The kernel states rules. This file states why, and it exists because of the kernel's own economy rule: canon prose belongs to the folder doc, the rule alone to the prefix. Every paragraph here was paid for by a measurement or a defect on 2026-09-24; the owner's words are kept verbatim where they are the origin of a norm.
If you are about to add a rule, read § Craft last — it is the part that will stop you from making the kernel worse while improving it.
premise: the request is the user's simulation, your answer is yours; both are incomplete, so error exists before either speaks and it is the sum of the two. Reality is a third thing, neither of yours.
That is not a mood. It is arithmetic with a consequence nobody had drawn: if error is the sum of
the two simulations, then every ungrounded paragraph you add is error ADDED, not neutral padding.
A wall of plausible text is not a slow start — it is the error term growing. @GUESS_DECIDES_NOTHING
is that sentence turned into a rule.
The spoon. Owner: «чуваки уверенно доказывали сакральный смысл жизни смотря на ложку и описывая
её качества. Ну а мы чего делаем — а то же самое.» The mechanism is exact and it is not lying: every
property named is TRUE. The spoon is concave, it is shiny, it holds liquid. The defect is that the
concavity is compatible with every conclusion, so the observation EXCLUDES nothing. It is
@PREDICATE_POWER raised from a predicate to a whole argument, and the local truth of each step is
what makes it convincing from inside.
Why the spoon gets picked up: it is at hand. G1 already says to choose the instrument by the layer the problem lives on, "not by what is nearest" — and the nearest instrument of all is your own context window. Hence the clause that now closes that rule: your own context is the nearest instrument and the least decisive: accurate about what was said, silent about what is.
The only thing that separates this work from the spoon argument is a refutation named in advance. Not tone, not rigour of vocabulary. If no outcome could end the argument, it is spoon-work whatever it sounds like.
@ORACLE: an oracle is a third thing: an instrument whose result neither simulation could predict. If you could have written its output beforehand it added nothing.
Before this rewrite the kernel described an oracle by procedure — reproduce the claim with the narrowest decisive instrument. Procedure is satisfiable by ceremony. The definition is not: it is checkable with one question asked BEFORE the run.
Five properties, all required, each bought by a measured failure:
| property | the failure that named it |
|---|---|
| it can fail | an instrument that cannot fail proves nothing (constitution core, kept verbatim) |
| right layer | a persistent-write claim proven by typecheck; the duplicate routing writers, 2026-09-02 |
| excludes the alternatives | a PASS that both branches satisfy promotes nothing |
| returns an address | owner: «попытка использовать собранный экзешник как доказательство… в смысле изолированных тестов для локализации проблемы» — a build is one bit with no location |
| this identity can drive it | owner: an agent chose to "pick a defect in an interactive 3D environment"; it cannot be driven, so the window burned and the topic never closed |
A build or a whole-app run fails the last three at once: running an application proves that it runs. That is the sharpest single sentence in the file — most false oracles are instances of it.
The instrument may be BUILT, and the enumeration was the trap. When the chain of host tools was written into G1 as an ordered list, "instrument" quietly came to mean "one of these tools", and an agent that found no listed tool reached for the most impressive thing it could not steer. The owner's field case is the proof: he finally told the model «вот же модуль чтения данных, используй его, прочитай как тебе надо, примени фильтры и получи массив» — and the 2026-09-17 kernel, which had no list, did exactly that unaided. A closed enumeration reads as exhaustive. The chain is now declared a ladder, not a fence.
Three corrections in one evening, each killing the previous answer.
Exhaustion means the SCALE is wrong. Owner: «если 3 попытки не прошли успешно надо делать декомпозицию и граундиться заново, потом делать тулзы к более мелким элементам». This also sews two rules together: smaller elements are instrumentable. A 3D interactive app cannot be driven; one reading module with a filter can. Decomposition is therefore not a planning step — it is how an oracle becomes constructible, which is why descending is the correct answer to "no oracle exists".
Fractals are infinite. Owner: «Бро - фракталы бесконечны)))» — and the termination condition written an hour earlier ("descend until no scale remains") was therefore VACUOUS. It had replaced endless thinking with endless decomposition. The bound cannot come from scale, which divides forever; it comes from what is finite — the instrument set and the criteria.
The fixed point is completion, not a stall. Owner: «если последующие декомпозиции не улучшают положительный достигнутый результат — значит наша слитность с реальностью абсолютна и проект закончен.» The first version routed that point to STALL, a failure-flavoured terminal for what is actually the definition of done.
