diff --git a/docs/COMMANDS.md b/docs/COMMANDS.md
index fc2b954e..1a5fd42f 100644
--- a/docs/COMMANDS.md
+++ b/docs/COMMANDS.md
@@ -4299,7 +4299,7 @@ $ ./build/ripwire . --callers=rankGraphTeleport --format=bogus
 
 **Answers:** choose the legend posture for every XML verb — use compact when calling repeatedly output legend posture for EVERY XML verb.
 
-MAKING REPEATED CALLS (an agent, a script, a benchmark harness)? USE compact. The legend is a FIXED ~3 KB per call, so its share is a function of ANSWER SIZE, not of the verb: at least 50% of a small --callers/--uses/--impact/--affected answer (and more on --callees and --edit-check), a little of a large --for bundle. Every ROW is byte-identical; the only payload change is a schema="ripwire.<verb>/v1" attribute the root GAINS. The CLI default is full because a human reading ONE map needs the prose; the MCP server already defaults to compact, so the CLI is the path that pays. full is byte-identical to the default. compact keeps every row byte and every data/completeness attribute (counts_floor= capped= shown= total= has_more= next_offset= est_tokens= at= root= graph_ambiguous= …), adds a versioned schema id on the root (schema="ripwire.<verb>/v1") and replaces the explanatory prose with ONE <=400 B legend naming those attributes — the meanings live here and in the full legend. DATA comments stay (the map header, pack-task's body-omitted rows, +more). Per call this drops 2.9-5.2 KB on the navigation verbs (--edit-check 5.2 KB -> <0.4 KB); the MCP twin is the argument legend: on every XML-answering verb, where compact is the DEFAULT and legend:"full" restores this prose (M1, 2026-09-05: the ten-verb MCP edit loop pays 2,866 B of legend instead of 30,839 B). The CLI default stays full. Runs with nothing to compact refuse it, naming the verb: prose/markdown/JSON answers (--situ --recall --report --mermaid --html --plan-lanes --sarif --eval*) and the writers (edit verbs, --note-add, --quality-baseline/--quality-ack, --index-out, --export).
+MAKING REPEATED CALLS (an agent, a script, a benchmark harness)? USE compact. The legend is a FIXED ~3 KB per call, so its share is a function of ANSWER SIZE, not of the verb: at least 45% of a small --callers/--uses/--impact/--affected answer (and more on --callees and --edit-check), a little of a large --for bundle. Every ROW is byte-identical; the only payload change is a schema="ripwire.<verb>/v1" attribute the root GAINS. The CLI default is full because a human reading ONE map needs the prose; the MCP server already defaults to compact, so the CLI is the path that pays. full is byte-identical to the default. compact keeps every row byte and every data/completeness attribute (counts_floor= capped= shown= total= has_more= next_offset= est_tokens= at= root= graph_ambiguous= …), adds a versioned schema id on the root (schema="ripwire.<verb>/v1") and replaces the explanatory prose with ONE legend naming those attributes — the meanings live here and in the full legend. DATA comments stay (the map header, pack-task's body-omitted rows, +more). Per call this drops 2.8-5.8 KB on the navigation verbs (--edit-check 6.3 KB -> 0.5 KB); the MCP twin is the argument legend: on every XML-answering verb, where compact is the DEFAULT and legend:"full" restores this prose (M1, 2026-09-05: the ten-verb MCP edit loop pays 2,866 B of legend instead of 30,839 B). The CLI default stays full. Runs with nothing to compact refuse it, naming the verb: prose/markdown/JSON answers (--situ --recall --report --mermaid --html --plan-lanes --sarif --eval*) and the writers (edit verbs, --note-add, --quality-baseline/--quality-ack, --index-out, --export).
 
 **Try it**
 
diff --git a/src/cli.h b/src/cli.h
index b59d851c..295fb932 100644
--- a/src/cli.h
+++ b/src/cli.h
@@ -2341,7 +2341,7 @@ inline constexpr char kHelpTail[] =
         "    --legend=full|compact      choose the legend posture for every XML verb — use compact when calling repeatedly\n"
         "                               output legend posture for EVERY XML verb. MAKING REPEATED CALLS (an agent, a\n"
         "                               script, a benchmark harness)? USE compact. The legend is a FIXED ~3 KB per call,\n"
-        "                               so its share is a function of ANSWER SIZE, not of the verb: at least 50% of a\n"
+        "                               so its share is a function of ANSWER SIZE, not of the verb: at least 45% of a\n"
         "                               small --callers/--uses/--impact/--affected answer (and more on --callees and\n"
         "                               --edit-check), a little of a large --for bundle. Every ROW is byte-identical; the\n"
         "                               only payload change is a schema=\"ripwire.<verb>/v1\" attribute the root GAINS.\n"
@@ -2351,9 +2351,9 @@ inline constexpr char kHelpTail[] =
         "                               keeps every row byte and every data/completeness attribute (counts_floor= capped= shown=\n"
         "                               total= has_more= next_offset= est_tokens= at= root= graph_ambiguous= …), adds a versioned\n"
         "                               schema id on the root (schema=\"ripwire.<verb>/v1\") and replaces the explanatory prose\n"
-        "                               with ONE <=400 B legend naming those attributes — the meanings live here and in the full\n"
+        "                               with ONE legend naming those attributes — the meanings live here and in the full\n"
         "                               legend. DATA comments stay (the map header, pack-task's body-omitted rows, +more). Per\n"
-        "                               call this drops 2.9-5.2 KB on the navigation verbs (--edit-check 5.2 KB -> <0.4 KB);\n"
+        "                               call this drops 2.8-5.8 KB on the navigation verbs (--edit-check 6.3 KB -> 0.5 KB);\n"
         "                               the MCP twin is the argument legend: on every XML-answering verb, where compact is\n"
         "                               the DEFAULT and legend:\"full\" restores this prose (M1, 2026-09-05: the ten-verb MCP\n"
         "                               edit loop pays 2,866 B of legend instead of 30,839 B). The CLI default stays full.\n"
diff --git a/src/compactlegend.h b/src/compactlegend.h
index 24de238e..b8aaa213 100644
--- a/src/compactlegend.h
+++ b/src/compactlegend.h
@@ -5,12 +5,13 @@
 // legend, the canonical ten-verb edit loop pays 29,824 B of legend per session for ~9 KB of rows, and the
 // MCP server re-pays it on every call. --for/--grep/--slice grew a compact dialect by hand (each emitter
 // branching on the posture); the other ~60 XML roots are printed by as many emitters. Compact is therefore
-// applied HERE, once, to the finished document: the explanatory comments are replaced by ONE ≤400 B legend
-// (schema id + the verb's purpose + a reading for every completeness attribute the document actually
-// carries), the root gains schema="ripwire.<key>/v1", and every payload byte is untouched — rows, root
-// attributes, CDATA bodies, and the comments that CARRY DATA (the map header's <!-- files= … -->, pack-task's
-// <!-- body omitted … -->, the <!-- +more --> marker, --notes' counted header). The full dialect (the default,
-// and --legend=full) never passes through this file.
+// applied HERE, once, to the finished document: the explanatory comments are replaced by ONE legend (schema id +
+// the verb's purpose + a reading for every completeness attribute the document actually carries), held to that
+// verb's measured byte pin (test/compactlegendcheck.sh pinFor: the pins fit the definitions, docs/METHODOLOGY.md §9),
+// the root gains schema="ripwire.<key>/v1", and every payload byte is untouched — rows, root attributes, CDATA
+// bodies, and the comments that CARRY DATA (the map header's <!-- files= … -->, pack-task's <!-- body omitted … -->,
+// the <!-- +more --> marker, --notes' counted header). The full dialect (the default, and --legend=full) never passes
+// through this file.
 //
 // WHAT IS PROSE. A comment is explanatory prose iff it starts with one of kCompactProsePrefixes and none of
 // kCompactDataPrefixes — the prefixes are the legend openers the emitters use (`<!-- ripwire <verb>: …`, the
@@ -35,10 +36,12 @@
 namespace rw
 {
 
-// One entry per XML root the tool emits. `key` is the schema id stem (ripwire.<key>/v1); `purpose` is the
-// one-clause reading of the verb, ≤ ~110 B so the whole legend stays under the 400 B ceiling with every
-// completeness term present. Roots shared by several verbs (`r` = the ranked map family, `ctx` = the bundle
-// family) are disambiguated by a HINT the caller derives from its own flags (compactLegendHintFromRoot).
+// One entry per XML root the tool emits. `key` is the schema id stem (ripwire.<key>/v1); `purpose` is the reading
+// of the verb and of the root vocabulary EVERY answer of that root carries. Its bytes count against the verb's
+// per-verb pin in test/compactlegendcheck.sh, and that pin is measured from the definitions, never the reverse.
+// Roots shared by several verbs (`r` = the ranked map family, `ctx` = the bundle family) are disambiguated by a
+// HINT: main.cpp compactLegendHint reads it off the answer (the root picks the family, then the mark the answering verb
+// writes), and mcpverbs.h mcpCompactLegendHint keys it by verb name.
 struct CompactLegendSpec
 {
     std::string_view rootTag;
@@ -61,7 +64,13 @@ inline constexpr CompactLegendSpec kCompactLegendSpecs[] =
     { "ctx", "notes",      "field notes by target: <target id= dangling=> holds <note d= sha= branch=>; counts = the rows" },
     { "ctx", "lego",       "ONE interface/base type: <iface n= p= defs= implementors=>, its <m> method contract, every implementor" },
     { "ctx", "expand",     "full bodies: <bodies shown= total= capped=> of <b t= l= p= n= sibs= sibs_total= sibs_capped= inc=>; <calls><c n= l=> resolved callees" },
-    { "ctx", "pack-task",  "one-call task bundle under budget_tokens=: <sigs> ranking > <bodies> > <far> callers > notes > tests_to_run" },
+    // pack-task (2026-09-12, the lane's end): the bundle's own vocabulary reads here, checked against packtask.h. task= is the task
+    // text (a bare --pack-task refuses); <far> is the ranked name-only tier inside <sigs> (renderNameOnlyRows: t= n= p=), of_top=
+    // there the ranked rows it was cut from (topRanked); <calls><c> are a body's callee signatures; <callers> rows are the bodies'
+    // 1-hop neighbours in either direction, rel= which one, of_top= there the bodies that qualified (bodiesTotal), shared= how many
+    // of them a row neighbours (emitted above 1); run= rides a <test> row only when a runner is derivable (testmap.h runHint). The
+    // <d> lens facts and route= ride only some answers and are present-only terms below. compactlegendcheck (D36).
+    { "ctx", "pack-task",  "one-call task bundle for task= under budget_tokens=: <sigs><d n= id= l= p=> ranking, <far><s t= n= p=> ranked but over 1 hop out (of_top= ranked rows) > <bodies><b t= n= p= l=> with <calls><c n= l=> callees > <callers><s rel=caller|callee shared=> 1-hop from the bodies (of_top= bodies; shared= bodies reached, absent at 1) > notes > <tests><test p= run=> (run= when derivable)" },
     { "ctx", "from-trace", "trace frames mapped to indexed symbols, innermost first; the innermost in-corpus body included" },
     { "ctx", "exemplar",   "the best-in-class instance of kind= for the task, chosen by role: <exemplar n= p= in= ccx= tested=>, <bodies><b> to imitate" },
     { "ctx-partitions", "pack-task", "N minimally overlapping agent bundles carved along call-graph communities plus one shared core; each <bundle> wraps a <ctx>" },
@@ -69,7 +78,13 @@ inline constexpr CompactLegendSpec kCompactLegendSpecs[] =
     { "callers",     "callers",     "1-hop CALLERS of of= (defs= matched, count= distinct symbols): <s t= n= p=>; hop_tested=/hop_untested=" },
     { "callees",     "callees",     "1-hop CALLEES of of= (defs= matched, count= distinct symbols): <s t= n= p= role= tested=>" },
     { "uses",        "uses",        "resolvable use-sites of of=: <u role=call|macro|read|write|import|extends|type p=file:line in_id=>" },
-    { "impact",      "impact",      "transitive blast radius of of=: <s t= n= p=> reach set, <f via= p=> importers" },
+    // impact (2026-09-12, the fourth sweep): defs=/reaches=/radius_tested=/radius_untested=/importers= ride EVERY answer of this
+    // root (the CLI XML and columnar forms and the MCP twin all write them) and were defined only by the full legend, so they read
+    // here beside the rows this line already named, present exactly when the root is. Checked against the emitters: reaches= is
+    // transitiveCallers( defs ), the defs themselves excluded; radius_tested= counts isTestedByReach, which never counts a test
+    // symbol (a seed), so a test in the reach set lands in radius_untested=; importers= is impactImportTier's one-hop set of
+    // files whose include/import resolves to a def's file. shown_importers= is a present-only term: the columnar form omits it.
+    { "impact",      "impact",      "transitive blast radius of of=: <s t= n= p=> reach set, <f via= p=> importers; defs= matched, reaches= their transitive callers, radius_tested= non-tests an indexed test reaches, radius_untested= the rest; importers= files that #include/import a def's file" },
     { "path",        "path",        "one DIRECTED call path from= to to=, each <s t= n= p=> a hop; reachable=0 hops=0 when none" },
     { "connect",     "connect",     "minimal joining subgraph: <g> groups, <t> terminals, <s connects=> joins, <e f= t=> edges, <unconnected>" },
     { "at",          "at",          "enclosing-definition chain at p=:l=: sym= innermost, chain= outermost-first, <s n= t= l= el=> spans" },
@@ -85,7 +100,16 @@ inline constexpr CompactLegendSpec kCompactLegendSpecs[] =
     { "slice",       "slice",       "name-based def-use rows of one variable in one definition: <s l= k=def|use|both|scope t= [b= pp= rd=]> (rd= reaching-def lines per reach=cfg|linear), <v n= l= t=> inventory; steps=/depth= flow" },
     // ── change / quality ──
     { "edit-check",   "edit-check",   "sym='s contract NOW vs HEAD: status=unchanged|new-symbol|contract-change; <c n= p= incompatible=1 sites_l=> callers" },
-    { "safe-delete",  "safe-delete",  "can sym= go, a READ never a verdict: callers= impact_reaches= uses= tested_self= risk=; <c n= p= amb=>" },
+    // safe-delete (2026-09-12, the fourth sweep): radius_tested=/radius_untested= ride every answer and read here, by the same
+    // isTestedByReach lens as --impact's pair (verbs_navigate.h runSafeDelete), over impact_reaches= instead of reaches=. The
+    // sweep's last pass read the rest of that root against runSafeDelete: t= and p= are defs[0]'s, the lowest id
+    // resolveAllByNameQualified returns. That is a MATCH, not always a definition (the sweep's design review): on a
+    // header-qualified file:name selector the decl→def widening keeps the declarations beside the definitions it adds
+    // (graph.h declToDefFollowThrough), and a declaration can hold the lowest id, so the reading names the unit defs= counts.
+    // ambiguous_callers= counts callers whose g.ambOut is non-zero; dead_code_candidate=1 needs defs=1, no 1-hop caller,
+    // deadCodeEligibleKind (SymKind::Function with a body, not in a .h/.hpp/.hh/.hxx path) and a whole-word `static` inside the
+    // signature span (quality.h sourceHasStaticToken).
+    { "safe-delete",  "safe-delete",  "can sym= go, a READ never a verdict: callers= impact_reaches= uses= tested_self= risk=; <c n= p= amb=>; radius_tested= non-tests of impact_reaches= an indexed test reaches, radius_untested= the rest; t= p= its lowest-id match's kind and file:line; defs= matched; ambiguous_callers= callers with a call split over several defs; dead_code_candidate=1 only at defs=1 with no caller, for a t=fn with a body, outside .h/.hpp/.hh/.hxx, whose signature spells static (0 never means in use)" },
     { "quality-delta","quality-delta","only what the change made WORSE vs baseline=: regressions= minor= gating=; <r kind= sym= p= was= now= gating= bar=>, <sa> acked" },
     { "test-gate",    "test-gate",    "tests <t p= changed= partner= hops= run=> + untested blast radius <u sym= p= l= ccx=>; exit 4 while either exists" },
     { "affected",     "affected",     "test files that transitively reach the changed files/symbols: <test p= partner= hops= run=> in evidence order (order= partners=); seeded_by= the reading taken" },
@@ -107,11 +131,25 @@ inline constexpr CompactLegendSpec kCompactLegendSpecs[] =
     { "external-surface", "external-surface", "names used but never defined in the index: <x n= lang= refs= calls=>" },
     { "owners",       "owners",       "recency-weighted author ownership (half-life 6mo): <f p= authors= bf= top= share=>; bf=1 = one person holds it" },
     { "cochange",     "cochange",     "files that change together in git: <pair a= b= together= deg= conf_ab= conf_ba= surprising=>, or for of= <f p= together= conf_rev=>" },
-    { "communities",  "communities",  "call-graph modules (Louvain): <community id= size= dir= label=> of <member t= n= p=>" },
-    { "community",    "community",    "ONE module id=: <member t= n= p=> ranked members, its <bridge> edges; size= the TRUE count" },
+    // communities and community (2026-09-12, the fourth sweep): every attribute read below rides EVERY answer of its root
+    // (verbs_report.h emitCommunitiesReport / emitCommunityDrill), so its reading lives in the purpose line, present exactly
+    // when the root is: the zoom/tree precedent below. Checked against the emitters: bridges= on <communities> counts community
+    // PAIRS joined by a cross-community call edge (its <bridge a= b=> rows), one-symbol communities included, so its reading says
+    // community where modules= (2+ symbols only) says module (the sweep's design review); on <community> the PEER communities
+    // of this one, which that line's partition= clause already counts as modules, singletons included;
+    // isolated= counts symbols with neither an in- nor an out-edge, and isolateStats splits it in that precedence (a markdown
+    // section, then a bodyless def, then a header file, else source); dir= is the most common member directory, and
+    // communityPresentation takes a top-level file's own path as its directory; label= anchors on the member with the highest
+    // fan-in, non-accessors first, and appends up to three known leading verbs of member names when any occur; partition= is
+    // the community count (ids 0..partition-1, the range --community refuses outside), modules= nonIsolatedModuleCount.
+    // The sweep's last pass read the rest of both roots: shown_bridges= is the <bridge> rows printed (min( pairs, 12 ), with
+    // bridges_capped= marking a cut) on both; connected_singletons= counts one-symbol communities whose symbol still has an in-
+    // or out-edge (isolateStats); symbols= is ing.symbols.size(). The <bridge> row attributes are present-only terms below.
+    { "communities",  "communities",  "call-graph modules (Louvain): <community id= size= dir= label=> of <member t= n= p=>; drill= the verb taking a row's id=; shown_modules=/shown_bridges= <community>/<bridge> rows listed; bridges= community pairs joined by a call edge; isolated= symbols with no call edge: isolated_doc= doc sections, isolated_decl= other bodyless, isolated_header= other header defs, isolated_source= the rest; modules= modules of 2+ symbols; connected_singletons= 1-symbol modules with a call edge; symbols= indexed symbols" },
+    { "community",    "community",    "ONE module id=: <member t= n= p=> ranked members, its <bridge> edges; size= the TRUE count; dir= its members' most common directory (a top-level file's own path); label= dir::name@file:line:byte of its top fan-in member (non-accessors first) [up to 3 top name verbs]; bridges= modules a call edge joins to it; partition= module count incl. singletons (ids 0..partition-1); modules= those of 2+ symbols; shown_bridges= <bridge> rows listed" },
     // zoom and tree (2026-09-12): symbols=/isolated=/top_modules=/levels_shown= and files= ride EVERY answer of their root and
     // were defined only by the full legend, so they read here beside the levels=/files_unlisted= this line already named.
-    // zoom's line is the (U) --zoom probe's budget: 324 -> 394 B of its 400.
+    // That line moved the (U) --zoom probe's compact legend from 324 to 394 B.
     { "zoom",         "zoom",         "nested module hierarchy: <module level= id= size= dir= shown= capped=> of <member t= n= p=>; levels_shown= of levels= printed; symbols= = isolated= + size= of all top_modules=" },
     { "tree",         "tree",         "each file with its top symbols by rank, files by best symbol: <file p= symbols=> of <s t= n=>; of files= indexed, files_unlisted= have none" },
     { "seams",        "seams",        "cross-directory call edges NO test reaches: <seam from= to= untested= shown= capped=> of <edge caller= p= callee= cp=>" },
@@ -141,7 +179,8 @@ inline constexpr std::string_view kCompactProsePrefixes[] =
 {
     "<!-- ripwire ",                   // every verb's own legend opener (`<!-- ripwire callers/callees: …`), incl. the
                                        // native compact legends of grep/slice (`<!-- ripwire slice ripwire.slice/v1: …`),
-                                       // which this layer restates at ≤400 B; --for's is never routed here (main.cpp)
+                                       // which this layer restates as its own compact legend; --for's is never routed
+                                       // here (main.cpp)
     "<!-- root= ",                     // the shared root-relative-paths block (graphlegend.h)
     "<!-- graph_unindexed=",           // the #66 third-gauge clause where it rides as its OWN comment
                                        // (graphlegend.h graphUnindexedLegendComment — connect/lego/verify/
@@ -218,6 +257,8 @@ struct CompactCompletenessTerm
     std::string_view onTag     = {};      // read ONLY on this element and never on the head: label= on the multi-root <root>
                                           // rows is not the label= --communities carries on its first child
     MapHeaderRead    mapHeader = MapHeaderRead::No;
+    std::string_view valueItem = {};      // with onTag: read only where that attribute's quoted value LISTS this comma-separated
+                                          // item: <cols fields=> naming tested carries the tested column, not every columnar answer
 };
 
