diff --git a/docs/known-gaps.md b/docs/known-gaps.md
index 499712835..9e010cdc4 100644
--- a/docs/known-gaps.md
+++ b/docs/known-gaps.md
@@ -31,7 +31,7 @@
 |---|---|
 <!-- @generated:gap-counts START (do not edit — `bun scripts/state.ts --write`) -->
 | HIGH | 77 |
-| MED | 200 |
+| MED | 201 |
 | LOW | 86 |
 | Nominal (spec-ahead-of-impl) | 7 |
 <!-- @generated:gap-counts END -->
@@ -49,6 +49,14 @@
 
 <!-- ⚑ S391-bryan filing — ONE retroactive entry, and the reason it is retroactive IS the finding. The S385 4(b) mandate records a PA ruling as `prov=pa-ruled:` ON THE GAP'S `@gap` MARKER, and the FIRST exercise of the mandate ruled an item that HAD no marker: "S386 observation 3", a route observation carried in `docs/changes/s385-decision-queue/DECISION-QUEUE.md` and ruled from there, never filed as a ledger entry. So the boot-report count the mandate depends on has read **0** since the class was created, and would keep reading 0 for every ruling on an unfiled item. That is base §10 — the obligation and the probe must resolve to the SAME artifact — recurring inside the mandate written to close a different instance of it. This entry supplies the artifact for the ruling that already landed; whether the mandate should ALSO bind rulings on non-gap items (a route observation, a decision-queue row, an adopter issue) is a change to the class itself and is therefore bryan's. -->
 
+<!-- ⛑ S395-bryan filing — TWO entries, both PA-CONFIRMED BY EXECUTION on merged main `908a631c`, both surfaced by the #815 arc rather than by building anything. Both are the SAME ROOT as the entry #815 closed — the shared `bare-expr` handler under an active `tildeContext` — which is why #815 is correctly scoped as one position of a class and NOT the class. The dev agent declined the first of these deliberately rather than half-fix it, and that judgment is endorsed here: closing it touches the §32 tilde-accumulator semantics and the fix direction rests on a reading of §17.6.2 that has not been ruled. -->
+
+### g-bare-expr-in-if-arm-rebinds-tilde-context-corrupting-the-result-var — a bare-expression statement inside an if-as-expression arm mints a FRESH `_scrml_tilde_N` **and rebinds `tildeContext.var`**, so a following explicit `lift` writes the wrong variable and the binding stays `null`. **PA-CONFIRMED BY EXECUTION on merged main `908a631c`, and it survives #815.** `const label = if (@n > 0) { note("a") lift "pos" } else { lift "neg" }` compiles **exit 0, zero diagnostics** and emits `let _scrml_tilde_5 = _scrml_note_2("a");` then `_scrml_tilde_5 = "pos";` inside the then-arm, while the real result var `_scrml_tilde_4` keeps its `null` seed — so `label` is **always null on the true path**. ⛑ **AND THE SIBLING ARM LEAKS A GLOBAL.** With `else { lift "neg" }` the else-arm emits `_scrml_tilde_5 = "neg"`, a name `let`-declared INSIDE the then-block and therefore **not in scope** there. PA-verified the emitted client artifact is a **classic script** (`<script src=…>`, no `"use strict"`, no `type="module"`), so this is a silent **implicit global**, not a `ReferenceError`. ⛑ **A REVIEWER CLAIMED #815 REMOVES THIS `ReferenceError` CLASS; ADJUDICATED BY EXECUTION AND IT IS HALF TRUE** — with a SUGAR else (`else { "neg" }`) the else-arm correctly writes the outer `_scrml_tilde_4` and the class IS gone; with an explicit-`lift` else it is NOT, and the explicit-`lift` form is the one §17.6.1's canonical grammar documents. **This is the canonical production** `'{' statement* lift-stmt statement* '}'` — the shape §17.6.9 example 4 documents — and the corpus misses it on a technicality: `samples/compilation-tests/gauntlet-s19-phase2-control-flow/phase2-if-as-expr-intermediate-014.scrml` uses a `let`-decl as its intermediate statement, which does NOT rebind; only a bare EXPRESSION does. **Candidate governing sentence, PA-read not ruled:** §17.6.2 — *"Execution within an arm body is unrestricted: the arm body MAY contain variable declarations, **function calls**, server calls… Only one `lift` statement designates the result; **other statements are side effects or intermediate computation**."* If that governs, a bare call is normatively a side effect and NOT a result designator, the emitter contradicts it, and this is conformance restoration rather than a design fork. Direction is `semantics-changed`, so it is OUTSIDE the S385 4(b) class either way and owes a measured differential. **RULING OWED (bryan): accept the §17.6.2 reading, or rule the §32 question explicitly — does a bare expression inside an if-as-expression arm participate in the `~` accumulator?** — `NEW S395-bryan (surfaced by the dev agent during #815, declined by it deliberately, then PA-reproduced)`; **HIGH**; open
+<!-- @gap id=g-bare-expr-in-if-arm-rebinds-tilde-context-corrupting-the-result-var sev=HIGH status=open locus=compiler/src/codegen/emit-logic.ts:1723,1882(the shared bare-expr handler: under an active tildeContext it emits `let _scrml_tilde_N = <expr>;` AND rebinds tildeContext.var — correct §32 pipeline semantics, wrong for a §17.6.2 arm body) prov=empirical:PA-two-sided-execution-on-merged-main-908a631c-then-arm-binds-null-and-explicit-lift-else-arm-writes-an-out-of-scope-name-in-a-non-strict-classic-script -->
