A successful sell followed sell-filled-awaiting-collect -> closed, and
'closed' had no outgoing transition while the scheduler left closed
slots untouched — every GE slot could perform ONE flip and then became
permanently unusable (no rotations, breaks, or longer sessions).
Fix (finding-by-finding, governor comment 10471):
1. 'closed' is no longer a sink. The completed cycle's ledger is
reconciled and ARCHIVED at close, and the physical slot is released
to free via the explicit archival transition closed -> free
(flip-candidates.yaml slot_transitions, whens, scheduler_iteration,
a9 archive step, summary, risk, sources). The scheduler pass
dispatches the release (SLOT_DISPATCH['closed'] = 'release'), so a
closed slot is only ever transient.
2. A deliberately closed cancelled sell releases identically:
sell-cancelled-awaiting-collect -> closed -> free (whens updated).
3. Committed two-rotation regression (validator, wired into
ge_lifecycle_errors for every flipping entry): slot_reuse_violations
walks one physical slot through free -> buy-open ->
buy-filled-awaiting-collect -> ready-to-sell -> sell-open ->
sell-filled-awaiting-collect -> closed -> free -> buy-open (second
buy in the SAME slot), validating every ledger frame against both
conservation gates; archived_ledger_preserved_after_second_buy
proves the rotation-1 archived ledger survives rotation 2 bit-for-bit
(no loss, duplication, or mutation). Negative fixtures prove a
closed sink or a closed that does not release to free FAILS.
4. ge_lifecycle_errors now requires closed == ['free'] exactly and
rejects any machine where a state has no transitions.
5. Worked example: t5/t8 walk the release, t8b runs rotation 2 in the
same physical slots.
All prior fixtures preserved (tax x4, async-slot scheduler,
collection-box, limit-window, side-aware conservation x25) — now 35
selftest checks.
Evidence: python3 tools/validate.py -> 2 entries, 0 errors, 1
pre-existing warning; --selftest -> 35 PASS, 0 errors; git diff
--check clean.
671d025d9f