No instrument distinguishes noProfile wrong-account from genuinely-unprovisioned: both carriers falsified

TERRA-18 shipped arms (1)+(2) and left this as an open gap on pm-terra-cc's instruction (two working arms are not held behind a third). BOTH proposed carriers are dead, for DIFFERENT structural reasons, and neither is a data gap. (1) supersededPriorFlowId: finish() deletes SIGN_IN_FLOW_COOKIE on every exit path and that deletion IS completion semantics, so the stamp can only link a flow whose predecessor never completed - a noProfile completes, so the field is null for every noProfile and the discriminator has ONE reachable value. Measured against the real 2026-08-14 pair (noProfile 07:12:44, authorized 07:12:57): no link. (2) TERRA-27's SIGN_IN_BRIDGE_COOKIE survives a completed attempt and carries the flowId, but friction-actions.ts consumes and deletes it unconditionally on RENDER of the /login?error= landing, before the user clicks; and a bridge still present would mean TERRA-27's own reader had not run, so a second consumer is a race for that rail's correlator, not an addition. STANDING BOUND that survives any future carrier: the population is THREE, not two - no later link means 'not provisioned' OR 'the user gave up', and nothing proposed separates those, so a two-valued reading over-counts by exactly the people who walked away. CONSTRAINTS ON ANY FIX: no PII in appEvents (standing ruling msvnjtzzqp5k - not the email, not a hash, the email space is enumerable so an unsalted digest is reversible and a per-flow salt destroys cross-flow correlation); never widen supersededPriorFlowId's meaning to carry this, it means 'prior flow that never completed' and every existing read changes silently; a fabricated link is worse than a null one because it is not visibly wrong. CLOSE CONDITION: either a carrier is found that survives a completed flow AND is not already owned by another rail, with the three-population bound stated, or this is explicitly accepted as unmeasurable with that reason named.