docs: disclose the 19.4% ast.unparse formatting ceiling (new section 8 + section 7 table row)

ORACLE-LIMITS.md

@@ -131,3 +131,57 @@ the unverified remainder as errors understates the model; treating it as correct
 | `-O` mismatch collapse, docstrings unprovable | this file; `EVAL.md`; `weights/MODEL-CARD.md` |
 | unverified ≠ wrong | this file; `EVAL.md`; `weights/MODEL-CARD.md`; `harness/README.md` |
 | 3.13 / PyInstaller untested | this file; `EVAL.md`; `weights/MODEL-CARD.md` |
+| **19.4% formatting ceiling (§8)** | **this file** |
+
+## 8. The formatting ceiling: 19.4% of real modules cannot certify a re-formatted answer
+
+This section was added on 2026-09-11. It discloses a ceiling that was measured earlier and was
+not previously written down here, which left §7's promise of a complete accounting unmet.
+
+**`ast.unparse` is not bytecode-preserving.** Compiling a source file, and compiling that same
+file after an AST round trip, do not always produce the same code object:
+
+```python
+compile(ast.unparse(ast.parse(src)))  !=  compile(src)     # for 100 of 516 stdlib modules
+```
+
+Measured on all 516 CPython 3.12 stdlib modules: **100 fail the round trip — an 80.6% pass rate,
+so 19.4% of real modules contain at least one affected construct.**
+
+**The cause**, reduced to a repro verified on the measurement box:
+
+```python
+a = {name for name, value in ns.items() if getattr(value, 'x', False)}   # POP_JUMP_IF_FALSE
+a = {name                                                               # POP_JUMP_IF_TRUE
+     for name, value in ns.items()                                      # + JUMP_BACKWARD
+     if getattr(value, 'x', False)}
+```
+
+Identical AST, different bytecode. CPython 3.12's CFG optimiser lays out basic blocks according to
+the **physical line layout** of a comprehension. An `if` *statement* wrapped the same way does not
+change; comprehensions do.
+
+**What this means for anyone reading a score from this oracle.**
+
+- It is a ceiling on the **oracle**, not a defect in any model. A decompilation that is
+  semantically perfect but wraps a comprehension across lines differently from the original will
+  **not certify**. It is scored as unverified, which per §5 means *unknown*, not *wrong*.
+- It applies to **every system measured against this oracle** — ours, PyLingual's, and any other.
+  It is not a differential advantage or disadvantage to anybody.
+- It is **whole-module scale**: 19.4% is the fraction of *modules* containing at least one
+  affected construct, not the fraction of constructs affected. Function- and class-level units are
+  affected at a lower rate, because the chance of containing a comprehension is lower.
+- **It compounds with §2's 0.33% floor and §3's `-O` collapse.** These are independent sources of
+  false rejection; none of them ever produces a false accept.
+
+**Why the numbers already published are not invalidated by this disclosure.** Every published
+score was produced by grading a model's output against a reference *source*, never against an
+`ast.unparse` round trip, so no published figure was computed through the lossy path. This section
+discloses a bound on how high any such score could ever go; it does not move one. It also rules
+out a class of pipeline we did not build: an AST-splice reassembler would have discarded roughly
+one module in five before asking the model a single question.
+
+**Measured, and stated as such.** 100/516 is a direct count over the CPython 3.12 stdlib on the
+measurement box. The corresponding ceiling on the internal 522-row module-shaped eval set — 92.5%
+overall, 88.3% on rows of ≥400 representation lines — is measured on a different set and is
+reported with those internal results rather than here.