docs(ci-reds): fix the serial-run arithmetic, U9's scope, and add U18

Three corrections to yesterday's correction, and one new row.

The serial-binary measurement was stated as "119 Running and 121 result
lines alternate strictly", which cannot be strict --- the count itself
gave it away. Precisely: 119 ordinary targets each report before the
next starts, and the two extra result lines belong to `Doc-tests pmacs`
and `Doc-tests pmacs_protocol`, which cargo labels differently and runs
last.

The replacement premise did not describe U9 either. Both U9 selectors
live in the ROOT LIB TARGET --- `m6_1_pty_raw_mode_disables_kernel_echo`
(src/process.rs:3945) and `composition_overhead_under_ten_percent`
(src/editor.rs:9717) --- and the sweep runs that target first, finishing
it in about 12 seconds. The sweep's later minutes cannot reach them.
What survives: the sweep re-runs the lib target late in the overall gate
invocation, under unmeasured machine state.

Two stale references to U9's void control are corrected, including the
ledger's claim that a synthetic-load run would "either implicate load or
clear it". It would not: with concurrency fixed at 1 there is no second
arm, so a red shows load is sufficient and a green shows nothing.
Non-reproduction never clears anything under this file's own rerun rule.

U18 is new and a new class. `Test (ubuntu-latest / luajit)` died in
toolchain setup before any cargo command ran: `go install gopls@v0.16.2`
hit an HTTP/2 INTERNAL_ERROR from sum.golang.org while verifying
x/telemetry. Every other row here is a test that failed; this is
infrastructure the workflow depends on failing to answer, and it
presents as a red check indistinguishable from a real one.

docs/active-work.md

@@ -420,6 +420,16 @@ touching crdt-gated code does not rediscover it at CI.
   control**, which is the case U11 motivated it for. It came back **green on the macOS legs**, so the
   inference it could have supplied is **unavailable**; recorded as a
   null result, as R1's row had to record its own;
+- **U18, new** — `Test (ubuntu-latest / luajit)` died in **toolchain
+  setup**, before any `cargo` command ran: `go install gopls@v0.16.2`
+  hit `INTERNAL_ERROR` from `sum.golang.org` while verifying
+  `x/telemetry`. A new class for the registry — every other row is a
+  test that failed; this is infrastructure the workflow depends on
+  failing to answer, and it presents as a red check indistinguishable
+  from a real one. No attribution to the branch is possible: the step
+  precedes compilation, and the other 13 checks passed on the same head.
+  **Not rerun** — a transient network error is expected to pass on
+  retry, which would establish nothing.
 - **U17, new** — that same control run **redded `Test (crdt)` on `main`
   at `aae5b35`**: `read_dir_supersede_cancels_in_flight_predecessor`,
   `first read_dir must be superseded; got ok`. It fails the **opposite**
@@ -1544,9 +1554,14 @@ from #171 and #215.
     only: no mechanism is claimed, and the standing leaked-daemon
     confound is uncontrolled as always.
   - **Cost, stated plainly:** four `--protocol` gate runs on one commit,
-    three of them lost to these two signatures. U9's synthetic-load
+    three of them lost to these two signatures. **This sentence used to
-    control remains unrun and is the cheapest thing that would either
+    add that U9's synthetic-load control "would either implicate load or
-    implicate load or clear it.
+    clear it". It would not.** With cargo running test targets serially,
+    U9's concurrency arm is void and there is no second arm to compare
+    against: a red under synthetic load shows load is **sufficient**, and
+    a green shows nothing — non-reproduction never clears anything under
+    this file's own rerun rule. See the correction on U9 in
+    `docs/ci-red-signatures.md`.
 - **Rustdoc split, FOUR occurrences on this branch** (`screen_size`,
   `peer_may_send_panel_events`, `send_panel_pointer`, and
   `SemanticRenderState`). Always the same mechanism: inserting an item

docs/ci-red-signatures.md

@@ -1220,16 +1220,32 @@ because it was false.** Every row in it is a wall-clock budget asserted
 inside a workspace-wide test run. This paragraph used to add that
 "`cargo test --workspace` starts many test binaries at once". **It does
 not. Cargo runs test targets SERIALLY, one executable at a time**, and
-this project's own gate logs measure it: in
+this project's own gate logs measure it. In
-`20260831T093655Z-857818/07-sweep.log`, 119 `Running` markers and 121
+`20260831T093655Z-857818/07-sweep.log` (and reproduced on
-`test result:` lines alternate strictly — **zero** cases of one binary
+`20260831T130742Z-2805186`): **119 ordinary targets, each of which
-starting before the previous one reported. The pattern is `RTRTRT…`.
+reports its result before the next one starts** — zero cases of one
+`Running` line following another. **The 121st and 122nd result lines are
+not targets**: they belong to the two doc-test groups, `Doc-tests pmacs`
+and `Doc-tests pmacs_protocol`, which cargo labels differently and runs
+after everything else. An earlier version of this paragraph called the
+whole thing "strictly `RTRTRT…`" with 119 and 121, which cannot be
+strict — the count itself gave it away.
 