 inline constexpr CompactCompletenessTerm kCompactCompletenessTerms[] =
@@ -236,8 +277,8 @@ inline constexpr CompactCompletenessTerm kCompactCompletenessTerms[] =
     // a definition this table never put back: --callers/--callees/--impact, their columnar forms and the MCP impact
     // default all printed these numbers undefined. test/compactlegendcheck.sh (S) reads every conditional attribute the
     // graphlegend.h family emits from source and fails the next one that lands without a row here.
-    // Written to the shortest honest form: a document carrying these is already near the 400 B ceiling, and the
-    // callees answer can carry the first two at once.
+    // Written to the shortest honest form: every byte counts against the verb's pin, and the callees answer can carry the
+    // first two at once.
     { "bodyless_defs",     "bodyless_defs=K: K of defs= have no body, so no callees to read" },
     { "unproven_defs",     "unproven_defs=K: K same-named defs not tied to that file, in no count or row (bare name shows them)" },
     { "declined_calls",    "declined_calls=K: K call sites left unbound (several defs, none chosen), in no count or row" },
@@ -297,6 +338,92 @@ inline constexpr CompactCompletenessTerm kCompactCompletenessTerms[] =
     { "lpin",              "lpin=K: K calls pinned by locality alone (a guess)", true },
     { "overloads",         "overloads=N: N same-name defs merged in this row; shown= counts each", true },
     { "prov",              "prov=scip|binding|import|split: how that <c> edge bound (absent: one unique name); split = one arm of an amb= pick", true },
+    // THE FOURTH SWEEP (2026-09-12): attributes that ride their documents with no reading here, which the earlier sweeps stopped
+    // on at the byte pins. Owner decision: per-verb pins that fit honest definitions (docs/METHODOLOGY.md §9). The unconditional
+    // root vocabulary of --impact, --safe-delete, --communities and --community reads in those roots' purpose lines above, and
+    // the row here is the PRESENT-ONLY half: shown_importers= is impactImportTier's listed <f> rows, ELEMENT-qualified (only
+    // <impact> carries it) and absent from the columnar form, which names the omission in lens=. The sweep also defined the map
+    // header's unresolved=, which sums graph.h's unresolvedOut: three sites raise it and none mints an edge (a name defined in
+    // the tree whose every def was language-filtered, a shadowed, refused or renamed-unlisted ES import binding, a
+    // function-pointer binding with no function target). It had a row of its own until the sweep's design review folded it
+    // into the always-on header clause below (the `files` row): buildStats writes it into EVERY map header beside files=, so
+    // one clause is present exactly when both fields are, and the header-ONLY read still keeps it off <trace unresolved=>,
+    // which counts frames. compactlegendcheck (S) accepts an always-on header field spelled inside that clause.
+    { "shown_importers",   "shown_importers=: <f> rows", true, "impact" },
+    // THE SWEEP'S LAST PASS (2026-09-12) listed every attribute the compact --impact, --safe-delete, --communities,
+    // --community=ID and map-header documents emit and found these still without a reading. Each rides only SOME answers of
+    // its root, so each is a present-only term rather than a purpose-line clause. Checked against the emitters:
+    //   lazy= (serialize.h emitImportRowsXml) is graph.h scanImporterEdges' allLazy over that importer's edges into the def
+    //     files; its full clause is graphlegend.h kImpactImportTierLegend. ELEMENT-qualified on <f>, the importer row.
+    //   <bridge> (verbs_report.h): --communities prints a= b= (a (min,max) community pair), from_label=/to_label= (their
+    //     communityPresentation labels) and edges=; --community prints to= to_label= edges=; --zoom prints a= b= edges= over
+    //     top-module pairs. edges= sums the call edges crossing the pair in both directions on all three. Four terms, because
+    //     the attribute SET differs by root and a reading must not name what its row does not carry.
+    //   the map header (serialize.h buildStats): files= is ing.files.size(), symbols= ing.symbols.size(), edges= the CSR's
+    //     outTargets (graph.h dedupes them per caller, so distinct caller-callee pairs), shown= the kept symbol count (a
+    //     merged overload row counts each def, the map legend's own arithmetic), ambiguous= the sum of every symbol's ambOut,
+    //     unresolved= (above), order= the stable / important-last / important-last(auto:fill) / important-first choice. Absent
+    //     unless it applies: roots= (two or more workspace roots), changed= (--map-diff only, and there even at 0: main.cpp
+    //     counts the INDEXED files git reports changed, and a tree git cannot read counts 0 and ranks uniform, as a clean tree
+    //     does; the sweep's design review), skipped_oversize=,
+    //     unindexed= (ext:count, at most kUnindexedHeaderExts entries) with unindexed_exts= once that list was cut,
+    //     escaped_root=, precise= (edges a SCIP index pinned, prov value 1 only). serialize.h records that the FULL map
+    //     legend cannot define unindexed=/escaped_root= (tokenbudgetcheck arm #3's seven bytes of floor headroom); a compact
+    //     legend replaces more prose than it adds, which compactlegendcheck (U) asserts on every probe, so here they fit.
+    //     Header-ONLY: files=, symbols=, edges=, shown= and order= are quoted attributes with other meanings on other roots.
+    //   the columnar form (columnar.h kColumnarLegend): format="columnar" on the root, <paths> I=path, <cols n= fields=>.
+    //     ELEMENT-qualified on <cols>: --from-trace's <trace format=> names a trace dialect. lens= names what one form of an
+    //     answer withholds and another serves: the columnar --impact (shown_importers,importers_capped), --order=stable's
+    //     <r> (k,est_tokens), the MCP for dialect (churn,amp,tested). Read on the head, with one meaning on all three.
+    { "lazy",              "<f lazy=1>: every edge from that importer into a def file is deferred (in a function/block body, or an autoload), firing only if reached; lazy=0: at least one is load-time", true, "f" },
+    { "a",                 "<bridge a= b=>: two module ids joined by call edges", true, "bridge" },
+    { "from_label",        "from_label=/to_label=: the label= of a=/b=", true, "bridge" },
+    { "to",                "<bridge to= to_label=>: a peer module's id and label=", true, "bridge" },
+    { "edges",             "<bridge edges=>: call edges between the two, either direction", true, "bridge" },
+    { "files",             "files=/symbols=: files and symbols indexed; edges= distinct call edges; shown= symbols printed, a merged row counting each def; ambiguous= calls split over several defs, corpus-wide; unresolved= calls with in-tree evidence and no edge (defs all language-filtered, or import/pointer binding refused); order= rows by rank (important-first, important-last; (auto:fill) = flipped past a size threshold) or by path (stable)", false, {}, MapHeaderRead::Only },
+    { "roots",             "roots=N: N workspace roots", false, {}, MapHeaderRead::Only },
+    { "changed",           "changed=K: K indexed git-changed files seed the PageRank teleport (0: uniform, incl. no git)", false, {}, MapHeaderRead::Only },
+    { "skipped_oversize",  "skipped_oversize=K: K files over a size ceiling, not indexed", false, {}, MapHeaderRead::Only },
+    { "unindexed",         "unindexed=ext:N: N text files of that extension no grammar reads (6 extensions at most)", false, {}, MapHeaderRead::Only },
+    { "unindexed_exts",    "unindexed_exts=E: E such extensions in all, the list cut", false, {}, MapHeaderRead::Only },
+    { "escaped_root",      "escaped_root=K: K files refused: a symlink led out of the root", false, {}, MapHeaderRead::Only },
+    { "precise",           "precise=K: K call edges a SCIP index pinned", false, {}, MapHeaderRead::Only },
+    { "fields",            "format=columnar: parallel arrays, not row attributes: <paths> maps I=path, each <cols> array holds n= comma-separated values in one row order, fields= naming them (the path column indexes <paths>; &#44; is a comma)", true, "cols" },
+    // THE TESTED COLUMN (2026-09-12, the follow-up to the <s tested=> row below). --callers/--callees/--impact --format=columnar
+    // always pass the test-reach lens (verbs_navigate.h), so fields= names tested and columnar.h emitColumnarTestedColumn writes one
+    // DENSE value per row: 1 where graph.h isTestedByReach holds, 0 on every other row, a test symbol's row included. A parallel
+    // array cannot omit a false entry, so unlike the <s> attribute this prints 0, and an answer over a tree with no test carries a
+    // column of zeros: the term reads the COLUMN (a <cols fields=> that lists tested), never a 1. compactlegendcheck (D34)/(D35).
+    { "fields",            "<tested> column: 1 = a non-test row an indexed test transitively reaches; 0 = none found, or a test row", true, "cols", MapHeaderRead::No, "tested" },
+    { "lens",              "lens=: attributes another form of this answer serves, withheld here" },
+    // THE SWEEP'S DESIGN REVIEW (2026-09-12) checked every reading above against its emitter and found one row reading still
+    // missing: tested="1" on <s>. --callers/--callees and --impact (verbs_navigate.h), the MCP impact twin (mcpverbs.h) and the
+    // map's own rows (serialize.h, whose tested[] column computeQMetrics fills by the same predicate) print it where graph.h
+    // isTestedByReach holds: an indexed test transitively reaches that row's symbol and the symbol is not itself a test. Never
+    // a literal 0. ELEMENT-qualified on <s>: flipimpact.h's <h tested=> prints 0 as well as 1 and <exemplar tested=> is another
+    // root's attribute; a <d> signature row's tested= is the next row's. No earlier sweep saw it because the gate fixture holds
+    // no test (compactlegendcheck (D31) builds the smallest tree that prints one).
+    { "tested",            "<s tested=1>: a non-test row an indexed test transitively reaches (absent otherwise, never 0)", true, "s" },
+    // The same lens on the signature rows (2026-09-12, the follow-up): serialize.h's two <d> row writers print tested="1" from
+    // computeQMetrics' tested[] column, which the same isTestedByReach fills, and never a literal 0. main.cpp computes that column
+    // only under --metrics, --for or --exemplar, so the reading rides the answers that computed it (--pack-task --metrics; --for
+    // keeps its native legend). ELEMENT-qualified on <d>, like the row above: flipimpact.h's <d sym=> and the dead-code <d n=>
+    // rows carry no tested=. compactlegendcheck (D33)/(D35).
+    { "tested",            "<d tested=1>: a non-test row an indexed test transitively reaches (absent otherwise, never 0)", true, "d" },
+    // THE LENS FACTS ON <d> ROWS (2026-09-12, the lane's end). serialize.h sigRowHead writes r= on a lens row (rank > 0), cx=/ccx=
+    // under facts.metrics and in= when a fan-in vector was supplied, and packSignatures' lens appends amp= (main.cpp computes it
+    // under --metrics; printed above 0). --pack-task passes metrics and supplies its own fan-in, so every one of its <d> rows
+    // carries the first four, and --from-trace's do too; their full legends define them in a "Row keys" clause, which is prose and
+    // goes. amp= is graph.h's callerCount (direct callers, the in-edge CSR) plus the co-change degree of the symbol's file (the
+    // other files sharing a commit with it in git's 18-month window; 0 without git). ELEMENT-qualified on <d>: the map's <s> rows
+    // carry the same names under the metrics schema's purpose line, and <exemplar in= ccx=> is another root's. route= (serialize.h
+    // ctxRootOpen) rides a bundle whose task was routed to a ranker: --pack-task always, MCP explore unless no_route; it is
+    // ELEMENT-qualified on <ctx>. compactlegendcheck (D36)/(D37).
+    { "r",                 "<d r=N>: rank N in this ranking, rows in r= order", true, "d" },
+    { "ccx",               "<d cx= ccx=>: cyclomatic/cognitive complexity", true, "d" },
+    { "in",                "<d in=N>: N callers in the index (absent: not measured)", true, "d" },
+    { "amp",               "<d amp=N>: direct callers + files sharing a commit with its file (absent at 0)", true, "d" },
+    { "route",             "route=: the ranker the task was routed to, and why", true, "ctx" },
     { "parse_degraded",    "parse_degraded=1: ERROR nodes in that parse", true },
     { "tier_partial",      "tier_partial=1: tier elected under a partial classification" },
     { "dangling",          "dangling=1: matches nothing indexed", true },
@@ -407,6 +534,16 @@ inline std::string_view compactDocHead( std::string_view doc, const CompactRootI
     return doc.substr( root.openBegin, end - root.openBegin );
 }
 
+// The root's FIRST CHILD open tag alone, or empty when the root has no child element. compactDocHead's span runs from the root to
+// that tag and keeps the comments between them (lego/skipped/notes put their legends there), so the child's '<' is the span's LAST
+// one: every comment ends before the child begins, and a tag spells '<' inside an attribute value as &lt;.
+inline std::string_view compactFirstChildTag( std::string_view doc, const CompactRootInfo& root ) noexcept
+{
+    const std::string_view head    = compactDocHead( doc, root );
+    const std::size_t      childAt = head.rfind( '<' );
+    return childAt == std::string_view::npos || childAt == 0 ? std::string_view() : head.substr( childAt );
+}
+
 // Does `span` carry ` <attr>=<tail>`? Matched after a leading space, so `capped` never matches `hits_capped` and `bytes`
 // never matches `fit_bytes`. The head reads a quoted attribute (tail `"`); the map header an unquoted field (no tail).
 inline bool spanHasAttr( std::string_view span, std::string_view attr, std::string_view tail )
@@ -491,8 +628,35 @@ inline bool isElementNamed( std::string_view tag, std::string_view name ) noexce
     return next == ' ' || next == '/' || next == '>';
 }
 
-// Row-level terms: does ANY tag outside comments/CDATA carry ` <attr>="`? With `onTag`, only a `<onTag …>` element counts.
-inline bool payloadHasAnyAttr( std::string_view doc, std::string_view attr, std::string_view onTag = {} )
+// Does the quoted value that opens `value` (up to its closing quote) list `item` as one whole comma-separated entry? An empty
+// item accepts any value: only a valueItem term asks what the attribute holds rather than whether it is there.
+inline bool quotedValueListsItem( std::string_view value, std::string_view item ) noexcept
+{
+    if( item.empty() )
+    {
+        return true;
+    }
+    const std::string_view list  = value.substr( 0, value.find( '"' ) );
+    std::size_t            begin = 0;
+    while( begin <= list.size() )
+    {
+        std::size_t end = list.find( ',', begin );
+        if( end == std::string_view::npos )
+        {
+            end = list.size();
+        }
+        if( list.substr( begin, end - begin ) == item )
+        {
+            return true;
+        }
+        begin = end + 1;
+    }
+    return false;
+}
+
+// Row-level terms: does ANY tag outside comments/CDATA carry ` <attr>="`? With `onTag`, only a `<onTag …>` element counts; with
+// `valueItem`, only a value that lists that item.
+inline bool payloadHasAnyAttr( std::string_view doc, std::string_view attr, std::string_view onTag = {}, std::string_view valueItem = {} )
 {
     std::string needle;
     needle.reserve( attr.size() + 3 );
@@ -516,7 +680,8 @@ inline bool payloadHasAnyAttr( std::string_view doc, std::string_view attr, std:
         {
             const std::size_t j = doc.find( '>', i );
             const std::string_view tag = doc.substr( i, j == std::string_view::npos ? doc.size() - i : j + 1 - i );
-            if( tag.find( needle ) != std::string_view::npos && isElementNamed( tag, onTag ) ) { return true; }
+            const std::size_t at = tag.find( needle );
+            if( at != std::string_view::npos && isElementNamed( tag, onTag ) && quotedValueListsItem( tag.substr( at + needle.size() ), valueItem ) ) { return true; }
             i = j == std::string_view::npos ? doc.size() : j + 1;
         }
         else
@@ -531,12 +696,12 @@ inline bool payloadHasAnyAttr( std::string_view doc, std::string_view attr, std:
 // The opener of the map header's data comment (serialize.h buildStats, its one emitter).
 inline constexpr std::string_view kCompactMapHeaderOpener = "<!-- files=";
 
