docs(plan): record the semver guard-chain round

Two coupled findings. The operand decode is the one the ledger asked for;
the carrier union is the pre-existing defect that decode uncovered when its
first measurement loosened 408 probes instead of tightening two.

Records that the carrier repair's 2,575 tightenings are declared-shape
policy restorations rather than helm-abort-justified rejections, with the
ci-values sweep as the evidence they are safe, and notes that the repair
changes the arithmetic of the reverted traefik `not`-decode lane: part of
what its 111 airflow flips measured was the union dropping sibling typings,
not base classification.

Author: romnn

plan/chart-corpus-expansion.md

@@ -10960,3 +10960,84 @@ integration tests (`task test:integration`), `task lint` and `cargo fmt
 the pre-round fixtures. `task -t …/luup2/deployment/charts/taskfile.yaml
 check:local` exits 0. Eleven corpus fixtures and three gen fixtures
 regenerated.
+
+## Semver guard chain and member carriers (2026-07-28, forty-seventh round)
+
+kube-prometheus-stack gates all 41 rule files on
+`and (semverCompare ">=1.14.0-0" $kubeTargetVersion)
+(semverCompare "<9.9.9-9" $kubeTargetVersion) .Values.defaultRules.create
+… .Values.defaultRules.rules.X`, where `$kubeTargetVersion :=
+default .Capabilities.KubeVersion.GitVersion
+.Values.kubeTargetVersionOverride`. Go's `and` short-circuits, so deleting
+`defaultRules` or `windowsMonitoring` aborts on the dereference that
+follows — unless an override too old for the constraint stops the chain
+first, which is a real, renderable state.
+
+The condition decoder has answered `semverCompare` exactly since the
+capabilities lanes landed. What it could not do was answer for an OPERAND
+of a short-circuit chain: `eval_short_circuit_args` derives each operand's
+execution guard from `direct_raw_identity_path`, so anything that is not a
+raw values path contributes `Approximate { "and operand truthiness" }` —
+and one approximate conjunct silences every capture the LATER operands
+make. Both the policy version and the locals bound to a
+Capabilities-defaulted version now reach the evaluator through `EvalEnv`
+(the same channel `local_truthy_reductions` already uses for a reduced
+boolean flag), and `semver_constraint_predicate` is the one model both the
+decoder and the evaluator call. The predicate stays exact: with the
+override falsy it is the policy version's own verdict, with the override
+truthy it is that string's own match against the constraint pattern.
+
+### The carrier split this exposed
+
+The first measurement closed the two deletions and LOOSENED 408 probes:
+every one of `defaultRules.rules`' 38 declared boolean leaves stopped being
+typed. The host's base had become
+`anyOf[{properties: {alertmanager: …}}, {type: object, properties: {…37}}]`,
+so a document with a junk `alertmanager` simply satisfied the second arm
+and a junk `configReloaders` satisfied the first.
+
+That union is a pre-existing defect the new guard merely reached. A host
+whose object-ness is claimed only under a guard leaves an UNTYPED member
+carrier (`{properties: …}` with no `type`), and `try_merge_compatible`
+opens with `schema_type(a)?` — an untyped carrier fails that test, so two
+carriers for the SAME path fell through to the union fallback. Both
+describe one value and their members conjoin;
+`merge_untyped_member_carrier` merges them member-wise and keeps the weaker
+domain by staying untyped, because re-stamping `type: object` would
+reinstate exactly the unconditional host claim the untyped side dropped.
+The rule is narrow — only fragments whose keys are member keywords
+(`properties`/`additionalProperties`/`patternProperties`/`required`) and
+that actually carry members — so a scalar alternative beside an object arm
+still unions.
+
+### Result
+
+kube-prometheus-stack `defaultRules` and `windowsMonitoring` reject, both
+helm-confirmed ("nil pointer evaluating interface {}.create" /
+".enabled" at `windows.pod.rules.yaml:7`). The 1,848-probe root sweep moves
+those two cells and nothing else, with and without the carrier fix.
+
+The carrier fix is the larger change: 45 of 55 corpus schemas move and the
+full battery reports 2,575 flips over 214 distinct paths, **every one a
+TIGHTEN, zero loosenings anywhere**. They are one class — a declared
+mapping's leaves (`*.enabled`, `*.create`, `service.type`, `pathType`)
+regaining the type their values.yaml default declares, which the union had
+been dropping wherever the host had a single guarded member. They are NOT
+helm-abort-justified: `argo-cd controller.startupProbe.enabled: "audit"`
+renders, because a truthy string works as a gate. They are the
+declared-shape typing this ledger already keeps as policy (see the F80
+kyverno scalar-shadow entry), restored to paths that had silently lost it.
+The strongest evidence that the restoration is safe is the ci-values sweep:
+116 real values files, the same 4 rejected as before.
+
+18 of the audit's 70 root deletions remain.
+
+### Validation
+
+947 unit tests (two new focused reproducers, each verified failing pre-fix:
+the semver-gated host claim and the untyped-carrier merge), 497 integration
+tests (`task test:integration`), `task lint` and `cargo fmt --all --check`
+clean. The ci-values sweep rejects the same 4 of 116 files as the pre-round
+fixtures. `task -t …/luup2/deployment/charts/taskfile.yaml check:local`
+exits 0 over 234 resources. 45 corpus fixtures and 2 gen fixtures
+regenerated.

