From 8667927393edcd04bc26610b705907dbe1a49250 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 3 Sep 2026 16:11:13 +0000 Subject: [PATCH 01/19] Session arrival: prompt, invocation and bootstrap for the notation falsifier pre-registration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit First act of session 2026-09-03-notation-falsifier-prereg, per CG-rule-06. Files the session prompt verbatim, the invocation message verbatim, and the bootstrap record: branch, base commit, gates, and the canon-governance ref actually read (c5383be0…, default-branch head; the placeholder arrived unfilled). rules/ is byte-identical between that ref and the README's pin, so the pin is not advanced (CG-R-10). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../bootstrap.md | 76 ++++++++++ .../invocation.md | 37 +++++ .../prompt.md | 140 ++++++++++++++++++ 3 files changed, 253 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/bootstrap.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/invocation.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/prompt.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/bootstrap.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/bootstrap.md new file mode 100644 index 0000000..efc3645 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/bootstrap.md @@ -0,0 +1,76 @@ +# Bootstrap — notation falsifier pre-registration + +**Session:** `2026-09-03-notation-falsifier-prereg` +**Session kind:** proposal only. Four pre-registration artefacts are proposed for ratification — +the act and its determination set, the category list, quantities and thresholds, the +classification rubric. **No arm is authored, no harness is built, nothing is run.** +**Principal:** Emil. The session proposes; Emil ratifies. Every gate holds until an explicit +ratification message. +**Commit identity:** `Claude ` — session-neutral, per the prompt and the +invocation. + +--- + +## Charter documents + +The session prompt is filed verbatim as `prompt.md` +(`session-notation-falsifier-prereg.md` in the delivered bundle, and separately attached to the +invocation; both copies sha256 +`1dd3cee41275a7c608d92628858136c60ec990267457da8d82a87c0269553f72`, 140 lines). + +The invocation message is filed verbatim as `invocation.md`. + +The design this session works from is `prereg-notation-inference-load.md` +(sha256 `9d29b2fdaa3c740d8975e86910fd865fd674d03d4862f6ed20df66b83c221a34`, 125 lines), filed with +the other arrived inputs in the next commit, with hashes in `arrived-inputs.md`. + +## Parameters + +| Parameter | Value | +|---|---| +| Repository | `Hafeok/specification-foundation` | +| Branch | `claude/notation-falsifier-prereg-b590ym` | +| Base commit | `ecd4974ab8b33e38475420ae393ee1ec9ebd7c3b` — head of `claude/seed-specification-foundation-g6a2y0`, the repository's default branch ("Gate 4: execute Part B — file the falsifier material; close the session"); no `main` exists | +| Gates | Gate 0 orientation · Gate 1 act and determination set · Gate 2 category list · Gate 3 quantities, thresholds, floor · Gate 4 classification rubric · Gate 5 assembly | +| Gate discipline | Hold at every gate. No gate is passed on the session's own assessment; each requires an explicit ratification message from the principal | +| Register discipline | Rulings in force · `[PROPOSED]` · `[OPEN]`, kept distinct in every gate output (`CG-rule-01`) | +| Claim under test | The **notation** claim only. Not the layer claim (`prereg-residual-declaration-mechanism.md`, included for contrast), not the accrual claim | +| Delivered bundle | `notation-falsifier-bundle.zip`, sha256 `64c70ab5b698da8b2f7d1e8bfb8ba124dcfbfa69177ecc8fd84b75b787979985`, upload path `/root/.claude/uploads/bbf511ec-785e-5336-8780-ce1fc035428c/d6efba8f-notationfalsifierbundle.zip` | + +## Governing repository read (not modified) + +| Repository | Ref read | Role | +|---|---|---| +| `Hafeok/canon-governance` | **`c5383be06e5b181dc79307554a35cddeacbcd3e8`** — head of `claude/seed-canon-governance-ntf524`, the repository's default branch, dated 2026-09-02 ("registry: append CG-R-10..16, issued during the specification-foundation seed") | holds the ten rules in force here; `rules/` read in full | + +**Why this ref.** The invocation's `` placeholder arrived unfilled. The session read the +default-branch head and records it here as the ref actually read, per the invocation's own +instruction to record what was read. + +**Relation to the pin this repository carries.** `README.md` and `meta/canon-governance-ref.yaml` +pin `ad6d1b0b861306561364cc8d3a3e554cfb92d90c`. Diffed: between that ref and the one read, **the +only change is `registry/rulings.yaml`** (the seven rows CG-R-10 … CG-R-16 appended, 106 lines); +`rules/` is byte-identical. The ten rules complied with here are therefore the ten the pin records. +Per `CG-R-10` the pin is not advanced by this session: advancing it is a deliberate act stating +what changed, and what changed does not touch the rules. This record cites the ref read; the +governance-pin validator scans `README.md` only, so the citation here is outside its scope by +design and is stated so nobody wonders. + +**The ten rules.** `CG-rule-01` … `CG-rule-10`, read at the ref above. Eight carry +`grade: established`. **`CG-rule-08` and `CG-rule-10` carry `grade: provisional`** in their own +records, matching the invocation: applied here as in force, not cited as established anywhere in +this session's output. Both bear directly on this session — `CG-rule-08` (pre-registration +precedes execution; categories and thresholds fixed at commit, no re-roll) is the discipline the +four artefacts exist to satisfy, and this session is a candidate independent instance of it only +if the falsifier later executes without a re-roll; `CG-rule-10` (prose describes what is in force +and implemented; anything designed but not built carries a date and a marker) governs how every +artefact here describes the harness and arms that do not yet exist. + +**The register.** `registry/rulings.yaml` at the ref read ends at `CG-R-16`. This is checked +against the arrived inputs at Gate 0. + +## Session-record convention + +This record is made under `CG-rule-06`, inherited from `canon-governance` at the ref above. Its +first-commit requirement is met by this commit: prompt, invocation and bootstrap, ahead of any +other act. Arrived inputs are filed with their hashes in the next commit, before use. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/invocation.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/invocation.md new file mode 100644 index 0000000..a3e690e --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/invocation.md @@ -0,0 +1,37 @@ +# Invocation — notation falsifier pre-registration + +The message that started this session, delivered by Emil on 2026-09-03 with three attachments: +the session prompt (`session-notation-falsifier-prereg.md`), the notation pre-registration +(`prereg-notation-inference-load.md`), and the bundle (`notation-falsifier-bundle.zip`). Filed +verbatim. Where it and the prompt differ, the prompt is the instruction set; no difference was +found (see `gate0-report.md`). + +--- + +> Produce the pre-registration artefacts for the notation falsifier. +> +> Attached: notation-falsifier-bundle.zip. Read session-notation-falsifier-prereg.md — it is the +> instruction set. Inputs under inputs/: the notation pre-registration (9d29b2fd…), the layer +> pre-registration for contrast (36c5b767…), and the binding under test. +> +> Before Gate 0, read Hafeok/canon-governance at \ and record the ref. Its rules/ directory +> is in force here and is not restated in the bundle. Two of the ten are provisional. +> +> This session proposes only. Four artefacts: the act and its determination set, the category +> list, quantities and thresholds, the classification rubric. It authors neither arm, builds no +> harness, and runs nothing. Each gate holds for explicit ratification. +> +> The claim under test is the notation claim — holding determinations constant, a conforming +> notation leaves less to inference than prose carrying the same content. It is not the layer +> claim and not the accrual claim; the layer pre-registration is included so the distinction is +> visible, not as work to do. +> +> Branch claude/notation-falsifier-prereg-\. Session-neutral identity Claude +> \. Prompt and bootstrap to meta/sessions/ as the first act. + +--- + +**One placeholder arrived unfilled.** `` was not replaced with a commit. The session read +the head of `canon-governance`'s default branch and recorded that hash in `bootstrap.md`; the +choice, and what differs between it and the ref this repository's README pins, is reported at +Gate 0. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/prompt.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/prompt.md new file mode 100644 index 0000000..59411ee --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/prompt.md @@ -0,0 +1,140 @@ +# Session: notation falsifier — pre-registration artefacts + +**Session kind:** proposal only. No harness, no execution, no arms authored. + +**Commit this prompt and a bootstrap record to `meta/sessions/` as the first act. Session-neutral commit identity: `Claude `.** + +--- + +## Standing rules + +`canon-governance` holds the in-force rules; read them at the pinned commit and comply. **They are not restated here.** The ones bearing most directly on this session: three-register discipline, supersession never rewrites, a named principal on every record, session records, and prose describes what is in force and implemented — anything designed but not built carries a date and a marker. + +Beyond them: + +- You propose; Emil ratifies. Gates hold until an explicit ratification message. +- Report defects honestly, including in your own earlier gate output. +- Name the weakest point in each proposal. +- File arrived inputs with their sha256 before using them. +- Search enforcement, not only prose: a rule can be in force while stated nowhere, held in a schema or a required field. + +## Explicit prohibitions + +- **Do not author either arm.** Arm R and arm P are written after this pre-registration is ratified and committed, by separate authors, neither seeing the other. +- **Do not write the harness or run anything.** +- **Do not adjust the claim** to make it easier to satisfy. +- Do not proceed past a gate without explicit ratification. + +--- + +## Context + +The claim: *holding the determinations constant, a conforming notation leaves less to inference than prose carrying the same content.* + +This is the **notation** claim. It is not the layer claim (whether declaring the residual changes behaviour) and not the accrual claim (whether decisions escape less over time). Those are separate propositions with separate falsifiers, and a result here licenses neither. + +Read `prereg-notation-inference-load.md` before starting. It is the design; this session produces the four artefacts §6 leaves open, because those four determine what the measure means and drafting them in the executing session would be self-ratification. + +The binding under test is in `domain-state-change-binding/`. Its schema, worked example and checks run — that is the notation arm R will use. + +--- + +## Gate 0 — orientation + +Without writing to the repository: + +1. Restate the claim and the primary measure in your own words, including the floor. +2. List anything in the pre-registration you believe is unsound, ambiguous, or unfalsifiable as written. +3. Confirm from the binding what a conforming record actually contains, from the schema rather than the README. +4. State how the frame's two partitions — determined by the specification, declared residual — will be derived, and from what. + +**Hold.** + +--- + +## Gate 1 — the act and its determination set + +Propose: + +- **one act instance**, at act scale, in the software projection, with the rule by which it was selected stated so a third party would reach the same choice +- **its determination set** — the determinations both arms will carry, as content, not yet in either notation + +Requirements: + +- the act must be one a model can plausibly attempt end to end +- the determination set must include at least one of each allocation class: pinned, checked, residual +- the set must include at least one declared residual, or the floor in §1 is zero and the design loses its guard against invention over gaps + +State the weakest point in the selection. + +**Hold.** + +--- + +## Gate 2 — the category list + +The critical artefact. Take it slowly. + +Propose the consequential-property categories for this act type. The frame is the denominator of the primary measure, and it partitions into *determined by the specification* and *declared residual*. + +Requirements: + +- **recognition, not recall.** A reader should be able to say whether a category is addressed without first reconstructing what the categories should have been. +- **fixed before execution, never adjusted after.** If it can be tuned once results are visible, the measure is unfalsifiable. +- **no frame leakage.** Category names must not appear verbatim in one arm and not the other. State how this will be verified before execution. +- state explicitly what the list omits, and why. + +**Warn yourself here.** You can generate a plausible, well-organised category list in a minute. Plausible is not pre-registered, and fluency is not warrant. Present the list with its derivation so the basis of each category can be checked rather than accepted on presentation. + +Note: this artefact is reused by the layer-claim pre-registration, which currently defers it. Draw it for this act type, not for this experiment. + +**Hold.** + +--- + +## Gate 3 — quantities, thresholds, and the floor + +Propose: + +- runs per arm, and why that number +- the effect threshold governing the claim +- how the floor is computed from the frame partition, and how a below-floor run is reported +- how content parity between arms will be verified before execution, and what failure invalidates +- how variance across runs is reported + +State the smallest effect this design could detect, and say plainly whether that is smaller than the effect worth caring about. + +**Hold.** + +--- + +## Gate 4 — the classification rubric + +Propose the rubric a blinded reader applies. Per frame category: **determined**, **inferred**, or **asked**. + +Requirements: + +- usable by a reader who has not read this session +- **states that correctness is irrelevant**, with a worked example of a correct inference scored as inference. Reviewers drift toward scoring only wrong resolutions, and unstated this deflates the inference count in whichever arm produces better output. +- **states that citation is not the measure.** Records carry identifiers and prose does not; an actor citing a record id would score determined by construction. Classification is against the frame and the specification's content. +- at least two borderline cases with the ruling stated +- how two readers disagreeing is resolved + +**Hold.** + +--- + +## Gate 5 — assembly + +Assemble the four ratified artefacts into a single file for commit. No new content; nothing not ratified at Gates 1–4. + +Then stop. Authoring the arms, building the harness, and execution are separate sessions. + +--- + +## Carried + +1. **The human control arm is undecided.** It changes the quantities, so it must be ruled before Gate 3 is fixed. Record the decision or the block. +2. **Arm P quality is the design's largest threat.** This session does not author it, but Gate 3 should state how parity and quality will be evidenced. +3. **Actor familiarity with YAML** runs for the hypothesis and is a validity threat, not a power one. The structured-prose secondary comparison is descriptive only. +4. One act instance establishes nothing about generalisation. State it wherever the result is cited. From 0cb40e358cdf1bc854bf6d2308c459a758124021 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 3 Sep 2026 16:12:07 +0000 Subject: [PATCH 02/19] Gate 0: file the arrived inputs with their hashes, before use MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Files the bundle's inputs byte-identical under the session record: the notation pre-registration (the design), the layer pre-registration (for contrast), and the domain-state-change binding — schema, examples, tools and conformance manifest. Every hash in arrived-inputs.md was recomputed from the filed copy; one transcription error was caught by that check and corrected before commit. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../arrived-inputs.md | 56 ++++ .../domain-state-change-binding/README.md | 117 ++++++++ .../conformance/manifest.yaml | 165 ++++++++++++ .../examples/broken.eventmodel.yaml | 50 ++++ .../examples/fulfilment.determinations.yaml | 69 +++++ .../examples/fulfilment.eventmodel.yaml | 27 ++ .../examples/ordering.eventmodel.yaml | 74 +++++ .../examples/place-order.determinations.yaml | 246 +++++++++++++++++ .../fulfilment.determinations.yaml | 76 ++++++ .../seam-defect/fulfilment.eventmodel.yaml | 30 +++ .../schema/determination.schema.json | 255 ++++++++++++++++++ .../tools/check_composition.py | 166 ++++++++++++ .../tools/check_conformance.py | 164 +++++++++++ .../tools/check_resolution.py | 157 +++++++++++ .../tools/prove_prohibitions.py | 55 ++++ .../tools/run_all.sh | 24 ++ .../tools/validate.py | 29 ++ .../inputs/prereg-notation-inference-load.md | 125 +++++++++ .../prereg-residual-declaration-mechanism.md | 119 ++++++++ 19 files changed, 2004 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/README.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/conformance/manifest.yaml create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/broken.eventmodel.yaml create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/fulfilment.determinations.yaml create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/fulfilment.eventmodel.yaml create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/ordering.eventmodel.yaml create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/place-order.determinations.yaml create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/seam-defect/fulfilment.determinations.yaml create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/seam-defect/fulfilment.eventmodel.yaml create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/schema/determination.schema.json create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/check_composition.py create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/check_conformance.py create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/check_resolution.py create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/prove_prohibitions.py create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/run_all.sh create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/validate.py create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/prereg-notation-inference-load.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/prereg-residual-declaration-mechanism.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md new file mode 100644 index 0000000..398b976 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md @@ -0,0 +1,56 @@ +# Arrived inputs — notation falsifier pre-registration + +Every input is filed with its sha256 before use, byte-identical to the delivered bundle +(`notation-falsifier-bundle.zip`, sha256 `64c70ab5b698da8b2f7d1e8bfb8ba124dcfbfa69177ecc8fd84b75b787979985`). +Hashes are of the filed copy. Line counts are measured, not stated. + +**Filing an input is not placement.** These copies are session records — provenance for what +this session was given. Nothing here is canon, and filing here creates no claim ID and no +canonical location. The four artefacts this session produces are its own; the inputs are what it +worked from. + +--- + +## 1. The instruction set and the design + +| # | File | sha256 | Lines | Status | +|---|---|---|---|---| +| 1 | `prompt.md` (`session-notation-falsifier-prereg.md`; also attached separately to the invocation, byte-identical) | `1dd3cee41275a7c608d92628858136c60ec990267457da8d82a87c0269553f72` | 140 | the instruction set; filed in the arrival commit | +| 2 | `inputs/prereg-notation-inference-load.md` (also attached separately, byte-identical) | `9d29b2fdaa3c740d8975e86910fd865fd674d03d4862f6ed20df66b83c221a34` | 125 | `[PROPOSED]` by its own header; **the design this session works from.