-// The map header comment (before the root, or trailing under order=stable), or empty when the document has none: every
-// verb outside the map family and the bundles that embed it. A well-formed document spells `<!--` raw only in a comment
-// or a CDATA body, and a comment cannot hold `--`, so the first hit outside CDATA IS the header.
-inline std::string_view compactMapHeader( std::string_view doc ) noexcept
+// The first comment outside CDATA that opens with `opener` (which itself starts `<!--`), or empty when the document has none. A
+// well-formed document spells `<!--` raw only in a comment or a CDATA body, and a comment cannot hold `--`, so the first hit
+// outside CDATA IS that comment.
+inline std::string_view compactCommentOpenedBy( std::string_view doc, std::string_view opener ) noexcept
 {
-    for( std::size_t hit = doc.find( kCompactMapHeaderOpener ); hit != std::string_view::npos; hit = doc.find( kCompactMapHeaderOpener, hit + 1 ) )
+    for( std::size_t hit = doc.find( opener ); hit != std::string_view::npos; hit = doc.find( opener, hit + 1 ) )
     {
         const std::size_t cdataOpen = doc.rfind( "<![CDATA[", hit );
         const bool        isInCdata = cdataOpen != std::string_view::npos && doc.find( "]]>", cdataOpen ) > hit;
@@ -549,6 +714,13 @@ inline std::string_view compactMapHeader( std::string_view doc ) noexcept
     return {};
 }
 
+// The map header comment (before the root, or trailing under order=stable), or empty when the document has none: every
+// verb outside the map family and the bundles that embed it.
+inline std::string_view compactMapHeader( std::string_view doc ) noexcept
+{
+    return compactCommentOpenedBy( doc, kCompactMapHeaderOpener );
+}
+
 // Does this document carry term `t`? An element-qualified term reads its element alone (the head can carry the same NAME
 // as a different attribute); a map-header term reads the kept header's unquoted field too (Also) or instead (Only).
 inline bool isCompletenessTermPresent( const CompactCompletenessTerm& t, std::string_view head, std::string_view doc, std::string_view mapHeader )
@@ -563,12 +735,12 @@ inline bool isCompletenessTermPresent( const CompactCompletenessTerm& t, std::st
     }
     if( !t.onTag.empty() )
     {
-        return payloadHasAnyAttr( doc, t.attr, t.onTag );
+        return payloadHasAnyAttr( doc, t.attr, t.onTag, t.valueItem );
     }
     return headHasAttr( head, t.attr ) || ( t.wholeDoc && payloadHasAnyAttr( doc, t.attr ) );
 }
 
-// The ≤400 B compact legend for one document.
+// The compact legend for one document: schema id, purpose, paging window, sub-caps, and every present term.
 inline std::string compactLegendText( const CompactLegendSpec& spec, std::string_view head, std::string_view doc )
 {
     std::string out;
diff --git a/src/graphlegend.h b/src/graphlegend.h
index 0644c408..cf5bb562 100644
--- a/src/graphlegend.h
+++ b/src/graphlegend.h
@@ -389,6 +389,14 @@ inline constexpr const char* kTestedLensBlindSpotLegend =
 inline constexpr const char* kTestedRowLegend =
     "tested=\"1\" on a row means an indexed test transitively reaches it (never 0, omitted when it does not). ";
 
+// The same lens in the COLUMNAR form (2026-09-12). A parallel array cannot omit a false entry, so --callers/--callees/--impact
+// --format=columnar carry it as a dense <tested> column (columnar.h emitColumnarTestedColumn): 1 where graph.h isTestedByReach
+// holds, 0 on every other row, a test symbol's row included. Those forms printed kTestedRowLegend's "never 0" beside a column of
+// zeros (test/fixture's --callers=distance read <tested>0,0</tested>), so they read the column instead, in the words of
+// compactlegend.h's compact column reading. Gate: test/impactpartitioncheck.sh arm (5).
+inline constexpr const char* kTestedColumnLegend =
+    "tested= is a dense column in this form: fields= names tested, and <tested> holds one value per row: 1 = a non-test row an indexed test transitively reaches; 0 = none found, or a test row. ";
+
 // --callers / --callees shipped NO legend at all (0 bytes on both, which is why every one of their root
 // attributes sits in test/legendcoverage_baseline.txt). ONE legend serves both forms: the two verbs are one
 // code path with the edge direction flipped, and giving them two descriptions is precisely the per-verb
@@ -410,17 +418,26 @@ inline constexpr const char* kCallHierarchyLegendCalleesOnly =
 inline constexpr const char* kCallersNextSelectorLegend = "next= is the one pasteable follow-up (the uses verb on this selector: the call sites). ";
 inline constexpr const char* kCallersNextBareNameLegend = "next= is the one pasteable follow-up (the uses verb on the called name: all same-named definitions' call sites, including sites bound to other definitions, because a declined call names no single definition). ";
 
+// The tested lens's reading for the form a document takes: an XML row omits a false tested=, the columnar array prints 0.
+// ONE choice for --callers/--callees (callHierarchyLegendOpen below) and --impact (verbs_navigate.h runImpact), so the verbs
+// cannot disagree about which form reads which sentence.
+inline constexpr const char* testedLensLegend( bool isColumnar ) noexcept
+{
+    return isColumnar ? kTestedColumnLegend : kTestedRowLegend;
+}
+
 // The composed opener, one call for the caller — keeps the wantCallers/callees branch out of
 // runCallHierarchy (already this file's largest dispatcher) rather than adding a ternary at the call site.
-inline std::string callHierarchyLegendOpen( bool wantCallers, bool nextUsesBareName = false )
+inline std::string callHierarchyLegendOpen( bool wantCallers, bool nextUsesBareName, bool isColumnar )
 {
     const char* const callersNextClause = nextUsesBareName ? kCallersNextBareNameLegend : kCallersNextSelectorLegend;
+    const char* const testedClause = testedLensLegend( isColumnar );
     // F-02: the blind-spot clause rides with hop_tested=/hop_untested=, which both forms always carry.
     // P3 (L7): next= defined where the reader meets it — callers hand over the SITES (the uses verb on the same
     // selector, its @FILE:LINE spelling mirrored), callees the BODY whose callees these are (expand).
     // nextUsesBareName is the emitter's OWN decision, never re-derived here; no double hyphen in comment text.
-    return wantCallers ? std::string( kCallHierarchyLegendOpen ) + kTestedRowLegend + kTestedLensBlindSpotLegend + callersNextClause
-                       : std::string( kCallHierarchyLegendOpen ) + kTestedRowLegend + kTestedLensBlindSpotLegend + kCallHierarchyLegendCalleesOnly + "next= is the one pasteable follow-up (expand on this selector: the body). ";
+    return wantCallers ? std::string( kCallHierarchyLegendOpen ) + testedClause + kTestedLensBlindSpotLegend + callersNextClause
+                       : std::string( kCallHierarchyLegendOpen ) + testedClause + kTestedLensBlindSpotLegend + kCallHierarchyLegendCalleesOnly + "next= is the one pasteable follow-up (expand on this selector: the body). ";
 }
 
 // ── LB-G (r10 GitNexus round) — the DISPLAY-CAP clause the neighbour verbs share ─────────────────────────
diff --git a/src/main.cpp b/src/main.cpp
index c19c57e5..66c55634 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -2706,7 +2706,7 @@ std::optional<int> runCliEdit( const rw::Config& cfg )
 //
 // --for/--grep/--slice compact their own legend (each emitter branches on cfg.legend); every other XML verb
 // is compacted HERE, after the fact: the run's stdout is captured into an anonymous tmpfile, the finished
-// document is rewritten once by compactlegend.h (prose comments out, ONE ≤400 B legend + schema= in, every
+// document is rewritten once by compactlegend.h (prose comments out, ONE compact legend + schema= in, every
 // payload byte untouched), and written to the real stdout. Exit codes pass through unchanged. A run that
 // produced no XML root (a refusal already happened, or a text verb slipped past validateLegendModifier's
 // list) is refused here naming the flag — never served as if the posture had applied.
@@ -2787,29 +2787,126 @@ static std::string_view scipIndexUnreadableReason( const std::string& scipPath )
 
 static int dispatchMain( const rw::Config& cfg, char** argv );
 
-// the key for a SHARED root (`r` = the map family, `ctx` = the bundle family), from the flags that shaped it
-static std::string_view compactLegendHint( const rw::Config& c ) noexcept
+// The key for a SHARED root (`r` = the map family, `ctx` = the bundle family) is read off the ANSWER, never off a flag order.
+// The ROOT picks the family: one flag order across both families cannot be right, because verb precedence interleaves them, and
+// a key from the other family took that root's FIRST spec, so --pack-task --metrics compacted as pack-signatures
+// (test/compactlegendcheck.sh (D36)). Nor can a flag order WITHIN a family: the bundle hint read --expand before --pack-task and
+// the map hint --around before --query, so --pack-task --expand compacted as expand and --query --around as around, over
+// documents byte-identical to --pack-task's and --query's alone ((D38), CodeRabbit on #203). So within the family a verb with a
+// mark of its own names its key only when the document carries that mark, and a flag whose verb lost dispatch cannot lend its
+// schema to the verb that answered. The row order is left as a TIE-BREAK between marks that share one answer: --metrics renders
+// into --map-diff's and --around's answers and keeps its old place between them, and a pack-task root carries from-trace's
+// task= beside its own budget_tokens=. A rule with no mark (--query, and the bundle modifiers only the default map renders, which
+// answers last) is read only after every marked verb was ruled out, which the static_asserts below hold.
+enum class CompactKeyMark : std::uint8_t
 {
-    if( c.mapDiff )                { return "map-diff"; }
-    if( c.metrics )                { return "metrics"; }
-    if( !c.around.empty() )        { return "around"; }
-    if( !c.query.empty() )         { return "query"; }
-    if( c.skippedList )            { return "skipped"; }
-    if( c.notesList )              { return "notes"; }
-    if( !c.legoType.empty() )      { return "lego"; }
-    if( !c.expand.empty() )        { return "expand"; }
-    if( c.packTaskFlag || !c.packTask.empty() ) { return "pack-task"; }
-    if( !c.fromTrace.empty() || !c.runTrace.empty() ) { return "from-trace"; }
-    if( !c.exemplar.empty() )      { return "exemplar"; }
-    if( c.packSignatures )         { return "pack-signatures"; }
-    if( c.packTopN > 0 )           { return "pack-top-n"; }
+    None,            // no mark of its own: the flag alone names the key
+    RootAttr,        // the root's own open tag carries needle="
+    FirstChild,      // the root's first child element, past the legend comments before it, is <needle>
+    MapHeaderField,  // the map header comment carries the unquoted field needle=
+    CommentOpener,   // a comment outside CDATA opens with needle (the verb's own legend block)
+};
+
+struct CompactKeyRule
+{
+    std::string_view key;
+    bool ( *isAsked )( const rw::Config& ) noexcept;
+    CompactKeyMark   mark;
+    std::string_view needle;
+};
+
+// Each mark read against its one emitter: changed= is serialize.h's changedCount, which only runDefaultMap's map-diff arm passes
+// (a clean tree still prints changed=0, and the query arm ahead of it never does); the metrics block is serialize.h's
+// `if( metrics )` legend; of= is the SeedDisclosure only --around's annotation fills.
+static constexpr CompactKeyRule kMapKeyRules[] =
+{
+    { "map-diff", []( const rw::Config& c ) noexcept { return c.mapDiff; },         CompactKeyMark::MapHeaderField, "changed" },
+    { "metrics",  []( const rw::Config& c ) noexcept { return c.metrics; },         CompactKeyMark::CommentOpener,  "<!-- metrics: " },
+    { "around",   []( const rw::Config& c ) noexcept { return !c.around.empty(); }, CompactKeyMark::RootAttr,       "of" },
+    { "query",    []( const rw::Config& c ) noexcept { return !c.query.empty(); },  CompactKeyMark::None,           {} },
+};
+
+// <skipped>, <notes> and <lego> open runSkipped's, runNotes' and the --lego arm's <ctx>; budget_tokens= rides every pack-task root
+// (packtask.h rootAttrsFor); task= rides every --from-trace and --run-trace root (ctxRootOpen with the trace label), including
+// the command-succeeded record, which has no <trace> block.
+static constexpr CompactKeyRule kBundleKeyRules[] =
+{
+    { "skipped",         []( const rw::Config& c ) noexcept { return c.skippedList; },                               CompactKeyMark::FirstChild, "skipped" },
+    { "notes",           []( const rw::Config& c ) noexcept { return c.notesList; },                                 CompactKeyMark::FirstChild, "notes" },
+    { "lego",            []( const rw::Config& c ) noexcept { return !c.legoType.empty(); },                         CompactKeyMark::FirstChild, "lego" },
+    { "pack-task",       []( const rw::Config& c ) noexcept { return c.packTaskFlag || !c.packTask.empty(); },       CompactKeyMark::RootAttr,   "budget_tokens" },
+    { "from-trace",      []( const rw::Config& c ) noexcept { return !c.fromTrace.empty() || !c.runTrace.empty(); }, CompactKeyMark::RootAttr,   "task" },
+    { "expand",          []( const rw::Config& c ) noexcept { return !c.expand.empty(); },                           CompactKeyMark::None,       {} },
+    { "exemplar",        []( const rw::Config& c ) noexcept { return !c.exemplar.empty(); },                         CompactKeyMark::None,       {} },
+    { "pack-signatures", []( const rw::Config& c ) noexcept { return c.packSignatures; },                            CompactKeyMark::None,       {} },
+    { "pack-top-n",      []( const rw::Config& c ) noexcept { return c.packTopN > 0; },                              CompactKeyMark::None,       {} },
+};
+
+// A rule with no mark sits below every marked rule, so a bare flag is read only once the answer itself has ruled out every verb
+// that could have answered in its place.
+static constexpr bool unmarkedRulesTrail( std::span<const CompactKeyRule> rules ) noexcept
+{
+    bool hasUnmarkedAbove = false;
+    for( const CompactKeyRule& rule : rules )
+    {
+        if( rule.mark == CompactKeyMark::None )
+        {
+            hasUnmarkedAbove = true;
+        }
+        else if( hasUnmarkedAbove )
+        {
+            return false;
+        }
+    }
+    return true;
+}
+static_assert( unmarkedRulesTrail( kMapKeyRules ), "kMapKeyRules: a rule with no mark sits above a marked rule" );
+static_assert( unmarkedRulesTrail( kBundleKeyRules ), "kBundleKeyRules: a rule with no mark sits above a marked rule" );
+
+static bool isCompactKeyMarkPresent( const CompactKeyRule& rule, std::string_view doc, const rw::CompactRootInfo& root )
+{
+    switch( rule.mark )
+    {
+        case CompactKeyMark::None:
+            return true;
+        case CompactKeyMark::RootAttr:
+            return rw::headHasAttr( doc.substr( root.openBegin, root.openEnd - root.openBegin ), rule.needle );
+        case CompactKeyMark::FirstChild:
+            return rw::isElementNamed( rw::compactFirstChildTag( doc, root ), rule.needle );
+        case CompactKeyMark::MapHeaderField:
+            return rw::spanHasAttr( rw::compactMapHeader( doc ), rule.needle, {} );
+        case CompactKeyMark::CommentOpener:
+            return !rw::compactCommentOpenedBy( doc, rule.needle ).empty();
+    }
+    return false;
+}
+
+static std::string_view compactLegendHint( const rw::Config& c, std::string_view doc )
+{
+    const rw::CompactRootInfo root = rw::findCompactRoot( doc );
+    if( root.tag.empty() )
+    {
+        return {};   // no root element: applyCompactDialect answers NotXml before any key is read
+    }
+    // The default map's --token-budget gate replaces an over-budget answer with <r withheld="1"/> (main.cpp's budget gate, its one
+    // emitter): no rows, no header, no legend, so no verb's mark. Nothing on it can rule a verb out, so there the flags keep their
+    // old order. That is the one residue no mark can reach: a withheld --query --map-diff still compacts as map-diff.
+    const bool isWithheld = root.tag == "r" && rw::spanHasAttr( doc.substr( root.openBegin, root.openEnd - root.openBegin ), "withheld", "\"1\"" );
+    const std::span<const CompactKeyRule> rules = root.tag == "r" ? std::span<const CompactKeyRule>( kMapKeyRules ) : std::span<const CompactKeyRule>( kBundleKeyRules );
+    for( const CompactKeyRule& rule : rules )
+    {
+        if( rule.isAsked( c ) && ( isWithheld || isCompactKeyMarkPresent( rule, doc, root ) ) )
+        {
+            return rule.key;
+        }
+    }
     return {};
 }
 