+
+### g-nested-if-as-expression-arm-body-binds-null-silently — a NESTED if-as-expression used as an arm body is not the exactly-one-`bare-expr` shape, so the §17.6.10 sugar redirect declines and the binding is **silently `null` at exit 0 with zero diagnostics**. Reproduced by the S239 adversarial pass on the #815 branch: `const label = if (@n > 0) { if (@n > 3) { "big" } else { "small" } } else { "neg" }` emits `let _scrml_tilde_14 = "big";` / `let _scrml_tilde_15 = "small";` inside the nested `if`, leaving the outer `_scrml_tilde_13` at its `null` seed. ⛑ **Filed as a DIRECTION defect, not as a missing feature.** §17.6.1 enumerates expression position as a `const`/`let` RHS or a direct operand; an `if` as an arm body's sole content is NEITHER, so the shape is **unspecified** — and *making it work is a widening that is bryan's call.* What is a defect independent of that ruling is that an unspecified shape fails **SILENTLY** rather than loudly: the same fail-silent-vs-fail-loud axis that decided the #811 landing order and that the derived-cell sibling gets RIGHT (`const <label> = if (…)` fails loud with `E-CODEGEN-INVALID-LOGIC`). Neither #815 conformance case pins this shape, so nothing guards the regression window. — `NEW S395-bryan (S239 adversarial finding on #815, reviewer-reproduced; PA has NOT independently re-executed this one — RELAYED-VERIFIED-BY-REVIEWER)`; **MED**; open
+<!-- @gap id=g-nested-if-as-expression-arm-body-binds-null-silently sev=MED status=open locus=compiler/src/codegen/emit-logic.ts:4439(the `length === 1 && kind === "bare-expr"` shape test declines a nested if-expr arm body and falls through to the null-seeded path) prov=empirical:reviewer-reproduced-during-the-S239-pass-on-815-not-independently-PA-re-executed -->
+
 ### g-if-chain-all-arms-run-at-module-init — every arm of a mutually-exclusive `if=`/`else` chain executes its `${…}` body at module init, in source order, **last writer wins** — so a cell declared or written in the DEAD arm overwrites the live one. **PA-CONFIRMED BY EXECUTION.** `<div if=@open>${ <n>: number = 1 }…</div><div else>${ <n>: number = 2 }…</div>` with `@open = true` emits BOTH `_scrml_cs_reactive_set("n", 1)` and `_scrml_cs_reactive_set("n", 2)` at module init; `@n` is **2**, the dead arm's value, while the `if` arm is the one that mounts. Exit 0, zero diagnostics. SPEC §17.1.1 *Desugaring* is explicit that the chain desugars to `${ if (…) {…} else if (…) {…} else {…} }` — exactly one arm runs. ⚑ **THE ROOT IS PRE-EXISTING AND WIDER THAN THE CHAIN.** PA-verified on untouched `main`: a LONE `<div if=@open>${ <n>: number = 1 }…</div>` with `@open = **false**` STILL emits `reactive_set("n", 1)`. So "only the taken arm runs" has never held, and §17.1 calls `if=` sugar over `${ if(expr) { lift … } }`, which the lone shape already contradicts. ⚑ **Introduced-shape note, stated plainly:** before the S393 if-chain class fix the chain arms were DEAD (zero `reactive_set`), so this delta brings the chain into parity with the already-non-conforming lone shape rather than creating a new class — and **no currently-correct program regresses**, because anything depending on those statements was already broken. Corpus blast radius MEASURED ZERO (1 changed line across 2,198 files, and not this shape). **This is a RULING, not a fix:** closing it means deciding whether a markup `${…}` body is a FILE-SCOPE statement or a BRANCH-SCOPED one, and the answer changes lone `if=` too — which is why the landing branch did not absorb it. — `NEW S393-bryan (S239 re-review of the if-chain class fix; PA reproduced both the chain shape AND the pre-existing lone-shape root)`; **MED**; open
 <!-- @gap id=g-if-chain-all-arms-run-at-module-init sev=MED status=open locus=searched:codegen/collect.ts:collectTopLevelLogicStatements,codegen/reactive-deps.ts — the collectors now reach every branch body and hoist each to module init; the SCOPING decision (file-scope vs branch-scope for a markup ${} body) has no single locus and is a ruling prov=empirical:PA-execution-both-arms-emit-reactive-set-last-wins-AND-the-lone-if-shape-fires-with-a-FALSE-condition-on-untouched-main -->
 
@@ -58,8 +66,8 @@
 ### g-timer-in-if-chain-branch-never-starts — a `<timer>` declared inside an `if=`/`else` chain branch is never started: `_scrml_timer_start` count **0** on the chain shape vs **1** on the lone-`if=` oracle. **PRE-EXISTING and byte-identical before/after the S393 if-chain class fix** — a sibling of the same class living in the LIFECYCLE emitter rather than in `symbol-table.ts` / `collect.ts` / `reactive-deps.ts`. Verified no module-init body leak in either chain shape (timer nested in a branch, and timer AS the branch element). **RELAYED from the S239 re-review; not PA-reproduced.** — `NEW S393-bryan (S239 re-review of the if-chain class fix)`; **MED**; open
 <!-- @gap id=g-timer-in-if-chain-branch-never-starts sev=MED status=open locus=searched:the-lifecycle-emitter-that-owns-_scrml_timer_start — not traced; the class is the same if-chain descent blind spot prov=review:S239-re-review-RELAYED-pre-existing-byte-identical-across-the-delta -->
 