plan/chart-corpus-status.md

@@ -1,7 +1,10 @@
 # Chart-corpus findings: status ledger
 
-Last reconciled 2026-07-28 after the call-dict navigation round
-(forty-sixth), which extended the navigation base one level over: a helper's
+Last reconciled 2026-07-28 after the semver guard-chain round
+(forty-seventh), which taught a short-circuit chain's operands to carry
+their own decoded condition instead of an approximate marker, and repaired
+the member-carrier union that decode exposed. The call-dict navigation
+round (forty-sixth) extended the navigation base one level over: a helper's
 call dict binds `.config` to `.Values.pdb`, so the body's `.config.enabled`
 navigates that path. The root-scoped `with` round (forty-fifth)
 closed the 5 nats deletions the preceding round could reach but not
@@ -2074,15 +2077,49 @@ strict Kubernetes schema while their valid controls passed.
   battery finds exactly one acceptance flip: the other ten already claimed
   those hosts through their own direct reads.
 
-  The 20 that remain: three are the TEST-TEMPLATE roots (grafana's and
+  **Semver guard chain CLOSED (forty-seventh round).**
+  kube-prometheus-stack's `defaultRules` and `windowsMonitoring` reject.
+  Every rule file gates on `and (semverCompare ">=1.14.0-0" $v)
+  (semverCompare "<9.9.9-9" $v) .Values.defaultRules.create …`, and the
+  condition decoder has answered `semverCompare` exactly for a long time —
+  but an OPERAND of a short-circuit chain took its execution guard from
+  `direct_raw_identity_path` alone, so anything that is not a raw values
+  path stood in as `Approximate`, and one approximate conjunct silences
+  every capture the later operands make. The policy version and the locals
+  bound to a Capabilities-defaulted version now reach the evaluator through
+  `EvalEnv`, and `semver_constraint_predicate` is the single model both the
+  decoder and the evaluator call, so the claim keeps the override's own
+  semantics: a too-old `kubeTargetVersionOverride` short-circuits the chain
+  and the deletion stays accepted. This is the general repair the datadog
+  `fips` lane needs too — its blocking conjuncts are an `include` equality
+  and a `not (or …)`, not a semver comparison.
+
+  The first measurement LOOSENED 408 probes, which uncovered a
+  pre-existing defect the new guard merely reached: a host whose
+  object-ness is claimed only under a guard leaves an UNTYPED member
+  carrier, `try_merge_compatible` opens with `schema_type(a)?`, and two
+  carriers for the SAME path therefore fell through to the union fallback —
+  `anyOf[{properties: {alertmanager}}, {type: object, properties: {…37}}]`,
+  where a junk value in either half satisfies the other arm.
+  `merge_untyped_member_carrier` conjoins them member-wise and keeps the
+  weaker (untyped) domain. That repair moves 45 of 55 corpus schemas and
+  2,575 battery probes, EVERY one a tightening: declared mapping leaves
+  (`*.enabled`, `*.create`, `service.type`) regaining the type their
+  values.yaml default declares. They are not helm-abort-justified — a
+  truthy string works as a gate — they are the declared-shape typing this
+  ledger keeps as policy (see the F80 kyverno scalar-shadow entry),
+  restored where the union had silently dropped it. The ci-values sweep
+  still rejects the same 4 of 116 real values files.