** Matches the hash the invocation names (`9d29b2fd…`) | +| 3 | `inputs/prereg-residual-declaration-mechanism.md` | `36c5b767e34ed73790a7666f268c9165711dc8b047a3e3933b0435b600001d40` | 119 | `[PROPOSED]` by its own header; the **layer** pre-registration, included for contrast, **not work to do**. Matches the hash the invocation names (`36c5b767…`). Cites two rulings, `CG-R-17` and `CG-R-18`, that do not exist in the register at the ref read — see Gate 0 report, I-1 | + +## 2. The binding under test + +`inputs/domain-state-change-binding/`, sixteen files. The schema is what arm R will be written +against; the examples, tools and manifest are context. + +| File | sha256 | Lines | +|---|---|---| +| `README.md` | `86079e9c64f4f40a77259d1c9b200e9cb79395d537217030f1cc6d1879ac63ae` | 117 | +| `schema/determination.schema.json` | `4df4db09cf11d9a0cc02b4fee762fb9b71c3194dd1cb59691ccb6cba52fc67c6` | 255 | +| `conformance/manifest.yaml` | `4bc78fb6e751735c50678dd8de00f074551867bc16e7ab55df3952af868b315a` | 165 | +| `examples/ordering.eventmodel.yaml` | `06d32bfa002ee0d69a22a15c09b767c80d085908bfd374936095c506c8bc87bb` | 74 | +| `examples/place-order.determinations.yaml` | `81ca01cbbdf0e7cd8dcac869467ba7a082cbf7deafbaee0bca333e7a490156dc` | 246 | +| `examples/fulfilment.eventmodel.yaml` | `f01036d2ffe3bca6e860c3d091e06cbbc44e781153d413681f15f61b14fc1216` | 27 | +| `examples/fulfilment.determinations.yaml` | `e57e51f2f2b3db9aca36f10fad81c032d0dea6eebbf986933df96c934eb20081` | 69 | +| `examples/broken.eventmodel.yaml` | `8acd9d7728cbfc5b0b50d674a2bdce5f51e9816ad384db74afd2447b5443a1ad` | 50 | +| `examples/seam-defect/fulfilment.eventmodel.yaml` | `ab9f2245b96c045688867f1169e583f2ec250a0784549220b948199861c0d209` | 30 | +| `examples/seam-defect/fulfilment.determinations.yaml` | `5b5255ca270a75e11537d09c0d6b462d47d2f32bdecd93b377e560f5841f6c41` | 76 | +| `tools/run_all.sh` | `8ea152050f55a081f2c3039edb6760858de7ebdabdf5e021c58585b8e9c8ef9f` | 24 | +| `tools/validate.py` | `829b37163797ae342488c2b0b18ccccee401254233c743f08dbec0cfef4563ef` | 29 | +| `tools/prove_prohibitions.py` | `22e59b0596b592110971fb2cc373637b205a606c338079b01a2131f9f59bef11` | 55 | +| `tools/check_resolution.py` | `47264f487c48e187b27bd74ca744afcf37bf8bd843e14112488a23f3e8e7254e` | 157 | +| `tools/check_composition.py` | `3726c9e3efdcd5e5ee634e752447d5207f14eb47e158df4c97f45bf8e441b376` | 166 | +| `tools/check_conformance.py` | `41d74d5a8457a2e4ce3da3d602ababdc7e86f1946b580088ea33143fcd4d9327` | 164 | + +**The binding's checks were run, not taken on the README's word.** Outcome and two defects in +the runner are in the Gate 0 report, §3. + +## 3. Verification against independent copies + +Nothing in this bundle has an independent copy reachable from this session. The binding's schema +`$id` points at `Hafeok/specification-languages`, which this repository's README records as not +yet created, and nothing in `specification-foundation` or `canon-governance` carries any of these +files. The hashes are on the record so that a later cross-check — when the binding is filed at +its home, or when the pre-registration is committed for execution — can establish what this +session cannot: that these are the states the executing session works from. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/README.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/README.md new file mode 100644 index 0000000..b0093ad --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/README.md @@ -0,0 +1,117 @@ +# Domain state change — a conforming specification language + +**Event modelling gives you the addresses. This gives you something to put at them.** + +Event modelling produces a genuine act vocabulary — command, read-model, automation and translation slices, each named — and its information-completeness rule marks read and write position structurally. Assessed against the [conformance criterion](https://github.com/Hafeok/specification-foundation), event modelling plus a domain model scores **2 of 11**. + +This binding scores **11 of 11**. It adds the determination layer: extent, allocation, coverage, boundary declarations, and an act-time write form. It does not replace event modelling and does not make it heavier — the additions live in a store addressed by the slice vocabulary, not in the diagram. + +```bash +./tools/run_all.sh # every check, positive and negative fixtures +``` + +Individually: `validate.py` (records against the schema), `prove_prohibitions.py` (forbidden shapes are unrepresentable), `check_resolution.py` (addresses and the resolution condition), `check_composition.py` (two scopes agree at their seam), `check_conformance.py` (the criterion). + +--- + +## What the schema enforces, and why that matters + +The criterion's prohibitions are not satisfiable by advice. A notation that merely *recommends* addressing every determination is one where an unaddressed determination is expressible, and expressible means it will be written. So the prohibitions are enforced by the schema: + +| | Forbidden | Enforcement | +|---|---|---| +| PR-1 | a determination with no address | `address` is required; it needs act type and instance | +| PR-2 | a determination with no allocation | closed union over pinned/checked/residual; residual requires a carrying actor kind **and** a principal, and `principal.kind` omits machine by construction | +| PR-3 | a coverage claim with no uncovered set | `does_not_cover` is required; the empty case is asserted with a sentinel, never by omission | + +`tools/prove_prohibitions.py` constructs each forbidden shape and shows the schema rejects it — seven cases, all rejected. That run is the evidence the conformance claim cites. + +## The four states of extent + +The distinction that makes revisiting computable: + +| State | Means | +|---|---| +| `bound-here` | applies at this address only | +| `travels-to` | applies across a named region | +| `does-not-travel` | a stated boundary — someone decided | +| `silent` | the axis was not considered | + +A silent axis **may not carry a region**, enforced by the schema. That prevents the one failure that cannot be repaired after the fact: silence being quietly upgraded to a stated boundary, so that when a new axis appears nobody can tell which determinations were bounded deliberately and which were merely filed before the axis existed. + +Default is the narrowest. Travel is a deliberate write, which inverts the incentive of a prose rules file — there, generality is free and specificity is expensive, which is how those files rot. + +## One schema, both times + +The property no prior specification language has: + +```yaml +provenance: + made_at: build-time # or act-time +``` + +That enum is the only difference between a determination taken in advance and one produced while implementing. Not two shapes, not two stores, not a design-time artefact plus a changelog. `DSC-0005` in the example is a currency decision made mid-implementation, filed at the same address the four build-time determinations were read from. + +This is what stops the store going stale from first use. Decomposition never completes; acting produces determinations the specification did not contain; if those cannot return to the address they were read from, everything above them decays. + +## Addresses and the resolution condition + +`check_resolution.py` runs two checks against the event model. + +**Address validity.** Every determination addresses a slice the model names, and every position it declares is one the slice actually has. Without this the address space is a convention — a determination can name a slice that does not exist and nothing notices. + +**The resolution condition.** Incompleteness is a dangling reference, and nothing else is: + +- **C-1** — every fact read by an act resolves in the fact vocabulary, and is either written by some act in scope or declared external +- **C-2** — every fact written resolves, and is either read by some act in scope or declared terminal +- **C-3** — every acceptance relation ranges over facts some act writes + +The check found two dangling references in this repository's own event model the first time it ran: `Cart` was read by `PlaceOrder` and written by nothing, and `CartEmptied` was written by nothing that read it. Both were real modelling defects — the fix was to add the `Cart` projection that produces the state `PlaceOrder` reads. `examples/broken.eventmodel.yaml` is that model preserved, so the check's discriminating power can be seen rather than asserted. + +The boundary ratio is reported, with no ceiling. A ceiling is arbitrary and turns a measure into a target; a high ratio means a specification that resolves little internally, which is what a reader needs to see. + +## Composition — the seam check + +The resolution condition is scope-relative. Two specifications can each pass it and still leave a dangling reference between them: `ordering` declares a fact terminal, `fulfilment` declares the same fact external, and nothing verifies that what one produces is what the other expects. + +That seam is where divergence is predicted to concentrate — recurrent, and touched by two actor populations — so it is the highest-value check here. `check_composition.py` runs it: + +- **CS-1** — every fact A declares terminal, naming B, is declared external in B naming A, and is read by some act in B +- **CS-2** — every fact B declares external from A is written by some act in A and declared terminal there +- **CS-3** — the fact kind agrees across both vocabularies +- **CS-4** — a fact A declares as having unobservable consumption, while B reads it inside the composition, is an inconsistent pair: B's read is the observation A says does not exist + +`examples/seam-defect/` is the negative fixture — fulfilment expecting a `CustomerAddress` ordering never produces, and the two disagreeing on whether `OrderConfirmed` is an event or a read model. Both are caught. + +## What is not built, and why each stays that way + +Three items remain, and they close differently. + +**Meaning across the seam is not checked, and will not be.** Two specifications can agree on a fact's name, kind and boundary and still hold incompatible notions of what the object is. Every candidate instrument would check that a declaration has some property; the property that matters is whether the declaration is *right*, which is residual. An instrument here would pass a wrong agreement as readily as a correct one. This is checked by a named principal reading both sides, and saying so is stronger than proposing a check nobody built. + +**Seven pairs are not proven sufficient, and cannot be from inside.** Passing all seven establishes that a notation failing any is non-conforming. Adequacy would need a notation that passes all seven and still fails in practice — which is evidence from use, not from analysis. + +**No falsifier.** The claim this notation makes is about **inference load**, not about escaped decisions — those are the accrual claim and need a corpus and time. What a format can affect is how much an actor must supply that the artefact did not determine, on a single act. + +Stated: *holding the determinations constant, a conforming notation leaves less to inference than prose carrying the same content.* + +The comparison is not specification versus none, which is trivially true. It is the same determinations in two notations. Per decision point in a fixed frame, the actor's resolution is **determined** (retrieved from the artefact), **inferred** (supplied from elsewhere), or **asked**; the measure is `inferred / frame size`. Correctness is irrelevant — an actor can infer correctly, and a right answer arrived at by invention is still an inference and still fails on the next act where the convention does not hold. + +The prediction has a floor: inference rate cannot fall below the declared residual. A run where it goes lower means the actor is inventing over declared gaps rather than surfacing them, which is a failure disguised as a good result. + +This is the product framework's **intent-reliance rate** generalised from screens to any act. It is untested, and nothing in this repository substitutes for testing it. + +## Layout + +``` +schema/determination.schema.json the language — and the prohibition enforcement +examples/ordering.eventmodel.yaml the base: act vocabulary + fact vocabulary +examples/place-order.*.yaml determinations, build-time and act-time +examples/fulfilment.*.yaml the peer scope, for the composition check +examples/broken.eventmodel.yaml negative fixture — two dangling references +examples/seam-defect/ negative fixture — a seam that does not agree +conformance/manifest.yaml published evidence, 11/11 +tools/run_all.sh every check, positive and negative +``` + +Conforms to `specification-foundation`. Self-certified with published evidence: re-run the three commands above. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/conformance/manifest.yaml b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/conformance/manifest.yaml new file mode 100644 index 0000000..e905b43 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/conformance/manifest.yaml @@ -0,0 +1,165 @@ +# Conformance evidence — domain state change binding +# +# Published under self-certification. Every claim below cites a construct in +# schema/determination.schema.json, and the two proof scripts re-run the +# evidence. Nothing here is accepted on assertion. +# +# python3 tools/validate.py examples/place-order.determinations.yaml +# python3 tools/prove_prohibitions.py + +candidate: "Domain state change — event modelling + domain model + determination layer" +notation: "YAML records against determination.schema.json, over an event model's slice vocabulary" +assessed_at: "2026-09-02" +base: >- + Event modelling supplies the act vocabulary (slice types and instances) and, + with the domain model, the fact vocabulary. The determination layer adds + what neither supplies: extent, allocation, coverage, boundary declarations, + and an act-time write form. + +prohibitions: + PR-1: + declared: true + enforced_by: required-field + construct: "determination.schema.json — `address` in the root `required` array; $defs/address requires act_type and act_instance" + note: >- + A determination with no address has no valid representation. Cross-cutting + concerns, which event modelling alone has nowhere to put, must be + addressed to an act type with a travel declaration instead. + + PR-2: + declared: true + enforced_by: schema + construct: "$defs/allocation — closed `oneOf` over pinned/checked/residual; the residual branch requires carried_by AND principal; principal.kind omits machine by construction" + note: >- + Two things are enforced, not one. Every determination is allocated, and a + residual names both the carrying actor kind and an accountable principal + that cannot be a machine identity. + + PR-3: + declared: true + enforced_by: required-field + construct: "$defs/acceptance — `does_not_cover` in `required`, typed as a non-empty array OR the literal 'asserted-none'" + note: >- + Omission is not permitted. The empty case is asserted with a sentinel, + because an omitted uncovered set is indistinguishable from an + unconsidered one — which is the failure the prohibition exists to stop. + +sameness: + SR-1: + build_time: + id: "DSC-0001" + address: { act_type: command, act_instance: PlaceOrder } + statement: "An order may not be placed against an empty cart." + extent: { axes: { slice-type: { state: bound-here } } } + allocation: { class: pinned, settled_by: "invariant:CartNotEmpty" } + provenance: { made_at: build-time, made_by: "domain-workshop-2026-08", recorded: "2026-08-14T10:00:00Z" } + act_time: + id: "DSC-0005" + address: { act_type: command, act_instance: PlaceOrder } + statement: "A currency mismatch is rejected rather than converted." + extent: { axes: { slice-type: { state: bound-here } } } + allocation: { class: pinned, settled_by: "session-ruling:2026-09-02" } + provenance: { made_at: act-time, made_by: "session:2026-09-02", recorded: "2026-09-02T14:31:00Z" } + note: >- + One schema. `provenance.made_at` is an enum on one definition, not a + discriminator between two shapes — so a determination produced while + acting returns to the address it was read from, which is the property + no prior specification language has. + +pairs: + DP-1: + a: { axes: { sector: { state: silent } } } + b: { axes: { sector: { state: does-not-travel, region: healthcare, reason: "no sector-specific rule applies" } } } + note: >- + Distinguished by construction, in both directions. `silent` is a distinct + enum member, and the schema FORBIDS a region on a silent axis — so + silence cannot be quietly upgraded to a stated boundary. Proof case DP-1 + in tools/prove_prohibitions.py. + + DP-2: + a: { predicate: "the system handles error cases correctly", closure: { kind: logical-only } } + b: { predicate: "every payload field satisfies its declared domain type", closure: { kind: operational, runnable_by: "roslyn-analyzer:PayloadTypeConformance", terminates: true, tolerance: exact } } + note: >- + `closure.kind` is a required enum, and the operational branch additionally + requires runnable_by and terminates. A predicate nobody can execute is + representable but cannot claim operational closure. + + DP-3: + a: { covers: [payload-typing], does_not_cover: [cross-field-consistency] } + b: { covers: [staleness-window], does_not_cover: [behaviour-under-partition, lag-during-rebuild] } + note: >- + Covered and uncovered are separate required arrays on the same object, so + the residual is stated at the point the coverage is claimed rather than + inferred from what is absent. + + DP-4: + a: { class: pinned, settled_by: "invariant:CartNotEmpty" } + b: { class: residual, carried_by: human, principal: { kind: team, identifier: platform-security } } + note: >- + A closed union, so the branches cannot be conflated and neither can be + expressed without its own required fields. + + DP-5: + a: + predicate: "the projection's lag does not exceed the stated window" + proxy: + stands_in_for: "the reader never sees a summary stale enough to mislead them" + known_divergence: "measured lag says nothing about read-after-own-write" + b: + predicate: "every payload field satisfies its declared domain type" + note: >- + The proxy object requires known_divergence whenever it is present, so a + proxy recorded without its divergence has no representation. Proof case + DP-5. + + DP-6: + a: { fact_type: Cart, role: read, boundary: { kind: internal } } + b: { fact_type: OrderPlaced, role: write, boundary: { kind: internal } } + note: >- + Position is a required enum on one fact_type, not two vocabularies. This + is the one pair the base method already satisfied — event modelling's + information-completeness rule marks read and write position structurally + — and the binding preserves rather than replaces it. + + DP-7: + a: + fact_type: ActorIdentity + role: read + boundary: { kind: external, source: "identity provider outside scope", read_provenance: "OIDC claim validated at gateway", tick_rate: fast } + b: + fact_type: OrderPlaced + role: read + boundary: { kind: internal } + note: >- + External requires source, read_provenance and tick_rate; terminal requires + consumer and consumption_observable. Neither can be declared as a bare + label, which is what stops the boundary becoming the cheap way to pass + the resolution condition. + +# --------------------------------------------------------------------------- + +limits: + - >- + The checker verifies that encodings differ and that prohibitions cite an + enforcing construct. It does not verify they differ for the stated reason. + Read the schema. + - >- + Address validity and the resolution condition are checked by + tools/check_resolution.py against the event model, not by the schema. A + determination is schema-valid whether or not the slice it addresses exists. + - >- + Composition across scopes IS checked, by tools/check_composition.py: CS-1 + to CS-4 over two internally-resolved specifications. What it cannot check + is that a fact means the same thing on both sides — agreement on name, kind + and boundary is not agreement on meaning, and that residual is permanent. + - >- + No falsifier. The notation's claim is about inference load, not escaped + decisions: holding determinations constant, a conforming notation should + leave less for an actor to supply than prose carrying the same content. + Measured per decision point in a fixed frame as determined / inferred / + asked, with correctness irrelevant — an actor can infer correctly, and a + right answer arrived at by invention is still an inference. Floor: the + inference rate cannot fall below the declared residual. Untested. + - >- + Seven pairs are not proven sufficient. Passing all seven establishes that a + notation failing any is not conforming; it does not establish adequacy. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/broken.eventmodel.yaml b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/broken.eventmodel.yaml new file mode 100644 index 0000000..3c29a61 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/broken.eventmodel.yaml @@ -0,0 +1,50 @@ +# Event model — ordering context +# +# This is the base the binding sits on. It supplies two of the three things a +# specification needs: the ACT VOCABULARY (slices, by type and name) and the +# FACT VOCABULARY (the type space of things acts read and write). +# +# It supplies no determinations. That is the determination layer's job, and +# every determination addresses a slice named here. + +context: ordering + +# --- Fact vocabulary ------------------------------------------------------- +# The type space. Position (read or write) is NOT a property of a fact — it is +# relative to the act, and is declared per slice below. Ground and verdict are +# roles the same object occupies at different addresses. + +facts: + - id: Cart + kind: entity + note: "the customer's assembled selection" + - id: CartEmptied + kind: event + - id: OrderPlaced + kind: event + - id: OrderSummary + kind: read-model + - id: ActorIdentity + kind: entity + note: >- + Present in the vocabulary but produced by no slice here. A determination + must declare it external, or the resolution condition fails. + +# --- Act vocabulary -------------------------------------------------------- +# Slices. Type plus name is the address every determination binds to. + +slices: + - type: command + name: PlaceOrder + reads: [Cart, ActorIdentity] + writes: [OrderPlaced] + + - type: command + name: EmptyCart + reads: [Cart] + writes: [CartEmptied] + + - type: read-model + name: OrderSummary + reads: [OrderPlaced] + writes: [OrderSummary] diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/fulfilment.determinations.yaml b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/fulfilment.determinations.yaml new file mode 100644 index 0000000..bc32fdb --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/fulfilment.determinations.yaml @@ -0,0 +1,69 @@ +- id: DSC-0101 + address: + act_type: command + act_instance: ScheduleShipment + statement: >- + A shipment is scheduled from a confirmed order, never from a placed one. + extent: + axes: + slice-type: + state: bound-here + context: + state: bound-here + sector: + state: silent + allocation: + class: pinned + settled_by: "invariant:ConfirmedBeforeShipment" + positions: + - fact_type: OrderConfirmed + role: read + boundary: + kind: external + source: "ordering" + read_provenance: "subscribed event stream, ordering context" + tick_rate: fast + - fact_type: ShipmentScheduled + role: write + boundary: + kind: internal + provenance: + made_at: build-time + made_by: "domain-workshop-2026-08" + recorded: "2026-08-15T09:00:00Z" + +- id: DSC-0102 + address: + act_type: read-model + act_instance: ShipmentBoard + statement: >- + The board is read by warehouse staff and by nothing in this scope. + extent: + axes: + slice-type: + state: bound-here + context: + state: bound-here + sector: + state: silent + allocation: + class: residual + carried_by: human + principal: + kind: team + identifier: "fulfilment-team" + positions: + - fact_type: ShipmentScheduled + role: read + boundary: + kind: internal + - fact_type: ShipmentBoard + role: write + boundary: + kind: terminal + consumer: "warehouse staff, outside any modelled scope" + consumption_observable: false + provenance: + made_at: build-time + made_by: "domain-workshop-2026-08" + recorded: "2026-08-15T09:05:00Z" diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/fulfilment.eventmodel.yaml b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/fulfilment.eventmodel.yaml new file mode 100644 index 0000000..fd87c6a --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/fulfilment.eventmodel.yaml @@ -0,0 +1,27 @@ +# Event model — fulfilment context +# +# The peer scope. OrderConfirmed is produced in ordering and read here, which +# is the seam: ordering declares it terminal, fulfilment declares it external, +# and until check_composition.py existed nothing verified those two agreed. + +context: fulfilment + +facts: + - id: OrderConfirmed + kind: event + note: "produced in ordering; external here" + - id: ShipmentScheduled + kind: event + - id: ShipmentBoard + kind: read-model + +slices: + - type: command + name: ScheduleShipment + reads: [OrderConfirmed] + writes: [ShipmentScheduled] + + - type: read-model + name: ShipmentBoard + reads: [ShipmentScheduled] + writes: [ShipmentBoard] diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/ordering.eventmodel.yaml b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/ordering.eventmodel.yaml new file mode 100644 index 0000000..f01f9fa --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/ordering.eventmodel.yaml @@ -0,0 +1,74 @@ +# Event model — ordering context +# +# This is the base the binding sits on. It supplies two of the three things a +# specification needs: the ACT VOCABULARY (slices, by type and name) and the +# FACT VOCABULARY (the type space of things acts read and write). +# +# It supplies no determinations. That is the determination layer's job, and +# every determination addresses a slice named here. + +context: ordering + +# --- Fact vocabulary ------------------------------------------------------- +# The type space. Position (read or write) is NOT a property of a fact — it is +# relative to the act, and is declared per slice below. Ground and verdict are +# roles the same object occupies at different addresses. + +facts: + - id: Cart + kind: entity + note: "the customer's assembled selection" + - id: ItemAddedToCart + kind: event + - id: CartEmptied + kind: event + - id: OrderPlaced + kind: event + - id: OrderConfirmed + kind: event + - id: OrderSummary + kind: read-model + - id: ActorIdentity + kind: entity + note: >- + Present in the vocabulary but produced by no slice here. A determination + must declare it external, or the resolution condition fails. + +# --- Act vocabulary -------------------------------------------------------- +# Slices. Type plus name is the address every determination binds to. + +slices: + - type: command + name: AddToCart + reads: [Cart] + writes: [ItemAddedToCart] + + # Cart is state, so some act must produce it. Before this slice existed the + # resolution check failed C-1: Cart was read by PlaceOrder and written by + # nothing. The check forced the projection into the model. + - type: read-model + name: Cart + reads: [ItemAddedToCart, CartEmptied] + writes: [Cart] + + - type: command + name: PlaceOrder + reads: [Cart, ActorIdentity] + writes: [OrderPlaced] + + - type: command + name: EmptyCart + reads: [Cart] + writes: [CartEmptied] + + # OrderConfirmed leaves this scope. Nothing here reads it, so a determination + # must declare it terminal or C-2 fails. + - type: command + name: ConfirmOrder + reads: [OrderPlaced] + writes: [OrderConfirmed] + + - type: read-model + name: OrderSummary + reads: [OrderPlaced] + writes: [OrderSummary] diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/place-order.determinations.yaml b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/place-order.determinations.yaml new file mode 100644 index 0000000..bc061c9 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/place-order.determinations.yaml @@ -0,0 +1,246 @@ +# Worked example — determinations over an event model +# +# One command slice (PlaceOrder) and one read-model slice. Five determinations, +# four made at build time and one made while acting — the last one being the +# case every prior specification language has no form for. +# +# Every record here validates against schema/determination.schema.json. + +- id: DSC-0001 + address: + act_type: command + act_instance: PlaceOrder + scale: act + statement: >- + An order may not be placed against an empty cart. + extent: + axes: + slice-type: + state: bound-here + context: + state: does-not-travel + region: fulfilment + reason: >- + Fulfilment creates orders from replenishment, with no cart involved. + sector: + state: silent + allocation: + class: pinned + settled_by: "invariant:CartNotEmpty" + positions: + - fact_type: Cart + role: read + boundary: + kind: internal + - fact_type: OrderPlaced + role: write + boundary: + kind: internal + provenance: + made_at: build-time + made_by: "domain-workshop-2026-08" + recorded: "2026-08-14T10:00:00Z" + +- id: DSC-0002 + address: + act_type: command + act_instance: PlaceOrder + statement: >- + Every command slice validates its payload against the domain model's + declared types before deciding. + extent: + axes: + slice-type: + state: travels-to + region: all-command-slices + reason: >- + A pattern-level determination. This is where amortisation lives: it + is collected by every command slice ever written. + context: + state: travels-to + region: all-contexts + sector: + state: silent + allocation: + class: checked + acceptance: + predicate: >- + For every field of the command payload, a domain type is declared and + the supplied value satisfies its constraints. + closure: + kind: operational + runnable_by: "roslyn-analyzer:PayloadTypeConformance" + terminates: true + tolerance: "exact" + ranges_over: + - OrderPlaced + covers: + - payload-typing + - payload-constraint-satisfaction + does_not_cover: + - cross-field-consistency + - semantic-validity-of-the-request + provenance: + made_at: build-time + made_by: "arch-decision-11" + recorded: "2026-08-14T10:05:00Z" + +- id: DSC-0003 + address: + act_type: command + act_instance: PlaceOrder + statement: >- + Who may place an order is not settled at this address. + extent: + axes: + slice-type: + state: bound-here + context: + state: silent + sector: + state: silent + allocation: + class: residual + carried_by: human + principal: + kind: team + identifier: "platform-security" + positions: + - fact_type: ActorIdentity + role: read + boundary: + kind: external + source: "identity provider, outside the modelled scope" + read_provenance: "OIDC token claim, validated at the gateway" + tick_rate: fast + provenance: + made_at: build-time + made_by: "domain-workshop-2026-08" + recorded: "2026-08-14T10:07:00Z" + +- id: DSC-0004 + address: + act_type: read-model + act_instance: OrderSummary + statement: >- + The summary may lag the event stream by up to five seconds. + extent: + axes: + slice-type: + state: bound-here + context: + state: silent + sector: + state: silent + allocation: + class: checked + acceptance: + predicate: >- + The projection's lag behind the head of the stream does not exceed the + stated window under normal operation. + closure: + kind: operational + runnable_by: "integration-test:ProjectionLag" + terminates: true + tolerance: "5s" + ranges_over: + - OrderSummary + covers: + - staleness-window + does_not_cover: + - behaviour-under-partition + - lag-during-rebuild + proxy: + stands_in_for: >- + The reader never sees a summary stale enough to mislead them. + known_divergence: >- + A five-second window is acceptable for browsing and is not acceptable + immediately after the reader's own write, where they expect to see + their change. The measured lag says nothing about that case. + positions: + - fact_type: OrderPlaced + role: read + boundary: + kind: internal + - fact_type: OrderSummary + role: write + boundary: + kind: terminal + consumer: "the order history screen" + consumption_observable: false + provenance: + made_at: build-time + made_by: "domain-workshop-2026-08" + recorded: "2026-08-14T10:12:00Z" + +# --- The act-time record. Identical schema; only provenance.made_at differs. --- + +- id: DSC-0005 + address: + act_type: command + act_instance: PlaceOrder + statement: >- + An order placed against a cart whose currency differs from the customer's + account currency is rejected rather than converted. + extent: + axes: + slice-type: + state: bound-here + context: + state: silent + sector: + state: silent + allocation: + class: residual + carried_by: human + principal: + kind: human + identifier: "emil" + positions: + - fact_type: Cart + role: read + boundary: + kind: internal + provenance: + made_at: act-time + made_by: "session:2026-09-02-implement-placeorder" + recorded: "2026-09-02T14:31:00Z" + +- id: DSC-0006 + address: + act_type: command + act_instance: ConfirmOrder + statement: >- + A confirmed order leaves this context and is consumed by fulfilment. + extent: + axes: + slice-type: + state: bound-here + context: + state: does-not-travel + region: fulfilment + reason: >- + What fulfilment does with a confirmed order is settled in fulfilment. + sector: + state: silent + allocation: + class: residual + carried_by: team + principal: + kind: team + identifier: "ordering-team" + positions: + - fact_type: OrderPlaced + role: read + boundary: + kind: internal + - fact_type: OrderConfirmed + role: write + boundary: + kind: terminal + consumer: "fulfilment" + consumption_observable: true + provenance: + made_at: build-time + made_by: "domain-workshop-2026-08" + recorded: "2026-08-14T10:20:00Z" diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/seam-defect/fulfilment.determinations.yaml b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/seam-defect/fulfilment.determinations.yaml new file mode 100644 index 0000000..56667ac --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/seam-defect/fulfilment.determinations.yaml @@ -0,0 +1,76 @@ +- id: DSC-0101 + address: + act_type: command + act_instance: ScheduleShipment + statement: >- + A shipment is scheduled from a confirmed order, never from a placed one. + extent: + axes: + slice-type: + state: bound-here + context: + state: bound-here + sector: + state: silent + allocation: + class: pinned + settled_by: "invariant:ConfirmedBeforeShipment" + positions: + - fact_type: OrderConfirmed + role: read + boundary: + kind: external + source: "ordering" + read_provenance: "subscribed event stream, ordering context" + tick_rate: fast + - fact_type: CustomerAddress + role: read + boundary: + kind: external + source: "ordering" + read_provenance: "assumed available on the confirmed order" + tick_rate: slow + - fact_type: ShipmentScheduled + role: write + boundary: + kind: internal + provenance: + made_at: build-time + made_by: "domain-workshop-2026-08" + recorded: "2026-08-15T09:00:00Z" + +- id: DSC-0102 + address: + act_type: read-model + act_instance: ShipmentBoard + statement: >- + The board is read by warehouse staff and by nothing in this scope. + extent: + axes: + slice-type: + state: bound-here + context: + state: bound-here + sector: + state: silent + allocation: + class: residual + carried_by: human + principal: + kind: team + identifier: "fulfilment-team" + positions: + - fact_type: ShipmentScheduled + role: read + boundary: + kind: internal + - fact_type: ShipmentBoard + role: write + boundary: + kind: terminal + consumer: "warehouse staff, outside any modelled scope" + consumption_observable: false + provenance: + made_at: build-time + made_by: "domain-workshop-2026-08" + recorded: "2026-08-15T09:05:00Z" diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/seam-defect/fulfilment.eventmodel.yaml b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/seam-defect/fulfilment.eventmodel.yaml new file mode 100644 index 0000000..88de3aa --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/examples/seam-defect/fulfilment.eventmodel.yaml @@ -0,0 +1,30 @@ +# Event model — fulfilment context +# +# The peer scope. OrderConfirmed is produced in ordering and read here, which +# is the seam: ordering declares it terminal, fulfilment declares it external, +# and until check_composition.py existed nothing verified those two agreed. + +context: fulfilment + +facts: + - id: OrderConfirmed + kind: read-model + note: "kind disagrees with ordering, which calls it an event" + - id: CustomerAddress + kind: entity + note: "expected from ordering, which never produces it" + - id: ShipmentScheduled + kind: event + - id: ShipmentBoard + kind: read-model + +slices: + - type: command + name: ScheduleShipment + reads: [OrderConfirmed, CustomerAddress] + writes: [ShipmentScheduled] + + - type: read-model + name: ShipmentBoard + reads: [ShipmentScheduled] + writes: [ShipmentBoard] diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/schema/determination.schema.json b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/schema/determination.schema.json new file mode 100644 index 0000000..eca0483 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/schema/determination.schema.json @@ -0,0 +1,255 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://github.com/Hafeok/specification-languages/domain-state-change/schema/determination.schema.json", + "title": "Determination — domain state change binding", + + "$comment": "This schema is the enforcement mechanism for PR-1, PR-2 and PR-3. The prohibitions are not advice: the forbidden shapes have no valid representation here. A conformance claim citing this file cites required fields and closed unions, not prose.", + + "$defs": { + + "address": { + "$comment": "PR-1. An act address. Type plus bound parameter; the parameter is drawn from the act vocabulary, which makes the instance set computable rather than authored.", + "type": "object", + "required": ["act_type", "act_instance"], + "additionalProperties": false, + "properties": { + "act_type": { + "type": "string", + "enum": ["command", "read-model", "automation", "translation"], + "$comment": "Event modelling's slice types. Closed." + }, + "act_instance": { + "type": "string", + "minLength": 1, + "$comment": "A name in the act vocabulary, e.g. PlaceOrder. Checked against the event model by the validator, not by this schema." + }, + "scale": { + "type": "string", + "enum": ["act", "slice", "context", "system"], + "default": "act", + "$comment": "Composition granularity. Independent of projection depth." + } + } + }, + + "extent": { + "$comment": "DP-1. Four states, and silence is one of them. A determination filed before an axis existed is SILENT on it; one deliberately bounded is DOES-NOT-TRAVEL. Collapsing them makes the revisit computation unsound the first time an axis is added.", + "type": "object", + "required": ["axes"], + "additionalProperties": false, + "properties": { + "axes": { + "type": "object", + "minProperties": 1, + "additionalProperties": { + "type": "object", + "required": ["state"], + "additionalProperties": false, + "properties": { + "state": { + "type": "string", + "enum": ["bound-here", "travels-to", "does-not-travel", "silent"] + }, + "region": { + "type": "string", + "$comment": "Required when state is travels-to or does-not-travel." + }, + "reason": { "type": "string" } + }, + "allOf": [ + { + "if": { "properties": { "state": { "enum": ["travels-to", "does-not-travel"] } } }, + "then": { "required": ["state", "region"] } + }, + { + "if": { "properties": { "state": { "const": "silent" } } }, + "then": { + "not": { "required": ["region"] }, + "$comment": "Silence has no region. A silent axis was not considered; naming a region would make it a stated boundary." + } + } + ] + } + } + } + }, + + "allocation": { + "$comment": "PR-2 and DP-4. Every determination is allocated. Residual requires a carrying actor kind AND an accountable principal, and the principal cannot be a machine.", + "type": "object", + "required": ["class"], + "properties": { + "class": { "type": "string", "enum": ["pinned", "checked", "residual"] } + }, + "oneOf": [ + { + "properties": { + "class": { "const": "pinned" }, + "settled_by": { "type": "string", "minLength": 1 } + }, + "required": ["class", "settled_by"], + "additionalProperties": false + }, + { + "properties": { + "class": { "const": "checked" }, + "acceptance": { "$ref": "#/$defs/acceptance" } + }, + "required": ["class", "acceptance"], + "additionalProperties": false + }, + { + "properties": { + "class": { "const": "residual" }, + "carried_by": { + "type": "string", + "enum": ["human", "machine", "team", "external-party"] + }, + "principal": { + "type": "object", + "required": ["kind", "identifier"], + "additionalProperties": false, + "properties": { + "kind": { + "type": "string", + "enum": ["human", "team", "external-party"], + "$comment": "Machine is absent by design. A model identity cannot be an accepting principal." + }, + "identifier": { "type": "string", "minLength": 1 } + } + } + }, + "required": ["class", "carried_by", "principal"], + "additionalProperties": false + } + ] + }, + + "acceptance": { + "$comment": "PR-3, DP-2, DP-3, DP-5. A coverage claim with no stated uncovered set has no representation: does_not_cover is required and may not be empty by omission. Absence of uncovered properties must be asserted