-### g-value-form-sugar-in-bound-position-emits-null — the §17.6.10 single-expression sugar is normative for **every** if-as-expression arm body, but the emitters implement it only in the interpolation-sole-content path; in **bound** position the value is silently discarded and the binding is `null`. **PA-CONFIRMED BY EXECUTION on `f6e1720c`, two-sided.** `<x>: int = 1` + `${ const label = if (@x > 0) { "pos" } else { "neg" }  lift <p id="a">${label}</p> }` compiles **exit 0, zero diagnostics** and emits `let _scrml_tilde_1 = null;` then a FRESH SHADOWED local per branch (`let _scrml_tilde_2 = "pos"`) that is discarded — so `label` is **always null**. The explicit-`lift` twin is the control and emits `_scrml_tilde_1 = "pos"` correctly. **The governing sentence is the amendment's own:** `SPEC.md:11888` — *"An if-as-expression arm body SHALL produce its result value via a `lift` statement, **or** by being exactly one expression, which is sugar for `lift` of that expression (§17.6.10). These are the only two ways an arm body produces a value."* §17.6.1 defines expression position as including the RHS of a `const`/`let`, and the amended grammar carries no sole-content-of-an-interpolation condition. ⚑ **Under the PRE-amendment §17.6.2 this emit was CONFORMING** (a lift-less arm contributes `not`, and `null` is `not`) — the SPEC edit alone made it non-conforming, which is the over-claiming-row shape in mirror image. ⚑ **And the only diagnostic that could have surfaced it was normatively retired in the same edit:** `:11893` states an exactly-one-expression arm `SHALL NOT` surface `W-LIFT-001` — a code with **zero** fire sites in `compiler/src/` against a live §34 catalog row. — `NEW S393-bryan (S239 review of the already-merged #802; PA re-executed rather than relayed)`; **HIGH**; open
-<!-- @gap id=g-value-form-sugar-in-bound-position-emits-null sev=HIGH status=open locus=searched:emit-html.ts,emit-each.ts,emit-control-flow.ts — all three implement the sugar only in the interpolation-sole-content path; the bound `_scrml_tilde_N` assign-in-branches lowering was never taught it, and the responsible emit site was NOT traced prov=empirical:PA-two-sided-execution-sugar-emits-shadowed-locals-and-null-while-the-explicit-lift-twin-assigns-correctly -->
+### g-value-form-sugar-in-bound-position-emits-null — the §17.6.10 single-expression sugar is normative for **every** if-as-expression arm body, but the emitters implement it only in the interpolation-sole-content path; in **bound** position the value is silently discarded and the binding is `null`. **PA-CONFIRMED BY EXECUTION on `f6e1720c`, two-sided.** `<x>: int = 1` + `${ const label = if (@x > 0) { "pos" } else { "neg" }  lift <p id="a">${label}</p> }` compiles **exit 0, zero diagnostics** and emits `let _scrml_tilde_1 = null;` then a FRESH SHADOWED local per branch (`let _scrml_tilde_2 = "pos"`) that is discarded — so `label` is **always null**. The explicit-`lift` twin is the control and emits `_scrml_tilde_1 = "pos"` correctly. **The governing sentence is the amendment's own:** `SPEC.md:11888` — *"An if-as-expression arm body SHALL produce its result value via a `lift` statement, **or** by being exactly one expression, which is sugar for `lift` of that expression (§17.6.10). These are the only two ways an arm body produces a value."* §17.6.1 defines expression position as including the RHS of a `const`/`let`, and the amended grammar carries no sole-content-of-an-interpolation condition. ⚑ **Under the PRE-amendment §17.6.2 this emit was CONFORMING** (a lift-less arm contributes `not`, and `null` is `not`) — the SPEC edit alone made it non-conforming, which is the over-claiming-row shape in mirror image. ⚑ **And the only diagnostic that could have surfaced it was normatively retired in the same edit:** `:11893` states an exactly-one-expression arm `SHALL NOT` surface `W-LIFT-001` — a code with **zero** fire sites in `compiler/src/` against a live §34 catalog row. **RESOLVED S395-bryan via #815 (`908a631c`)** — `_emitValueFormSugarArm` + `tildeVar` threaded through `emitIfExprAltChain`. PA-verified on MERGED main, not on the branch: reproducer C emits `_scrml_tilde_3 = "pos"` and the arm-local `let _scrml_tilde_N = "…"` count is **0**. Differential 2 of 7408, both the new conformance cases, ZERO pre-existing corpus files — and the zero is EXPLAINED, not assumed: a PA census finds exactly **5** bound-position sites in the whole corpus, all in `samples/compilation-tests/gauntlet-s19-phase2-control-flow/`, and all 5 write the explicit `lift` form. ctrl-023 / ctrl-024 FAIL on base and PASS on head. ⛑ **TWO CORRECTIONS TO THIS ENTRY AS FILED.