        assert!(line_has_float("    let u = \"http://h/x\"; let c = 0.85;").is_some());
+
+        // Things that merely look like floats. The last three reddened before the tokeniser.
+        assert!(
+            line_has_float("/// [architecture.md:967-974]").is_none(),
+            "a line-number range is not a float"
+        );
+        assert!(
+            line_has_float("    let a = t.0;").is_none(),
+            "a tuple field access is not a float"
+        );
+        assert!(
+            line_has_float("    let a = t.0.1;").is_none(),
+            "a NESTED tuple field access is not a float either — it reddened before"
+        );
+        assert!(
+            line_has_float("    for i in 1..32 {").is_none(),
+            "a range is not a float"
+        );
+        assert!(line_has_float("    let s: u32 = 42;").is_none());
+        assert!(
+            line_has_float("        assert_eq!(ip, \"192.168.0.1\");").is_none(),
+            "a dotted quad has three dots and is no numeric literal — it reddened before, and \
+             story 5.5 writes IP literals under the guarded subtree"
+        );
+        assert!(
+            line_has_float("        let v = \"0.9.0\";").is_none(),
+            "a three-part version is not a float"
+        );
+        assert!(
+            line_has_float("    fn a_f64_never_decides() {}").is_none(),
+            "an identifier merely CONTAINING f64 is not a float type — it reddened before"
+        );
+        assert!(
+            line_has_float("    let v = f32x4::splat(1);").is_none(),
+            "nor is a wider SIMD type whose name starts with f32"
+        );
+        assert!(
+            line_has_float("        let s = \"story 5.4b\";").is_none(),
+            "a story number has a suffix that is no Rust suffix, so it is not a literal"
+        );
+        assert!(
+            line_has_float("    let x = 0xFF;").is_none(),
+            "a hex integer is not a float"
+        );
+    }
+
+    /// The stripping is not an optimisation, and this is the assertion that says so.
+    ///
+    /// Run the same two checks the gate runs, but on the RAW line instead of the code part, and the
+    /// real tree yields many offenders where the gate yields none — because every story number and
+    /// line-range citation in a doc comment is a digit-dot-digit. The exact figure is deliberately
+    /// NOT written down: a count in a comment rots, and this assertion does not.
+    #[test]
+    fn the_stripping_is_what_makes_the_literal_rule_usable() {
+        let root = workspace_root();
+        let dir = root.join(IDENTITY_DIR);
+        let mut raw_hits = 0usize;
+        for entry in walkdir::WalkDir::new(&dir)
+            .into_iter()
+            .filter_map(Result::ok)
+        {
+            if entry.path().extension().and_then(|e| e.to_str()) != Some("rs") {
+                continue;
+            }
+            let content = std::fs::read_to_string(entry.path()).expect("readable");
+            for line in content.lines() {
+                let typed = FLOAT_TYPES.iter().any(|t| contains_word(line, t));
+                if typed || float_literal_kind(line).is_some() {
+                    raw_hits += 1;
+                }
+            }
+        }
+
+        let (green, msg) = gate_float_free(&root).expect("the gate runs");
+        assert!(green, "the gate itself is green on the real tree: {msg}");
+        assert!(
+            raw_hits > 10,
+            "without stripping the same checks must flood — they found only {raw_hits}, so either \
+             the guarded subtree lost its doc comments or the stripping is no longer load-bearing"
+        );
+    }
+
+    /// The gate itself, against a temp tree — the walk, the recursion, and the missing directory.
+    ///
+    /// Testing only [`line_has_float`] would leave all three untested while the gate read as
+    /// covered, so this drives `gate_float_free` end to end.
+    #[test]
+    fn float_gate_walks_recursively_strips_comments_and_fails_closed() {
+        let root = scratch("float-gate");
+        let guarded = root.join(IDENTITY_DIR);
+        let nested = guarded.join("field_decision");
+        std::fs::create_dir_all(&nested).expect("nested dir");
+
+        // A quotation of D13, which must NOT red — the regression the stripping exists for.