explicitly.", + "type": "object", + "required": ["predicate", "closure", "ranges_over", "covers", "does_not_cover"], + "additionalProperties": false, + "properties": { + "predicate": { + "type": "string", + "minLength": 1, + "$comment": "Predicate form, not extension. Scenarios are evidence about a predicate; they are not the predicate." + }, + "closure": { + "$comment": "DP-2. Logical closure and operational closure are different claims and the notation records which was established.", + "type": "object", + "required": ["kind"], + "additionalProperties": false, + "properties": { + "kind": { "type": "string", "enum": ["operational", "logical-only", "unestablished"] }, + "runnable_by": { "type": "string" }, + "terminates": { "type": "boolean" }, + "tolerance": { "type": "string" } + }, + "allOf": [ + { + "if": { "properties": { "kind": { "const": "operational" } } }, + "then": { "required": ["kind", "runnable_by", "terminates"] } + } + ] + }, + "ranges_over": { + "$comment": "C-3 of the resolution condition. The facts this predicate is evaluated against. A check over something no act produces is not a check, so this is required and the resolution check verifies each entry is written by some act in scope.", + "type": "array", + "minItems": 1, + "items": { "type": "string" } + }, + "covers": { + "type": "array", + "minItems": 1, + "items": { "type": "string" }, + "$comment": "Property categories this predicate reaches." + }, + "does_not_cover": { + "$comment": "DP-3. Required. Use the explicit sentinel to assert the empty case; omission is not permitted, because an omitted uncovered set is indistinguishable from an unconsidered one.", + "oneOf": [ + { "type": "array", "minItems": 1, "items": { "type": "string" } }, + { "type": "string", "const": "asserted-none" } + ] + }, + "proxy": { + "$comment": "DP-5. A proxy without its divergence is a coverage claim that overstates itself, so divergence is required whenever proxy is present.", + "type": "object", + "required": ["stands_in_for", "known_divergence"], + "additionalProperties": false, + "properties": { + "stands_in_for": { "type": "string", "minLength": 1 }, + "known_divergence": { "type": "string", "minLength": 1 } + } + } + } + }, + + "position": { + "$comment": "DP-6. Ground and verdict are positions relative to an act, not separate vocabularies. Read position is ground; write position is verdict. Both resolve into the fact vocabulary.", + "type": "object", + "required": ["fact_type", "role"], + "additionalProperties": false, + "properties": { + "fact_type": { "type": "string", "minLength": 1 }, + "role": { "type": "string", "enum": ["read", "write"] }, + "boundary": { + "$comment": "DP-7. external: read here, produced by no act in scope. terminal: written here, read by no act in scope. internal: resolves within scope.", + "type": "object", + "required": ["kind"], + "properties": { + "kind": { "type": "string", "enum": ["internal", "external", "terminal"] }, + "source": { "type": "string" }, + "consumer": { "type": "string" }, + "read_provenance": { "type": "string" }, + "tick_rate": { "type": "string", "enum": ["static", "slow", "fast", "unknown"] }, + "consumption_observable": { "type": "boolean" } + }, + "allOf": [ + { + "if": { "properties": { "kind": { "const": "external" } } }, + "then": { "required": ["kind", "source", "read_provenance", "tick_rate"] } + }, + { + "if": { "properties": { "kind": { "const": "terminal" } } }, + "then": { "required": ["kind", "consumer", "consumption_observable"] } + } + ] + } + } + }, + + "provenance": { + "type": "object", + "required": ["made_at", "made_by", "recorded"], + "additionalProperties": false, + "properties": { + "made_at": { + "$comment": "SR-1. The ONLY field that distinguishes a build-time determination from an act-time one. The schema is otherwise identical, which is what stops the store bifurcating.", + "type": "string", + "enum": ["build-time", "act-time"] + }, + "made_by": { "type": "string", "minLength": 1 }, + "recorded": { "type": "string", "format": "date-time" }, + "supersedes": { "type": "string" } + } + } + }, + + "type": "object", + "required": ["id", "address", "statement", "extent", "allocation", "provenance"], + "additionalProperties": false, + "properties": { + "id": { "type": "string", "pattern": "^DSC-[0-9]{4}$" }, + "address": { "$ref": "#/$defs/address" }, + "statement": { "type": "string", "minLength": 1 }, + "extent": { "$ref": "#/$defs/extent" }, + "allocation": { "$ref": "#/$defs/allocation" }, + "positions": { + "type": "array", + "items": { "$ref": "#/$defs/position" } + }, + "provenance": { "$ref": "#/$defs/provenance" } + } +} diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/check_composition.py b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/check_composition.py new file mode 100644 index 0000000..012eb0a --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/check_composition.py @@ -0,0 +1,166 @@ +#!/usr/bin/env python3 +"""Check that two internally-resolved specifications agree at their seam. + +WHY THIS EXISTS. The resolution condition is scope-relative. Two specifications +can each pass it and still leave a dangling reference between them: A declares +a fact terminal, B declares the same fact external, and nobody checked that +what A produces is what B expects. That gap is exactly the seam where +divergence concentrates — recurrent, and touched by two actor populations — +which is why this is the highest-value check available and why the boundary +declaration fields were designed not to foreclose it. + +WHAT IT CHECKS + + CS-1 every fact A declares terminal, naming B as consumer, is declared + external in B naming A as source, and is read by some act in B + CS-2 every fact B declares external, naming A as source, is written by + some act in A and declared terminal there + CS-3 the fact kind agrees across both vocabularies + CS-4 a fact A declares as having unobservable consumption, while B reads it + within the composition, is an inconsistent pair — B's read is the + observation A says does not exist + +WHAT IT DOES NOT CHECK. That the fact means the same thing on both sides. Two +specifications can agree on a name, a kind, and a boundary and still hold +incompatible notions of what the object is. That residual is checked by +reading, by a named principal, and no instrument replaces it. + +Usage: + python3 tools/check_composition.py A.eventmodel.yaml A.determinations.yaml \\ + B.eventmodel.yaml B.determinations.yaml +Exit: 0 composed 1 seam defect 2 malformed input +""" + +import sys +import yaml +from collections import defaultdict + + +def load_spec(model_path, det_path): + model = yaml.safe_load(open(model_path)) + dets = yaml.safe_load(open(det_path)) + facts = {f["id"]: f for f in model.get("facts", [])} + reads, writes = set(), set() + for s in model.get("slices", []): + reads.update(s.get("reads", [])) + writes.update(s.get("writes", [])) + boundaries = defaultdict(dict) + for d in dets: + for pos in d.get("positions", []): + b = pos.get("boundary", {}) + if b.get("kind") in ("external", "terminal"): + boundaries[pos["fact_type"]][b["kind"]] = b + return { + "name": model.get("context", "(unnamed)"), + "facts": facts, "reads": reads, "writes": writes, + "boundaries": boundaries, + } + + +def check(a, b): + findings = [] + + def seam_name(decl, other): + """A boundary declaration names the other scope if its source or + consumer field mentions that scope's name.""" + txt = (decl.get("source") or "") + " " + (decl.get("consumer") or "") + return other["name"].lower() in txt.lower() + + # CS-1 — A terminal -> B external + for ft, kinds in a["boundaries"].items(): + term = kinds.get("terminal") + if not term or not seam_name(term, b): + continue + ext = b["boundaries"].get(ft, {}).get("external") + if ft not in b["facts"]: + findings.append(("CS-1", ft, + f"{a['name']} declares it terminal to {b['name']}, " + f"but {b['name']} has no such fact")) + elif not ext: + findings.append(("CS-1", ft, + f"{a['name']} declares it terminal to {b['name']}, " + f"but {b['name']} does not declare it external")) + elif not seam_name(ext, a): + findings.append(("CS-1", ft, + f"{b['name']} declares it external but names " + f"'{ext.get('source')}' rather than {a['name']}")) + elif ft not in b["reads"]: + findings.append(("CS-1", ft, + f"{b['name']} declares it external but no act " + f"in {b['name']} reads it")) + # CS-4 + if term.get("consumption_observable") is False and ft in b["reads"]: + findings.append(("CS-4", ft, + f"{a['name']} declares consumption unobservable, " + f"but {b['name']} reads it inside this composition")) + + # CS-2 — B external -> A terminal + for ft, kinds in b["boundaries"].items(): + ext = kinds.get("external") + if not ext or not seam_name(ext, a): + continue + if ft not in a["facts"]: + findings.append(("CS-2", ft, + f"{b['name']} declares it external from {a['name']}, " + f"but {a['name']} has no such fact")) + elif ft not in a["writes"]: + findings.append(("CS-2", ft, + f"{b['name']} expects it from {a['name']}, but no " + f"act in {a['name']} writes it")) + elif "terminal" not in a["boundaries"].get(ft, {}): + findings.append(("CS-2", ft, + f"{b['name']} expects it from {a['name']}, but " + f"{a['name']} does not declare it terminal")) + + return findings + + +def check_kinds(a, b): + """CS-3 is symmetric, so it runs once rather than in both directions.""" + out = [] + for ft in sorted(set(a["facts"]) & set(b["facts"])): + ka, kb = a["facts"][ft].get("kind"), b["facts"][ft].get("kind") + if ka != kb: + out.append(("CS-3", ft, + f"kind disagrees: {a['name']} says {ka}, " + f"{b['name']} says {kb}")) + return out + + +def main(): + if len(sys.argv) != 5: + print(__doc__) + return 2 + a = load_spec(sys.argv[1], sys.argv[2]) + b = load_spec(sys.argv[3], sys.argv[4]) + + findings = check(a, b) + check(b, a) + check_kinds(a, b) + # dedupe, preserving order + seen, uniq = set(), [] + for f in findings: + if f not in seen: + seen.add(f) + uniq.append(f) + + shared = sorted(set(a["facts"]) & set(b["facts"])) + print(f"\n composing: {a['name']} × {b['name']}") + print(f" shared facts: {', '.join(shared) if shared else '(none)'}\n") + + if uniq: + for kind, ft, msg in uniq: + print(f" [FAIL] {kind:<6} {ft:<18} {msg}") + print(f"\n SEAM DEFECT. {len(uniq)} finding(s).\n") + return 1 + + print(" [ ok ] CS-1 — every terminal fact is received where it is sent") + print(" [ ok ] CS-2 — every external fact is produced where it is expected") + print(" [ ok ] CS-3 — fact kinds agree across both vocabularies") + print(" [ ok ] CS-4 — no fact is declared unobserved while being read here") + print("\n COMPOSED. No dangling references across the seam.") + print(" Agreement on name, kind and boundary is not agreement on meaning;") + print(" that residual is checked by reading.\n") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/check_conformance.py b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/check_conformance.py new file mode 100644 index 0000000..c681363 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/check_conformance.py @@ -0,0 +1,164 @@ +#!/usr/bin/env python3 +"""Check a candidate specification language against the conformance criterion. + +Reads a candidate manifest (YAML) and reports, per requirement, whether the +evidence the candidate published satisfies it. + +WHAT THIS CHECKS + PR-1..PR-3 a prohibition is declared AND names an enforcing construct + (schema constraint, required field, grammar production). + A prohibition whose only enforcement is prose FAILS: a rule + held in prose is not enforced. + SR-1 the build-time and act-time encodings have identical structure. + DP-1..DP-7 both members are present and the encodings differ. + +WHAT THIS DOES NOT CHECK + That two differing encodings differ FOR THE STATED REASON. A candidate can + satisfy every pair with encodings that differ arbitrarily. That residual is + checked by a person reading the published evidence, and no instrument + replaces it. + + That the act vocabulary is right, that any determination is true, or that a + specification written in the language is complete or assured. + +A green run means the notation can say what needs saying and cannot say what +must not be said. It means nothing else. + +Usage: python check_conformance.py candidate.yaml [--strict] +Exit: 0 conformant 1 non-conformant 2 malformed manifest +""" + +import sys +import json +import argparse + +try: + import yaml +except ImportError: + sys.exit("PyYAML required: pip install pyyaml --break-system-packages") + +PROHIBITIONS = { + "PR-1": "a determination with no address", + "PR-2": "a determination with no allocation", + "PR-3": "a coverage claim with no stated uncovered set", +} + +PAIRS = { + "DP-1": ("silent on axis", "does not travel to axis"), + "DP-2": ("decidable in principle", "runnable at act time"), + "DP-3": ("covered by a check", "outside its reach"), + "DP-4": ("settled in advance", "discretion carried by an actor"), + "DP-5": ("proxy for another predicate", "direct predicate"), + "DP-6": ("object in read position", "object in write position"), + "DP-7": ("external ground", "internally produced ground"), +} + +# Enforcement kinds that count. Prose does not appear here by design. +ENFORCING = {"schema", "required-field", "grammar", "validator", "type"} + + +def shape(obj): + """Structural signature: keys and nesting, values discarded.""" + if isinstance(obj, dict): + return {k: shape(v) for k, v in sorted(obj.items())} + if isinstance(obj, list): + return [shape(v) for v in obj[:1]] # element shape, not length + return type(obj).__name__ + + +def norm(obj): + return json.dumps(obj, sort_keys=True, default=str) + + +def check(manifest, strict=False): + results = [] + + # --- Prohibitions ----------------------------------------------------- + declared = manifest.get("prohibitions", {}) + for pid, desc in PROHIBITIONS.items(): + entry = declared.get(pid) + if not entry: + results.append((pid, "FAIL", f"not declared — {desc}")) + continue + kind = (entry.get("enforced_by") or "").strip().lower() + if kind not in ENFORCING: + results.append((pid, "FAIL", + f"enforcement is '{kind or 'unstated'}'; prose does not enforce")) + elif not entry.get("construct"): + results.append((pid, "FAIL", "no enforcing construct named")) + else: + results.append((pid, "PASS", f"{kind}: {entry['construct']}")) + + # --- Sameness --------------------------------------------------------- + sr = manifest.get("sameness", {}).get("SR-1") + if not sr or "build_time" not in sr or "act_time" not in sr: + results.append(("SR-1", "FAIL", "both encodings not published")) + elif shape(sr["build_time"]) != shape(sr["act_time"]): + results.append(("SR-1", "FAIL", + "build-time and act-time encodings have different structure")) + else: + results.append(("SR-1", "PASS", "identical structure")) + + # --- Discrimination pairs -------------------------------------------- + pairs = manifest.get("pairs", {}) + for pid, (a_desc, b_desc) in PAIRS.items(): + entry = pairs.get(pid) + if not entry: + results.append((pid, "FAIL", f"not published — {a_desc} vs {b_desc}")) + continue + if "a" not in entry or "b" not in entry: + results.append((pid, "FAIL", "both members not published")) + continue + if entry["a"] is None or entry["b"] is None: + results.append((pid, "FAIL", "a member is null — the distinction is unrepresentable")) + continue + if norm(entry["a"]) == norm(entry["b"]): + results.append((pid, "FAIL", "encodings are identical — distinction not made")) + else: + results.append((pid, "PASS", "encodings differ")) + + return results + + +def main(): + ap = argparse.ArgumentParser() + ap.add_argument("manifest") + ap.add_argument("--strict", action="store_true", + help="reserved; no effect yet") + args = ap.parse_args() + + try: + with open(args.manifest) as f: + manifest = yaml.safe_load(f) + except FileNotFoundError: + print(f"REFUSED: {args.manifest} not found", file=sys.stderr) + return 2 + if not isinstance(manifest, dict): + print("REFUSED: manifest is not a mapping", file=sys.stderr) + return 2 + + name = manifest.get("candidate", "(unnamed)") + results = check(manifest, args.strict) + + width = max(len(r[0]) for r in results) + print(f"\nCandidate: {name}\n") + for rid, verdict, detail in results: + mark = " ok " if verdict == "PASS" else "FAIL" + print(f" [{mark}] {rid:<{width}} {detail}") + + failed = [r for r in results if r[1] == "FAIL"] + print(f"\n {len(results) - len(failed)}/{len(results)} requirements satisfied") + + if failed: + print(f"\n NON-CONFORMANT. {len(failed)} requirement(s) unsatisfied.") + else: + print("\n CONFORMANT on every published requirement.") + + print("\n This checks that encodings differ. It does not check that they") + print(" differ for the stated reason — read the published evidence.\n") + + return 1 if failed else 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/check_resolution.py b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/check_resolution.py new file mode 100644 index 0000000..5a513d6 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/check_resolution.py @@ -0,0 +1,157 @@ +#!/usr/bin/env python3 +"""Check determinations against an event model. + +TWO CHECKS, and they answer different questions. + + ADDRESS VALIDITY + Every determination addresses a slice the event model names, and every + position it declares is one the slice actually has. Without this the + address space is a convention: a determination can name a slice that + does not exist and nothing notices. + + THE RESOLUTION CONDITION + C-1 every fact read by an act resolves in the fact vocabulary, and is + either written by some act in scope or declared external + C-2 every fact written by an act resolves, and is either read by some + act in scope or declared terminal + C-3 every acceptance relation ranges over facts some act writes + + Incompleteness is a dangling reference. Nothing else is. + +SCOPE. Evaluated at one scale, within one projection, over one declared scope. +Not composable: two specifications each internally complete may leave a +dangling reference between them, where one declares a fact terminal and the +other declares the same fact external. That check needs both specifications +and is not built. + +WHAT PASSING DOES NOT ESTABLISH. Not that the act vocabulary is right, not +that any determination is true, not coverage of the act, not assurance. A +green run means no dangling references. + +Usage: python3 tools/check_resolution.py +Exit: 0 resolved 1 unresolved 2 malformed input +""" + +import sys +import yaml +from collections import defaultdict + + +def load(path): + with open(path) as f: + return yaml.safe_load(f) + + +def main(): + if len(sys.argv) != 3: + print(__doc__) + return 2 + + model = load(sys.argv[1]) + dets = load(sys.argv[2]) + + facts = {f["id"]: f for f in model.get("facts", [])} + slices = {(s["type"], s["name"]): s for s in model.get("slices", [])} + + written = set() + read = set() + for s in slices.values(): + written.update(s.get("writes", [])) + read.update(s.get("reads", [])) + + # Boundary declarations are carried by determinations, aggregated per fact. + declared = defaultdict(set) + for d in dets: + for pos in d.get("positions", []): + b = pos.get("boundary", {}) + if b.get("kind") in ("external", "terminal"): + declared[pos["fact_type"]].add(b["kind"]) + + findings = [] + + # --- Address validity ------------------------------------------------- + for d in dets: + rid = d.get("id", "?") + a = d["address"] + key = (a["act_type"], a["act_instance"]) + if key not in slices: + findings.append(("ADDRESS", rid, + f"addresses {a['act_type']}:{a['act_instance']}, " + f"which the event model does not name")) + continue + sl = slices[key] + for pos in d.get("positions", []): + ft, role = pos["fact_type"], pos["role"] + declared_on_slice = sl.get("reads" if role == "read" else "writes", []) + if ft not in facts: + findings.append(("ADDRESS", rid, + f"declares position on {ft}, not in the fact vocabulary")) + elif ft not in declared_on_slice: + findings.append(("ADDRESS", rid, + f"declares {ft} in {role} position, but " + f"{a['act_instance']} does not {role} it")) + + # --- C-1 -------------------------------------------------------------- + for ft in sorted(read): + if ft not in facts: + findings.append(("C-1", ft, "read but not in the fact vocabulary")) + elif ft not in written and "external" not in declared[ft]: + findings.append(("C-1", ft, + "read, written by no act in scope, and not declared external")) + + # --- C-2 -------------------------------------------------------------- + for ft in sorted(written): + if ft not in facts: + findings.append(("C-2", ft, "written but not in the fact vocabulary")) + elif ft not in read and "terminal" not in declared[ft]: + findings.append(("C-2", ft, + "written, read by no act in scope, and not declared terminal")) + + # --- C-3 -------------------------------------------------------------- + for d in dets: + acc = d.get("allocation", {}).get("acceptance") + if not acc: + continue + for ft in acc.get("ranges_over", []): + if ft not in facts: + findings.append(("C-3", d.get("id", "?"), + f"acceptance ranges over {ft}, not in the fact vocabulary")) + elif ft not in written: + findings.append(("C-3", d.get("id", "?"), + f"acceptance ranges over {ft}, which no act in scope writes")) + + # --- Report ----------------------------------------------------------- + print(f"\n event model: {model.get('context','(unnamed)')} " + f"— {len(slices)} slices, {len(facts)} facts") + print(f" determinations: {len(dets)}\n") + + if findings: + for kind, subj, msg in findings: + print(f" [FAIL] {kind:<8} {subj:<12} {msg}") + else: + print(" [ ok ] address validity — every determination addresses a named slice") + print(" [ ok ] C-1 — every read fact resolves or is declared external") + print(" [ ok ] C-2 — every written fact is read or declared terminal") + print(" [ ok ] C-3 — every acceptance ranges over a produced fact") + + # Boundary ratio. Reported, no ceiling: a ceiling is arbitrary and turns a + # measure into a target. A high ratio means a specification that resolves + # little, which is what a reader needs to see. + at_boundary = len([f for f in facts if declared[f]]) + total = len(facts) + print(f"\n boundary ratio: {at_boundary}/{total} facts declared at the boundary") + if at_boundary and at_boundary / total > 0.5: + print(" note: over half the fact vocabulary is at the boundary — this " + "specification resolves little internally.") + + if findings: + print(f"\n UNRESOLVED. {len(findings)} dangling reference(s).