Two systems of distinct representatives whose images are disjoint glue into one on the union of their index sets, with no disjointness required of the index sets themselves

ADR-1614 expected Nat.Finset.card_le_of_injOn to be the tool. It is not: that lemma COUNTS an injection, and what is needed here is that the glued function IS one. The content is four branches, one per pair of decisions on `memB s1 i` and `memB s1 j`; the two diagonal ones are each matching's own injectivity and the two mixed ones are refuted by the disjointness hypothesis at exactly that pair, reached through memB_union_elim ('in the union but not in s1' gives 'in s2'). Requiring disjoint INDEX sets would have cost every consumer an obligation the argument never uses.

Produces an `Or` rather than a computed index deliberately: the two sides may overlap, and `setUnion` reads the left one first, so the decision on `memB s i` IS the disjunction. Its pointwise base `memB_union` costs one step more than the difference's, because `union` stores `bound s + bound t` and putting an index above it means putting it above EACH -- le_add_right on the left, the same lemma plus one add_comm on the right. `memB_union_right` needs a decision on `memB s i` where its `_left` twin needs none, for the same left-first reason.

Nat.Hall.glue is a Definition, so the trusted gate cannot tell you it is wrong -- a glue reading the selector the other way round has exactly the same type. It is reduced at concrete arguments with the wrong formula named: with f i = i + 10, g i = i + 20 and s = {1}, the glue is 11 at 1 and 22 at 2, and the swapped convention's answers 21 and 12 are named as the values it must NOT produce. A mutation exchanging the two branches WAS run: it killed all 18 tests in the module by making the shared prelude unbuildable, because the proof terms name the selector's branches positionally through select_nat_true/select_nat_false. So this test is the readable pin on the convention, not a load-bearing guard -- ADR-1623's mutation table records that this lane predicted otherwise and the measurement refuted it.

The presence check is not decoration: Kernel::axiom_footprint returns an EMPTY vector for a name that was never declared, so a footprint assertion alone passes vacuously on a typo'd or missing declaration. Environment::contains is what makes the exit status depend on the finding. The shape_search binary was rebuilt at this lane's HEAD (declarations=3017, up from 3000 at the base commit, the increment being exactly the seventeen new declarations), and the freshness control postdates every commit in the lane, so a stale index cannot pass.