+        std::fs::write(
+            guarded.join("cascade.rs"),
+            "/// *\"REFUSED: `rule -> confidence: f64`\"* [architecture.md:956-958]\npub fn ok() {}\n",
+        )
+        .expect("write");
+        let (green, msg) = gate_float_free(&root).expect("the gate runs");
+        assert!(green, "a float quoted in a doc comment must not red: {msg}");
+
+        // A real float in a NESTED file: proves the walk recurses.
+        std::fs::write(nested.join("weights.rs"), "pub fn w() -> f64 { 0.5 }\n").expect("write");
+        let (green, msg) = gate_float_free(&root).expect("the gate runs");
+        assert!(
+            !green,
+            "a float in a nested subdirectory must red — a flat read would go blind"
+        );
+        assert!(
+            msg.contains("field_decision/weights.rs"),
+            "the message names the offending file: {msg}"
+        );
+
+        // A bare literal, in the guarded directory itself.
+        std::fs::remove_file(nested.join("weights.rs")).expect("rm");
+        std::fs::write(guarded.join("score.rs"), "pub fn w() { let _c = 0.85; }\n").expect("write");
+        let (green, msg) = gate_float_free(&root).expect("the gate runs");
+        assert!(!green, "a bare float literal must red: {msg}");
+
+        // FAILS CLOSED when the directory still stands but holds no Rust file — the likelier
+        // accident of the two, and the one that used to report `0 file(s)` as a PASS.
+        std::fs::remove_file(guarded.join("cascade.rs")).expect("rm");
+        std::fs::remove_file(guarded.join("score.rs")).expect("rm");
+        let (green, msg) = gate_float_free(&root).expect("the gate runs");
+        assert!(
+            !green,
+            "a guarded subtree with no .rs file must RED, not pass over nothing: {msg}"
+        );
+        assert!(msg.contains("no .rs file"), "{msg}");
+
+        // FAILS CLOSED when the guarded subtree is gone — the fixture gate's reasoning, not the
+        // DDL gate's: this directory exists today, so its disappearance is a finding.
+        std::fs::remove_dir_all(&guarded).expect("rm -r");
+        let (green, msg) = gate_float_free(&root).expect("the gate runs");
+        assert!(
+            !green,
+            "a missing guarded subtree must RED, not report 'nothing to check': {msg}"
+        );
+        assert!(msg.contains("missing"), "{msg}");
+
+        let _ = std::fs::remove_dir_all(&root);
+    }
+
+    /// The gate is GREEN on the real tree — and the committed D13 citation is why that is a claim
+    /// worth pinning rather than a tautology.
+    ///
+    /// `crates/opencmdb-core/src/identity/cascade.rs` quotes *"REFUSED: `rule -> confidence: f64`"*
+    /// in a `///` block, and a naive line grep would red on it. This test is what keeps the stripping
+    /// from being removed as "an optimisation".
+    ///
+    /// ⚠️ The premise is pinned to the citation's TEXT, not to the substring `f64`. It was pinned to
+    /// the substring first, and that guard went inert inside the same story: `cascade.rs` gained
+    /// further `f64` tokens in other doc comments, so deleting the citation left the assertion green
+    /// while its message still claimed it would catch that — MEASURED by renaming the citation and
+    /// watching the substring form stay green.
+    ///
+    /// The property the gate actually holds is *"no float token in CODE under the guarded subtree"*,
+    /// never *"there is only one `f64` in the workspace"*. **No count is written here on purpose**:
+    /// the workspace figure moved the moment this file gained a `FLOAT_TYPES` constant, and the first
+    /// draft of this very paragraph quoted the pre-tokeniser number.
+    #[test]
+    fn float_gate_is_green_on_the_real_tree_despite_the_committed_d13_citation() {
+        let root = workspace_root();
+        let (green, msg) = gate_float_free(&root).expect("the gate runs");
+        assert!(green, "the real tree carries no float in code: {msg}");
+        assert!(msg.contains("no float in code"), "{msg}");
+
+        let cascade = root.join(IDENTITY_DIR).join("cascade.rs");
+        let source = std::fs::read_to_string(&cascade).expect("cascade.rs is readable");
+        assert!(
+            source.contains("confidence: f64"),
+            "the citation this gate must tolerate has moved or gone — if it was removed on purpose, \
+             this test's premise is what needs revisiting"
+        );
+    }
 }