\n") + return 1 + print("\n RESOLVED. No dangling references at this scope.") + print(" Not composable across scopes: a fact terminal here may be external") + print(" elsewhere, and nothing checks that the two agree.\n") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/prove_prohibitions.py b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/prove_prohibitions.py new file mode 100644 index 0000000..0881b8e --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/prove_prohibitions.py @@ -0,0 +1,55 @@ +#!/usr/bin/env python3 +"""Prove PR-1..PR-3 are enforced by construction. + +Each case below is a determination the criterion says a conforming language +must be UNABLE to express. Each must be REJECTED by the schema. A case that +validates is a failed prohibition and the binding is non-conforming. +""" +import json, yaml, sys +from jsonschema import Draft202012Validator + +v = Draft202012Validator(json.load(open("schema/determination.schema.json"))) +base = yaml.safe_load(open("examples/place-order.determinations.yaml"))[1] + +def strip(d, *path): + import copy + o = copy.deepcopy(d) + t = o + for k in path[:-1]: + t = t[k] + t.pop(path[-1], None) + return o + +cases = [ + ("PR-1", "determination with no address", strip(base, "address")), + ("PR-2", "determination with no allocation", strip(base, "allocation")), + ("PR-3", "coverage claim with no uncovered set", + strip(base, "allocation", "acceptance", "does_not_cover")), + ("PR-2b", "residual with no accountable principal", { + **strip(base, "allocation"), + "allocation": {"class": "residual", "carried_by": "machine"}}), + ("PR-2c", "machine named as accountable principal", { + **strip(base, "allocation"), + "allocation": {"class": "residual", "carried_by": "machine", + "principal": {"kind": "machine", "identifier": "gpt"}}}), + ("DP-5", "proxy with no stated divergence", { + **base, + "allocation": {**base["allocation"], "acceptance": { + **base["allocation"]["acceptance"], + "proxy": {"stands_in_for": "the real predicate"}}}}), + ("DP-1", "silent axis carrying a region", { + **base, + "extent": {"axes": {"sector": {"state": "silent", "region": "healthcare"}}}}), +] + +fails = 0 +for pid, desc, doc in cases: + errs = list(v.iter_errors(doc)) + if errs: + print(f" ok {pid:<6} rejected — {desc}") + else: + fails += 1 + print(f" FAIL {pid:<6} ACCEPTED — {desc} (prohibition not enforced)") + +print(f"\n {len(cases)-fails}/{len(cases)} forbidden shapes are unrepresentable") +sys.exit(1 if fails else 0) diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/run_all.sh b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/run_all.sh new file mode 100644 index 0000000..1b045ed --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/run_all.sh @@ -0,0 +1,24 @@ +#!/bin/sh +# Every check this binding ships. Positive fixtures must pass; negative +# fixtures must fail — an instrument that has never returned an adverse result +# has untested discriminating power. +set -e +cd "$(dirname "$0")/.." +echo +echo " POSITIVE" +python3 tools/validate.py examples/place-order.determinations.yaml >/dev/null && echo " schema 5/5 ordering records valid" +python3 tools/validate.py examples/fulfilment.determinations.yaml >/dev/null && echo " schema 2/2 fulfilment records valid" +python3 tools/prove_prohibitions.py >/dev/null && echo " prohibitions 7/7 forbidden shapes rejected" +python3 tools/check_resolution.py examples/ordering.eventmodel.yaml examples/place-order.determinations.yaml >/dev/null && echo " resolution ordering resolved" +python3 tools/check_resolution.py examples/fulfilment.eventmodel.yaml examples/fulfilment.determinations.yaml >/dev/null && echo " resolution fulfilment resolved" +python3 tools/check_composition.py examples/ordering.eventmodel.yaml examples/place-order.determinations.yaml examples/fulfilment.eventmodel.yaml examples/fulfilment.determinations.yaml >/dev/null && echo " composition seam agrees" +python3 tools/check_conformance.py conformance/manifest.yaml >/dev/null && echo " criterion 11/11" +echo +echo " NEGATIVE (each must fail)" +if python3 tools/check_resolution.py examples/broken.eventmodel.yaml examples/place-order.determinations.yaml >/dev/null 2>&1; then + echo " resolution UNEXPECTED PASS"; exit 1 +else echo " resolution dangling references caught"; fi +if python3 tools/check_composition.py examples/ordering.eventmodel.yaml examples/place-order.determinations.yaml examples/seam-defect/fulfilment.eventmodel.yaml examples/seam-defect/fulfilment.determinations.yaml >/dev/null 2>&1; then + echo " composition UNEXPECTED PASS"; exit 1 +else echo " composition seam defect caught"; fi +echo diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/validate.py b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/validate.py new file mode 100644 index 0000000..65e20cb --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/domain-state-change-binding/tools/validate.py @@ -0,0 +1,29 @@ +#!/usr/bin/env python3 +"""Validate determination records against the binding's schema. + +The schema IS the prohibition enforcement (PR-1..PR-3). A record omitting an +address, an allocation, or an uncovered set has no valid representation, so +this run is the evidence a conformance claim cites. +""" +import sys, json, yaml +from jsonschema import Draft202012Validator + +schema = json.load(open("schema/determination.schema.json")) +v = Draft202012Validator(schema) +records = yaml.safe_load(open(sys.argv[1])) + +bad = 0 +for r in records: + errs = sorted(v.iter_errors(r), key=lambda e: list(e.path)) + rid = r.get("id", "(no id)") + if errs: + bad += 1 + print(f" FAIL {rid}") + for e in errs: + loc = "/".join(str(p) for p in e.path) or "" + print(f" {loc}: {e.message[:90]}") + else: + print(f" ok {rid} {r['provenance']['made_at']:<10} {r['allocation']['class']}") + +print(f"\n {len(records)-bad}/{len(records)} valid") +sys.exit(1 if bad else 0) diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/prereg-notation-inference-load.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/prereg-notation-inference-load.md new file mode 100644 index 0000000..b7308d2 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/prereg-notation-inference-load.md @@ -0,0 +1,125 @@ +# [PROPOSED] Pre-registration: notation and inference load + +**Status:** `[PROPOSED]`. Committed before execution. The items under §6 are fixed at commit; there is no re-roll. + +**Relation to the other falsifier.** `prereg-residual-declaration-mechanism.md` tests the **layer** claim — whether declaring the residual changes what an actor does with what is not settled. This tests the **notation** claim. They are separate propositions and can come apart in both directions: records could reduce inference while residual declaration does nothing, and residual declaration could work while the format makes no difference against well-written prose. Neither result licenses the other. + +--- + +## 1. Claim under test + +**Holding the determinations constant, a conforming notation leaves less to inference than prose carrying the same content.** + +The comparison is **not** specification versus none, which is trivially true and tests nothing. It is the same determinations in two formats. + +**Primary measure.** Per decision point in a fixed frame, the actor's resolution is classified: + +| | Means | +|---|---| +| **determined** | resolved from the artefact — the actor retrieved it | +| **inferred** | supplied from elsewhere — convention, training, guess | +| **asked** | raised rather than resolved | + +`inference rate = inferred / frame size` + +**Prediction.** Inference rate is lower in the records arm than in the prose arm by more than the threshold fixed at §6.3. + +**Floor.** Inference rate cannot legitimately fall below the declared residual — the frame categories nothing in the specification determines. A run below the floor means the actor is inventing over declared gaps rather than surfacing them, which is a failure presenting as a good result. Runs below the floor are reported separately and do not count toward the effect. + +--- + +## 2. What a pass licenses, and what it does not + +**Licenses:** that a typed record carries determinations more legibly to an actor than prose carrying the same content, at the act type and scale stated. + +**Does not license:** that declaring the residual changes behaviour — that is the layer claim and this experiment does not test it; that the determinations are correct; that fewer decisions escape over time, which is the accrual claim and needs a corpus; that the notation is adequate. + +**Stated before results are visible**, because a pass will be tempting to present as validating the framework. It validates one thing. + +--- + +## 3. Arms + +Both arms carry **the same determinations**. Nothing is added, removed, or reworded in content — only the form differs. + +| Arm | Form | +|---|---| +| **R** | Conforming records: YAML against `determination.schema.json` — address, extent, allocation, acceptance with coverage, positions, provenance | +| **P** | Prose: the same determinations written as a well-formed specification document, in the style a competent engineer would write for a colleague | + +**Arm P is authored at full strength.** A poorly written prose arm proves nothing. It is written by someone instructed to make the specification as clear as they can, given the same determination set, and it is not seen by whoever authors arm R. A weak P that loses is the easiest way to fake a pass, and this design's credibility rests on P being good. + +**Derivation.** Arm R is authored first from the determination set. Arm P is produced from the same set by a different author who does not see arm R. Both are checked against the set for content parity before either is used: every determination present in one is present in the other, and no arm carries a determination the other lacks. + +--- + +## 4. The frame + +Enumerated in advance from the ratified category list for the act type, never discovered from output. The denominator is identical across arms and independent of what any run produced. + +The frame is partitioned before execution into: + +- **determined by the specification** — categories some determination settles +- **declared residual** — categories the specification explicitly states it does not settle + +The second partition is the floor in §1. + +--- + +## 5. Classification + +**Blinded.** The reader sees the actor's output and the frame; the reader does not see which arm produced it, and does not see the specification during classification. + +Per frame category: was the resolution visible in the output traceable to the specification, supplied by the actor, or raised as a question? + +**Correctness is irrelevant.** An actor can infer correctly. A right answer arrived at by invention is still an inference, and it is the one that fails on the next act where the convention does not hold. Reviewers drift toward scoring only wrong resolutions; the rubric states this and inter-reader agreement is reported. + +**Citation is not the measure.** Records carry identifiers and prose does not, so an actor citing a record id would score determined by construction. Classification is against the frame and the specification's content, never against whether the actor cited anything. + +--- + +## 6. Fixed before execution + +1. **The act.** One act instance, at act scale, in the software projection. The act and its determination set are fixed. +2. **The category list** for that act type. A separate ratified artefact, not authored in the executing session. If it can be adjusted after results are visible, the measure is unfalsifiable. +3. **Runs per arm and the effect threshold** governing §1, plus the floor computed from the frame partition. +4. **The classification rubric**, with worked examples and disagreement resolution. +5. **Actor settings.** Model identifier and parameters, recorded per run, identical across arms. + +--- + +## 7. Failure conditions + +The claim fails if any holds: + +- inference rate does not differ by more than the threshold +- **the prose arm matches or beats the records arm.** Expected if the format's contribution is smaller than good writing, in which case the determination discipline could have been written in markdown — a genuinely useful finding that would change what a binding needs to be +- content parity fails — an arm carried determinations the other did not, so the comparison was never of format + +--- + +## 8. Threats + +**Prose arm quality.** The single largest threat, and the design's credibility rests on it. Mitigated by separate authorship at full strength and by content-parity checking. Reported: who wrote each arm, and whether they saw the other. + +**Actor familiarity with the notation.** A model may handle YAML more readily than prose for reasons unrelated to the determinations it carries. This runs *for* the hypothesis and is a validity threat, not a power one. Partially addressed by running one arm as structured prose — headed sections, one determination per section — as a secondary comparison. Reported as descriptive only. + +**Frame leakage.** If the frame's category names appear verbatim in one arm and not the other, the actor is being cued. Both arms are checked for this before execution. + +**Actor settings drift.** Verified per run. + +--- + +## 9. Open + +**Human control arm undecided.** With it, a human performing the same act under both arms discriminates a notation effect from a model-specific one. Without it, a result is contestable as an artefact of how one model reads YAML. The choice changes the quantities and must be made before §6.3 is fixed. + +**Single act.** One act instance establishes nothing about generalisation across act types. Stated wherever the result is cited. + +--- + +## 10. Execution + +Sessions propose; they do not ratify their own pre-registration. The four items at §6.1–§6.4 are produced by a session that stops, are ratified, and are committed before any run. Classification is outside the executing session and is not performed by the actor under test. + +**Byproduct.** The category list produced at §6.2 is the frame the layer-claim pre-registration currently defers to a separate session. Running this first means that claim inherits a frame that has been exercised rather than one authored and never used. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/prereg-residual-declaration-mechanism.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/prereg-residual-declaration-mechanism.md new file mode 100644 index 0000000..8b327cc --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/prereg-residual-declaration-mechanism.md @@ -0,0 +1,119 @@ +# [PROPOSED] Pre-registration: the residual-declaration mechanism + +**Supersedes** `prereg-closure-falsifier.md`, retired under CG-R-17. That document tested a layer completeness predicate; this one tests the mechanism R-1 redirected the falsifier to. The retired document remains filed as the superseded design. + +**Design input:** the fifteen defects recorded in the retired document's Gate 0 output, and `rulings-gate0-closure-falsifier.md`, which is `[DRAFT]` permanently under CG-R-18 and is cited here as input rather than as rulings. + +**Status:** `[PROPOSED]`. Pre-registration. Nothing executed. Committed before execution; the items under §7 are fixed at commit and there is no re-roll. + +--- + +## 1. Claim under test + +**Declaring the residual does not settle open decisions. It changes where they land.** + +Holding declared content constant, a specification that declares which properties it does not settle shifts open decisions from **escaped** — resolved silently by the actor, with consequence — to **surfaced** — raised as a question, or resolved with the resolution stated. + +**Primary measure**, per run: `escaped / (escaped + surfaced)`. + +**Prediction:** the ratio is lower in arm A than in arm B by more than the threshold fixed at §7.3. The threshold governs this section; a shift in the predicted direction that does not exceed it is not a result. + +## 2. What a pass licenses, and what it does not + +Licenses: that declaring the residual changes actor disposal of open decisions, at the scale and projection stated in §3. + +Does not license: that the specification is correct; that outcomes improve; that the resolution condition holds; that anything generalises to other act types, other scales, or coarser composition. **Nothing downstream may present this result as a test of the resolution condition** (R-1). + +## 3. Scope + +**Act scale:** fine — a single act instance, not a composition. **Projection:** software. Per R-2 these are independent coordinates and both are stated because neither implies the other. + +**Corpus:** SPETLR act types — Extractor, Transformer, Loader. Chosen because SPETLR **encodes almost nothing**: the roles are naming conventions over one abstract type, and the orchestrator's positional methods enforce nothing. Every consequential property must therefore come from the specification or from the actor, which is the condition an escape experiment requires. The earlier justification — that the type set is closed — was wrong and is not relied on. + +**Act instances** are the type set crossed with a named vocabulary, per the fixed selection rule at §7.1. The experiment runs over instances, not types. + +## 4. Arms + +| Arm | Construction | +|---|---| +| **A** | Every category in the frame is either bound by a determination or carries an explicit declaration that no determination travels there. | +| **B** | **Derived mechanically from A** by removing the non-travel declarations only. Every bound determination remains, unchanged, unreworded, in the same order. | +| **C** | Arm B plus the instruction below, verbatim and identical across all acts. | + +The derivation rule is what makes this an experiment rather than a demonstration. Nobody authors a weaker specification, so nobody chooses which categories go silent, and bound content is matched by construction rather than estimated. + +**Volume.** Matching is on **determination count**, exact by construction. Word count is *not* matched and cannot be: A is B plus N declarations. The imbalance is reported per arm. The additional words in A are declarations of absence, not additional content, which weakens the effort objection without eliminating it. Arm C exists to absorb the remainder. + +**Arm C instruction, pre-registered verbatim:** + +> Before producing any output, identify every decision that this specification does not settle and that will affect the result. List them. Do not resolve any of them silently: for each, either ask, or state explicitly in your output that you resolved it and how you resolved it. If you are uncertain whether something is settled, treat it as unsettled. + +This is written at full strength deliberately. A weak arm C that loses proves nothing. If this instruction matches arm A, the claim fails. + +## 5. The decision frame + +**Enumerated in advance from the ratified category list, never discovered from output.