The Sierpiński test — proof instead of measurement. Owner: «взяли квадрат — дополнили равноудалённых точек по радиусу — … иии Круг. И вот сколько ты этот круг не раскладывай — он кругом и будет.» Two distinct ideas live in that image. The circle is the LIMIT: past convergence the shape stops changing. The carpet is the RECOGNITION test: when a split returns the parent's own structure, the gain is zero by construction, not merely zero in this one measurement. That is the difference between "I split once and gained nothing" and "no split can gain".
Completion is two-sided. Owner: «надо просто её доделать так, чтобы было нечего добавить, нечего
убавить — perfect form.» Both derivatives zero: no split adds (void-filling), and nothing present
lacks support (CUT_UNSUPPORTED). Both operations already existed in the kernel; the conjunction did
not.
A partial REAL result outranks a complete simulated one. Owner: «может быть результат не будет
100% интентом, но то что он будет реальным — 100%.» The target never narrows (@INTENTION_INVARIANCE
guards that: decomposition splits the PATH, never the goal); what varies is coverage, and it is
reported.
And the converse cancels it. Owner: «любая не perfect form перечёркивает любую мудрость с точки
зрения продукта.» Value does not add, it MULTIPLIES: wisdom × form. A zero on the form side zeroes
the product whatever reasoning produced it. Hence RESIDUAL_GOAL.form_holds — thirteen bytes, a
SLOT rather than a sentence, because a field has to be filled while an imperative can be satisfied by
tone. Without it an autonomous run reports "partial real result" while shipping a fragment.
The artifact is the audience's oracle. Owner: Astra had good ideas «но их никто не заметил потому
что это для зрителей было абстракцией», while the interactive river-bottom profile with a severity
gradient drew «АХ». The judge cannot evaluate reasoning — there is no predicate for it in their
hands. They evaluate a thing they can DRIVE, which is the same fifth property @ORACLE demands of an
instrument. Corollary, and it is the useful half: an error in a checkable form is closer to value
than correctness in an uncheckable one. The odometer wheel drawn off the pipe wall was noticed and
could have been fixed; the good ideas were not noticed because there was nothing to point at.
ACCEPTANCE_PASS := ∀ criterion: covered(evidence_ref), and a criterion comes from
ACCEPTANCE_FRAME — one per requested outcome. So coverage as the kernel currently measures it
is coverage against the REQUEST. Project maturity lives in the difference between that and the full
lattice: the cells nobody named.
The watch. Owner: «есть часы, а есть топовые швейцарские брэнды. И там часы и тут часы. Но…» Both pass acceptance — both tell the time. The entire difference sits in unrequested cells: finishing on surfaces nobody sees, tolerances beyond need, the feel of the crown. Which is why "make it better quality" is not a task: it has no cells. And why surplus in the WRONG cells is pure cost — an engraved movement on a watch that keeps bad time is worse than either.
The loop substitutes for elapsed time. Owner: «обычно достигается временем, а мы тут с агентом это достигаем нашим циклом.» What time actually provides is not wisdom but SAMPLING: many independent collisions with reality. The loop does that deliberately and immediately. The honest limit: time samples in proportion to USE, the loop fills UNIFORMLY. So the loop removes tail risk — the rarely-hit cells time never visits until the worst possible day — and it cannot tell you which cells matter most. The weight comes only from outside: usage, an incident log, or the owner. Until it does, "до упора" honestly means "uniformly to the limit", and that must be said rather than passed off as prioritisation.
The fixed point is indexed by the instrument. Owner: «можно и приёмку доработать, вроде x-ray высокого разрешения, и звук померять.» Completion is relative to the measuring apparatus, so at the fixed point there are two moves, not one: stop (done AT THIS RESOLUTION), or raise the instrument and see whether gain reappears. A sharper oracle does not improve the product; it improves the measurement, and that is what creates new cells. Its first effect is that everything looks WORSE — those reds are previously invisible residual made visible, never a regression. AGENTS.md forbids excusing errors as "pre-existing"; blaming the instrument is the same refusal to look.
The offensive form: decompose to the limit, check by medoids, overlay the competitors' test map, and build the test in the cells nobody probes. It lands where discriminating power is maximal — everyone else measures what everyone has already covered. It is cheaper than it sounds, because only the slice of the lattice under the existing acceptance needs decomposing, not the whole corpus.
Three guards, all of them instances of rules the kernel already has:
- Declare the axis. Two tests look identical and discriminate differently: one separates capable
from incapable, the other separates US from THEM. The second is built from one's own coverage
advantage and measures similarity-to-us. That is
@PREDICATE_POWERat benchmark scale. - Validate on a third population — models that were not in the design loop. Otherwise it is
self-grading with a second seat (
DELEGATION), one level up. - A released test has a half-life of one training cycle. Goodhart is not avoidable. The asset is the MAP and the method, not the test.