 // --for's compact legend is its own (verbs_for.h): it splices est_tokens=/dropped_positive=/weak= and the
 // adaptive/relevance-floor counts INTO its comments (estchargecheck A10 pins the form), so the layer would strip
 // data there. It is the one verb the layer skips. --grep/--slice compact natively too, but their compact
-// legends are pure prose — the layer restates them at ≤400 B and keeps their schema id.
+// legends are pure prose — the layer restates them as its own compact legend and keeps their schema id.
 static bool nativeCompactLegendVerb( const rw::Config& c ) noexcept
 {
     return !c.forTask.empty();
@@ -2855,7 +2952,7 @@ static int runWithCompactLegend( const rw::Config& cfg, char** argv )
     {
         return rc;   // a refusal (or an empty answer) — nothing to rewrite, the exit code says what happened
     }
-    switch( rw::applyCompactDialect( doc, compactLegendHint( cfg ) ) )
+    switch( rw::applyCompactDialect( doc, compactLegendHint( cfg, doc ) ) )
     {
         case rw::CompactOutcome::Rewritten:
         case rw::CompactOutcome::AlreadyCompact:
diff --git a/src/verbs_navigate.h b/src/verbs_navigate.h
index d41a14e4..7545fdf9 100644
--- a/src/verbs_navigate.h
+++ b/src/verbs_navigate.h
@@ -138,7 +138,8 @@ std::optional<int> runCallHierarchy( const MainDispatch& d )
         // §H4 §3.4: the FIRST legend these two verbs have ever shipped (0 bytes before — which is why every
         // one of their root attributes sits in test/legendcoverage_baseline.txt), and the floor marker that
         // is the round's honest half. ONE opener for both forms, printed BEFORE the format branches so the
-        // columnar and default shapes carry the identical disclosure. JSON has no comment-node analogue, so
+        // columnar and default shapes carry the same disclosure, all but the tested lens's reading, which names
+        // its form's shape (kTestedColumnLegend: the columnar array prints 0). JSON has no comment-node analogue, so
         // there the marker travels as the counts_floor key on the root object instead.
         // V1 fix (verifier finding 3): bodyless_defs= is callees-only (main.cpp gates the attribute itself
         // behind !wantCallers a few lines up), so its defining sentence rides along only on the callees
@@ -149,7 +150,7 @@ std::optional<int> runCallHierarchy( const MainDispatch& d )
         {
             // M12: under multi-root this verb carries no root= at all (correctly — no single root exists)
             // and, before this, disclosed nothing about the `<label>/` prefix every p= below carries.
-            rw::emitTo( stdout, "{}{}{}{}{}-->{}{}", rw::callHierarchyLegendOpen( wantCallers, chNextIsBare ).c_str(),
+            rw::emitTo( stdout, "{}{}{}{}{}-->{}{}", rw::callHierarchyLegendOpen( wantCallers, chNextIsBare, cfg.columnar ).c_str(),
                          rw::capLegendClause( rw::computePageDisclosure( pw.end - pw.begin, result.size(), pw.end,
                                                                         cfg.pageLimit, cfg.pageOffset, chDiscloseCap ).active ),
                          rw::declinedCallsLegend( chRows.declinedCalls > 0 ),   // exactly when the root carries declined_calls=
@@ -2255,7 +2256,7 @@ std::optional<int> runImpact( const MainDispatch& d )
             // form carries the count without the rows and a reader must be told which shape they hold.
             rw::emitTo( stdout, "{}{}. {}{}{}{}{}{}{}{}-->", rw::kImpactLegendOpen, rw::kPageRaiseCapClause,
                          cfg.columnar ? rw::kImpactImportTierColumnarLegend : rw::kImpactImportTierLegend,
-                         rw::kTestedRowLegend, rw::kImpactTestedPartitionLegend,   // A6
+                         rw::testedLensLegend( cfg.columnar ), rw::kImpactTestedPartitionLegend,   // A6: the columnar form reads its dense column
                          rw::kTestedLensBlindSpotLegend,                           // F-02: rides with the partition
                          rw::unprovenDefsVerbLegend( rw::UnprovenDefsVerb::Impact, imUnprovenDefs > 0 ).c_str(),   // H1: exactly when the root carries unproven_defs=
                          rw::declinedCallsLegend( imDeclinedCalls > 0 ),           // exactly when the root carries declined_calls=
diff --git a/test/compactlegendcheck.sh b/test/compactlegendcheck.sh
index 2176df04..41dd3a6b 100755
--- a/test/compactlegendcheck.sh
+++ b/test/compactlegendcheck.sh
@@ -9,8 +9,8 @@
 # opt-in on the CLI this round), and an opt-in `legend:"compact"` argument on every MCP verb that answers XML.
 #
 # THE COMPACT CONTRACT (what every arm below asserts):
-#   • the root carries schema="ripwire.<key>/v1"; the legend (= every <!-- --> comment outside CDATA) is
-#     ≤ 400 B and names every completeness attribute the document carries (counts_floor / capped / shown /
+#   • the root carries schema="ripwire.<key>/v1"; the legend (= every <!-- --> comment outside CDATA) fits
+#     its verb's byte pin and names every completeness attribute the document carries (counts_floor / capped / shown /
 #     total / has_more / next_offset / offset / limit / *_capped / est_tokens / at / root / graph_ambiguous
 #     / graph_unresolved …) — the prose moved to --help and --legend=full;
 #   • the ROWS are byte-identical to the full dialect and the root's attribute-name set is the full set plus
@@ -23,13 +23,23 @@
 # UNIVERSE arm (U): the verb set is DERIVED from src/cli.h (test/flaguniverse.py) — the same derivation
 # jsoncheck #8b and shapingflagcheck (F) use — so a verb added tomorrow is probed tomorrow. Each flag runs at
 # defaults on a tmp git fixture; whatever answers with an XML root is an XML verb and must honor compact,
-# everything else must refuse it. LOOP arm (L): the ten-verb loop's compact legend bill ≤ 4,100 B (was 29,824
-# on the ripwire tree). MCP arm (M): edit_check with legend:"compact" answers in ≤ 900 B on a clean tree.
+# everything else must refuse it, and each verb's prose legend fits its per-verb pin (pinFor). LOOP arm (L): the ten-verb
+# loop's compact legend bill ≤ 4,900 B (was 29,824 on the ripwire tree). MCP arm (M): edit_check with legend:"compact" answers
+# in ≤ 900 B on a clean tree, and five more MCP verbs' legends fit their per-verb pins.
 # CONDITIONAL arm (D): an absent-at-zero or form-conditional attribute (declined_calls=, unproven_defs=, bodyless_defs=,
 # the member form, the multi-root <root label=> rows, --lego's caveat=; on the map family and --impact: pr_iters=,
 # pr_converged=, the map header's gauges, --around's defs=, --rank-by's rank_by=/window=; in the third sweep: --tree's
-# files=, --zoom's root counts and <module children=>, churn-decay's <recent>, the map rows' lpin=/overloads=/prov=) is
-# DEFINED by the compact legend of a document that carries it, and by none that does not. STRUCTURAL arm (S): every
+# files=, --zoom's root counts and <module children=>, churn-decay's <recent>, the map rows' lpin=/overloads=/prov=; in the
+# fourth sweep: the map header's unresolved=, --impact's defs=/reaches=/importers=/shown_importers=/radius_tested=/
+# radius_untested=, --communities' drill=/isolated=/isolated_*=/shown_modules=/bridges=, --community's dir=/label=/bridges=/
+# partition=/modules=, --safe-delete's radius_tested=/radius_untested=; in that sweep's last pass: --communities' modules=/
+# shown_bridges=/connected_singletons=/symbols=, --community's shown_bridges=, the <bridge> rows, --safe-delete's t=/defs=/
+# ambiguous_callers=/dead_code_candidate=, --impact's <f lazy=>, every map-header field, the columnar format=/<cols fields=> and
+# lens=; from that sweep's design review: the <s tested=> rows of --callers/--impact; in its follow-up: the <d tested=> rows of
+# --pack-task --metrics and the columnar tested column; at the lane's end: the schema of a bundle answered beside a map-family
+# flag, every attribute of --pack-task --metrics, and the <d r= cx= ccx= in= amp=> lens facts; from the review of #203: the schema,
+# and every reading, of an answer given beside a flag whose verb lost dispatch) is DEFINED by the compact legend of
+# a document that carries it, and by none that does not. STRUCTURAL arm (S): every
 # conditional attribute the graphlegend.h helper family emits, the PageRank disclosure, every conditional hdr: field of
 # the map header, and every absence-marked row field of the map legend, read from source, has a compact reading — so the
 # next one cannot land undefined.
@@ -309,6 +319,90 @@ probeFor()
         *)                 printf '%s' "$1" ;;
     esac
 }
+# PER-VERB PINS (owner decision 2026-09-12: per-verb pins that fit honest definitions, docs/METHODOLOGY.md §9: honesty lives in
+# attributes, the ceiling is a constraint). One 400 B ceiling held every verb until the fourth sweep, and three sweeps stopped on it
+# with attributes still undefined. Each schema's pin is its LARGEST measured (U) probe on this gate's fixture, rounded up to the
+# next multiple of 10 B, plus 10 B, so a verb whose legend grows is re-pinned in the commit that adds the bytes, with the bytes
+# attributed there. A schema with no row FAILS: a new XML verb is measured and pinned, never waved through under a default.
+# --for keeps its native dialect and is exempt (below).
+# ONE ROW PER SCHEMA: the pin, then the largest (U) probe it was measured from. Measured 2026-09-12 in the fourth sweep's last
+# pass, once every attribute the --impact, --safe-delete, --communities, --community and map-header answers print had a reading;
+# re-measured the same day after that sweep's design review corrected three readings, added the present-only <s tested=> reading
+# (no probe on this fixture prints one) and shortened fourteen readings without losing accuracy. Ten pins moved down.
+# Re-measured at the lane's end, (D36): pack-task 327 -> 804 B (its purpose line spells the bundle's own vocabulary, and the
+# <d r= cx= ccx= in=> and route= readings ride its rows) and from-trace 290 -> 445 B (the same four <d> readings); no other schema moved.
+# schema                      pin  measured
+PIN_TABLE='
+ripwire.map/v1                   810   799
+ripwire.map-diff/v1              800   789
+ripwire.pack-signatures/v1       680   663
+ripwire.metrics/v1               720   702
+ripwire.deps/v1                  260   245
+ripwire.hotspots/v1              280   264
+ripwire.clones/v1                290   280
+ripwire.readability/v1           240   224
+ripwire.nonlocal-state/v1        360   344
+ripwire.ensemble/v1              280   261
+ripwire.context-ratio/v1         250   240
+ripwire.quality-panel/v1         290   271
+ripwire.naming-calibration/v1    220   206
+ripwire.naming-consistency/v1    280   261
+ripwire.comment-coherence/v1     260   241
+ripwire.cochange/v1              290   271
+ripwire.communities/v1           820   807
+ripwire.zoom/v1                  410   394
+ripwire.tree/v1                  250   238
+ripwire.seams/v1                 380   365
+ripwire.handoff/v1               340   325
+ripwire.test-gate/v1             410   400
+ripwire.field-affinity/v1        320   304
+ripwire.skipped/v1               210   195
+ripwire.lint/v1                  250   240
+ripwire.lint-catalog/v1          140   124
+ripwire.external-surface/v1      190   171
+ripwire.scan-skills/v1           160   147
+ripwire.owners/v1                220   207
+ripwire.dead-code/v1             310   297
+ripwire.quality-delta/v1         230   212
+ripwire.dmm/v1                   200   189
+ripwire.pr-context/v1            410   399
+ripwire.stray-content/v1         190   179
+ripwire.flags/v1                 170   159
+ripwire.doc-drift/v1             220   205
+ripwire.notes/v1                 150   135
+ripwire.path/v1                  280   263
+ripwire.connect/v1               410   392
+ripwire.impact/v1                780   770
+ripwire.mentions/v1              180   168
+ripwire.affected/v1              350   339
+ripwire.verify/v1                330   316
+ripwire.help-task/v1             170   153
+ripwire.query/v1                 630   611
+ripwire.grep/v1                  360   345
+ripwire.match/v1                 270   260
+ripwire.lego/v1                  290   275
+ripwire.exemplar/v1              250   232
+ripwire.around/v1                780   760
+ripwire.callers/v1               330   317
+ripwire.callees/v1               380   369
+ripwire.uses/v1                  290   271
+ripwire.batch/v1                 160   142
+ripwire.safe-delete/v1           720   708
+ripwire.at/v1                    180   161
+ripwire.from-trace/v1            460   445
+ripwire.plan-lint/v1             170   156
+ripwire.merge-scout/v1           220   208
+ripwire.whereis/v1               240   223
+ripwire.community/v1             730   719
+ripwire.layout/v1                160   149
+ripwire.pack-task/v1             820   804
+ripwire.pack-top-n/v1            660   649
+ripwire.expand/v1                280   265
+'
+pinFor()
+{
+    printf '%s\n' "$PIN_TABLE" | awk -v schema="$1" '$1 == schema { printf "%s", $2; exit }'
+}
 nXml=0; nXmlBad=0; nRefuse=0; nSkip=0; loopBytes=0; xmlVerbs=""
 while IFS="$( printf '\t' )" read -r flag kind example policy; do
     [ -n "$flag" ] || continue
@@ -338,7 +432,12 @@ while IFS="$( printf '\t' )" read -r flag kind example policy; do
     case "$schema" in ripwire.*/v1) ;; *) no "(U) $probe compact root has no schema=\"ripwire.<key>/v1\" (got '$schema')" ;; esac
     case "$flag" in
         --for=) [ "$lb" -lt "$lbfull" ] || no "(U) --for compact legend ($lb B) did not shrink vs full ($lbfull B)" ;;   # native dialect, data in its comments (A10) — registered follow-up
-        *)      [ "$lb" -le 400 ] || no "(U) $probe compact PROSE legend is $lb B (> 400 B; all comments $lball B, full $lbfull B): $( leg legend "$TMP/u.c" | head -c 200 )" ;;
+        *)      pin="$( pinFor "$schema" )"
+                if [ -z "$pin" ]; then
+                    no "(U) $probe answers $schema, which has no per-verb pin: measure its compact PROSE legend ($lb B here) and pin it in pinFor"
+                elif [ "$lb" -gt "$pin" ]; then
+                    no "(U) $probe compact PROSE legend is $lb B (> its $pin B pin for $schema; all comments $lball B, full $lbfull B): $( leg legend "$TMP/u.c" | head -c 200 )"
+                fi ;;
     esac
     [ "$lball" -lt "$lbfull" ] || [ "$lbfull" -eq 0 ] || no "(U) $probe compact comments ($lball B) are not smaller than the full dialect's ($lbfull B)"
     fa="$( leg rootattrs "$TMP/u.full" )"; ca="$( leg rootattrs "$TMP/u.c" )"
@@ -380,7 +479,7 @@ while IFS="$( printf '\t' )" read -r flag kind example policy; do
         xmllint --noout "$TMP/u.c" >/dev/null 2>&1 || no "(U) $probe compact document is malformed XML"
     fi
 done < "$UNIV"
-[ "$nXml" -ge 60 ] && [ "$nXmlBad" -eq 0 ] && ok "(U) $nXml XML flags answer under --legend=compact (schema id, ≤400 B legend, rows byte-identical, root attrs kept):$xmlVerbs" \
+[ "$nXml" -ge 60 ] && [ "$nXmlBad" -eq 0 ] && ok "(U) $nXml XML flags answer under --legend=compact (schema id, legend within its per-verb pin, rows byte-identical, root attrs kept):$xmlVerbs" \
                    || no "(U) $nXml XML flags probed, $nXmlBad refused compact (want ≥ 60 probed, 0 refused — rows above name them):$xmlVerbs"
 [ "$nRefuse" -ge 60 ] && ok "(U) $nRefuse non-XML flags refuse --legend=compact (empty stdout, non-zero exit); $nSkip write/serve/exec flags not probed" \
                       || no "(U) only $nRefuse non-XML flags refused compact (want ≥ 60)"
@@ -401,7 +500,18 @@ echo
 # else in the loop moved. Same rule the SIZE ceilings in test/mcpmanifestcheck.sh follow — a ceiling moves up
 # only for a DECLARED attribute the contract obliges to define, in the commit that lands it, with its bytes
 # attributed here, never for prose.
-echo "=== (L) the canonical ten-verb edit loop: compact legend bill ≤ 4,100 B (29,824 B in full on the ripwire tree) ==="
+# RE-ANCHORED 2026-09-12 (the fourth sweep): 4,100 → 4,400 B, measured 4,392 (from 4,089). Owner decision 2026-09-12: per-verb
+# pins that fit honest definitions (METHODOLOGY §9); the loop's pin is the next multiple of 100 B above its measured total.
+# Attributed against a build of the parent merge: --impact 390 → 597 B (defs=/reaches=/radius_tested=/radius_untested=/
+# importers= in its purpose line, shown_importers= as a term) and --safe-delete 328 → 424 B (its radius pair); nothing else
+# in the loop moved.
+# RE-ANCHORED 2026-09-12 (the fourth sweep's last pass): 4,400 → 4,900 B, measured 4,860 (from 4,392), by the same rule. Attributed
+# against the previous lane build: --impact 597 → 777 B (its <f lazy=> importer-row reading) and --safe-delete 424 → 712 B (t=/p=,
+# defs=, ambiguous_callers=, dead_code_candidate=); nothing else in the loop moved.
+# RE-MEASURED 2026-09-12 (that sweep's design review): 4,849 B, the pin unchanged at 4,900. Attributed against the last-pass build:
+# --impact 777 → 770 B (the shorter <f lazy=> reading) and --safe-delete 712 → 708 B (t= reads a match, dead_code_candidate= says
+# outside); nothing else in the loop moved.
+echo "=== (L) the canonical ten-verb edit loop: compact legend bill ≤ 4,900 B (29,824 B in full on the ripwire tree) ==="
 loopBytes=0; fullBytes=0
 for v in "--for=geometry distance" "--callers=distance" "--impact=distance" "--uses=distance" "--edit-check=total_area" \
          "--quality-delta" "--test-gate=geometry.cpp" "--affected=geometry.cpp" "--safe-delete=total_area" "--slice=total_area"; do
@@ -410,11 +520,11 @@ for v in "--for=geometry distance" "--callers=distance" "--impact=distance" "--u
     b="$( leg bytes "$TMP/l.c" )"; f="$( leg bytes "$TMP/l.f" )"
     loopBytes=$(( loopBytes + b )); fullBytes=$(( fullBytes + f ))
 done
-[ "$loopBytes" -le 4100 ] && ok "(L) ten-verb loop: $loopBytes B of compact legend (full: $fullBytes B)" \
-                          || no "(L) ten-verb loop pays $loopBytes B of compact legend (> 4,100 B; full: $fullBytes B)"
+[ "$loopBytes" -le 4900 ] && ok "(L) ten-verb loop: $loopBytes B of compact legend (full: $fullBytes B)" \
+                          || no "(L) ten-verb loop pays $loopBytes B of compact legend (> 4,900 B; full: $fullBytes B)"
 