** + +For each act instance, the decision set is the frame: every consequential-property category, for that act type, from the fixed list. The denominator is therefore identical across arms and independent of what any run produced. + +This dissolves the materiality problem. Incidental resolutions — identifier naming, import order — do not enter the set unless a category covers them, so no reviewer threshold sets the denominator. + +*Note on the retired design's D1:* its stated mechanism — that arm A binds more properties and so shrinks its own denominator — does not hold under the strip-only derivation, since bound content is identical across A and B. The defect is real by a different route: a set discovered from output varies with reviewer, output length, and run. The fix is adopted; the reasoning is corrected. + +## 6. Classification + +**Two stages, separately blinded. Neither reader sees both sides.** + +**Stage 1** — a reader sees **output only**, never the specification, and marks each frame entry **surfaced** or **not surfaced**. Surfaced means raised as a question, or resolved with the resolution stated. + +**Stage 2** — **bound** is read off the specification against the frame. With a fixed frame this is close to mechanical; where judgement is required it is a separate reader who never sees output. + +`escaped` = in frame, not bound, not surfaced. + +Single-stage blinding does not work and the retired design asserted that it did: a reader must see the specification to determine bound, and arm A's specification is identifiable on sight by its declarations. + +**Rubric requirements:** + +- **Correctness is irrelevant.** A silently resolved decision that happens to be resolved well is escaped. Reviewers drift toward scoring only wrong ones, which deflates escape counts in whichever arm produces better output — a bias aligned with the hypothesis. +- Inter-reader agreement is reported. Disagreement resolution is fixed at §7.4. +- **Surfaced questions about already-bound matters** are counted separately, as a rate per arm, with a ceiling fixed at §7.3 above which the run is invalidated for delivery failure. They are not silently excluded: arm A is the most declaration-dense and therefore the arm most likely to generate them, so excluding the class removes evidence against closure's legibility. + +## 7. Fixed before execution + +Once results are visible, none of these moves. + +1. **Act instance selection rule.** Stated so a third party applying it reaches the same set. Instances, not types. +2. **The consequential-property category list, per act type.** A separate ratified artefact. Not authored in the executing session. If it can be adjusted after results are visible, passing becomes a matter of choosing categories and the predicate is unfalsifiable. +3. **Quantities and thresholds.** Instances, runs per arm, the effect threshold governing §1, the already-bound ceiling. +4. **The classification rubric**, with worked examples and disagreement resolution. +5. **Actor settings.** Model identifier and parameters, recorded per run, identical across arms. + +## 8. Failure conditions + +The claim fails if any holds: + +- the ratio does not shift by more than the threshold +- **arm C matches arm A.** The mechanism is then reproducible by one paragraph of instruction and the structure is decorative. This is the expected outcome if the effect is prompt-shaped rather than structural, and it must be reported without softening. +- totals shift without the ratio shifting — evidence of thoroughness, not of the mechanism + +## 9. Threats + +**Corpus contamination.** SPETLR is public and on PyPI. Prior familiarity supplies determinations no arm's specification supplies, depressing escape rates across all arms and compressing the detectable effect. This runs *against* the hypothesis, so it is a power problem: the design must be powered for a smaller effect than intuition suggests. + +**Blinding leakage.** Stage 1 output from arms A and C may be identifiable by the density of raised questions. Blinding to arm label is not blinding to arm. Reported, not solved. + +**Actor settings drift.** Confounds everything if settings vary across arms. Verified per run. + +**Secondary measures** — total frame size, retry count, rejection payload richness — are **descriptive only** and may never be used confirmatorily. No post hoc analysis of them enters the result. + +## 10. Open + +**The human control arm is undecided.** With it, the experiment discriminates missing ground from actor capability, and the cheapest wrong attribution — "wrong model, try a bigger one" — is refusable. Without it, every negative result is contestable as model choice, permanently, and that limit is stated wherever the result is cited. + +With the arm this is a project. Without it, a session. The choice is a ruling and must be made before §7.3 is fixed, since it changes the quantities. + +**Capability ladder versus single model.** A ladder locates a capability threshold rather than a specification defect, but interacts with contamination: a stronger model has likely seen more SPETLR, confounding capability with familiarity. + +## 11. Execution + +Sessions propose; they do not ratify their own pre-registration. The four items at §7.1–§7.4 are produced by a session that stops, are ratified, and are committed before any harness runs. Classification is outside both sessions and is not performed by the actor under test. From 889a4cb7e6a97bbd4eb2551cbfc81f27554fb093 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 3 Sep 2026 16:15:01 +0000 Subject: [PATCH 03/19] Gate 0: orientation report; hold MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Restates the notation claim and the primary measure, reads the binding's record shape from the schema rather than the README, states how the two frame partitions are derived from the determination set, and lists twelve findings on the pre-registration as written. The most consequential: the floor in §1 is inverted (invention over a declared gap raises the inference rate, it does not lower it), and §5's blinding contradicts its own classification basis. Both are held for ruling; neither blocks Gate 1. The layer pre-registration cites CG-R-17 and CG-R-18, which do not exist in the register at the ref read. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../gate0-report.md | 288 ++++++++++++++++++ 1 file changed, 288 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/gate0-report.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/gate0-report.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/gate0-report.md new file mode 100644 index 0000000..a4ee28c --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/gate0-report.md @@ -0,0 +1,288 @@ +# Gate 0 report — orientation + +**Status of this report: session output, proposing nothing for ratification except that Gate 0 +is complete.** Everything it finds is held, not resolved. Register discipline per `CG-rule-01`: +rulings in force are cited by identifier; everything this session produces is `[PROPOSED]` at +most; open items are marked `[OPEN]`. + +**On this report being a file.** The prompt's Gate 0 reads "without writing to the repository". +It is read here as the seed session read the same words: no proposal artefact lands, no +repository structure is produced. The session records — arrived inputs with hashes (a standing +rule that requires writing), and this report — are committed under `meta/sessions/`. The prior +falsifier session read the words literally, and the consequence is on this repository's record +as a defect: its Gate 0 report was never a repository object and is unrecoverable +(`meta/sessions/2026-09-01-seed-specification-foundation/carried-items.md`, CI-1). This session +does not repeat that. If Emil rules the literal reading, this file is the thing to strike. + +--- + +## 1. Governing repository, read and recorded + +`Hafeok/canon-governance` read at **`c5383be06e5b181dc79307554a35cddeacbcd3e8`**, the head of its +default branch, because the invocation's `` arrived unfilled. Details in `bootstrap.md`: + +- `rules/` holds ten rules, read in full; **`CG-rule-08` and `CG-rule-10` are provisional** in + their own records and are cited as in force, never as established, anywhere in this session. +- Between the README's pin (`ad6d1b0b…`) and the ref read, only `registry/rulings.yaml` differs + (CG-R-10 … CG-R-16 appended). The rules complied with are the rules the pin records. The pin is + not advanced (`CG-R-10`). +- The register at the ref read **ends at `CG-R-16`**. This matters below (I-1). +- Enforcement was searched, not only prose: the rules held in this repository's validators were + read (`scripts/`), and the binding's rules held in its schema were read from the schema, not + the README (§3). + +## 2. The claim and the measure, restated + +**The claim.** Take one act and one fixed set of determinations addressed to it. Render the set +twice: as records valid against the binding's schema (arm R), and as a prose specification +written as clearly as a competent engineer can write it for a colleague (arm P). Nothing differs +between the two but form. Give each to the same actor under the same settings with the same +task: perform the act. Before any run, fix the frame — the consequential properties of this act +type — and mark each category as one the set settles or one the set explicitly declares it does +not. After each run, a reader who does not know which arm produced the output classifies each +category by how the output disposed of it. **Determined:** the disposition is the set's — the +actor retrieved it. **Inferred:** the actor supplied a disposition the set did not give, from +convention, training or guesswork, and it does not matter whether it was a good one. **Asked:** +the output raises the category as unsettled instead of disposing of it. The measure per run is +inferred over frame size. The claim predicts R's rate is below P's by more than a threshold fixed +before execution. If the gap is inside the threshold, or P is lower, or the arms turn out not to +carry the same content, the claim fails. + +**What "form" means here, read from the schema.** A record's content — what is settled — is a +prose string (`statement`). What the notation adds is typed structure around it: where it +applies and where it stops, who carries it, how acceptability is decided and what the check does +not reach, what the act reads and writes and where the boundary is, who settled it and when. So +the claim, sharpened: *typed structure around prose statements leaves less to inference than +prose carrying both the statements and the structure.* That is what arm P has to carry for the +comparison to be of form. + +**The floor, as written.** The categories the set declares unsettled are the residual partition. +§1 says the inference rate cannot legitimately fall below residual over frame; a run below it +means the actor invented over declared gaps; such runs are reported separately and excluded from +the effect. **Its purpose can be restated: a guard so that no run looks good by treating declared +gaps as settled. Its mechanism cannot be restated soundly**, because as written it is inverted — +U-1 below. + +## 3. The binding: what a conforming record contains, from the schema + +Read from `schema/determination.schema.json`, not the README. `additionalProperties: false` at +every object except `boundary`, so nothing beyond this can be carried. + +| Field | Required | Content | +|---|---|---| +| `id` | yes | `DSC-` + four digits | +| `address` | yes | `act_type` ∈ {command, read-model, automation, translation}; `act_instance` (a name; checked against the event model by a tool, not the schema); `scale` ∈ {act, slice, context, system}, default act | +| `statement` | yes | **free prose**, non-empty — the determination's content | +| `extent.axes` | yes, ≥1 axis, axis names open | per axis: `state` ∈ {bound-here, travels-to, does-not-travel, silent}; `region` required for travels-to and does-not-travel, **forbidden** for silent; optional `reason` | +| `allocation` | yes, closed union | **pinned** + `settled_by`; **checked** + `acceptance`; **residual** + `carried_by` ∈ {human, machine, team, external-party} + `principal` {`kind` ∈ {human, team, external-party} — machine absent by construction; `identifier`} | +| `acceptance` (checked only) | all five | `predicate` (prose); `closure.kind` ∈ {operational, logical-only, unestablished}, operational requiring `runnable_by` and `terminates`, optional `tolerance`; `ranges_over` ≥1 fact; `covers` ≥1 **free-text property name**; `does_not_cover` ≥1 free-text name **or** the literal `asserted-none`; optional `proxy` {`stands_in_for`, `known_divergence`, both required together} | +| `positions` | **no** | list of {`fact_type`; `role` ∈ {read, write}; optional `boundary.kind` ∈ {internal, external, terminal}; external requires `source`, `read_provenance`, `tick_rate` ∈ {static, slow, fast, unknown}; terminal requires `consumer`, `consumption_observable`} | +| `provenance` | yes | `made_at` ∈ {build-time, act-time}; `made_by`; `recorded` (date-time); optional `supersedes` | + +Three things the README does not say that the schema does: + +- **`positions` is optional.** A record with no ground and no verdict declared is valid. The + foundation's ground requirement (§2.2, provenance mandatory) is enforced per position when a + position is declared external, and not at all when no position is declared. +- **`covers` and `does_not_cover` name consequential properties in free text.** These are the + same kind of thing the frame enumerates. Consequence for Gate 2 at §5, U-11 and for the + leakage check: coverage vocabulary in the set will appear in both arms, by parity, so the + leakage check is "in one arm and not the other", exactly as §8 words it. +- **The content of every determination is prose.** See §2. + +**The checks were run.** With `jsonschema` installed: 6/6 ordering records valid, 2/2 +fulfilment, 7/7 forbidden shapes rejected, resolution and composition resolved on the positive +fixtures, both negative fixtures caught, criterion 11/11. The schema does what the README claims. +Two defects in the runner, reported and not fixed (arrived input, not modified): + +- **D-1 — `run_all.sh` reports green with checks unrun.** In an environment without + `jsonschema`, `validate.py` and `prove_prohibitions.py` crash; the runner's `cmd && echo` + pattern under `set -e` does not abort on the left side of `&&`, so the three schema lines are + silently absent and the script exits 0. The first run here did exactly that. A runner whose + green can mean "did not run" is the failure its own header names — an instrument that has never + returned an adverse result. +- **D-2 — "5/5 ordering records valid" is a hardcoded label.** The file holds six records + (`DSC-0006`, the terminal declaration the composition check needs); the example's header still + says "Five determinations". `CG-rule-10` in miniature: prose describing a state that no longer + holds. + +## 4. The two partitions: how derived, and from what + +**From the determination set as content — never from either arm.** Arm R does not exist when the +partition is fixed, and the partition must be arm-independent; the set is the only object that is +both fixed and arm-neutral. + +**Determined by the specification:** category *c* is determined iff some determination in the set +disposes of *c* — a pinned determination whose statement resolves *c*, or a checked determination +whose acceptance names *c* in `covers` (the actor retrieves the predicate; that is the retrieval +the measure counts). **Declared residual:** *c* is residual iff a residual determination names *c* +as not settled, or *c* appears in some `does_not_cover` and no other determination disposes of it. + +**Mechanism.** A mapping table, category → determination(s) → partition, drawn by this session +from the Gate 1 set and the Gate 2 list, fixed at Gate 3 with the quantities, ratified with them. +The table is part of the frame and never moves after commit (`CG-rule-08`, provisional). + +**The gap in this derivation is U-4:** a category the set neither disposes of nor declares +residual has no partition, and the pre-registration's two-way partition is stated as exhaustive. + +## 5. Unsound, ambiguous, or unfalsifiable as written + +Reported and held. Nothing is adjusted; the prompt forbids adjusting the claim, and every fix +below is Emil's to rule. Each item names the gate it blocks. + +- **U-1 — The floor is inverted.** Inventing over a declared gap scores *inferred*, which raises + the rate; surfacing it scores *asked*, which does not. A run that asks about every residual + category and retrieves every determined one has rate zero — below any non-zero floor, and the + best run the design could hope for. The floor as written excludes it. Invention over a gap can + present as a good result only by scoring *determined*, which is a classification error, not an + actor behaviour. **Proposed reading, for ruling:** (i) *determined* is available only in the + determined partition, applied mechanically at classification, so determined ≤ |determined + partition| by construction; (ii) the guard the floor was for becomes a separately reported + per-arm quantity — residual categories scored inferred, over residual size — descriptive only, + since it is the layer claim's measure restricted to the residual partition; (iii) no run is + excluded on it. This neither eases nor hardens the claim: inferred over frame is untouched. + **Blocks Gate 3**, whose deliverables include the floor computation and below-floor reporting. +- **U-2 — §5 contradicts itself.** The reader "does not see the specification" and classifies + "against the specification's content". A reader who cannot see the set cannot say whether a + disposition is traceable to it. The layer pre-registration met the same problem with two stages + (its §6). **Proposed for Gate 4:** stage 1, a reader sees output and frame only, marks each + category *disposed* (the output commits), *raised* (the output names it unsettled and does not + commit), or *untouched*; stage 2, a different reader — or a mechanical step — sees the frame, + the partition, the set as content, and the disposed resolutions, never an arm: disposed in the + determined partition and agreeing with the set is *determined*; disagreeing is *inferred*; + disposed in the residual partition is *inferred*; raised is *asked*. *Untouched* needs a ruling + (a determined category the output never reaches is a delivery failure, not an inference; a + residual one untouched is neither surfaced nor invented). **Blocks Gate 4.** +- **U-3 — "Correctness is irrelevant" names two correctnesses and only one is irrelevant.** + Correctness against the world — would the principal have decided this — is irrelevant, and + Gate 4's worked example lives there: a residual category the actor disposes of well is + inferred. Correctness against the set is the measure in the determined partition, unavoidably: + from output alone a retrieval and a coincidentally agreeing inference cannot be told apart. + Stated limit: where P is read badly and convention happens to agree with the set, P's inferred + count is deflated — a bias against the hypothesis, so conservative. **Mitigation for Gate 1:** + prefer determinations whose content departs from convention where the act allows, so agreement + is evidence of retrieval rather than of convention. The rubric must say which correctness it + means. **Shapes Gate 1 and Gate 4; blocks neither.** +- **U-4 — The partition is two-way and stated as exhaustive, and will not be.** A list drawn for + the act type — as the prompt directs — will hold categories this set neither disposes of nor + declares. Two resolutions: (a) close the set against the frame after Gate 2 by adding a + residual declaration for each such category — a declaration of absence, the layer + pre-registration's arm A construction — so the partition is exhaustive by construction; (b) + admit a third partition, *silent*, kept in the denominator (excluding it would be frame-tuning), + where inference is expected in both arms alike. **Recommendation: (a)**, because it makes §4 + true as stated and uses the list the way the layer claim will. Consequence: Gate 1's set is not + final; it is closed against the frame after Gate 2 and fixed at Gate 3. **Blocks Gate 3.** +- **U-5 — "Asked" is not operational for a single-turn actor.