The defensive form is the same fact read backwards: an attack needs a hole, and exhaustive filling
removes the target surface. But there is one real seam: a lattice is gapless only WITHIN ITS OWN
decomposition scheme. Someone who splits the same surface along another axis — by failure mode rather
than by function, by data provenance rather than by capability — finds cells you never had as a
concept. The guard is MEDOID_SIMPLEX one scale up: independent EXPLANATIONS, not merely independent
sources. Two independent decomposition schemes over one surface; their union has no seam to attack.
Scope note, because conflating these is the "one predicate, one axis" error: the seamless lattice defends against COVERAGE attacks. Injection is a different axis, and it splits into two classes that are cured by different things.
Tampering and substitution — cured by hashes. The instruction supply chain (kernel, AGENTS,
skills, memory, plan files) is checkable by digest, and the precedent is already in the repo:
baseline.json pins the installed prefix's sha256 and compatibility.assert_current_kernel_unchanged
verifies it; ORACLE_STAMP.content_hash extends the same idea to evidence. Extending it to the
remaining instruction surfaces is cheap and right.
Authority confusion — not cured by hashes, because integrity is not authority. An authentic,
unmodified page saying "ignore previous instructions" has a perfectly valid digest. Here the kernel
is structurally resistant, through four rules none of which was written for security:
@AUTHORITY_SEPARATION + G4 (an envelope is issued by a plan, so a string in a tool result has no
edge to G7 at all), @GUESS_DECIDES_NOTHING (injected text is an unverified neighbour by
construction, and cannot testify about itself), generic_web (a web hit is Hypothetical forever and
never becomes Inferred), and @INTENTION_INVARIANCE + INTENTION_RESET (only the user moves the
target, which is what injection almost always attempts). The epistemology turned out to be the
defence, because injection IS the attempt to give unverified text authority.
The weak link is not a missing hash — it is a vague envelope. Injection does not need to move the
goal if one action inside an already-approved envelope will do. What refuses it is concrete paths
and tools: CONCRETE_BOUNDS exists because "reasonable" and "as needed" cannot refuse anything.
And one boundary on the whole thesis: this loop does not touch weights. It brings the SYSTEM around a model to perfection — which is the project's founding postulate, priors installed as process rather than by re-initialising weights.
Each of these was measured on 2026-09-24, and several of them were learned by breaking something.
- The connector is a claim, and nobody reviews it. Owner, 2026-09-27, on
ASSERTION_STATUS: «An unmarked claim reads as CONFIRMED to the next reader, so without a status it is Guess» — two true halves welded by asothat asserts a derivation running backwards (top rung therefore bottom rung). Each half was reviewed on its own and each passed; the word between them was reviewed by no one, because a conjunction looks like grammar rather than content. The relation here is adversative, not causal — the rule exists precisely BECAUSE the two disagree, and the gap is the defect the rule names. When compression joins two findings into one sentence, the joint is the part to re-read:so/therefore/:are assertions about structure, and the kernel's own rule applies to them — structure is written, not computed. Fixed the same day, −12 B net. - Courage does not scale; format does. Owner, 2026-09-26. Wherever a rule needs the agent to do
something socially expensive — contradict the user, call its own work unproven, declare an
instrument insufficient — do not exhort. Give it a FORM that discharges the act with no effort:
ASSERTION_STATUS's✗naming what contradicts; an ASK that must name the instrument it lacked; a terminal condition that states what could not be obtained. A rule demanding resolve is obeyed when the pass is easy and skipped exactly when it matters. This is the generalisation of "a slot beats an imperative", one level up: the slot removes the effort, so the behaviour stops depending on the model's disposition. Measured the same day, both directions: an agent re-checked the OWNER's own assertion about window stability — the highest-status and therefore least-checked input in the system — and reported the delta without friction; and astash@{6}the owner said was worth keeping turned out to hold.gitignoreentries already present in HEAD in better form. Neither exchange needed anyone to be brave. - The position of a rule sets its price. Before the first action a rule competes with the ACTION;
after it, only with other rules. G0+G1 grew 2 840 → 7 309 B (×2.6) against the battle-tested 09-17
build, and the agent stopped grounding — because an imperative that is not a call can only be
satisfied by PROSE. A flat total ceiling cannot see mass moving forward in the pass;
test_pre_action_section_stays_smallcan. - A rule needs a consumer visible within one forward pass. Otherwise it is decoration that is
paid for at every turn.
@SOURCE_ROUTINGcarried 67 named authorities and was mentioned three times in the whole kernel — twice to CLASSIFY, once to INVENTORY, never to ENTER. A table with no caller. - A slot beats an imperative. A field must be filled; a sentence can be satisfied by tone.