 echo
-echo "=== (M) MCP: legend:\"compact\" on edit_check answers in ≤ 900 B on a clean tree; every XML verb takes the argument ==="
+echo "=== (M) MCP: legend:\"compact\" on edit_check answers in ≤ 900 B on a clean tree; every XML verb takes the argument, within its per-verb legend pin ==="
 mcp_call() { printf '%s\n' "$@" | ( cd "$REPO" && "$BIN" --mcp 2>/dev/null ); }
 mcp_text() {   # mcp_text VERB '<json-arguments>' → the text payload, or __ERROR__:code:message
     mcp_call '{"jsonrpc":"2.0","id":1,"method":"initialize"}' \
@@ -445,19 +555,25 @@ cmp -s "$TMP/m.p1" "$TMP/m.p2" && ok "(M) MCP edit_check rows are byte-identical
 mcp_text edit_check '{"path":".","symbol":"total_area","legend":"terse"}' >"$TMP/m.bad"
 grep -q '^__ERROR__' "$TMP/m.bad" && ok "(M) MCP edit_check legend:\"terse\" is refused (closed set full|compact)" \
                                   || no "(M) MCP edit_check accepted legend:\"terse\" — an unknown value read as a default"
-for pair in "impact:{\"path\":\".\",\"symbol\":\"distance\",\"legend\":\"compact\"}" \
-            "uses:{\"path\":\".\",\"symbol\":\"distance\",\"legend\":\"compact\"}" \
-            "path_between:{\"path\":\".\",\"from\":\"total_area\",\"to\":\"distance\",\"legend\":\"compact\"}" \
-            "lego:{\"path\":\".\",\"type\":\"Point\",\"legend\":\"compact\"}" \
-            "exemplar:{\"path\":\".\",\"kind\":\"fn\",\"task\":\"distance\",\"legend\":\"compact\"}"; do
-    verb="${pair%%:*}"; args="${pair#*:}"
+# Per-verb legend pins, the (U) rule on the MCP surface (the legend, never the whole answer, which edit_check's 900 B above bounds):
+#   impact        780  measured 770 B; owner decision 2026-09-12: per-verb pins that fit honest definitions (METHODOLOGY §9)
+#   uses          290  measured 271 B; owner decision 2026-09-12: per-verb pins that fit honest definitions (METHODOLOGY §9)
+#   path_between  280  measured 263 B; owner decision 2026-09-12: per-verb pins that fit honest definitions (METHODOLOGY §9)
+#   lego          260  measured 249 B; owner decision 2026-09-12: per-verb pins that fit honest definitions (METHODOLOGY §9)
+#   exemplar      260  measured 243 B; owner decision 2026-09-12: per-verb pins that fit honest definitions (METHODOLOGY §9)
+for pair in "impact:780:{\"path\":\".\",\"symbol\":\"distance\",\"legend\":\"compact\"}" \
+            "uses:290:{\"path\":\".\",\"symbol\":\"distance\",\"legend\":\"compact\"}" \
+            "path_between:280:{\"path\":\".\",\"from\":\"total_area\",\"to\":\"distance\",\"legend\":\"compact\"}" \
+            "lego:260:{\"path\":\".\",\"type\":\"Point\",\"legend\":\"compact\"}" \
+            "exemplar:260:{\"path\":\".\",\"kind\":\"fn\",\"task\":\"distance\",\"legend\":\"compact\"}"; do
+    verb="${pair%%:*}"; rest="${pair#*:}"; mpin="${rest%%:*}"; args="${rest#*:}"
     mcp_text "$verb" "$args" >"$TMP/m.v"
     if grep -q '^__ERROR__' "$TMP/m.v"; then
         no "(M) MCP $verb legend:compact refused: $( head -c 160 "$TMP/m.v" )"
-    elif [ "$( leg bytes "$TMP/m.v" )" -le 400 ] && [ -n "$( leg schema "$TMP/m.v" )" ]; then
-        ok "(M) MCP $verb legend:compact: $( leg bytes "$TMP/m.v" ) B legend, schema $( leg schema "$TMP/m.v" )"
+    elif [ "$( leg bytes "$TMP/m.v" )" -le "$mpin" ] && [ -n "$( leg schema "$TMP/m.v" )" ]; then
+        ok "(M) MCP $verb legend:compact: $( leg bytes "$TMP/m.v" ) B legend (pin $mpin B), schema $( leg schema "$TMP/m.v" )"
     else
-        no "(M) MCP $verb legend:compact: legend $( leg bytes "$TMP/m.v" ) B, schema '$( leg schema "$TMP/m.v" )'"
+        no "(M) MCP $verb legend:compact: legend $( leg bytes "$TMP/m.v" ) B (pin $mpin B), schema '$( leg schema "$TMP/m.v" )'"
     fi
 done
 
@@ -595,8 +711,8 @@ isHdr = spec.startswith( "#" )   # `#name`: an UNQUOTED field of the map header,
 tag, _, attr = ( "", "", spec[ 1: ] ) if isHdr else spec.rpartition( ":" )
 def on( t ):   # a tag-qualified spec reads only that element: <root label=> is not <community label=>
     return not tag or re.match( r"<" + re.escape( tag ) + r"[\s/>]", t ) is not None
-if isHdr:
-    vals = [ m.group( 1 ) for h in header for m in [ re.search( r"\s" + re.escape( attr ) + r"=([^\s\"]+)", h ) ] if m ]
+if isHdr:   # a header field's value is bare (files=6) or QUOTED (unindexed="f90:1,zzqa:1"): both spellings are read
+    vals = [ m.group( 1 ) for h in header for m in [ re.search( r"\s" + re.escape( attr ) + r"=(\"[^\"]*\"|[^\s\"]+)", h ) ] if m ]
 else:
     vals = [ m.group( 1 ) for t in tags if on( t ) for m in [ re.search( r"\s" + re.escape( attr ) + r"=\"([^\"]*)\"", t ) ] if m ]
 leg = " ".join( legend )
@@ -606,18 +722,24 @@ elif op == "defines":  print( 1 if re.search( r"(?<![A-Za-z0-9_])" + re.escape(
 elif op == "mentions": print( 1 if spec in leg else 0 )   # a literal needle anywhere in the legend
 PY
 ca(){ python3 "$TMP/condattr.py" "$@"; }
-# condArm ID LABEL FULL COMPACT SPEC… — the control, then the compact definition, one verdict row per document
+# condArm ID LABEL FULL COMPACT SPEC… — the control, then the compact definition, one verdict row per document. A spec written
+# `!el:attr` skips the FULL-legend control and only that: the full dialect names the attribute as row vocabulary or not at
+# all (the fourth sweep's --impact defs=, --communities' isolated_*=/shown_modules=/bridges=, --community's dir=/label=/
+# bridges=), so the compact reading is the one definition a reader gets and the row asserts exactly that. Whether the full
+# legend should define them too is test/legendcoveragecheck.sh's question, not this arm's.
 condArm()
 {
-    local id="$1" label="$2" full="$3" comp="$4" spec attr bad=0 got=""
+    local id="$1" label="$2" full="$3" comp="$4" spec attr bad=0 got="" needFull
     shift 4
     for spec in "$@"; do
+        needFull=1
+        case "$spec" in '!'*) needFull=0; spec="${spec#!}" ;; esac
         attr="${spec#*:}"; attr="${attr#\#}"
         if [ "$( ca carries "$full" "$spec" )" != 1 ] || [ "$( ca carries "$comp" "$spec" )" != 1 ]; then
             no "($id) $label: control broken — the answer does not carry $attr= in both postures, so its definition row would be vacuous: $( head -c 160 "$comp" )"
             bad=1; continue
         fi
-        if [ "$( ca defines "$full" "$attr" )" != 1 ]; then
+        if [ "$needFull" -eq 1 ] && [ "$( ca defines "$full" "$attr" )" != 1 ]; then
             no "($id) $label: control broken — the FULL legend does not define $attr= either, so this row asserts nothing compact-specific"
             bad=1; continue
         fi
@@ -731,7 +853,10 @@ for v in "" "--query=distance" "--rank-by=hub" "--around=total_area" "--impact=d
     for spec in pr_iters pr_converged "#declined" "#external" "#locality_pinned" "#extent_suspect_syms" "#macro_blanked_files" \
                 "#ignored_files" "#ignored_dirs" "#max_tokens" "#fit_bytes" "#over_ceiling" r:defs r:rank_by r:window; do
         attr="${spec#*:}"; attr="${attr#\#}"
-        if [ "$( ca defines "$TMP/d12.c" "$attr" )" = 1 ] && [ "$( ca carries "$TMP/d12.c" "$spec" )" != 1 ]; then
+        # Since the fourth sweep (2026-09-12) --impact's purpose line reads its OWN defs=, so the map root's defs= reading is
+        # found by its opener rather than its attribute name, the way (D17)/(D23) find theirs.
+        if [ "$spec" = r:defs ]; then isRead="$( ca mentions "$TMP/d12.c" "the lowest-id one was walked" )"; else isRead="$( ca defines "$TMP/d12.c" "$attr" )"; fi
+        if [ "$isRead" = 1 ] && [ "$( ca carries "$TMP/d12.c" "$spec" )" != 1 ]; then
             no "(D12) ${v:-the flagless map}: the compact legend defines $attr= but the document carries no $spec — a reading of a field that is not there"
             d12bad=1
         fi
@@ -778,9 +903,8 @@ done
 #   FAIL (D14) --zoom --zoom-levels=1 over test/chafix (modules AT the depth cut): children="2" is carried but the compact legend never defines it
 #   FAIL (D15) --rank-by=churn-decay (the <recent> file rows): of="6" is carried but the compact legend never defines it
 #   FAIL (D16) the map over test/declinefix (merged overloads, split edges): prov="split" is carried but the compact legend never defines it
-# NOT FIXED, stopped on the (U) 400 B pin: --communities' drill= and isolated=. Its compact prose is 385 B on this gate's
-# repo; the shortest honest pair ("drill= takes an id=; isolated= edgeless symbols") costs 49 B (434 B), and even
-# "drill=/isolated=: id= verb/edgeless" costs 37 B (422 B). No ceiling is raised for it.
+# Stopped here on the (U) 400 B pin, and defined in the fourth sweep (D20) below once the owner raised the pins to fit honest
+# definitions: --communities' drill= and isolated=.
 condPair D13 "--tree (files= on its root)" "$FIX" "--tree" tree:files
 condPair D13 "--zoom (its root's counts)" "$FIX" "--zoom" zoom:symbols zoom:isolated zoom:top_modules zoom:levels_shown
 [ -d "$ROOT/test/chafix" ] || no "(D14) fixture missing: test/chafix — its children= row would be vacuous"
@@ -820,6 +944,522 @@ for v in "--around=distance" "--rank-by=churn" "--zoom" "" "--communities"; do
 done
 [ "$d17bad" -eq 0 ] && [ "$d17n" -eq 5 ] && ok "(D17) mirror: no third-sweep reading prints on $d17n answers that lack its field (--around's <r of=>, churn, a one-level zoom, the plain map, --communities' isolated=/symbols=)"
 