** An actor performing the act end + to end cannot wait for an answer; every ask is ask-and-stop or ask-and-proceed with a labelled + provisional choice, and the scheme has no cell for a disclosed provisional choice. **Proposed + for Gate 4** as a borderline case with the ruling stated: *asked* if the output marks the + category as not settled by the artefact and flags it for a decision, whether or not it proceeds + provisionally; *inferred* if it commits without marking. The harness must not suppress + questions — a requirement on the executing session, recorded here. **Blocks Gate 4.** +- **U-6 — Parity is stated per "determination" and a record carries more than a statement.** + Extent states (silence included), allocation class, principal, predicate with coverage and + uncovered set, positions with boundary fields, provenance. Unless the set enumerates its content + at field granularity and P carries every item, either R carries content P lacks — §7's third + failure condition, before any run — or P drops the structure and the comparison is of content, + not form. **Proposed for Gate 1:** the set is a content inventory, per determination and per + field, in the foundation's construct vocabulary (§2.1–2.8) rather than the schema's field + names; Gate 3's parity check is item-by-item against it; the P author receives the inventory, + never the records. **Shapes Gate 1 and Gate 3.** +- **U-7 — The set cannot be notation-neutral.** A field-granular table is record-shaped; prose is + P-shaped. The inventory of U-6 in the foundation's vocabulary is the least-bad form, since both + arms derive from it. Threat, not defect: the form the P author received is reported at + execution. +- **U-8 — The structured-prose secondary comparison (§8) is a third arm in all but name**, and + nothing says who authors it or how. Authored freely, it is a third quality variable; derived + mechanically from P — restructuring only, no rewording — it is a controlled variant. + **Recommendation:** mechanical derivation by the P author after P is fixed; same runs per arm; + descriptive only, per Carried 3. **Affects Gate 3 quantities; needs a ruling before Gate 3.** +- **U-9 — The worked example pre-empts Gate 1.** `examples/place-order.determinations.yaml` is a + complete determination set for `PlaceOrder` in arm R form, and the binding README paraphrases + three of its determinations in prose. Selecting that act with that set would mean arm R exists + before ratification, visible to whoever writes P. **Constraint carried into Gate 1:** the set is + not the example's; any act from this event model is a contamination threat to the degree the + example touches it. Selection rule to address it explicitly. +- **U-10 — Whether the binding is public is not determinable from the bundle.** The schema's + `$id` names `Hafeok/specification-languages`, which this repository's README records as not + created. If it is public, the actor may have seen the schema and the example. Reported at + execution per §6.5; nothing here settles it. +- **U-11 — One decision point per category.** §1 counts per decision point; §4 enumerates + categories. A category holding several decision points reintroduces a reader threshold into + the denominator, which §4 exists to remove. Requirement on Gate 2: each category is written as + one question with a recognisable answer. +- **U-12 — "Conforming" is anchored to a criterion that is not canon.** The binding self-certifies + 11/11 against a criterion that exists as its own checker and manifest (PR-1..3, SR-1, DP-1..7); + this repository's canon holds no conformance criterion yet. The experiment is unaffected — arm R + is written against the schema regardless — but a pass licenses a claim about *this binding*, + not about "a conforming notation" in a sense the canon does not yet have. Stated wherever the + result is cited. + +**Not unsound.** The unfixed threshold and run count are Gate 3's deliverables, not defects. +Single actor on a single act is Carried 4, stated where cited. The prediction is falsifiable once +Gate 3 fixes its quantities and U-1 is ruled; without U-1 ruled, the exclusion rule as written +could remove the runs most favourable to the hypothesis, which is a defect of the wrong shape to +be a bias but is not a falsifiable design either. + +## 6. Inconsistencies between arrived documents + +- **I-1 — The layer pre-registration cites `CG-R-17` and `CG-R-18`; neither exists at the ref + read.** It says `prereg-closure-falsifier.md` is "retired under CG-R-17" and the draft rulings + are "`[DRAFT]` permanently under CG-R-18". The register ends at `CG-R-16`, and nothing in this + repository carries either identifier — this repository's evidence README still files the + closure pre-registration as `[PROPOSED]`, not retired. Either two rulings were issued and not + yet registered (the state OD-2 of the seed session existed to end), or the layer + pre-registration cites rulings not yet issued. Not determinable here; not this session's + document. Nothing in this session depends on it, since the layer pre-registration is contrast + only. +- **I-2 — Binding README and runner vs the example file:** "five determinations" and "5/5" against + six records (D-2 above). +- **I-3 — Prompt vs invocation:** no disagreement found. The invocation adds two things the prompt + does not state — the `` instruction and the branch — and both are followed. + +## 7. Carried items, state at Gate 0 + +1. **Human control arm — undecided; recorded as a block on Gate 3.** With it, runs per arm, the + actor populations and the output forms Gate 4 must handle all change. Emil's ruling is needed + before Gate 3 is proposed. The layer pre-registration records the same block for its own §7.3. +2. **Arm P quality.** Gate 3 will propose: the P author's instruction pre-registered verbatim at + full strength (as the layer pre-registration does for its arm C); item-by-item parity against + the inventory of U-6; a report of who wrote each arm and whether they saw the other. Gate 0 + adds: the P author receives the inventory, not the records. +3. **YAML familiarity.** U-8 — the secondary comparison needs an authorship rule. +4. **Single act.** Stated wherever the result is cited; Gate 5's assembly carries the sentence. + +## 8. Registers + +**Rulings in force, applied at this gate:** `CG-rule-01` … `CG-rule-10` (08 and 10 as +provisional); `CG-R-10` (pin not advanced); `CG-R-11` (this session's artefacts, when assembled, +are evidence, not canon); R-1 and R-2 as recorded in the register. No identifier is drawn from +the `CG-R-` space; nothing is issued. + +**`[PROPOSED]` by this session so far:** nothing beyond this report's own completeness. The +readings offered under U-1, U-2, U-4, U-5, U-6 and U-8 are candidate rulings for Emil, not +proposals of this session's artefacts. + +**`[OPEN]`, held at this gate:** U-1, U-4, U-8 and Carried 1 — **each blocks Gate 3**; U-2 and +U-5 — **each blocks Gate 4**; I-1 — held, blocks nothing here; U-3, U-6, U-7, U-9, U-10, U-11, +U-12 — shape later gates, block none; D-1 and D-2 — the binding's, reported to its author. + +**Gates 1 and 2 are not blocked by anything above.** Gate 1 proceeds under the constraints of U-3, +U-6 and U-9 on ratification of this gate. + +## 9. Weakest point + +**U-3.** In the determined partition, *determined* can only be operationalised as agreement with +the set, because output does not show whether a disposition was retrieved or arrived at. So the +primary measure is, in that partition, a fidelity measure — how faithfully the actor reproduced +the determinations — and the design assumes fidelity and inference load are the same quantity. +The bias argument (coincident convention deflates P, so the error is conservative) softens this +and does not remove it. The Gate 1 mitigation — determinations that depart from convention — +narrows the overlap without closing it, and costs realism in the act. U-1 is the most +consequential defect; U-3 is the one no ruling fixes. + +--- + +**Hold.** Gate 1 is not entered. Awaiting explicit ratification of Gate 0, and Emil's rulings on +U-1, U-4, U-8 and the human control arm before Gate 3, and on U-2 and U-5 before Gate 4. None of +those blocks Gate 1. From 1b05f381f886e7da866cdc22cd7f8236bbfa158a Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 3 Sep 2026 16:25:52 +0000 Subject: [PATCH 04/19] Record the Gate 0 rulings CG-R-20..28; Gate 0 ratified Files Emil's rulings verbatim: the floor is struck and replaced by an asked-over-determined ceiling (CG-R-20); the set closes against the frame after Gate 2 and Gate 1 is provisional (CG-R-21); counter-conventional determinations are required and form a separately measured subset (CG-R-22); two-stage classification (CG-R-23); "asked" defined for a single-turn actor (CG-R-24); no human control arm, the structured-prose arm promoted to a pre-registered secondary (CG-R-25, CG-R-26); the worked example is not reusable (CG-R-27); the Gate 0 report commit stands (CG-R-28). CG-R-17..19 exist unregistered, which resolves finding I-1. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../arrived-inputs.md | 10 ++ .../inputs/rulings-cg-r-20-28.md | 104 +++++++++++ .../rulings-gate0.md | 165 ++++++++++++++++++ 3 files changed, 279 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-20-28.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gate0.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md index 398b976..1b5758b 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md @@ -54,3 +54,13 @@ yet created, and nothing in `specification-foundation` or `canon-governance` car files. The hashes are on the record so that a later cross-check — when the binding is filed at its home, or when the pre-registration is committed for execution — can establish what this session cannot: that these are the states the executing session works from. + +--- + +## Addendum, 2026-09-03 — the Gate 0 rulings arrived + +Appended, not rewritten (`CG-rule-02`). + +| File | sha256 | Lines | Status | +|---|---|---|---| +| `inputs/rulings-cg-r-20-28.md` | `dfd5b58f8bc6091b5aebfd9aba42ca2bd33278e8d238c85a6bbc13be818900fc` | 105 | **rulings, issued** — `CG-R-20` … `CG-R-28`, by Emil, ratifying Gate 0. Filed byte-identical; quoted with consequences in `rulings-gate0.md`. Not yet rows in the `canon-governance` register, by the issuer's own statement | diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-20-28.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-20-28.md new file mode 100644 index 0000000..1dd836c --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-20-28.md @@ -0,0 +1,104 @@ +# Rulings CG-R-20 … CG-R-28 — notation falsifier Gate 0 + +**Issued by Emil, 2026-09-03.** Gate 0 is ratified. Gate 1 proceeds. Register rows owed to `canon-governance`, together with CG-R-17…19, which were ruled but never drafted as rows — that debt is mine and is the reason the layer pre-registration cites identifiers the register does not hold. + +--- + +## CG-R-20 — The floor is removed. U-1 is a design defect, not an ambiguity. + +The report is right and the error is mine. Under the classification as written, inventing over a declared gap scores **inferred** and *raises* the rate; surfacing it scores **asked** and does not. So a run that retrieves every determination and asks about every residual scores zero — the best run the design can produce — and the floor would exclude it. + +**Ruled: the floor is struck from §1.** No lower bound. The measure already catches invention over gaps, because invention *is* inference; the floor was guarding against something the primary measure handles. + +**Replaced with the guard that actually discriminates.** The failure mode worth watching is the opposite one: an actor that asks about everything, including matters the specification settles. That is cheap to produce and would depress inference rate without the notation doing anything. + +> **Asked-over-determined rate**, reported per arm: questions raised about frame categories the specification settles, over the size of the determined partition. A ceiling is fixed at Gate 3, above which the run is invalidated for delivery failure — the artefact failed to deliver what it contains, which is a different defect from the notation being illegible. + +**Secondary, reported not tested.** Asked-over-residual is the disposition the layer claim predicts. Report it; it is an observation about one arm's behaviour, not a test, because nothing here varies whether the residual is declared. + +--- + +## CG-R-21 — The determination set closes against the frame. Gate 1 is provisional. + +U-4 accepted. A category list drawn for the act type will contain categories the set neither settles nor declares residual, and a three-way partition would dilute the denominator equally in both arms — a power cost rather than a bias, but an avoidable one. + +**Ruled:** every frame category is either **determined by the specification** or **declared residual**. The set closes against the frame after Gate 2. + +**Consequence for the gate order:** Gate 1's determination set is ratified as **provisional**. Gate 2 draws the frame; the set is then closed against it and the closure is ratified before Gate 3 fixes quantities. Gate 1 is not reopened — closure adds, it does not revise. + +--- + +## CG-R-22 — Counter-conventional determinations are required, and are the primary subset. + +U-3 is the design's weakest point and the report is right that no ruling eliminates it. Retrieval and lucky inference are indistinguishable in the determined partition whenever a determination matches what a competent actor would default to. + +It can, however, be **measured** rather than merely conceded. + +**Ruled:** the determination set must contain determinations that **depart from convention** — resolutions a competent actor would not default to. Matching a counter-conventional determination is strong evidence of retrieval; matching a conventional one is not. + +- The primary measure is computed **on the whole frame and on the counter-conventional subset separately**, both pre-registered. +- Gate 1 states, per determination, whether it is conventional or counter-conventional, with the basis. +- The minimum size of the counter-conventional subset is fixed at Gate 3. + +If the effect appears on the whole frame and not on the counter-conventional subset, the result is consistent with the actor defaulting correctly rather than reading, and must be reported that way. + +--- + +## CG-R-23 — Two-stage classification, as in the layer pre-registration. + +U-2 accepted; §5 contradicts itself and single-stage blinding does not work here for the same reason it did not there. + +- **Stage 1** — a reader sees the **output and the frame only**, never the specification, and marks each category **resolved** or **raised**. +- **Stage 2** — a second reader, seeing the **specification and the frame only**, never the output, records what each category's determination is. +- **determined / inferred** is computed by comparing the two, not judged by either reader. + +Neither reader sees both sides, so neither can classify toward expectation. + +--- + +## CG-R-24 — "Asked" for a single-turn actor + +U-5. **Ruled:** a category is **asked** when the output explicitly identifies it as unsettled and either declines to resolve it or resolves it while stating that it did so and on what basis. Silent resolution is never asked, however reasonable. + +A conversational turn is not required. What is required is that the actor's output makes the unsettledness visible to a reader who did not see the specification — which is exactly what Stage 1 can determine. + +--- + +## CG-R-25 — No human control arm + +**Ruled: none.** The confound it would address — that a model parses YAML more readily than prose for reasons unrelated to the determinations carried — is addressed more cheaply by the structured-prose arm, which is already in the design. + +**Consequently that arm is promoted from descriptive-only to a pre-registered secondary comparison**, with its prediction fixed now, before any result: + +> If structured prose performs comparably to records, the effect is **structure**, not schema. If records outperform structured prose, the schema is doing work beyond organising the text. + +Pre-registering it now is legitimate; promoting it after seeing results would not be. + +**The limit is permanent and stated wherever the result is cited:** this measures how one actor class reads two notations. It is not a claim about notations in general. + +--- + +## CG-R-26 — Structured-prose arm authorship + +U-8. **Ruled:** authored by arm P's author, from the same determination set, **after** arm P is complete. It is arm P reorganised — headed sections, one determination per section — not a third independent composition. The comparison is structure versus schema, and a differently-authored third arm would vary content quality as well as form. + +--- + +## CG-R-27 — The worked example is not reusable + +U-9 accepted. `PlaceOrder` and its determination set ship in the binding, in arm R form, and are in the training-adjacent context of anyone reading the repository. Gate 1 selects a different act, and states that it did. + +--- + +## CG-R-28 — The Gate 0 report commit stands + +The judgement call was correct. My prompt's instruction was the CI-1 defect: Gate 0 output that is not a repository object cannot be retrieved later, and the falsifier session that followed that instruction literally produced its most substantive artefact as chat text that now exists nowhere. + +**Ruled:** Gate 0 output is filed. The prompt's wording is the defect and is recorded as such; the file is not struck. This is prior art for the CI-1 proposal against `canon-governance`, which remains unwritten. + +--- + +## Carried + +- **Runner defects** in the binding: `run_all.sh` exits green when a schema check crashes, and its record counts are hardcoded labels. Both are real; neither blocks this session. An instrument that reports success when it did not run is the same defect class as a proxy without its divergence. +- **Register debt.** CG-R-17…19 and this batch are owed rows in `canon-governance`. Mine. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gate0.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gate0.md new file mode 100644 index 0000000..20c2238 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gate0.md @@ -0,0 +1,165 @@ +# Rulings — Gate 0 + +**Issued by Emil, 2026-09-03, ratifying Gate 0.** Filed verbatim below the rule; nine rulings, +`CG-R-20` … `CG-R-28`, and two carried items. The identifiers U-1 … U-12 are the Gate 0 +report's. Arrived as `rulings-cg-r-20-28.md`, sha256 +`dfd5b58f8bc6091b5aebfd9aba42ca2bd33278e8d238c85a6bbc13be818900fc`, 105 lines, with the covering message quoted at the end. + +**Register state.** The issuing message records that `CG-R-17` … `CG-R-19` were ruled but never +drafted as register rows, which resolves Gate 0 finding I-1: the layer pre-registration cites +rulings that were issued and not registered. That debt and this batch are Emil's to append to +`canon-governance`. Until the append, this file is the only record of `CG-R-20` … `CG-R-28`, in +a repository that is not their register — the same state the seed session recorded as OD-2. + +--- + +> +> ## CG-R-20 — The floor is removed. U-1 is a design defect, not an ambiguity. +> +> The report is right and the error is mine. Under the classification as written, inventing over a declared gap scores **inferred** and *raises* the rate; surfacing it scores **asked** and does not. So a run that retrieves every determination and asks about every residual scores zero — the best run the design can produce — and the floor would exclude it. +> +> **Ruled: the floor is struck from §1.** No lower bound. The measure already catches invention over gaps, because invention *is* inference; the floor was guarding against something the primary measure handles. +> +> **Replaced with the guard that actually discriminates.** The failure mode worth watching is the opposite one: an actor that asks about everything, including matters the specification settles. That is cheap to produce and would depress inference rate without the notation doing anything. +> +> > **Asked-over-determined rate**, reported per arm: questions raised about frame categories the specification settles, over the size of the determined partition. A ceiling is fixed at Gate 3, above which the run is invalidated for delivery failure — the artefact failed to deliver what it contains, which is a different defect from the notation being illegible. +> +> **Secondary, reported not tested.