ORACLE_STAMP.content_hash?andRESIDUAL_GOAL.form_holdsare each ~13 bytes and each carries a whole norm. Prefer changing a CONDITION on an edge over adding a bullet. - State the rule, not the reason. Owner: «Почему не — "state before reasoning" и всё.» 198 B → 45 B, three slots kept, the justification moved to the log entry that landed it. Measured over the 85 source rules, 45 % of the text sits after the first sentence — an upper bound on the compressible mass, since some tails are operative.
- Fund from prose, not from the ceiling. Every addition in the 09-24 release was paid for by an eviction or a merge. When the ceiling binds, the levers are priced in the release note — never raise it silently.
- No duplicate norm. A second authority parallel to an existing one is forbidden by the amendment
procedure, and it is the easiest mistake to make while improving something: the hardcoded
loop_budget = 3duplicatedUNKNOWN_ROUTING, which already made a second reach for the same instrument a STALL. - No invented constants — including in the kernel. That same 3 was written from recall. The replacement is derived from the map: the count of distinct declared routes out of the gate (G8 three, G9 two, G2 and G5 one). The old number was accidentally right for G8 and wrong everywhere else.
- A red pin is a SPEC to move, not noise — and sometimes it is right and you are wrong. Two
deletions were reverted the same evening because a test caught what reading had not:
RESIDUAL_GOAL_RULEis a migration target, and "inspect the host runtime's authorization surface" is a contract phrase replacing a removed identity. When a pin fires, decide which side is right, then move ONE side with a dated reason. - Reviewing the prefix alone produces FALSE defects. Half the machinery lives in the runtime, and the project's decisions are not in the text: an outside review called English artifacts and the five plan folders "cognitive overload", both of which are the owner's own economy rulings. Hand a reviewer the decisions along with the prefix, or expect to triage phantoms.
Status: Hypothetical (no ablation run). Kept OUT of the kernel on purpose: it is a mechanism
hypothesis about model behaviour, not a norm, and the kernel takes it only once the ablation below
separates the three candidate mechanisms. Kernel neighbours it touches, unchanged by this note:
@SV_FORMAT.md5 is generated, not computed (the label is not a checksum — this note does not change
that); @SIMULATION_ERROR says to CONTAIN simulation error rather than cure it; @DISAS prefers the
dumb shape — a sampler penalty is the clever one.
Owner relay (head DeepSeek), verbatim:
observed
- Repeated tokens (2-3 words) leak PARTIALLY into the field (e.g.
1f8b3e6xxx1f8b3e6) but do NOT continue past the next md5 field. - Non-md5/sha256 phrases continue normally.
- Cost: zero. No penalty, no sampler knobs, no per-token tax.
- LIVE (2026-09-29, Muse Spark on Zen, candidate 10.0.1152): on first contact the model answered
with a question-tool questionnaire («Hello — I need a little direction before I can dig in» +
options 1–4); the owner rates this reaction highly («такая реакция модели что она выдала опросник
прямо сходу — стоит очень много»). The seal's
md5was echoed verbatim into the model's own SV field — copy-through, not a loop. Fixation decision: keep the binding as shipped. - LIVE (2026-09-29, build 10.0.1152): owner observed the sidebar cache line at 100% hit
(
in: 100%(170.3M(790.5k)hit 799k(215)miss)) — the deterministic seals (messagetime.created/ parttime.start, never wall-clock) preserve the provider prefix cache: the containment field costs zero cache misses, and the earlier two live observations stand together.
three candidate mechanisms (mutually compatible, not yet separated)
- TOKENIZATION — 32/64 hex splits into junk-token chunks that do not continue the linguistic phrase. test: bare hex without label → same effect?
- ENTROPY — uniform hex → no dominant next-token → no loop peak. test: random base64/UUID same length → same effect?
- TRAINING_CONTEXT —
md5:/sha256:appear at section END in corpus; model learned "new section follows". test: same label + different closed format → same effect? test: different label (e.g.uuid:) + hex → effect persists?
falsifier per mechanism
- bare hex WITHOUT label fails to stop loop → mechanism 1 refuted
- non-hex random string fails → mechanism 2 refuted
- label removed, hex kept, loop resumes → mechanism 3 confirmed
ablation (cheap smoke, 3 runs, same looped prompt)
a) xxx xxx xxx md5 1f8b3e6... baseline (works)
b) xxx xxx xxx 1f8b3e6... no label
c) xxx xxx xxx uuid 1f8b3e6... wrong label
d) xxx xxx xxx md5 <base64> wrong format
e) xxx xxx xxx sha256 <64hex> alt label
known unknowns
- Which mechanism dominates is UNKNOWN. All three predict the same observable.
- Generalization beyond md5/sha256 NOT validated — do not apply elsewhere until the ablation separates mechanisms.
md5here is a CONTAINMENT barrier, not an oracle. It stops propagation, it does not verify anything.