** (a) Its `locus=searched:` named three files and the responsible site was in NONE of them — it is `emit-logic.ts`, a FOURTH file, reached via the `const-decl`/`let-decl` dispatch through `node.ifExpr`. The searched-set was not merely incomplete, it was disjoint from the answer; routed to the nav-maps per base §5 (a locus error that recurs across dispatches is a map gap wearing a brief's clothes). (b) Its claim *"the explicit-`lift` twin is the control and is correct"* holds for the LOCAL binding ONLY. For a DERIVED CELL (`const <label> = if (…)`) **both** forms fail with `E-CODEGEN-INVALID-LOGIC` — so anyone building against that sentence would be working from a false control. That derived-cell failure is NOT a defect: §17.6.3 names only `const`/`let` binding sites, so a derived state cell is an UNSPECIFIED shape failing LOUD (the safe direction); making it work is a WIDENING and is bryan's. (Asymmetry recorded: `const <label> = match @level { … }` in a derived cell DOES work and ships as a conformance case.) — `NEW S393-bryan (S239 review of the already-merged #802; PA re-executed rather than relayed)`; **HIGH**; resolved S395
+<!-- @gap id=g-value-form-sugar-in-bound-position-emits-null sev=HIGH status=resolved locus=compiler/src/codegen/emit-logic.ts(emitIfExprDecl + BOTH branches of emitIfExprAltChain; the S393 entry recorded locus=searched: over emit-html.ts,emit-each.ts,emit-control-flow.ts and the real site was in NONE of the three) — all three implement the sugar only in the interpolation-sole-content path; the bound `_scrml_tilde_N` assign-in-branches lowering was never taught it, and the responsible emit site was NOT traced prov=empirical:PA-two-sided-execution-sugar-emits-shadowed-locals-and-null-while-the-explicit-lift-twin-assigns-correctly -->
 
 ### g-value-form-shall-overclaims-each-and-markup-branch-positions — §17.6.10's placement `SHALL`s claim positions that render nothing. `SPEC.md:12199` says a sole-content control-flow statement whose every branch is one expression **SHALL** render the selected branch's value, and `:12209` says the value-form **SHALL** be available in **every** markup `${…}` position **including inside an `<each>` body**. Reported shapes that satisfy that text and render nothing at exit 0 with zero diagnostics: a markup-valued branch (`${ if @shown { <b>YES</b> } else { <i>NO</i> } }` → two empty blocks, markup dropped) and a value-form `match` in an `<each>` body (→ the literal artifact line `// each: empty logic interpolation skipped`). A fourth position hard-fails `E-CODEGEN-INVALID-LOGIC`. ⚑ **The BEHAVIOUR is pre-existing** (base-vs-build emitted-JS byte-diff empty; tracked as `g-each-inline-value-form-match-or-markup-branch-interp-dropped`) — **what is NEW is the `SHALL` that now claims them.** Markup is an expression under §7.4.1 and the `:12191` grammar carries no markup carve-out; only the code comments do. **RELAYED-UNVERIFIED — reviewer-reported, NOT PA-reproduced.** Reproduce before acting. — `NEW S393-bryan (S239 review of #802)`; **HIGH**; open
 <!-- @gap id=g-value-form-shall-overclaims-each-and-markup-branch-positions sev=HIGH status=open locus=compiler/SPEC.md:12199+12209(the two placement SHALLs) prov=review:S239-pass-on-802-RELAYED-UNVERIFIED-behaviour-is-pre-existing-the-SHALL-is-new -->
@@ -2590,7 +2598,7 @@ Reuse-inside-iteration is a bread-and-butter UI pattern; the silent-nothing mode
 <!-- @gap id=g-each-inline-value-form-match-or-markup-branch-interp-dropped sev=MED status=open locus=compiler/src/codegen/emit-each.ts(the value-form-if fix lowers a non-markup value-form if only; a value-form match-stmt and a markup-valued if branch return null from _eachValueFormIfRaw → the empty-interp skip, silently) prov=rationale:S369-S239-review-finding-value-form-match-in-each-and-if-with-span-branch-both-emit-empty-logic-interpolation-skipped-no-error-PA-repro -->
 > **⚑ S369-peter: two residuals of [[g-each-inline-value-form-if-interp-dropped]], PA-reproduced.** After the value-form-`if` fix, two shapes still render empty with NO diagnostic (the S239 pass flagged the silent-drop it re-cements): (1) a value-form `${ match r.n { 10 :> "ten" _ :> "other" } }` in an each interp; (2) a value-form `if` whose branch VALUE is markup (`${ if c { <span>big</span> } else { "small" } }`). Both are pinned as RESIDUAL PINs in the merge-blocker test (assert the skip). ⚠ This creates a *works-then-silently-breaks* trap: the non-markup value-form `if` now works, so an adopter trusts it, then a markup-branch or a `match` variant silently fails. **Fix direction (peter-lane, two parts): (a) LOWER these shapes — a value-form `match` via a raw equality cascade (mirror `emitMatchExpr` arm conditions), a markup-branch value-form `if` via the (open) GITI-032 markup-value-in-each path; AND (b) make the recognized-but-unlowered case LOUD** — a `W-EACH-VALUE-FORM-CONTROL-FLOW-DROPPED` warning (built + verified at S369 but held back: shipping a new emitted code wants its §34 catalog row + emitter provenance, deferred to this fix so the code + catalog land together, per the #416 nested-`if`-warning precedent). Repro-first re-derive before building.
