defaultCriticalShapes

The shape every retiring type must reach: assert, retire, re-assert.

Returns [[assertA, retire, assertB]] for an alphabet with at least one OpKind.RETIRE op, and an empty list for a grow-only one. assertA and assertB are the first two OpKind.ASSERT ops in declaration order — so declaration order is load-bearing, and a binding that needs a particular word should pass criticalShapes explicitly rather than rely on this.

Why re-assert with a second op. A lattice that wrongly keeps a retired contribution and one that correctly drops it can land on the identical state, and then the shape asserts nothing. The discriminator is not that the re-asserted value differs — it is that it must not dominate the retired one. Measured on ORMap<String, GCounter>: re-asserting a larger count under the same author finds 0 violations against a lattice provably broken in exactly this way, because a GCounter join takes the max per author and both branches land on the larger number. Re-assert 1 after retiring 4 and the same construction finds the defect on every seed. When the alphabet offers only one assert, the shape repeats it — still worth running, but its power then rests on the op minting fresh identity (a new dot) rather than on domination.