+# ── THE FOURTH SWEEP (2026-09-12): the vocabulary the earlier sweeps stopped on at the byte pins ─────────────────────────
+# Owner decision 2026-09-12: per-verb pins that fit honest definitions (docs/METHODOLOGY.md §9 — honesty lives in attributes,
+# the ceiling is a constraint). Each attribute below rides EVERY answer of its document, and was defined by prose if at all:
+#   (D18) the map header's unresolved= (serialize.h buildStats writes it unconditionally; the always-on legend's
+#         hdr:unresolved= clause defines it), read from the header ALONE: --from-trace's <trace unresolved=> is a frame count;
+#   (D19) --impact's defs=, reaches=, importers=, shown_importers=, radius_tested=, radius_untested= on the XML form, the
+#         columnar form (which omits shown_importers= and names the omission in lens=) and the MCP default;
+#   (D20) --communities' drill=, isolated= and its isolated_decl=/isolated_header=/isolated_source=/isolated_doc= split,
+#         shown_modules=, bridges= (<zoom isolated=> and <seams bridges=> count other things);
+#   (D21) --community=ID's dir=, label=, bridges=, partition=, modules= (<communities modules=/bridges=>, <seams modules=> are
+#         other roots' attributes);
+#   (D22) --safe-delete's radius_tested=/radius_untested=, which partition impact_reaches= where --impact's partition reaches=.
+# A `!` spec is one the FULL legend does not define either (condArm's comment): --impact's defs=, the isolated_* split,
+# shown_modules=, --communities' bridges= (its full legend spells bridge=), --community's dir=/label=/bridges=.
+condPair D18 "the flagless map (unresolved= on its header)" "$FIX" "" "#unresolved"
+condPair D18 "--max-tokens=50 (the header beside a fit-cut root)" "$FIX" "--max-tokens=50" "#unresolved"
+condPair D19 "--impact=distance" "$FIX" "--impact=distance" '!impact:defs' impact:reaches impact:importers impact:shown_importers impact:radius_tested impact:radius_untested
+condPair D19 "--impact=distance --format=columnar" "$FIX" "--impact=distance --format=columnar" '!impact:defs' impact:reaches impact:importers impact:radius_tested impact:radius_untested
+mcp_text impact "{\"path\":\"$FIX\",\"symbol\":\"distance\",\"legend\":\"full\"}" >"$TMP/d.full"
+mcp_text impact "{\"path\":\"$FIX\",\"symbol\":\"distance\"}" >"$TMP/d.comp"
+condArm D19 "MCP impact at its DEFAULT posture (compact) vs legend:\"full\"" "$TMP/d.full" "$TMP/d.comp" '!impact:defs' impact:reaches impact:importers impact:shown_importers impact:radius_tested impact:radius_untested
+condPair D20 "--communities (its root's counts)" "$FIX" "--communities" communities:drill communities:isolated '!communities:isolated_decl' '!communities:isolated_header' \
+    '!communities:isolated_source' '!communities:isolated_doc' '!communities:shown_modules' '!communities:bridges'
+condPair D21 "--community=0 (its root's counts and names)" "$FIX" "--community=0" community:partition community:modules '!community:dir' '!community:label' '!community:bridges'
+condPair D22 "--safe-delete=total_area (its root's radius partition)" "$FIX" "--safe-delete=total_area" safe-delete:radius_tested safe-delete:radius_untested
+
+# (D23) THE MIRROR, on answers chosen for what they LACK, each lack asserted before it is relied on. The needles are the
+# readings' own openers, so a reading printed on the wrong document is caught however its NAME is spelled there: --from-trace
+# carries <trace unresolved=> and no map header; the columnar --impact carries no shown_importers= (the one present-only term
+# here); --safe-delete carries radius_tested= over impact_reaches= and no <impact>; --zoom carries an isolated= of its own;
+# --seams carries modules=/bridges= of its own; --community=0 carries its own bridges= and no drill=; --communities carries its
+# own bridges= and no partition=; the plain map carries none of these roots.
+rrun --from-trace="$TMP/trace.txt" --legend=compact >"$TMP/d23.trace"
+[ "$( ca carries "$TMP/d23.trace" trace:unresolved )" = 1 ] && [ "$( ca carries "$TMP/d23.trace" "#unresolved" )" != 1 ] \
+    || no "(D23) control: --from-trace no longer carries <trace unresolved=> without a map header, so it proves nothing about the header-only read"
+rrun --impact=distance --format=columnar --legend=compact >"$TMP/d23.col"
+[ "$( ca carries "$TMP/d23.col" impact:reaches )" = 1 ] && [ "$( ca carries "$TMP/d23.col" impact:shown_importers )" != 1 ] \
+    || no "(D23) control: the columnar --impact no longer carries reaches= without shown_importers=, so it proves nothing about that term being present-only"
+rrun --safe-delete=total_area --legend=compact >"$TMP/d23.sd"
+[ "$( ca carries "$TMP/d23.sd" safe-delete:radius_tested )" = 1 ] && [ "$( ca carries "$TMP/d23.sd" impact:reaches )" != 1 ] \
+    || no "(D23) control: --safe-delete carries no radius_tested= (or now an <impact reaches=>), so it no longer proves the two partitions read apart"
+rrun --zoom --legend=compact >"$TMP/d23.zoom"
+[ "$( ca carries "$TMP/d23.zoom" zoom:isolated )" = 1 ] \
+    || no "(D23) control: --zoom carries no isolated= any more, so it no longer proves the communities reading is element-qualified"
+rrun --seams --legend=compact >"$TMP/d23.seams"
+[ "$( ca carries "$TMP/d23.seams" seams:modules )" = 1 ] && [ "$( ca carries "$TMP/d23.seams" seams:bridges )" = 1 ] \
+    || no "(D23) control: --seams carries no modules=/bridges= any more, so it no longer proves the module readings are element-qualified"
+rrun --community=0 --legend=compact >"$TMP/d23.one"
+[ "$( ca carries "$TMP/d23.one" community:bridges )" = 1 ] && [ "$( ca carries "$TMP/d23.one" communities:drill )" != 1 ] \
+    || no "(D23) control: --community=0 no longer carries its bridges= without a drill=, so it proves nothing about the two roots reading apart"
+d23bad=0; d23n=0
+for v in "--from-trace=$TMP/trace.txt" "--impact=distance --format=columnar" "--safe-delete=total_area" "--impact=distance" "--zoom" "--seams" \
+         "--communities" "--community=0" ""; do
+    rrun $v --legend=compact >"$TMP/d23.c"
+    if [ ! -s "$TMP/d23.c" ]; then
+        no "(D23) ${v:-the flagless map} --legend=compact answered nothing — its mirror row would be vacuous"; d23bad=1; continue
+    fi
+    d23n=$(( d23n + 1 ))
+    for pair in "unresolved= calls with in-tree evidence@#unresolved" "reaches= their transitive callers@impact:reaches" "shown_importers=:@impact:shown_importers" \
+                "non-tests of impact_reaches=@safe-delete:radius_tested" "drill= the verb taking@communities:drill" \
+                "isolated= symbols with no call edge@communities:isolated" "bridges= community pairs@communities:bridges" \
+                "partition= module count@community:partition" "bridges= modules a call edge joins@community:bridges" "label= dir::name@community:label"; do
+        needle="${pair%%@*}"; spec="${pair#*@}"
+        if [ "$( ca mentions "$TMP/d23.c" "$needle" )" = 1 ] && [ "$( ca carries "$TMP/d23.c" "$spec" )" != 1 ]; then
+            no "(D23) ${v:-the flagless map}: the compact legend spells '$needle' but the document carries no $spec — a reading of a field that is not there"
+            d23bad=1
+        fi
+    done
+done
+[ "$d23bad" -eq 0 ] && [ "$d23n" -eq 9 ] && ok "(D23) mirror: no fourth-sweep reading prints on $d23n answers that lack its field (--from-trace, the columnar --impact, --safe-delete, --impact, --zoom, --seams, --communities, --community=0, the plain map)"
+
+# ── THE FOURTH SWEEP, LAST PASS (2026-09-12): every attribute the four answers and the map header print ─────────────────────
+# (D18)..(D23) closed what the earlier sweeps had named. This pass LISTED every attribute the compact --impact, --safe-delete,
+# --communities, --community=ID and map-header documents emit, on test/fixture and on corpora that reach their conditional
+# rows, and found these still undefined (each RUN before any reading landed):
+#   (D24) --communities' modules=, shown_bridges=, connected_singletons=, symbols= and --community's shown_bridges=: EVERY answer
+#         of the root carries them, so they read in the purpose lines;
+#   (D25) the <bridge> rows: --communities' a=/b=/from_label=/to_label=/edges= and --community's to=/to_label=/edges=. Only an
+#         answer with a cross-module call edge prints one (test/chafix does; test/fixture does not), so each is a present-only
+#         term read on <bridge> alone;
+#   (D26) --safe-delete's t=, defs=, ambiguous_callers=, dead_code_candidate= (its root p= reads in t='s clause; it is not a red
+#         spec because <c n= p=> already spells the name);
+#   (D27) --impact's <f lazy=> importer rows, present-only on <f>: the columnar form prints no <f> row;
+#   (D28) the map header: the always-on files=/symbols=/edges=/shown=/ambiguous=/order=, and the conditional roots=, changed=,
+#         skipped_oversize=, unindexed=/unindexed_exts=, escaped_root=, precise=. The full map legend defines none but shown=
+#         (serialize.h buildUnindexedAttr records why it cannot: tokenbudgetcheck arm #3 leaves that floor seven bytes); a
+#         compact legend replaces MORE prose than it adds, which (U) asserts on every probe, so here the readings fit;
+#   (D29) the columnar form's format=/<cols fields=> (<cols n=> reads in the same term, and is not a red spec because the
+#         purpose line's <s n=> already spells the name) and lens=, which --order=stable's <r> carries too.
+# A `#name` header value may be QUOTED (unindexed="zzqa:1,…"), so condattr.py reads both spellings.
+OVR="$TMP/oversize"; mkdir -p "$OVR"; cp -R "$FIX"/. "$OVR"/; head -c 5000 /dev/zero | tr '\0' 'a' >"$OVR/huge.py"
+UNX="$TMP/unindexed"; mkdir -p "$UNX"; printf 'x = 1\n' >"$UNX/a.py"
+for e in zzqa zzqb zzqc zzqd zzqe zzqf zzqg; do printf 'text\n' >"$UNX/a.$e"; done
+ESC="$TMP/escape"; mkdir -p "$ESC/inner" "$ESC/outside"; cp -R "$FIX"/. "$ESC/inner"/
+printf 'def far():\n    return 2\n' >"$ESC/outside/far.py"; ln -s ../outside/far.py "$ESC/inner/far.py"
+CHA="$ROOT/test/chafix"; SCIPF="$ROOT/test/scipfix"
+for d in "$CHA" "$SCIPF"; do [ -d "$d" ] || no "(D25/D28) fixture missing: $d — every row reading it would be vacuous"; done
+
+condPair D24 "--communities (the rest of its root's counts)" "$FIX" "--communities" \
+    '!communities:modules' '!communities:shown_bridges' '!communities:connected_singletons' '!communities:symbols'
+condPair D24 "--community=0 (its bridge listing's width)" "$FIX" "--community=0" '!community:shown_bridges'
+cdRun "$TMP/d25.cm" "$CHA" --communities
+chaModule="$( grep -o '<bridge a="[0-9]*"' "$TMP/d25.cm" | head -1 | grep -o '[0-9][0-9]*' )"
+[ -n "$chaModule" ] || no "(D25) control: --communities over test/chafix prints no <bridge> row any more, so both rows below are vacuous"
+condPair D25 "--communities over test/chafix (a cross-module <bridge> row)" "$CHA" "--communities" \
+    '!bridge:a' '!bridge:b' '!bridge:from_label' '!bridge:to_label' '!bridge:edges'
+condPair D25 "--community=${chaModule:-0} over test/chafix (its peer <bridge> row)" "$CHA" "--community=${chaModule:-0}" '!bridge:to' '!bridge:to_label' '!bridge:edges'
+condPair D26 "--safe-delete=total_area (the rest of its root)" "$FIX" "--safe-delete=total_area" \
+    safe-delete:t safe-delete:defs safe-delete:ambiguous_callers safe-delete:dead_code_candidate
+condPair D27 "--impact=distance (<f lazy=> importer rows)" "$FIX" "--impact=distance" f:lazy
+mcp_text impact "{\"path\":\"$FIX\",\"symbol\":\"distance\",\"legend\":\"full\"}" >"$TMP/d.full"
+mcp_text impact "{\"path\":\"$FIX\",\"symbol\":\"distance\"}" >"$TMP/d.comp"
+condArm D27 "MCP impact at its DEFAULT posture (compact) vs legend:\"full\"" "$TMP/d.full" "$TMP/d.comp" f:lazy
+condPair D28 "the flagless map (its always-on header)" "$FIX" "" '!#files' '!#symbols' '!#edges' '#shown' '!#ambiguous' '!#order'
+"$BIN" "$FIX" "$H1" >"$TMP/d.full" 2>/dev/null </dev/null
+"$BIN" "$FIX" "$H1" --legend=compact >"$TMP/d.comp" 2>/dev/null </dev/null
+condArm D28 "two roots, the flagless map (roots= on its header)" "$TMP/d.full" "$TMP/d.comp" '!#roots'
+condPair D28 "--map-diff (changed= on its header)" "$REPO" "--map-diff" '!#changed'
+condPair D28 "--max-file-size=1K over a tree with a 5 KB file" "$OVR" "--max-file-size=1K" '!#skipped_oversize'
+condPair D28 "a tree of seven extensions no grammar reads" "$UNX" "" '!#unindexed' '!#unindexed_exts'
+condPair D28 "a tree whose symlink leads out of the root" "$ESC/inner" "" '!#escaped_root'
+condPair D28 "test/scipfix under --scip (precise= on its header)" "$SCIPF" "--scip=index.scip --exclude=make_index.py --no-cache" '!#precise'
+condPair D29 "--impact=distance --format=columnar" "$FIX" "--impact=distance --format=columnar" cols:fields impact:format '!impact:lens'
+condPair D29 "--order=stable (lens= on the map root)" "$FIX" "--order=stable" '!r:lens'
+
+# (D30) THE MIRROR, on answers chosen for what they LACK, each lack asserted before it is relied on: --from-trace carries a
+# <trace format=> of its own (the trace's dialect) and no <cols>; --communities and --community=0 over test/fixture print no
+# <bridge> row; the columnar --impact prints no <f> row; --impact=distance carries no map header and no lens=; the flagless
+# map carries none of the conditional header fields. The needles are the readings' own openers, as in (D23).
+rrun --from-trace="$TMP/trace.txt" --legend=compact >"$TMP/d30.trace"
+[ "$( ca carries "$TMP/d30.trace" trace:format )" = 1 ] && [ "$( ca carries "$TMP/d30.trace" cols:fields )" != 1 ] \
+    || no "(D30) control: --from-trace no longer carries <trace format=> without <cols>, so it proves nothing about the columnar reading's element"
+rrun --communities --legend=compact >"$TMP/d30.cm"
+[ "$( ca carries "$TMP/d30.cm" communities:bridges )" = 1 ] && [ "$( ca carries "$TMP/d30.cm" bridge:edges )" != 1 ] \
+    || no "(D30) control: --communities over the fixture now prints a <bridge> row, so it no longer proves the bridge readings are present-only"
+rrun --impact=distance --format=columnar --legend=compact >"$TMP/d30.col"
+[ "$( ca carries "$TMP/d30.col" impact:importers )" = 1 ] && [ "$( ca carries "$TMP/d30.col" f:lazy )" != 1 ] \
+    || no "(D30) control: the columnar --impact now prints an <f lazy=> row, so it no longer proves that reading is present-only"
+rrun --impact=distance --legend=compact >"$TMP/d30.imp"
+[ "$( ca carries "$TMP/d30.imp" f:lazy )" = 1 ] && [ "$( ca carries "$TMP/d30.imp" "#files" )" != 1 ] && [ "$( ca carries "$TMP/d30.imp" lens )" != 1 ] \
+    || no "(D30) control: --impact=distance no longer carries <f lazy=> without a map header or lens=, so it proves nothing about the header-only and head readings"
+d30bad=0; d30n=0
+for v in "--from-trace=$TMP/trace.txt" "--communities" "--community=0" "--impact=distance --format=columnar" "--impact=distance" ""; do
+    rrun $v --legend=compact >"$TMP/d30.c"
+    if [ ! -s "$TMP/d30.c" ]; then
+        no "(D30) ${v:-the flagless map} --legend=compact answered nothing — its mirror row would be vacuous"; d30bad=1; continue
+    fi
+    d30n=$(( d30n + 1 ))
+    for pair in "<f lazy=1>:@f:lazy" "<bridge a= b=>:@bridge:a" "from_label=/to_label=:@bridge:from_label" "<bridge to= to_label=>:@bridge:to" \
+                "<bridge edges=>:@bridge:edges" "files=/symbols=:@#files" "roots=N:@#roots" "changed=K:@#changed" "skipped_oversize=K:@#skipped_oversize" \
+                "unindexed=ext:N:@#unindexed" "unindexed_exts=E:@#unindexed_exts" "escaped_root=K:@#escaped_root" "precise=K:@#precise" \
+                "format=columnar:@cols:fields" "lens=:@lens"; do
+        needle="${pair%%@*}"; spec="${pair#*@}"
+        if [ "$( ca mentions "$TMP/d30.c" "$needle" )" = 1 ] && [ "$( ca carries "$TMP/d30.c" "$spec" )" != 1 ]; then
+            no "(D30) ${v:-the flagless map}: the compact legend spells '$needle' but the document carries no $spec — a reading of a field that is not there"
+            d30bad=1
+        fi
+    done
+done
+[ "$d30bad" -eq 0 ] && [ "$d30n" -eq 6 ] && ok "(D30) mirror: no last-pass reading prints on $d30n answers that lack its field (--from-trace, --communities, --community=0, the columnar --impact, --impact, the plain map)"
+
+# ── THE TESTED ROW LENS (2026-09-12, the design review of the fourth sweep) ──────────────────────────────────────────────────
+# (D31) <s tested="1"> rows. --callers/--callees and --impact (verbs_navigate.h), the MCP impact twin (mcpverbs.h) and the map's
+# own rows (serialize.h, over computeQMetrics' tested[] column) print tested="1" on a row graph.h isTestedByReach accepts: an
+# indexed test transitively reaches it and it is not itself a test symbol; never a literal 0. The full legend defines it
+# (graphlegend.h kTestedRowLegend) and the compact layer stripped that clause with nothing to put back. No row above could see
+# it: test/fixture holds no test, so every probe here printed radius_tested="0" and no tested row, while --impact=
+# svector::push_back on this repo printed four. The corpus below is the smallest that prints one: test_lib.py's test_run calls
+# run, which calls helper. The reading is ELEMENT-qualified on <s>: flipimpact.h's <h tested=> prints 0 as well as 1, and
+# <exemplar tested=> is another root's attribute.
+# RED on the fourth sweep's last-pass build (the uncommitted lane over b7c55908, plain and ASan alike): all three rows FAILed and
+# nothing else did, for example
+#   FAIL (D31) --callers=helper over a tree with a test (its caller run is tested): tested="1" is carried but the compact legend never defines it
+#   FAIL (D31) MCP impact over a tree with a test, at its DEFAULT posture (compact) vs legend:"full": tested="1" is carried but the compact legend never defines it
+TESTED="$TMP/testedrows"; mkdir -p "$TESTED/src"
+printf 'def helper():\n    return 1\n\n\ndef run():\n    return helper()\n' >"$TESTED/src/lib.py"
+printf 'from src.lib import run\n\n\ndef test_run():\n    assert run() == 1\n' >"$TESTED/test_lib.py"
+condPair D31 "--callers=helper over a tree with a test (its caller run is tested)" "$TESTED" "--callers=helper" s:tested
+condPair D31 "--impact=helper over a tree with a test (run, in its reach set, is tested)" "$TESTED" "--impact=helper" s:tested
+mcp_text impact "{\"path\":\"$TESTED\",\"symbol\":\"helper\",\"legend\":\"full\"}" >"$TMP/d.full"
+mcp_text impact "{\"path\":\"$TESTED\",\"symbol\":\"helper\"}" >"$TMP/d.comp"
+condArm D31 "MCP impact over a tree with a test, at its DEFAULT posture (compact) vs legend:\"full\"" "$TMP/d.full" "$TMP/d.comp" s:tested
+
+# (D32) THE MIRROR, on answers chosen for what they LACK, each lack asserted before it is relied on: --callers=run over the same
+# corpus lists one caller, test_run, which is a test symbol, so it carries hop_tested= and no tested row; --safe-delete=helper
+# carries radius_tested= and lists <c> rows; test/fixture's --callers, --impact and flagless map carry no tested row at all. The
+# needle is the reading's own opener, as in (D23)/(D30). Green on the red build by construction, like (D7). Shown able to fail:
+# with the reading spliced into the legend of --callers=run over this corpus, the row's check read the needle as spelled and no
+# <s tested=> row as carried, which is its FAIL.
+cdRun "$TMP/d32.run" "$TESTED" --callers=run --legend=compact
+[ "$( ca carries "$TMP/d32.run" callers:hop_tested )" = 1 ] && [ "$( ca carries "$TMP/d32.run" s:tested )" != 1 ] \
+    || no "(D32) control: --callers=run over the tested corpus no longer carries hop_tested= without a tested row, so it proves nothing about the row reading being present-only"
+d32bad=0; d32n=0
+for v in "$TESTED@--callers=run" "$TESTED@--safe-delete=helper" "$REPO@--callers=distance" "$REPO@--impact=distance" "$REPO@"; do
+    dir="${v%%@*}"; args="${v#*@}"
+    cdRun "$TMP/d32.c" "$dir" $args --legend=compact
+    if [ ! -s "$TMP/d32.c" ]; then
+        no "(D32) ${args:-the flagless map} --legend=compact answered nothing — its mirror row would be vacuous"; d32bad=1; continue
+    fi
+    d32n=$(( d32n + 1 ))
+    if [ "$( ca mentions "$TMP/d32.c" "<s tested=1>:" )" = 1 ] && [ "$( ca carries "$TMP/d32.c" s:tested )" != 1 ]; then
+        no "(D32) ${args:-the flagless map}: the compact legend spells '<s tested=1>:' but the document carries no <s tested=> row — a reading of a field that is not there"
+        d32bad=1
+    fi
+done
+[ "$d32bad" -eq 0 ] && [ "$d32n" -eq 5 ] && ok "(D32) mirror: the tested row reading prints on none of $d32n answers that lack an <s tested=> row (a test-only caller list, --safe-delete's radius, the fixture's --callers/--impact, the plain map)"
+
+# ── THE TESTED LENS ON <d> ROWS AND IN THE COLUMNAR FORM (2026-09-12, the follow-up to (D31)/(D32)) ──────────────────────────────
+# (D31)'s reading is ELEMENT-qualified on <s>, and two more forms print the same lens with no reading. Each was run, and read
+# against its emitter, before any reading landed:
+#   (D33) <d tested="1"> signature rows. serialize.h's two signature-row writers print it from computeQMetrics' tested[] column,
+#         which graph.h isTestedByReach fills: the <s> rows' predicate, an indexed test transitively reaches that symbol and it
+#         is not itself a test. Never a literal 0. main.cpp computes that column only under --metrics, --for or --exemplar, so a
+#         plain --pack-task prints no tested= at all; --pack-task --metrics does (it compacted under the pack-signatures
+#         schema until (D36) had the hint read the root's family first). Its FULL legend never names
+#         tested= either (a `!` spec). condArm's left-anchored tested= would also be satisfied by (D31)'s <s tested=1> reading
+#         on an answer printing both forms, so the row asserts the <d> reading's own opener too.
+#   (D34) the columnar form's tested column. --callers/--callees/--impact --format=columnar always pass the test-reach lens
+#         (verbs_navigate.h), so fields= names tested and <tested> holds one DENSE value per row (columnar.h
+#         emitColumnarTestedColumn): 1 where isTestedByReach holds, 0 on every other row, a test row included. Unlike the <s>
+#         attribute it prints 0, so the reading rides the COLUMN rather than a 1: over test/fixture, which holds no test,
+#         --callers=distance carries <tested>0,0</tested>, and a reading keyed to a 1 would leave those zeros undefined. The
+#         full legend's only tested sentence is kTestedRowLegend's attribute reading ("never 0"), so no full control is taken.
+# RED on e45bd3ab (plain and ASan alike): all six (D33)/(D34) checks FAILed and nothing else did ((D35) is green by construction),
+# for example
+#   FAIL (D33) --pack-task=helper --metrics over a tree with a test (its <d> rows helper and run are tested): tested="1" is carried but the compact legend never defines it
+#   FAIL (D34) --callers=distance --format=columnar over test/fixture (...): fields="path,name,line,kind,tested" and <tested>0,0</tested> are carried but the compact legend never reads the column
+condPair D33 "--pack-task=helper --metrics over a tree with a test (its <d> rows helper and run are tested)" "$TESTED" "--pack-task=helper --metrics" '!d:tested'
+if [ "$( ca carries "$TMP/d.comp" d:tested )" = 1 ] && [ "$( ca mentions "$TMP/d.comp" "<d tested=1>:" )" = 1 ]; then
+    ok "(D33) --pack-task=helper --metrics: the reading is the <d> row's own ('<d tested=1>:')"
+else
+    no "(D33) --pack-task=helper --metrics: <d tested=> carried=$( ca carries "$TMP/d.comp" d:tested ), but the compact legend does not spell the <d> row reading '<d tested=1>:': $( leg legend "$TMP/d.comp" | head -c 260 )"
+fi
+COLTESTED="<tested> column:"
+namesTested(){ case ",$1," in *,tested,*) return 0 ;; esac; return 1; }
+# colTestedRow ID LABEL DIR "ARGS" — one columnar answer in both postures: the control (fields= names tested in both), then the
+# compact legend must spell the column's reading.
+colTestedRow()
+{
+    local id="$1" label="$2" dir="$3" args="$4" col
+    cdRun "$TMP/d.full" "$dir" $args; cdRun "$TMP/d.comp" "$dir" $args --legend=compact
+    col="$( grep -o '<tested>[^<]*</tested>' "$TMP/d.comp" | head -1 )"
+    if ! namesTested "$( ca value "$TMP/d.full" cols:fields )" || ! namesTested "$( ca value "$TMP/d.comp" cols:fields )"; then
+        no "($id) $label: control broken — <cols fields=> does not name tested in both postures, so its reading row would be vacuous: $( head -c 160 "$TMP/d.comp" )"
+    elif [ "$( ca mentions "$TMP/d.comp" "$COLTESTED" )" != 1 ]; then
+        no "($id) $label: fields=\"$( ca value "$TMP/d.comp" cols:fields )\" and $col are carried but the compact legend never reads the column: $( leg legend "$TMP/d.comp" | head -c 260 )"
+    else
+        ok "($id) $label: fields= names tested ($col), and the compact legend reads the column"
+    fi
+    return 0
+}
+colTestedRow D34 "--callers=helper --format=columnar over a tree with a test" "$TESTED" "--callers=helper --format=columnar"
+colTestedRow D34 "--callees=run --format=columnar over a tree with a test" "$TESTED" "--callees=run --format=columnar"
+colTestedRow D34 "--impact=helper --format=columnar over a tree with a test (test_run, a test row, reads 0)" "$TESTED" "--impact=helper --format=columnar"
+colTestedRow D34 "--callers=distance --format=columnar over test/fixture (no test: the column still rides, every value 0)" "$REPO" "--callers=distance --format=columnar"
+
+# (D35) THE MIRROR, on answers chosen for what they LACK, each lack asserted before it is relied on: --pack-task=helper over the
+# tested corpus prints <d> rows with no tested= (no --metrics, so no column was computed); --pack-task=geometry --metrics over
+# test/fixture prints <d amp=> rows and no tested= (no test reaches them); --uses=helper --format=columnar has a fields= that does
+# not name tested; --callers=helper carries <s tested=> rows and neither a <d> row nor <cols>; --pack-task=helper --metrics carries
+# <d tested=> and no <s tested=> row, which also keeps (D31)'s reading on <s>. The needles are the readings' own openers, as in
+# (D32). Green on the red build by construction, like (D7). Shown able to fail: with each reading spliced into the compact legend
+# of a real answer that lacks its field (the column reading into --uses=helper --format=columnar, the <d> reading into
+# --pack-task=helper, (D31)'s <s> reading into --pack-task=helper --metrics), its check here fired on all three spliced answers
+# and on none of the three unspliced ones. The column check is the one a dropped valueItem trips: without it the fields= term
+# reads every <cols fields=>, --uses' included.
+cdRun "$TMP/d35.pt" "$TESTED" --pack-task=helper --legend=compact