 
-### g-each-value-form-if-markup-fn-call-branch-stringifies — a value-form `if` inside an `<each>` whose branch CALLS a markup-returning fn renders `[object HTMLSpanElement]`; the identical ternary MOUNTS the node, and pre-#670 the same source rendered EMPTY — a WORSENING introduced by #670 — `NEW S371-bryan (review-floor S239 pass on the merged #670); MED; open`
+### g-each-value-form-if-markup-fn-call-branch-stringifies — a value-form `if` inside an `<each>` whose branch CALLS a markup-returning fn renders `[object HTMLSpanElement]`; the identical ternary MOUNTS the node, and pre-#670 the same source rendered EMPTY — a WORSENING introduced by #670 — **RESOLVED S392-peter** (the marker has carried `status=resolved` with a bite-proven `prov=` since then; this HEADING still read `open`, so a heading-based sweep saw an open entry the field-based probe saw closed. Heading corrected S395-bryan — no status change, the two representations just now agree). — `NEW S371-bryan (review-floor S239 pass on the merged #670); MED; resolved S392`
 <!-- @gap id=g-each-value-form-if-markup-fn-call-branch-stringifies sev=MED status=resolved locus=RESOLVED:emit-each.ts-set-interpExprNode-to-the-if-stmt-for-the-value-form-if-case+markup-return-scan.js-interpMayYieldNode-now-recurses-if-stmt-branch-bodies prov=empirical:S392-peter-value-form-if-now-emits-the-identical-_scrml_each_mv-instanceof-Node-mount-path-as-the-twin-ternary-bite-proven-on-clean-HEAD -->
 
 **RESOLVED S392 (Peter).** Root confirmed by execution on HEAD `76f97a59`: the value-form `if` already lowers (via `_eachValueFormIfRaw`) to the SAME ternary string the twin `${cond ? a : b}` emits, but the `markupCapable` discriminant (`emit-each.ts` ~1509) reads `interpExprNode`, which is populated ONLY from `body[0].exprNode` — an `if-stmt` carries none, so it stayed null → `interpMayYieldNode(null,…)` false → the String() text path (`_scrml_each_tn` + `textContent = String(badge(it))` → `[object HTMLSpanElement]`). Fix (exactly the ledger's anticipated direction, peter-lane, additive): (1) `emit-each.ts` sets `interpExprNode = stmt` for the value-form-`if` case; (2) `markup-return-scan.js` `interpMayYieldNode` now recurses an `if-stmt`'s branch bodies (`consequent`/`body`/`alternate`; a bare-expr's `exprNode` is the branch value; `alternate` may be a nested `if-stmt` for an else-if cascade). A value-form-`if` whose branch CALLS a markup-returning fn now routes to the mount path — the emitted JS is byte-shape-identical to the twin ternary (`const _mv = (cond ? badge(...) : badge(...)); if (_mv instanceof Node) appendChild`). A NON-markup value-form-`if` returns false → text path, unchanged. Gate: `compiler/tests/unit/g-each-value-form-if-markup-fn-call-branch-stringifies.test.js` (5 cases — mount + else-if cascade + ternary control + NON-markup-stays-text no-regression + node --check; bite-proven RED on clean HEAD: the mount + else-if cases fail unfixed, controls pass). each/match/markup/value-form suites green (1575/0). — `RESOLVED S392 (Peter); was MED; resolved`
diff --git a/docs/pr-reviews.md b/docs/pr-reviews.md
index 33e346789..722adb08f 100644
--- a/docs/pr-reviews.md
+++ b/docs/pr-reviews.md
@@ -1040,3 +1040,7 @@ surface, safe to take only because he is not live** ([[review-floor-is-shared-su
 <!-- @review pr=809 verdict=carve-out by=S393-bryan date=2026-09-01 probe=docs-only, MEASURED: 4 files — the return leg to peter, docs/pr-reviews.md, docs/changes/s393-if-chain-class/BRIEF.md, handOffs/delta-log.md; ZERO matching ^(compiler/|stdlib/|conformance/cases/|scripts/); direction=inert. ⚑ The CONTENT is PA execution, not correspondence: peter's channel-mount matrix was re-run independently (his correction CONFIRMED, plus a FOURTH cell he did not have — one <each> in the arm deletes E-CHANNEL-MOUNT-IN-CONDITIONAL, which is what shows his limb (b) IS arc (b), already ratified+promoted at S385, so no ruling is owed) and his colorless-async matrix reproduced four-cell. Delivery verified against origin/main, not against a status: field the author wrote — the S385 last-hop failure. note=return-leg-delivered-and-verified-on-origin-main -->