 So the budgets do **not** compete with the rest of the sweep in the way
-this family assumed. What is still true is smaller: a sweep is a long
+this family assumed.
-sequence of binaries, so any budget inside it runs at an arbitrary point
+
-in a multi-minute step, on whatever the machine is doing then. A 4.5%
+**And the first replacement for that premise did not describe U9
-overshoot on a 1ms budget remains not a signal about the code.
+either.** It said a budget "runs at an arbitrary point in a multi-minute
+step". **U9's two selectors are both in the root lib target** —
+`m6_1_pty_raw_mode_disables_kernel_echo` (`src/process.rs:3945`) and
+`composition_overhead_under_ten_percent` (`src/editor.rs:9717`) — and
+the sweep runs that target **first**, finishing it in about 12 seconds
+of a multi-minute step. The sweep's later minutes cannot reach them.
+
+What survives is narrower still: **the sweep re-runs the lib target late
+in the overall gate invocation**, after `03-lib` and `04-lib-crdt` have
+already run it, under machine state nobody measured. A 4.5% overshoot on
+a 1ms budget remains not a signal about the code.
 
 **And U9's named control does not discriminate what it claimed** —
 "pin test-binary concurrency to 1" pins something that is *already* 1.
@@ -1295,11 +1311,19 @@ PTY selector.
 | **relation to U6** | its selector, alone again, in U6's own step. U6's instruction to judge that separately is honoured for the second time — see U9, which did the same |
 | **relation to U9** | the same budget-plus-PTY co-failure, in `04-lib-crdt` rather than `11-sweep`, with `setsid_escapee…` where U9 had `m6_1_pty_raw_mode…` |
 
-**This family has now produced U6, U9, U10 and U12, and the
+**This family has now produced U6, U9, U10 and U12 — and the control
-discriminating control U9 named is STILL UNRUN**: pin test-binary
+U9 named no longer exists to run.** It had two halves. *Pin test-binary
-concurrency to 1, and separately load a lone `--lib` binary. Four
+concurrency to 1* is **VOID**: cargo already runs targets serially, so
-incidents is enough evidence that the family will keep costing review
+it pins nothing (see U9). *Separately load a lone `--lib` binary under
-rounds until someone runs it.
+synthetic load* survives as an experiment but is **not a discriminator**
+— with concurrency fixed at 1 there is no second arm to compare against,
+so a red would show load is **sufficient** to produce one, and a green
+would show nothing at all. **It could never "clear" load**, and this
+file's own rerun rule says why.
+
+Four incidents is enough evidence that the family will keep costing
+review rounds. What it needs is a control someone designs, not the one
+written down.
 
 ### U14 — FOUR selectors red in ONE gate run, across three stages
 
@@ -1569,6 +1593,46 @@ sharing a subject is not sharing a signature.
 disposition both apply, and there is no branch here whose merge this
 would gate.
 
+### U18 — a Go module checksum fetch fails before anything is built
+
+Recorded on the CRDT identity-undo lane, 2026-08-31,
+`Test (ubuntu-latest / luajit)` on PR #246 at `a7c4b3a`
+([job 99499800716](https://github.com/levineuwirth/pmacs/actions/runs/33395769472/job/99499800716)).
+**A new class for this file: nothing was built and no test ran.** The
+job died in its toolchain-setup step.
+
+| field | value |
+|---|---|
+| **selector** | none — this is not a test. The failing step is `go install golang.org/x/tools/gopls@v0.16.2`, part of the LSP fixture setup |
+| **job / flavor** | GitHub Actions, `Test (ubuntu-latest / luajit)` |
+| **required fragments** | `sum.golang.org/tile/` + `stream error` + `INTERNAL_ERROR; received from peer`, while `verifying module: golang.org/x/telemetry` |
+| **status** | **new incident, one occurrence** |
+| **what IS established** | the failure is a **checksum-database read over HTTP/2**: `reading https://sum.golang.org/tile/8/0/x114/644: stream error: stream ID 41; INTERNAL_ERROR; received from peer`. `gopls@v0.16.2` and the `x/telemetry` pin both downloaded successfully first; only the sum-database verification failed. Job duration 1m45s, exit code 1 |
+| **what is NOT** | anything about this repository. **No `cargo` command ran**, no test executed, and the pinned versions are the point — the workflow comments say the pin exists so "CI behaviour" does not "drift with upstream releases" |
+| **attribution** | **none to the branch.** The step runs before any pmacs code is compiled, and the other 13 checks passed on the same head |
+
+**Why it gets a row at all.** Every other row here is a test that
+failed. This is **infrastructure the workflow depends on failing to
+answer**, and it presents as a red check indistinguishable from a real
+one at a glance. A future occurrence should be recognisable as this
+rather than investigated as a product defect, which is the whole
+purpose of a signature.
+
+**It is genuinely external, and that is a claim with a limit.** The
+fragments name `sum.golang.org` — Google's checksum database — returning
+an HTTP/2 stream error. Nothing in this repository can produce that.
+What this repository *does* control is whether a transient upstream
+outage fails a whole matrix leg, and that is a real question this row
+does not answer: `GOFLAGS=-mod=mod`, `GONOSUMDB`/`GONOSUMCHECK`, a
+vendored `gopls`, or simply retrying the step are all options with
+different costs, and choosing among them is not this lane's work.
+
+**No rerun was performed**, and deliberately: U3's lesson is to read the
+log first, and the log is now read and quoted above. Whether a rerun
+would pass is uninteresting — a transient network error is *expected* to
+pass on retry, and doing so would establish nothing while destroying
+nothing either. It is left for whoever next pushes to this branch.
+
 ### U13 — gate prune-reporting row receives empty child stdout in `sweep`
 
 Recorded during PR #244 review, 2026-08-29, on signed head `756c2b8`.