+[ "$( ca carries "$TMP/d35.pt" d:l )" = 1 ] && [ "$( ca carries "$TMP/d35.pt" d:tested )" != 1 ] \
+    || no "(D35) control: --pack-task=helper over the tested corpus no longer prints <d> rows without tested=, so it proves nothing about the <d> reading being present-only"
+cdRun "$TMP/d35.uses" "$TESTED" --uses=helper --format=columnar --legend=compact
+{ [ "$( ca carries "$TMP/d35.uses" cols:fields )" = 1 ] && ! namesTested "$( ca value "$TMP/d35.uses" cols:fields )"; } \
+    || no "(D35) control: --uses=helper --format=columnar no longer carries a fields= without tested, so it proves nothing about the column reading riding the column"
+cdRun "$TMP/d35.ptm" "$TESTED" --pack-task=helper --metrics --legend=compact
+[ "$( ca carries "$TMP/d35.ptm" d:tested )" = 1 ] && [ "$( ca carries "$TMP/d35.ptm" s:tested )" != 1 ] \
+    || no "(D35) control: --pack-task=helper --metrics no longer carries <d tested=> without an <s tested=> row, so it proves nothing about the two row readings reading apart"
+d35bad=0; d35n=0
+for v in "$TESTED@--pack-task=helper" "$REPO@--pack-task=geometry --metrics" "$TESTED@--uses=helper --format=columnar" "$TESTED@--callers=helper" \
+         "$TESTED@--pack-task=helper --metrics"; do
+    dir="${v%%@*}"; args="${v#*@}"
+    cdRun "$TMP/d35.c" "$dir" $args --legend=compact
+    if [ ! -s "$TMP/d35.c" ]; then
+        no "(D35) $args --legend=compact answered nothing — its mirror row would be vacuous"; d35bad=1; continue
+    fi
+    d35n=$(( d35n + 1 ))
+    for pair in "<d tested=1>:@d:tested" "<s tested=1>:@s:tested"; do
+        needle="${pair%%@*}"; spec="${pair#*@}"
+        if [ "$( ca mentions "$TMP/d35.c" "$needle" )" = 1 ] && [ "$( ca carries "$TMP/d35.c" "$spec" )" != 1 ]; then
+            no "(D35) $args: the compact legend spells '$needle' but the document carries no <${spec%%:*} tested=> row — a reading of a field that is not there"
+            d35bad=1
+        fi
+    done
+    if [ "$( ca mentions "$TMP/d35.c" "$COLTESTED" )" = 1 ] && ! namesTested "$( ca value "$TMP/d35.c" cols:fields )"; then
+        no "(D35) $args: the compact legend spells '$COLTESTED' but no <cols fields=> names tested — a reading of a column that is not there"
+        d35bad=1
+    fi
+done
+[ "$d35bad" -eq 0 ] && [ "$d35n" -eq 5 ] && ok "(D35) mirror: neither new tested reading, nor (D31)'s, prints on $d35n answers that lack its field (<d> rows with no column computed, <d> rows over a tree with no test, a columnar fields= without tested, <s tested=> rows alone, <d tested=> rows alone)"
+
+# ── THE HINT READS THE ROOT, AND THE BUNDLE'S OWN VOCABULARY (2026-09-12, found at the end of the lane) ──────────────────────────────
+# (D36) main.cpp's compactLegendHint derived ONE key from the flags in ONE order: map-diff, metrics, around, query, then the bundle
+# verbs. A key names a spec only under its own root (<r> for those four, <ctx> for the rest), and a key from the other family took
+# that root's FIRST spec, pack-signatures. --pack-task --metrics is a pack-task bundle whose rows --metrics shapes, and it compacted
+# as pack-signatures; so did --from-trace --metrics and --pack-task beside --around. No single flag order is right, because verb
+# precedence interleaves the families (each pair run, its stderr read): --pack-task and --from-trace answer over --around, while
+# --around answers over --expand and --pack-signatures, whose bundles it never renders. So the ROOT picks the family and the flags
+# pick the key within it, in the old order; the around-over-expand row is the neighbour a flag reorder would break.
+# Under the right schema the bundle still carried attributes no compact reading named: task=, route=, its <d>/<b>/<s>/<c>/<test>
+# row vocabulary, of_top=, rel=, shared=, run=, and the lens facts serialize.h sigRowHead writes on every <d> row of a ranked bundle,
+# r= cx= ccx= in= (amp= too under --metrics). The full legend's "Row keys" clause defines most of them and is prose, so the layer
+# stripped it. schemaRow reads the schema. allAttrsRow reads EVERY attribute name the compact answer carries, and each must be
+# spelled NAME= in that legend; the <d> and route= readings must also be their own openers, as in (D33). --from-trace carries the
+# same four <d> facts, and its full legend defines them.
+# RED on 036c827d (plain): eleven (D36) checks FAILed and nothing else did (the around-over-expand row and (D37) are green by
+# construction), for example
+#   FAIL (D36) --pack-task=helper --metrics (a pack-task bundle; --metrics shapes its rows) compacts under 'ripwire.pack-signatures/v1', not ripwire.pack-task/v1
+#   FAIL (D36) --pack-task=helper --metrics over a tree with a test: carried, and spelled NAME= nowhere in the compact legend: amp budget_tokens ccx cx in of_top r rel route run t task
+#   FAIL (D36) MCP explore over a tree with a test, at its DEFAULT posture (compact): carried, and spelled NAME= nowhere in the compact legend: ccx cx in l n of_top r rel route run t task
+schemaRow()
+{
+    local id="$1" label="$2" dir="$3" args="$4" want="$5" got
+    cdRun "$TMP/d36.s" "$dir" $args --legend=compact
+    got="$( leg schema "$TMP/d36.s" )"
+    if [ "$got" = "$want" ]; then
+        ok "($id) $label compacts under $want"
+    else
+        no "($id) $label compacts under '$got', not $want"
+    fi
+    return 0
+}
+schemaRow D36 "--pack-task=helper --metrics (a pack-task bundle; --metrics shapes its rows)" "$TESTED" "--pack-task=helper --metrics" "ripwire.pack-task/v1"
+schemaRow D36 "--from-trace --metrics (a from-trace bundle)" "$REPO" "--from-trace=$TMP/trace.txt --metrics" "ripwire.from-trace/v1"
+schemaRow D36 "--pack-task=geometry --around=distance (--pack-task answers)" "$REPO" "--pack-task=geometry --around=distance" "ripwire.pack-task/v1"
+schemaRow D36 "--around=distance --expand=distance (--around answers; the neighbour a flag reorder breaks)" "$REPO" "--around=distance --expand=distance" "ripwire.around/v1"
+cat > "$TMP/allattrs.py" <<'PY'
+import re, sys
+buf = open( sys.argv[1], encoding = "utf-8", errors = "replace" ).read()
+legend, tags = [], []
+i = 0; n = len( buf )
+while i < n:
+    if buf.startswith( "<![CDATA[", i ):
+        j = buf.find( "]]>", i ); i = n if j < 0 else j + 3
+    elif buf.startswith( "<!--", i ):
+        j = buf.find( "-->", i ); j = n if j < 0 else j + 3; legend.append( buf[ i:j ] ); i = j
+    elif buf[ i ] == "<":
+        j = buf.find( ">", i ); j = n if j < 0 else j + 1; tags.append( buf[ i:j ] ); i = j
+    else:
+        j = buf.find( "<", i ); i = n if j < 0 else j
+leg = " ".join( legend )
+names = sorted( { a for t in tags for a in re.findall( r'\s([\w:.-]+)="', t ) } - { "schema" } )
+print( len( names ), " ".join( a for a in names if not re.search( r"(?<![A-Za-z0-9_])" + re.escape( a ) + "=", leg ) ) )
+PY
+# allAttrsRow ID LABEL FILE — every attribute name the compact document carries (schema= is the dialect's own id) is spelled NAME=
+# in its compact legend.
+allAttrsRow()
+{
+    local id="$1" label="$2" file="$3" count missing
+    read -r count missing <<<"$( python3 "$TMP/allattrs.py" "$file" )"
+    if [ "${count:-0}" -lt 12 ]; then
+        no "($id) $label: control broken — ${count:-0} attribute names carried, too few for this row to read a bundle: $( head -c 160 "$file" )"
+    elif [ -n "$missing" ]; then
+        no "($id) $label: carried, and spelled NAME= nowhere in the compact legend: $missing — $( leg legend "$file" | head -c 260 )"
+    else
+        ok "($id) $label: all $count attribute names it carries are defined by its compact legend"
+    fi
+    return 0
+}
+cdRun "$TMP/d36.a" "$TESTED" --pack-task=helper --metrics --legend=compact
+allAttrsRow D36 "--pack-task=helper --metrics over a tree with a test" "$TMP/d36.a"
+d36miss=""
+for opener in "<d r=N>:" "<d cx= ccx=>:" "<d in=N>:" "<d amp=N>:" "route=:"; do
+    [ "$( ca mentions "$TMP/d36.a" "$opener" )" = 1 ] || d36miss="$d36miss '$opener'"
+done
+if [ -z "$d36miss" ]; then
+    ok "(D36) --pack-task=helper --metrics: the <d> lens facts and route= read under their own openers"
+else
+    no "(D36) --pack-task=helper --metrics: the compact legend does not spell the reading(s)$d36miss: $( leg legend "$TMP/d36.a" | head -c 260 )"
+fi
+cdRun "$TMP/d36.b" "$REPO" --pack-task=geometry --metrics --legend=compact
+allAttrsRow D36 "--pack-task=geometry --metrics over the fixture" "$TMP/d36.b"
+mcp_text explore "{\"path\":\"$TESTED\",\"task\":\"helper\"}" >"$TMP/d36.c"
+allAttrsRow D36 "MCP explore over a tree with a test, at its DEFAULT posture (compact)" "$TMP/d36.c"
+condPair D36 "--from-trace (its <d> rows carry the lens facts)" "$REPO" "--from-trace=$TMP/trace.txt" d:r d:cx d:ccx d:in
+
+# (D37) THE MIRROR, on answers chosen for what they LACK, each lack asserted before it is relied on: --pack-task=helper without
+# --metrics prints <d> rows carrying r=/cx=/ccx=/in= and no amp=; --pack-signatures prints <d> rows with none of the four (no lens
+# rank, no metrics); MCP explore with no_route prints <ctx task=> and no route=. The needles are the readings' own openers, as in
+# (D35). Green on the red build by construction, like (D7).
+cdRun "$TMP/d37.pt" "$TESTED" --pack-task=helper --legend=compact
+cdRun "$TMP/d37.ps" "$REPO" --pack-signatures --legend=compact
+mcp_text explore "{\"path\":\"$TESTED\",\"task\":\"helper\",\"no_route\":true}" >"$TMP/d37.nr"
+{ [ "$( ca carries "$TMP/d37.pt" d:ccx )" = 1 ] && [ "$( ca carries "$TMP/d37.pt" d:amp )" != 1 ]; } \
+    || no "(D37) control: --pack-task=helper no longer prints <d ccx=> rows without amp=, so it proves nothing about the amp= reading being present-only"
+{ [ "$( ca carries "$TMP/d37.ps" d:l )" = 1 ] && [ "$( ca carries "$TMP/d37.ps" d:r )" != 1 ] && [ "$( ca carries "$TMP/d37.ps" d:ccx )" != 1 ] \
+    && [ "$( ca carries "$TMP/d37.ps" d:in )" != 1 ]; } \
+    || no "(D37) control: --pack-signatures no longer prints <d> rows without r=/ccx=/in=, so it proves nothing about those readings being present-only"
+{ [ "$( ca carries "$TMP/d37.nr" ctx:task )" = 1 ] && [ "$( ca carries "$TMP/d37.nr" ctx:route )" != 1 ]; } \
+    || no "(D37) control: MCP explore with no_route no longer prints <ctx task=> without route=, so it proves nothing about the route= reading being present-only"
+d37bad=0; d37n=0
+for v in "--pack-task=helper|d37.pt" "--pack-signatures|d37.ps" "MCP explore no_route|d37.nr"; do
+    label="${v%%|*}"; f="$TMP/${v#*|}"
+    if [ ! -s "$f" ] || grep -q '^__ERROR__' "$f"; then
+        no "(D37) $label answered nothing — its mirror row would be vacuous"; d37bad=1; continue
+    fi
+    d37n=$(( d37n + 1 ))
+    for pair in "<d r=N>:@d:r" "<d cx= ccx=>:@d:ccx" "<d in=N>:@d:in" "<d amp=N>:@d:amp" "route=:@ctx:route"; do
+        needle="${pair%%@*}"; spec="${pair#*@}"
+        if [ "$( ca mentions "$f" "$needle" )" = 1 ] && [ "$( ca carries "$f" "$spec" )" != 1 ]; then
+            no "(D37) $label: the compact legend spells '$needle' but the document carries no <${spec%%:*} ${spec#*:}=> — a reading of a field that is not there"
+            d37bad=1
+        fi
+    done
+done
+[ "$d37bad" -eq 0 ] && [ "$d37n" -eq 3 ] && ok "(D37) mirror: no <d> lens-fact or route= reading prints on $d37n answers that lack its field (<d> rows without amp=, <d> rows without the lens facts, a bundle not routed)"
+
+# ── THE KEY NAMES THE VERB THAT ANSWERED (2026-09-12, CodeRabbit on #203) ──────────────────────────────────────────────────────────
+# (D38) (D36) took the FAMILY from the root and kept each family's flag order for the key, and that order disagreed with dispatch
+# inside both families: the bundle hint read --expand before --pack-task, the map hint --around before --query. --pack-task=geometry
+# --expand=distance prints the byte-identical document --pack-task=geometry prints, and compacted under ripwire.expand/v1, reading
+# sibs=/sibs_total=/sibs_capped=/inc= that nothing in it carries; --query=distance --around=distance prints --query's lexical map and
+# compacted under ripwire.around/v1, reading of=/depth=/fanout= off a map with no seed. The same order lent the losing flag's schema on
+# every other pair below (each run, its stderr's precedence line read, its full answer compared with the winner's alone): --pack-task
+# beside --skipped/--notes/--lego, --from-trace beside --expand/--notes/--skipped, --notes beside --skipped, and --query and --around
+# beside --map-diff, whose changed= only the default map's non-query arm writes. main.cpp now reads the key off the answer: a verb
+# with a mark of its own (map-diff's header changed=, the metrics block, around's root of=, <skipped>/<notes>/<lego> as the first
+# child, pack-task's root budget_tokens=, from-trace's root task=) names its key only when the document carries that mark, and a flag
+# with none (--query, the default map's bundle modifiers) is read only after every marked verb was ruled out.
+# dispatchRow asserts, per pair: the controls (the pair's FULL answer is byte-identical to the winner's alone, and the winner alone
+# compacts under WANT), the schema, and that every NAME= reading the pair's compact legend spells is carried by the document (a tag
+# attribute or a map-header field) or printed by the winner's own compact legend over that same document (its conditional
+# vocabulary: pack-task's purpose line reads id=/run=/shared=, absent on this fixture, and (D36)/(D37) own those). schemaRow pins the
+# pairs whose verbs render into ONE answer, where the old order stays the tie-break and must not move: --metrics beside --around,
+# --map-diff beside --metrics, --expand beside --pack-signatures.
+# RED on 3a55f52d (plain): twenty-two (D38) checks FAILed, both checks of every dispatchRow, and nothing else did (the three
+# schemaRow tie-break rows are green by construction), for example
+#   FAIL (D38) --pack-task=geometry --expand=distance (...) compacts under 'ripwire.expand/v1', not ripwire.pack-task/v1 — the schema of a flag whose verb did not answer
+#   FAIL (D38) --pack-task=geometry --expand=distance (...): its compact legend reads inc= sibs= sibs_capped= sibs_total= — carried by no attribute or header field of the document, and printed by no compact legend of --pack-task=geometry alone
+#   FAIL (D38) --query=distance --around=distance (...): its compact legend reads depth= fanout= of= — carried by no attribute or header field of the document, and printed by no compact legend of --query=distance alone
+#   FAIL (D38) --notes --skipped compacts under 'ripwire.skipped/v1', not ripwire.notes/v1 — the schema of a flag whose verb did not answer
+cat > "$TMP/unread.py" <<'PY'
+import re, sys
+buf = open( sys.argv[1], encoding = "utf-8", errors = "replace" ).read()
+legend, tags, header = "", [], ""
+i = 0; n = len( buf )
+while i < n:
+    if buf.startswith( "<![CDATA[", i ):
+        j = buf.find( "]]>", i ); i = n if j < 0 else j + 3
+    elif buf.startswith( "<!--", i ):
+        j = buf.find( "-->", i ); j = n if j < 0 else j + 3; c = buf[ i:j ]; i = j
+        if "/v1:" in c: legend += c
+        elif c.startswith( "<!-- files=" ) and not header: header = c
+    elif buf[ i ] == "<":
+        j = buf.find( ">", i ); j = n if j < 0 else j + 1; tags.append( buf[ i:j ] ); i = j
+    else:
+        j = buf.find( "<", i ); i = n if j < 0 else j
+carried = { a for t in tags for a in re.findall( r'\s([\w:.-]+)="', t ) } | set( re.findall( r'\s(\w+)=', header ) )
+print( " ".join( sorted( set( re.findall( r'(?<![A-Za-z0-9_])([A-Za-z_]\w*)=', legend ) ) - carried ) ) )
+PY
+# dispatchRow ID LABEL DIR "PAIR ARGS" "WINNER ARGS" WANT — the pair compacts as the verb that answered it, reading nothing that verb's
+# own compact legend would not.
+dispatchRow()
+{
+    local id="$1" label="$2" dir="$3" pair="$4" winner="$5" want="$6" own extra r
+    cdRun "$TMP/d38.pf" "$dir" $pair;   cdRun "$TMP/d38.pc" "$dir" $pair --legend=compact
+    cdRun "$TMP/d38.wf" "$dir" $winner; cdRun "$TMP/d38.wc" "$dir" $winner --legend=compact
+    if [ ! -s "$TMP/d38.pf" ] || ! cmp -s "$TMP/d38.pf" "$TMP/d38.wf"; then
+        no "($id) $label: control broken — its full answer is not byte-identical to $winner alone, so the row cannot say which verb answered: $( head -c 160 "$TMP/d38.pf" )"
+        return 0
+    fi
+    if [ "$( leg schema "$TMP/d38.wc" )" != "$want" ]; then
+        no "($id) $label: control broken — $winner alone compacts under '$( leg schema "$TMP/d38.wc" )', not $want"
+        return 0
+    fi
+    if [ "$( leg schema "$TMP/d38.pc" )" = "$want" ]; then
+        ok "($id) $label compacts under $want, the verb that answered"
+    else
+        no "($id) $label compacts under '$( leg schema "$TMP/d38.pc" )', not $want — the schema of a flag whose verb did not answer"
+    fi
+    own=" $( python3 "$TMP/unread.py" "$TMP/d38.wc" ) "; extra=""
+    for r in $( python3 "$TMP/unread.py" "$TMP/d38.pc" ); do
+        case "$own" in *" $r "*) ;; *) extra="$extra $r=" ;; esac
+    done
+    if [ -z "$extra" ]; then
+        ok "($id) $label: every reading its compact legend spells is carried by the document or printed by $winner's own"
+    else
+        no "($id) $label: its compact legend reads$extra — carried by no attribute or header field of the document, and printed by no compact legend of $winner alone"
+    fi
+    return 0
+}
+dispatchRow D38 "--pack-task=geometry --expand=distance (--pack-task answers; the default map's --expand never renders)" "$REPO" "--pack-task=geometry --expand=distance" "--pack-task=geometry" "ripwire.pack-task/v1"
+dispatchRow D38 "--query=distance --around=distance (--query answers, ahead of --around)" "$REPO" "--query=distance --around=distance" "--query=distance" "ripwire.query/v1"
+dispatchRow D38 "--pack-task=geometry --skipped" "$REPO" "--pack-task=geometry --skipped" "--pack-task=geometry" "ripwire.pack-task/v1"
+dispatchRow D38 "--pack-task=geometry --notes" "$REPO" "--pack-task=geometry --notes" "--pack-task=geometry" "ripwire.pack-task/v1"
+dispatchRow D38 "--pack-task=geometry --lego=Point" "$REPO" "--pack-task=geometry --lego=Point" "--pack-task=geometry" "ripwire.pack-task/v1"
+dispatchRow D38 "--from-trace --expand=distance" "$REPO" "--from-trace=$TMP/trace.txt --expand=distance" "--from-trace=$TMP/trace.txt" "ripwire.from-trace/v1"
+dispatchRow D38 "--from-trace --notes" "$REPO" "--from-trace=$TMP/trace.txt --notes" "--from-trace=$TMP/trace.txt" "ripwire.from-trace/v1"
+dispatchRow D38 "--from-trace --skipped" "$REPO" "--from-trace=$TMP/trace.txt --skipped" "--from-trace=$TMP/trace.txt" "ripwire.from-trace/v1"
+dispatchRow D38 "--notes --skipped" "$REPO" "--notes --skipped" "--notes" "ripwire.notes/v1"
+dispatchRow D38 "--query=distance --map-diff (the query arm answers; map-diff's arm never runs)" "$REPO" "--query=distance --map-diff" "--query=distance" "ripwire.query/v1"
+dispatchRow D38 "--around=distance --map-diff" "$REPO" "--around=distance --map-diff" "--around=distance" "ripwire.around/v1"
+schemaRow D38 "--metrics --around=distance (both render into --around's answer; the tie-break keeps metrics)" "$REPO" "--metrics --around=distance" "ripwire.metrics/v1"
+schemaRow D38 "--map-diff --metrics (both render into the map-diff answer)" "$REPO" "--map-diff --metrics" "ripwire.map-diff/v1"
+schemaRow D38 "--pack-signatures --expand=distance (both render into the default map's bundle)" "$REPO" "--pack-signatures --expand=distance" "ripwire.expand/v1"
+# Every MARKED verb alone keeps its own schema, so a mark its own answer never carries is red on its own row rather than hidden in a
+# pair (dispatchRow's controls hold pack-task, query, from-trace, notes and around). The first cut of this fix read <lego>, <skipped>
+# and <notes> from the whole head span, which starts with the legend comments those verbs put before their first child, and all
+# three compacted as pack-signatures while only the --notes control noticed.
+schemaRow D38 "--map-diff alone (its mark: the header's changed=)" "$REPO" "--map-diff" "ripwire.map-diff/v1"
+schemaRow D38 "--metrics alone (its mark: the metrics legend block)" "$REPO" "--metrics" "ripwire.metrics/v1"
+schemaRow D38 "--skipped alone (its mark: <skipped> first, after its legend comments)" "$REPO" "--skipped" "ripwire.skipped/v1"
+schemaRow D38 "--lego=Point alone (its mark: <lego> first, after its legend comments)" "$REPO" "--lego=Point" "ripwire.lego/v1"
+# The default map's --token-budget gate replaces an over-budget answer with <r withheld="1"/>, which carries no verb's mark. A
+# byte-identity sweep of 854 probes against 3a55f52d caught the second cut of this fix compacting both answers below as
+# ripwire.map/v1; the arm that answered is the flag's, so on that stub alone the flags keep their old order.
+schemaRow D38 "--map-diff --token-budget=1 (the budget gate withholds the map: no mark, the flag decides)" "$REPO" "--map-diff --token-budget=1" "ripwire.map-diff/v1"
+schemaRow D38 "--metrics --token-budget=1 (withheld the same way)" "$REPO" "--metrics --token-budget=1" "ripwire.metrics/v1"
+
 echo
 echo "=== (S) STRUCTURAL: every conditional attribute the graphlegend.h family, the PageRank disclosure, the map header and the map's rows emit has a compact reading ==="
 # The (D) rows prove today's members; this row keeps the NEXT one from landing undefined. The population is READ FROM
@@ -845,10 +1485,13 @@ echo "=== (S) STRUCTURAL: every conditional attribute the graphlegend.h family,
 # conditional at its CALL SITE rather than inside graphlegend.h (fielduses.h's member form, serialize.h's multi-root
 # table, --lego's caveat=) — rows (D4)/(D5)/(D6) are what guard those; nor a map-family clause not spelled `hdr:`
 # (kMaxTokensFitLegend's max_tokens=/fit_bytes=/over_ceiling=, est_tokens= under order=stable, --around's defs=,
-# --rank-by's rank_by=/window=) — (D10)/(D11) guard those. And BY CONSTRUCTION not the always-on header field unresolved=
-# (no absent-if-0 marker), which the reader prints as INFO on every run because it is STILL undefined under compact: its
-# shortest reading, "unresolved=: resolver gauge", costs 29 B on every map and puts two (U) probes over the 400 B ceiling
-# (--max-tokens=3 379 -> 408, --rank-by=churn 376 -> 405 over their measured legends). No ceiling is raised for it.
+# --rank-by's rank_by=/window=) — (D10)/(D11) guard those. The always-on header field unresolved= (no absent-if-0 marker)
+# was printed here as INFO, still undefined under compact, until the fourth sweep (2026-09-12, owner decision: raise the pins
+# to fit honest definitions): population 3 now requires a header reading for EVERY hdr: field of that legend, marked or
+# not, and (D18) shows the reading live. Shown able to fail: this reader run over 27fc151d's src/compactlegend.h (no row)
+# FAILed on unresolved= and on nothing else. The sweep's design review folded unresolved= into the always-on files= clause, so an
+# UNMARKED field may read inside that one row; a marked field still needs a row of its own. Shown able to fail on the fold: with
+# unresolved= deleted from that clause, this reader FAILed on unresolved= and on nothing else.
 # RED on origin/main 28ee1df3: bodyless_defs=, declined_calls= and unproven_defs= FAILed. Shown able to fail on the fix
 # too: with the declined_calls row deleted from kCompactCompletenessTerms this arm went red on that name (landing commit).
 # RED on 34a97f66 for population 3: pr_iters=, pr_converged= and all seven hdr: fields FAILed. Shown able to fail on the
@@ -1014,7 +1657,25 @@ else:
             print( "FAIL|%s= (%s) has no kCompactCompletenessTerms row that reads the payload (wholeDoc or onTag) — a compact map carrying it leaves it undefined" % ( attr, rowPop[ attr ] ) )
     if len( rowCovered ) == len( rowPop ):
         print( "PASS|map rows: %d of %d absence-marked row fields of the always-on legend have a payload-reading compact term: %s" % ( len( rowCovered ), len( rowPop ), " ".join( rowCovered ) ) )
-print( "INFO|outside that population by construction (unconditional on every map, no absent-if-0 marker): %s — still undefined under compact, see the arm's comment" % " ".join( a + "=" for a in sorted( always ) ) )
+# The always-on header fields (no absent-if-0 marker) ride EVERY map header, so each needs a header reading as much as a
+# conditional one does (the fourth sweep, 2026-09-12: unresolved=). Since that sweep's design review the reading may sit inside
+# the always-on header clause, the `files` row (MapHeaderRead::Only): buildStats writes files= into every header, so a field
+# spelled there is read exactly when the header is. A CONDITIONAL field never qualifies that way (the population above wants a
+# row of its own), so a field that gains an absence marker leaves this set and fails there until it is split back out.
+hdrClause = None
+for m in re.finditer( r"\{\s*\"S(\d+)\"\s*,\s*\"S(\d+)\"(?:[^{}]|\{\})*?MapHeaderRead::Only", rows ):
+    if clits[ int( m.group( 1 ) ) ] == "files":
+        hdrClause = clits[ int( m.group( 2 ) ) ]
+if hdrClause is None:
+    print( "FAIL|no always-on map-header row (attr files, MapHeaderRead::Only) was read from src/compactlegend.h — the reader broke, so the always-on row below means nothing" )
+    hdrClause = ""
+inClause = lambda a: re.search( r"(?<![A-Za-z0-9_])" + re.escape( a ) + r"=", hdrClause ) is not None
+alwaysCovered = [ "hdr:" + a + "=" + ( "" if a in hdrTerms else " (in the files= clause)" ) for a in sorted( always ) if a in hdrTerms or inClause( a ) ]
+for attr in sorted( always ):
+    if attr not in hdrTerms and not inClause( attr ):
+        print( "FAIL|%s= (serialize.h's always-on map legend defines hdr:%s= with no absence marker, so EVERY map header carries it) has no compact reading that reads the map header, neither a row of its own nor a clause of the always-on files= row — every compact map carries it undefined" % ( attr, attr ) )
+if len( alwaysCovered ) == len( always ):
+    print( "PASS|map header, always-on: %d of %d unconditional header fields have a compact reading: %s" % ( len( alwaysCovered ), len( always ), " ".join( alwaysCovered ) ) )
 PY
 python3 "$TMP/struct.py" "$ROOT" >"$TMP/s.rows" 2>"$TMP/s.err" || no "(S) the source reader crashed: $( head -c 300 "$TMP/s.err" )"
 [ -s "$TMP/s.rows" ] || no "(S) the source reader printed no rows — the structural arm would be vacuous"
diff --git a/test/impactpartitioncheck.sh b/test/impactpartitioncheck.sh
index e687e73f..70858016 100644
--- a/test/impactpartitioncheck.sh
+++ b/test/impactpartitioncheck.sh
@@ -224,6 +224,49 @@ for flag in INERT:
     else:
         ok("(4) %s pays 0 bytes for the caveat (no tested partition on it)" % flag)
 