 <!-- @review pr=810 verdict=carve-out by=S393-bryan date=2026-09-01 probe=docs-only, MEASURED: handOffs/dpa-queue.md + handOffs/delta-log.md; ZERO code-bearing. Content: the two adopter Direction issues banked as dpa-038/dpa-039 in the ONLY file the dPA drains (S319 — banked elsewhere is never banked). dpa-038 carries a PA-verified fact that removes a third of its question: 6nz has ZERO service-worker files, ZERO manifest, ZERO serviceWorker references, so the "offline-first PWA" the adopter was told to copy is a README design-GOAL line, not a shipped pattern. dpa-039 carries the opposite warning: its five premises are adopter-surveyed and phase 1 of that DD must verify them BY EXECUTION. note=banking-with-one-fact-established-and-one-explicitly-unverified -->
 <!-- @review pr=811 verdict=finding by=S393-bryan date=2026-09-01 probe=CODE-BEARING, emit-changing — TWO adversarial passes with a fix round between them, plus PA reproduction of every load-bearing claim. Closes the if-chain descent class across TEN walks on ast-if-chain.js. ⚑ The dispatch brief's traced root was WRONG (type-system.ts visitNode had no case, so the ENTIRE chain subtree was unvisited; symbol-table.ts was blind but secondary) and a second brief premise was wrong in the DANGEROUS direction (a comment above a deliberately-TOTAL walk, which routing would have NARROWED) — both caught by the brief's own verify-instruction. Governing-sentence gate discharged BEFORE dispatch: SPEC.md:2071 §6.1.1 makes the branch-declared cell's read legal, so the accepting half is base §8 toward-the-contract restoration, not a widening. BOTH HALVES LANDED TOGETHER because removing the false error alone converts a loud failure into a silent blank render (PA-reproduced two-sided); reactive-deps.ts alone did NOT clear the bar, producing subscribed reads of a cell never created. Acceptance = exact lone-if oracle parity 1/1/4/3, PA-verified and re-verified on merged main. ⚑ AN AGENT WALKED INTO A SERVER LEAK AND BACKED OUT: closing collectFunctions puts a server fn BODY in client.js with no server.js; reverted, filed HIGH, LEAK GUARD proven to red on exactly that mistake. Evidence: double-emission probed over 2,198 files (40 descents, 0 duplicates, positive control 16); oracle parity on 7 shapes incl. elseBranch/nested/inside-each/inside-component; migration round 1 = 6 files +8 E-SCOPE-001 and nothing else, round 2 = 1 emit change on a REJECTING compile; security ABSOLUTE not differential (2,269 bundles per tip, same 56 files, byte-identical marker sets); conformance 889/889. LANDED WITH ONE KNOWN SPEC DIVERGENCE, filed: g-if-chain-all-arms-run-at-module-init — every arm's ${} body runs at module init, last writer wins, against §17.1.1. Landed because the property NEVER held (PA-verified: a LONE if= with a FALSE condition still fires its body on untouched main), so this is parity with existing non-conformance, no currently-correct program regresses, corpus impact measured zero. Closing it is a RULING about markup-${}-body scoping and changes lone if= too. note=class-closed-server-leak-backed-out-one-known-spec-divergence-landed-and-filed -->
+<!-- @review pr=812 verdict=carve-out by=S395-bryan date=2026-09-02 probe=docs-only, MEASURED not assumed: `gh pr diff 812 --name-only` returns 6 files — docs/changelog.md, docs/pr-reviews.md, hand-off.md, handOffs/delta-log.md and two handOffs/incoming/read/ archivals — and ZERO matching ^(compiler/|stdlib/|conformance/cases/|scripts/); direction=inert. This is the S393 wrap. Same structural recursion #541 recorded: a floor binding MERGED PRs can never read zero at the instant a floor-recording wrap merges. note=s393-wrap-docs-only -->
+<!-- @review pr=813 verdict=carve-out by=S395-bryan date=2026-09-02 probe=docs-only, MEASURED: exactly 3 files — docs/changelog.md, hand-off.md, handOffs/delta-log.md; ZERO code-bearing. S394-peter's continuity wrap; the PR body states "no compiler source touched" and the file list CONFIRMS it rather than relying on the claim. ⛑ The CONTENT is adopter-ops verification, not bookkeeping: the assetManagement `854a6a9b` pin was dog-fooded on scrml HEAD and is cleared to bump — compiles clean, 200 routes SSR, SPA soft-nav swaps without the stacked-views regression, all 10 portal views confirmed, no scrml defect found. Merged by S395-bryan under standing merge-auth (gate green; `tracking` red is the known-filed non-required job) specifically so it would not collide with the S395 wrap on the same three shared docs. note=peter-dogfood-continuity-am-pin-cleared -->
+<!-- @review pr=814 verdict=carve-out by=S395-bryan date=2026-09-02 probe=generated-artifact-only, MEASURED: the scheduled nav-map + @generated regen job. No hand-authored change; the content is machine-produced by project-mapper + scripts/state.ts and is gated by its own --check. Landed automatically between the S394 and S395 landings. note=scheduled-maps-and-generated-regen -->
