[MattJackson]

Blocks DEV-GREEN. modernci call measure --repo GetBusbar/busbar --from predev --check oracle on predev 4f9a948 failed before judging anything:
fatal: path 'testing/shadow-oracle/oracle-rust.pin' exists on disk, but not in 'a71b21e9fa…'.

dev is the v1.5.5 commit until predev first lands on it, and that commit has no pin. So the first predev→dev move can never pass.

Fix (.ci/predev.yaml oracle). judge() names the judge from the target only, never from the candidate:

• The target holds oracle-rust.pin: exactly as before. The target's sha256 for this architecture is checked against $BUSBAR_ORACLE_RUST_BIN.
• The target has no testing/shadow-oracle at all (only before the first 1.6.0 move): the judge is the busbar-oracle ModernCI installed on the backend (queue rule 11). One ORACLE-PIN: line names it and its sha256.
• The target has oracle data but no pin, or is not in the checkout: no judge, so the check is RED.

judge_selftest proves the six arms on a throwaway repo before the real target is judged. RED proof:

• Dropping the "oracle data without a pin" arm turns the self-test red.
• Never reading the pin turns it red.

Locally, against the real a71b21e9fa, it prints the bootstrap line.

golden-guard. Unchanged and still run. I ran the 4c47cad0385d judge locally with --base a71b21e9fa --head origin/predev and it reports add-only holds: golden_repo.rs reads absent golden files as empty, so every cell counts as added and nothing is refused. The check now requires: [git-history], because it uses merge-base and git show <target>:.

Scan of the rest of the file. Nothing else assumes the target is a 1.6.0 commit:

• gates: XTASK_CEILING_BASE=$MODERNCI_TO_SHA resolves to the dev merge-base (v1.5.5). The base-relative rules already handle a base that predates the ledgers:
  • kind_isolation/base.rs sets registry_present=false, so minted_rows reports nothing.
  • matrix.rs base_ledger reads an absent ledger as empty.
  • census.rs compares floors only when the base has the ceilings file.
  • matrix.rs:156 holds the 1.5.5 scan to its own count.
  • XTASK_SHIP_TARGET=dev is not a release line.
• verify-done and q128-audit: read no target ref.
• conformance: reads $MODERNCI_COMMIT only.

Overlap: #909 edits the same hunk. #909 (lane-retire-brel-dev-absolute, open, not a draft) rewrites this oracle block, and it reads this tree's own pin when dev holds none. That is the candidate picking its own judge, which this ruling refuses. This PR is opened as a draft under rule 20 (same hunk), so the coordinator can choose between the two.

[MattJackson]

Closed per the coordinator's ruling (2026-10-14, withdrawing the 10:54Z bootstrap ruling). The owner ruled at 02:42Z that there are no hand-installed tenant tools, and ModernCI has removed $BUSBAR_ORACLE_RUST_BIN, so this PR's middle branch names a judge the backend does not have. #909 lands instead: with #911, bin/oracle fetches busbar-release's published busbar-oracle for the BASE pin and verifies its sha256 and .sig. On the first move only, when dev holds no pin, it uses the tree's own pin, which on a predev->dev move is predev's, changed only through judged lane PRs (rule 11). The golden-guard finding (an absent golden reads as all-added) matches #909's guard. The judge_selftest is not ported, because #911 carries its own fetch-selftest.