+# ── (5) EACH FORM'S LEGEND READS THE TESTED LENS AS THAT FORM PRINTS IT (2026-09-12) ─────────────────────────────────────
+# kTestedRowLegend says tested="1" is "never 0, omitted when it does not", which is true of the XML rows: they print the
+# attribute only where the lens holds. The columnar form of the same three verbs carries the lens as a DENSE <tested> column
+# (columnar.h emitColumnarTestedColumn), one value per row and 0 on every row the lens does not accept, a test row included,
+# and it printed the row sentence anyway: test/fixture's --callers=distance --format=columnar read "never 0" beside
+# <tested>0,0</tested>. So the columnar legend must read the column and not carry the row sentence, and the XML legend must
+# keep the row sentence, carry no column reading, and print no <s tested="0">. test/fixture holds no test, so every value in
+# its columns is 0 and the control is certain. The needles are the two readings' own words (graphlegend.h).
+# RED on 036c827d (plain): the three columnar rows FAILed and nothing else did, for example
+#   FAIL  (5) --callers=distance --format=columnar: prints <tested>0,0</tested> under a legend that says tested is never 0
+ROW_READING = "never 0, omitted when it does not"
+COL_READING = "0 = none found, or a test row"
+
+def run_fixture(args):
+    p = subprocess.run([BIN, "test/fixture"] + args, capture_output=True, text=True, timeout=60)
+    return p.stdout
+
+for args in (["--callers=distance", "--format=columnar"], ["--callees=total_area", "--format=columnar"], ["--impact=distance", "--format=columnar"]):
+    doc, label = run_fixture(args), " ".join(args)
+    lg     = legend_of(doc)
+    fields = re.search(r'<cols [^>]*fields="([^"]*)"', doc)
+    col    = re.search(r'<tested>([^<]*)</tested>', doc)
+    if not fields or "tested" not in fields.group(1).split(",") or not col or "0" not in col.group(1).split(","):
+        no("(5) %s: control broken — no tested column holding a 0, so the legend has nothing to disagree with" % label)
+    elif ROW_READING in lg:
+        no("(5) %s: prints <tested>%s</tested> under a legend that says tested is never 0" % (label, col.group(1)))
+    elif COL_READING not in lg:
+        no("(5) %s: prints <tested>%s</tested> and its legend never reads the column's 0" % (label, col.group(1)))
+    else:
+        ok("(5) %s: the legend reads the column it prints (<tested>%s</tested>)" % (label, col.group(1)))
+
+for args in (["--callers=distance"], ["--impact=distance"]):
+    doc, label = run_fixture(args), " ".join(args)
+    lg = legend_of(doc)
+    if not re.search(r'<s [^>]*>', doc):
+        no("(5) %s: control broken — no <s> row, so the row reading has nothing to agree with" % label)
+    elif re.search(r'<s [^>]* tested="0"', doc):
+        no("(5) %s: an <s> row prints tested=\"0\" beside a row reading that says never 0" % label)
+    elif ROW_READING not in lg or COL_READING in lg:
+        no("(5) %s: the XML legend %s" % (label, "lost the row reading" if ROW_READING not in lg else "reads a column this form does not print"))
+    else:
+        ok("(5) %s: the row reading rides the XML form, whose rows never print tested=\"0\", and the column reading does not" % label)
+
 print()
 if fail[0]:
     print("impactpartitioncheck: FAILURES")
diff --git a/test/printf_parity.manifest b/test/printf_parity.manifest
index 62b182dc..3ea144ad 100644
--- a/test/printf_parity.manifest
+++ b/test/printf_parity.manifest
@@ -38,5 +38,5 @@ safe_delete 0 b06980d52e4991e57563059d8be986bb4614779e20ccfd3790aac1ee076d2512 e
 verify_layer 1 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 5288c345d7d6e335f88b9c1daa8935db22e1dcf89c0c8bc1f6140d4cb5af0b48
 graph_query 1 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 bfa4319feb9dee09cfbd3991cf6fbd752297e99d14de9e75768820d2a9c8832f
 callers_limit 0 ab9dee52240f70055fa4d82d6b928ef52f4f5781c6a80ee39edb49805b892719 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
-help_all 0 2218403491e83d37232a85d116cfea63d1eade5b8780a8022450fb846681fcc1 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
+help_all 0 fc6cdaff9da1b3af90fa3ad4bd4511da5cc23b27d24105ab18f73d1e53a28109 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
 help_one 0 d958f81abe53aa21051deaf47dded37bf80d707a049148a6356c96e331a28da1 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
diff --git a/test/showcase_capture.py b/test/showcase_capture.py
index 5ad49e6b..c02edb17 100644
--- a/test/showcase_capture.py
+++ b/test/showcase_capture.py
@@ -307,7 +307,7 @@ def add(section, cmd, what, **opts):
 add(S2, f"{BIN} . --around=rankGraphTeleport --around-depth=2", "The restoring knob: --around-depth=2 brings back the whole 2-hop neighbourhood (depth=\"2\" on the root) — pay for it only when the 1-hop view was not enough.")
 add(S2, f"{BIN} . --around=rankGraphTeleport --around-fanout=4", "The other knob: --around-fanout=4 keeps only the 4 strongest edges per node (default 32) — the same 1-hop depth, a quarter of the rows.")
 add(S2, f"{BIN} . --callers=rankGraphTeleport", "Who calls SYM (1-hop in-edges).")
-add(S2, f"{BIN} . --callers=rankGraphTeleport --legend=compact", "The same rows under --legend=compact: the prose legend becomes one <=400 B comment plus schema=\"ripwire.callers/v1\" on the root — every row byte and every completeness attribute (counts_floor=, graph_ambiguous=, next=) identical, ~3 KB of legend gone. Works on EVERY XML verb now, not four.")
+add(S2, f"{BIN} . --callers=rankGraphTeleport --legend=compact", "The same rows under --legend=compact: the prose legend becomes one compact comment plus schema=\"ripwire.callers/v1\" on the root — every row byte and every completeness attribute (counts_floor=, graph_ambiguous=, next=) identical, ~3 KB of legend gone. Works on EVERY XML verb now, not four.")
 add(S2, f"{BIN} . --callers=DoesNotExist", "Unknown-symbol REFUSAL shape (exit 1) with a did-you-mean from real edit distance.")
 add(S2, f"{BIN} . --callees=rankGraphTeleport", "What SYM calls (1-hop out-edges).")
 add(S2, f"{BIN} . --uses=rankGraphTeleport", "The resolvable use-sites (call/read/write/import/extends) with file:line; count= is a floor.")