+<!-- @review pr=815 verdict=finding by=S395-bryan date=2026-09-02 probe=CODE-BEARING, emit-changing — full S239 adversarial pass run PA-side (a codegen dev-agent cannot invoke /code-review in-agent), returning 3 findings, all LOW, none blocking, two of them PRE-EXISTING and adjacent rather than introduced. Closes g-value-form-sugar-in-bound-position-emits-null: SPEC §17.6.2's single-expression sugar was normative for every arm body but implemented only in the interpolation-sole-content path, so a bound `const label = if (@n>0) { "pos" } else { "neg" }` compiled exit 0 with zero diagnostics and bound null forever. ⛑ THE FILED LOCUS WAS DISJOINT FROM THE ANSWER — the entry recorded `locus=searched:` over emit-html.ts/emit-each.ts/emit-control-flow.ts and the responsible site was in NONE of the three; it is emit-logic.ts, reached via the const-decl/let-decl dispatch through node.ifExpr. Routed to the nav-maps per base §5. PA-VERIFIED INDEPENDENTLY OF THE AGENT, and on MERGED main rather than on the branch: reproducer emits `_scrml_tilde_3 = "pos"` with an arm-local `let _scrml_tilde_N` count of 0. Direction is semantics-changed — the class every gate is weakest against — so it owed a MEASURED differential: 2 of 7408 artifacts, both the new conformance cases, ZERO pre-existing corpus files, and the agent's first run was thrown out as contaminated by a source-set race (1912/1913) and re-run at 1914/1914. The zero is EXPLAINED not assumed: a PA census found exactly 5 bound-position sites corpus-wide, all in gauntlet-s19-phase2-control-flow/, all writing the explicit `lift` form. ctrl-023/ctrl-024 FAIL on base and PASS on head — genuine guards, not dormant fixtures. ⛑ REVIEWER-VS-DEV ADJUDICATED BY EXECUTION: the reviewer claimed the fix removes a ReferenceError/implicit-global class; it does for a SUGAR else arm and does NOT for an explicit-`lift` else arm, which is the form §17.6.1's canonical grammar documents — filed as g-bare-expr-in-if-arm-rebinds-tilde-context-corrupting-the-result-var. NOT WIDENED deliberately: the derived-cell binding still fails loud, §17.6.3 names only const/let binding sites, and making it work is bryan's ruling. Landing hygiene: the agent's progress.md crash-anchor was relocated out of the repo ROOT (untracked on main) into docs/changes/s395-value-form-sugar-bound/ rather than landed as a stray. note=conformance-restoration-with-a-measured-zero-two-adjacent-gaps-filed-and-a-disjoint-locus-corrected -->
diff --git a/handOffs/delta-log.md b/handOffs/delta-log.md
index 6a04aa830..d437a79fd 100644
--- a/handOffs/delta-log.md
+++ b/handOffs/delta-log.md
@@ -3240,3 +3240,11 @@ flagged `(deputy)`, observation-only, recording an agent that landed while the P
 [2024] friction · ⚑ **(S394-peter) I FLOATED A "5-MINUTE SESSION TTL" DEFECT, THEN RETRACTED IT — the instrument was a stale WAL snapshot, not the code.** Chasing login-bounces in the extension tab, I inferred a short session TTL from two rows in a readonly `.scrml-sessions.db`. WRONG: the emitted §52 middleware writes the store record AND the cookie BOTH at `_scrml_session_max_age = 3600` (login.server.js:293/295/300/301) — consistent, no mismatch; my readonly snapshot missed the live server's WAL writes. Actual cause: the `__Host-scrml_sid` cookie is flaky in the claude-in-chrome tab on `http://localhost` (partitioned cookie context) — Peter's own tab held the session fine and all 10 views worked. Read the EMITTED code, not a store file a live server owns; a bounce in an automation tab ≠ a scrml defect. ([[verify-the-bug-class-not-just-reported-instance]].)
 
 [2025] state · **(S394-peter) WRAP.** Dog-food/verification session — scrml compiler UNTOUCHED (no FACTS/state regen; maps unchanged; no code gate to run). Deliverable: aM pin fully de-risked to bump. Continuity landed as a LIGHT wrap on new main `0dc4d014` (which already carries S392 via the #805 merge + bryan's full S393 hand-off): this delta-log [2021]-[2025] + a changelog block + a small additive peter subsection in the hand-off PICKUP — bryan's S393 PICKUP (6 owed rulings + the if-chain spine) preserved verbatim, NOT overwritten. A stale parked branch `wrap/s394-peter-continuity` (built pre-merge on the old #805 tip 3e8a7a4a, delta numbers [2003]-[2007] now superseded) is deleted. 2 memories. Board flipped WRAPPED. Gaps per bryan's S393 close.