+
+  The 18 that remain: three are the TEST-TEMPLATE roots (grafana's and
   fluent-bit's `testFramework`, kyverno's `test`) — helm RENDERS
   `templates/tests/*` and only filters the output afterwards, so switching
   the corpus harness to the shipped `include_tests` default closes them, but
   kyverno's `test.nodeSelector`/`tolerations` then accept 21 values
   `kubeconform -strict` rejects. Those values RENDER — the claim is about the
   rendered sink, not about the guards a test template adds — so they belong
   to the provider-required-leaf entry (F56/F62/F8) below, not here; the
-  forty-third round corrected that attribution. The other 17 are NOT this mechanism:
+  forty-third round corrected that attribution. The other 15 are NOT this mechanism:
   2 string-parameter calls behind the reverted `upper` catalog entry (harbor
   `logLevel`, oauth2-proxy `httpScheme`), 1 typed call through a `tpl`
   program (airflow `multiNamespaceMode`), 5 YAML-sink text failures (the
@@ -2092,23 +2129,24 @@ strict Kubernetes schema while their valid controls passed.
   reduction from the four `include` results to `$message`'s truthiness is
   what is missing, not the absence case alone), 1 dotted root key (grafana's
   literal `grafana.ini`,
-  "can't evaluate field paths in type string"), and 6 nil-pointer sites the
+  "can't evaluate field paths in type string"), and 4 nil-pointer sites the
   navigated-host lane still cannot reach: istiod's root rewrite and signoz'
   `global` have their own entries, grafana `route` needs `tpl`-program
-  evaluation, datadog `fips` reads `.Values.fips.enabled` directly as the
-  third conjunct of an `and` whose earlier operands do not decode — the
-  capture exists and the guard chain is what blocks it,
+  evaluation, and datadog `fips` reads `.Values.fips.enabled` directly as
+  the third conjunct of an `and` whose earlier operands do not decode — the
+  capture exists and the guard chain is what blocks it, so it wants the
+  same operand-predicate treatment the forty-seventh round gave
+  `semverCompare`, extended to an `include` equality and a `not (or …)`.
   traefik `log` needs an `and` operand's `not` decoded
   exactly (attempted and REVERTED in the forty-second round — the exact
   decode turned previously-approximate captures into guarded member-host
   arms, which emptied declared-mapping bases across airflow, argo-cd, cilium
   and datadog; the forty-third round confirmed that emptying is CORRECT for a
   genuinely guarded-only host, so this needs its own adjudication of the
-  111 airflow flips rather than a fix to base classification), and
-  kube-prometheus-stack's `defaultRules`/`windowsMonitoring` sit behind
-  `semverCompare` against `.Capabilities.KubeVersion` — the accepted
-  approximate-guard limitation, though a structural evaluation of
-  `semverCompare` at the configured target version would close them.
+  111 airflow flips rather than a fix to base classification) — and the
+  forty-seventh round's carrier repair changes that lane's arithmetic,
+  since part of what those flips measured was the union fallback dropping
+  sibling typings rather than the base classification itself.
 
 - **F56/F62/F8/F80/F98 — provider contracts still lose required leaves
   and nested/helper payloads.** The remaining losses are bounded and have