+
+[2026] find · **(S395-bryan) THE "INVERTED RULING" WAS THE PA'S OWN MIS-DESCRIPTION, and bryan ruled the substance in one line.** S393 briefed a ratified limb of the S371 value-form ruling as INVERTED by #802; the S395 boot report RELAYED that framing without opening the governing section. It does not survive: **§17.6.4 has said since long before #802** that a missing `else` is valid, that the false path is `not`, and that *"the compiler SHALL NOT emit an error or warning for a missing `else` arm."* The S371 clause read as an inverted limb is, in full, *"with `else` required on every path **(the implementation's real rule, `emit-html.ts:645-670`)**"* — a PA DESCRIPTION of then-current behaviour riding inside a ratified paragraph, and it contradicted §17.6.4 the moment it was written. #802 did not reverse bryan; it made the value-form agree with the bound form. bryan, S395: *"seems ok not to have a trailing else"* → RATIFIED, direction stands. Residual process finding is real but narrower: a dispatch BRIEF edited SPEC text inside a ratified paragraph without returning to him. Third instance of [[feedback_relayed_premises_fail_at_one_in_three]] — verification holds when the PA EXECUTES, fails when it RELAYS.
+
+[2027] land · **(S395-bryan) #815 `908a631c` — the §17.6.2 value-form sugar now binds its result at a binding site; it was ALWAYS null.** Verifying the trailing-else ruling surfaced that the sugar had never worked in bound position at all: `const label = if (@n>0) { "pos" } else { "neg" }` compiled exit 0, zero diagnostics, minting a fresh shadowed `let _scrml_tilde_N` per arm and never writing the result var. Dispatched worktree-isolated to `scrml-js-codegen-engineer`; the fix mirrors the §18.5 match block-arm redirect ALREADY IN THE SAME FILE, sharing the leaf predicate `_blockTailIsValueExpr` but NOT the shape rule (§18.5 is tail-of-many, §17.6.1 is exactly-one — sharing the shape test would have widened §17.6 past its grammar). ⛑ **THE FILED LOCUS WAS DISJOINT FROM THE ANSWER** — `locus=searched:` named emit-html/emit-each/emit-control-flow and the real site is `emit-logic.ts`, a FOURTH file; routed to the nav-maps per base §5. Measured differential 2 of 7408, ZERO pre-existing corpus files, and the zero EXPLAINED by a PA census (5 bound-position sites corpus-wide, all explicit-`lift`). PA re-verified on MERGED main, not on the branch. S239 pass: 3 LOW, none blocking, two pre-existing.
+
+[2028] find · **(S395-bryan) TWO GAPS FILED FROM THE #815 ARC, SAME ROOT, AND ONE OWES A RULING.** `g-bare-expr-in-if-arm-rebinds-tilde-context-corrupting-the-result-var` (HIGH, PA-reproduced on merged main, SURVIVES #815): a bare-expression statement in an arm mints a fresh tilde AND rebinds `tildeContext.var`, so a following explicit `lift` writes the wrong var and the binding stays null — and with an explicit-`lift` else the sibling arm assigns a name block-scoped to the THEN branch, a silent **implicit global** in a PA-verified non-strict classic script. It hits the CANONICAL `'{' statement* lift-stmt statement* '}'` production; the corpus misses it only because `phase2-if-as-expr-intermediate-014.scrml` uses a `let`-decl, which does not rebind. The dev agent DECLINED it deliberately rather than half-fix — endorsed. **Candidate governing sentence §17.6.2** (*"other statements are side effects or intermediate computation"*) would make it conformance restoration rather than a design fork; PA-read, NOT ruled. Direction `semantics-changed` → outside the 4(b) class either way. Second: `g-nested-if-as-expression-arm-body-binds-null-silently` (MED, RELAYED-VERIFIED-BY-REVIEWER, not PA-re-executed) — filed as a fail-SILENT direction defect, not as a missing feature, since §17.6.1 makes the shape unspecified and supporting it is a widening.
+
+[2029] friction · **(S395-bryan) THREE INSTRUMENTS MISREPORTED IN ONE LANDING, ALL CAUGHT BY READING STATE INSTEAD OF AN EXIT CODE.** (1) A `git diff HEAD..origin/main` after a local commit showed my OWN 62-line user-voice entry as a **-62 deletion**, which read as a sibling truncating the append-only ledger; it was the wrong referent, not a violation. (2) `git push … | tail -3` returned 0 while the push was REJECTED by the pre-push generated-doc gate — the pipeline's exit code, not the push's; `echo PUSHED` fired on a failure. (3) The pre-commit hook exceeded a 300s foreground timeout with exit 143, and the commit had **already finalized** — git STATE is authoritative, per the overlay's own note. Same class as the S393 gate-poll miss and [[feedback_the_probe_answered_a_different_question]].