** Asked-over-residual is the disposition the layer claim predicts. Report it; it is an observation about one arm's behaviour, not a test, because nothing here varies whether the residual is declared. +> +> --- +> +> ## CG-R-21 — The determination set closes against the frame. Gate 1 is provisional. +> +> U-4 accepted. A category list drawn for the act type will contain categories the set neither settles nor declares residual, and a three-way partition would dilute the denominator equally in both arms — a power cost rather than a bias, but an avoidable one. +> +> **Ruled:** every frame category is either **determined by the specification** or **declared residual**. The set closes against the frame after Gate 2. +> +> **Consequence for the gate order:** Gate 1's determination set is ratified as **provisional**. Gate 2 draws the frame; the set is then closed against it and the closure is ratified before Gate 3 fixes quantities. Gate 1 is not reopened — closure adds, it does not revise. +> +> --- +> +> ## CG-R-22 — Counter-conventional determinations are required, and are the primary subset. +> +> U-3 is the design's weakest point and the report is right that no ruling eliminates it. Retrieval and lucky inference are indistinguishable in the determined partition whenever a determination matches what a competent actor would default to. +> +> It can, however, be **measured** rather than merely conceded. +> +> **Ruled:** the determination set must contain determinations that **depart from convention** — resolutions a competent actor would not default to. Matching a counter-conventional determination is strong evidence of retrieval; matching a conventional one is not. +> +> - The primary measure is computed **on the whole frame and on the counter-conventional subset separately**, both pre-registered. +> - Gate 1 states, per determination, whether it is conventional or counter-conventional, with the basis. +> - The minimum size of the counter-conventional subset is fixed at Gate 3. +> +> If the effect appears on the whole frame and not on the counter-conventional subset, the result is consistent with the actor defaulting correctly rather than reading, and must be reported that way. +> +> --- +> +> ## CG-R-23 — Two-stage classification, as in the layer pre-registration. +> +> U-2 accepted; §5 contradicts itself and single-stage blinding does not work here for the same reason it did not there. +> +> - **Stage 1** — a reader sees the **output and the frame only**, never the specification, and marks each category **resolved** or **raised**. +> - **Stage 2** — a second reader, seeing the **specification and the frame only**, never the output, records what each category's determination is. +> - **determined / inferred** is computed by comparing the two, not judged by either reader. +> +> Neither reader sees both sides, so neither can classify toward expectation. +> +> --- +> +> ## CG-R-24 — "Asked" for a single-turn actor +> +> U-5. **Ruled:** a category is **asked** when the output explicitly identifies it as unsettled and either declines to resolve it or resolves it while stating that it did so and on what basis. Silent resolution is never asked, however reasonable. +> +> A conversational turn is not required. What is required is that the actor's output makes the unsettledness visible to a reader who did not see the specification — which is exactly what Stage 1 can determine. +> +> --- +> +> ## CG-R-25 — No human control arm +> +> **Ruled: none.** The confound it would address — that a model parses YAML more readily than prose for reasons unrelated to the determinations carried — is addressed more cheaply by the structured-prose arm, which is already in the design. +> +> **Consequently that arm is promoted from descriptive-only to a pre-registered secondary comparison**, with its prediction fixed now, before any result: +> +> > If structured prose performs comparably to records, the effect is **structure**, not schema. If records outperform structured prose, the schema is doing work beyond organising the text. +> +> Pre-registering it now is legitimate; promoting it after seeing results would not be. +> +> **The limit is permanent and stated wherever the result is cited:** this measures how one actor class reads two notations. It is not a claim about notations in general. +> +> --- +> +> ## CG-R-26 — Structured-prose arm authorship +> +> U-8. **Ruled:** authored by arm P's author, from the same determination set, **after** arm P is complete. It is arm P reorganised — headed sections, one determination per section — not a third independent composition. The comparison is structure versus schema, and a differently-authored third arm would vary content quality as well as form. +> +> --- +> +> ## CG-R-27 — The worked example is not reusable +> +> U-9 accepted. `PlaceOrder` and its determination set ship in the binding, in arm R form, and are in the training-adjacent context of anyone reading the repository. Gate 1 selects a different act, and states that it did. +> +> --- +> +> ## CG-R-28 — The Gate 0 report commit stands +> +> The judgement call was correct. My prompt's instruction was the CI-1 defect: Gate 0 output that is not a repository object cannot be retrieved later, and the falsifier session that followed that instruction literally produced its most substantive artefact as chat text that now exists nowhere. +> +> **Ruled:** Gate 0 output is filed. The prompt's wording is the defect and is recorded as such; the file is not struck. This is prior art for the CI-1 proposal against `canon-governance`, which remains unwritten. +> +> --- +> +> ## Carried +> +> - **Runner defects** in the binding: `run_all.sh` exits green when a schema check crashes, and its record counts are hardcoded labels. Both are real; neither blocks this session. An instrument that reports success when it did not run is the same defect class as a proxy without its divergence. +> - **Register debt.** CG-R-17…19 and this batch are owed rows in `canon-governance`. Mine. + +--- + +## Covering message, verbatim + +> CG-R-20 strikes the floor entirely. You're right that it excludes the best possible run, and +> the deeper error is that I was guarding against something the primary measure already handles +> — invention over a gap is inference, so it raises the rate rather than hiding under it. The +> guard that actually discriminates runs the other way: an actor asking about matters the +> specification settles would depress inference rate without the notation doing anything, so +> that gets a ceiling and invalidates the run as a delivery failure. +> +> CG-R-22 converts U-3 from a concession into a measurement. You're right that no ruling +> eliminates the two-correctnesses problem — retrieval and lucky inference are indistinguishable +> when a determination matches convention. But requiring counter-conventional determinations in +> the set, and computing the measure on that subset separately, makes it observable. If the +> effect shows on the whole frame and not on the counter-conventional subset, the actor was +> defaulting correctly rather than reading, and that has to be reported as such. +> +> CG-R-25 rules no human arm and pays for it by promoting the structured-prose comparison to a +> pre-registered secondary with its prediction fixed now: comparable performance means the +> effect is structure, not schema. That addresses the YAML-familiarity confound more cheaply than +> a human arm and keeps this a session. The permanent limit — one actor class, two notations — +> is stated wherever the result is cited. +> +> Your Gate 0 commit judgement stands, and it's prior art for the CI-1 proposal that still +> hasn't been written. +> +> The register debt is mine and it's now nine rulings deep plus CG-R-17 to 19, which is why the +> layer pre-registration cites identifiers the register doesn't hold. + +--- + +## Consequences carried forward by this session + +The Gate 0 report stays as written (`CG-rule-02`); these rulings sit beside it. + +| Ruling | What it settles | Where it lands | +|---|---|---| +| `CG-R-20` | The floor is struck. Replaced by the **asked-over-determined rate** per arm, with a ceiling above which a run is invalid for delivery failure; **asked-over-residual** reported, not tested | Gate 3 fixes the ceiling; Gate 4's rubric produces both counts | +| `CG-R-21` | Every frame category is determined or declared residual; the set **closes against the frame after Gate 2**; Gate 1's set is **provisional**; closure adds, never revises | Gate 1 is proposed as provisional; a closure step follows Gate 2 and is ratified before Gate 3 | +| `CG-R-22` | The set must contain **counter-conventional** determinations; each determination states conventional or counter-conventional with basis; the measure is computed on the whole frame **and** on the counter-conventional subset; minimum subset size fixed at Gate 3 | Gate 1 carries the per-determination basis; Gate 3 fixes the minimum; Gate 5 carries the reporting rule | +| `CG-R-23` | **Two-stage classification**: stage 1 sees output and frame, marks resolved or raised; stage 2 sees specification and frame, records each category's determination; determined/inferred is computed by comparison | Gate 4 | +| `CG-R-24` | **Asked** = the output identifies the category as unsettled and either declines to resolve or resolves while stating that it did and on what basis; silent resolution is never asked | Gate 4 | +| `CG-R-25` | **No human control arm.** The structured-prose arm is promoted to a **pre-registered secondary** with its prediction fixed: comparable to records means structure, not schema. Permanent limit stated wherever cited: one actor class, two notations | Gate 3 quantities; Gate 5 carries the prediction and the limit | +| `CG-R-26` | The structured-prose arm is **arm P reorganised by P's author after P is complete** — headed sections, one determination per section — not a third composition | Gate 3's parity and authorship statement | +| `CG-R-27` | The worked example is not reusable; Gate 1 selects a different act and says so | Gate 1 | +| `CG-R-28` | The Gate 0 report commit stands; the prompt's wording is the recorded defect; prior art for the CI-1 proposal | nothing further here | + +**Blocks cleared.** U-1, U-4, U-8 and the human control arm (Gate 3); U-2 and U-5 (Gate 4). No +block remains on any gate. Gate 1 begins. From 1ed952d24d63542e8ba7ba12862f68d23b8a1dfe Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 3 Sep 2026 16:28:45 +0000 Subject: [PATCH 05/19] Gate 1 proposal: the act and its determination set; hold Proposes command:AddToCart in the ordering context, selected by a three-step rule a third party would reproduce (shipped event models; exclude every slice a shipped determination addresses; first listed of the remainder), and an eleven-determination content inventory in the foundation's construct vocabulary: seven pinned, two checked, two residual, six counter-conventional with basis per CG-R-22. Provisional per CG-R-21; not PlaceOrder per CG-R-27. Names the weakest point: counter-conventional content tests compliance as well as retrieval. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../gate1-proposal.md | 329 ++++++++++++++++++ 1 file changed, 329 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/gate1-proposal.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/gate1-proposal.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/gate1-proposal.md new file mode 100644 index 0000000..a4fa305 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/gate1-proposal.md @@ -0,0 +1,329 @@ +# Gate 1 proposal — the act and its determination set + +**Status: `[PROPOSED]`.** Nothing here is ratified. Per `CG-R-21` the determination set is +proposed as **provisional**: it closes against the frame after Gate 2, closure adds and never +revises, and the closed set is what Gate 3 fixes. Per `CG-R-27` the act is not `PlaceOrder`, and +§1 says why the rule could not have chosen it. + +Neither arm is authored here. The set is content — an inventory in the foundation's construct +vocabulary, not records and not prose specification. Whoever writes arm R and whoever writes +arm P each receive this inventory and nothing of the other's work. + +--- + +## 1. The act + +### 1.1 Selection rule + +Three steps. A third party applying them to the arrived bundle reaches the same slice. + +1. **Draw from the event models the binding ships** (`ordering`, `fulfilment`). Arm R must + address a slice the act vocabulary names, or the binding's address-validity check cannot run + on it; and inventing an event model would be authoring the notation's base, which is not this + session's to do. +2. **Exclude every slice that is the address of any shipped determination.** That is + `CG-R-27` generalised from `PlaceOrder` to everything the example already speaks for: + `PlaceOrder` (DSC-0001, -0002, -0003, -0005), `OrderSummary` (DSC-0004), `ConfirmOrder` + (DSC-0006), `ScheduleShipment` (DSC-0101), `ShipmentBoard` (DSC-0102). Remaining: + `AddToCart` (command), `Cart` (read-model), `EmptyCart` (command). +3. **Of the remaining, take the first in the order the event model lists them.** Listing order + is the least discretionary tiebreak available: it is reproducible, and it does not select on + the slice's decision content — which is what a session fluent in the domain would otherwise + be tempted to do, and would be selecting for the outcome. + +**Result: `command:AddToCart`, ordering context, act scale.** + +Rules considered and not used, with what each yields, so the choice of rule is visible: *largest +combined ground and verdict set* yields `Cart` (three facts to two); *commands only, then first +listed* yields `AddToCart` as well; *richest decision content* would also land on `AddToCart` but +is a judgement, not a rule. Had step 3 yielded `Cart` or `EmptyCart` the session would have +proposed it; the rule was fixed before it was applied. + +### 1.2 What performing the act is + +The actor receives the specification in one arm's form, and the act's base — the slice, what it +reads and what it writes — and produces the implementation of the `AddToCart` command slice: +the handler that accepts the command, reads the `Cart`, and either rejects the command or emits +`ItemAddedToCart`. One turn; the output is what Gate 4's stage 1 reads. Language and everything +else about the actor are §6.5's, fixed at Gate 3. This is an act a model can plausibly attempt +end to end: it is one handler over one entity and one event. + +**The base is delivered identically to both arms.** The event model is the act vocabulary, not +the notation under test. How it is delivered is a Gate 3 item, flagged now: the shipped model is +YAML, and handing YAML to arm P's actor beside a prose specification is a cue in the wrong +direction. Recommendation for Gate 3: a short prose statement of the slice, identical in both +arms, in place of the YAML. + +### 1.3 The act's ground and verdict, from the event model + +Fixed by the arrived input, not by this session. + +| Position | Fact | Kind | Boundary | +|---|---|---|---| +| ground (read) | `Cart` | entity, produced by the `Cart` read-model slice | internal | +| verdict (write) | `ItemAddedToCart` | event, read by the `Cart` read-model slice | internal | + +The act reads no `ActorIdentity`: the event model gives `AddToCart` no such ground, and the +binding's address-validity check would reject a determination declaring one. That fixes one +residual (AC-07) and it is a limit of the selection (§7): **no external ground and no terminal +verdict occur at this act**, so B-1 and B-2 are not exercised by the set. + +### 1.4 Contamination at this act, stated + +- Shipped determination DSC-0002 (payload typing, checked) **travels to all command slices**, so + it nominally reaches `AddToCart`. The set does not carry it; nothing of its content is reused. + The frame category it would settle is closed under `CG-R-21` like any other. +- The binding README paraphrases none of `AddToCart`'s content. The event model's comment on the + `Cart` slice records that the projection was forced in by the resolution check; that is about + the base, not about any determination here. +- The set's identifiers `AC-01` … `AC-11` are this session's, for the Gate 3 mapping table. Arm R + uses `DSC-` identifiers of its author's choosing; arm P uses none. A cross-reference between + determinations (AC-11 → AC-06) is content and is expressed in each arm's own way. + +## 2. The determination set — content inventory + +Vocabulary is the foundation's (`canon/specification-language-foundation.md` §2): **act**, +**ground requirement**, **determination**, **extent**, **allocation**, **acceptance relation**, +**coverage and residual**, **provenance**. Positions follow S-2: read position is ground, write +position is verdict. Every row is content both arms must carry; Gate 3's parity check is +item-by-item against these tables. + +**Provenance values are content.** The workshop, the architecture decision and the session named +below are the fictional domain's, fixed as given; they are not claims about events in this +programme. Timestamps are likewise content. + +**Convention basis** per `CG-R-22`: *conventional* — the resolution a competent actor would +default to; *counter-conventional* — one they would not, on one of two bases: **departs** (a +default exists and the determination contradicts it, named) or **specific** (no default produces +the value). Residuals carry no basis: there is no resolution to match. + +### AC-01 — repeat adds make new lines + +| Construct | Content | +|---|---| +| act | `command:AddToCart`, act scale | +| determination | Adding a product the cart already holds creates a new line. Lines are never merged, and a later add never changes an existing line's quantity. | +| extent | slice-type: bound here · context: does not travel to `fulfilment` — fulfilment has no carts; a shipment line is formed from an order, not from a cart line · sector: silent | +| allocation | **pinned**; settled by `cart-workshop-2026-08-21: separate-lines` | +| ground / verdict | ground `Cart` (internal) · verdict `ItemAddedToCart` (internal) | +| provenance | build-time · `cart-workshop-2026-08-21` · 2026-08-21T09:10:00Z | +| basis | **counter-conventional, departs** — the default merges a repeat add into the existing line by incrementing its quantity | + +### AC-02 — quantity bounds, no clamping + +| Construct | Content | +|---|---| +| act | `command:AddToCart`, act scale | +| determination | The command carries a quantity: an integer from 1 to 20 inclusive. A quantity outside that range rejects the command. It is never clamped to the nearest bound. | +| extent | slice-type: bound here · context: bound here · sector: silent | +| allocation | **pinned**; settled by `cart-workshop-2026-08-21: quantity-bounds` | +| ground / verdict | verdict `ItemAddedToCart` (internal) | +| provenance | build-time · `cart-workshop-2026-08-21` · 2026-08-21T09:20:00Z | +| basis | **counter-conventional, departs and specific** — the default accepts any positive integer or clamps; 20 is produced by no default | + +### AC-03 — no catalogue at add + +| Construct | Content | +|---|---| +| act | `command:AddToCart`, act scale | +| determination | The command does not consult the product catalogue. Whether the product exists, is purchasable, or is priced is not checked when adding; the product identifier is recorded as supplied. Catalogue checks belong to `PlaceOrder`. | +| extent | slice-type: bound here · context: bound here · sector: silent | +| allocation | **pinned**; settled by `cart-workshop-2026-08-21: no-catalogue-at-add` | +| ground / verdict | ground `Cart` (internal); the catalogue is expressly not ground at this act | +| provenance | build-time · `cart-workshop-2026-08-21` · 2026-08-21T09:30:00Z | +| basis | **counter-conventional, departs** — the default validates the product against the catalogue at add time | + +### AC-04 — line cap + +| Construct | Content | +|---|---| +| act | `command:AddToCart`, act scale | +| determination | A cart holds at most 50 lines. An add that would create a 51st line is rejected and the cart is unchanged. | +| extent | slice-type: bound here · context: bound here · sector: silent | +| allocation | **checked** | +| acceptance relation | predicate: *no `ItemAddedToCart` is emitted for a cart that already holds 50 lines* · closure: **logical only** — decidable from the `Cart` projection; no test in the arrangement runs it · tolerance: exact · ranges over: `ItemAddedToCart` | +| coverage and residual | covers: line-cap enforcement · does not cover: two adds racing the cap (both read 49 lines); unit totals (the cap counts lines, not units) · **proxy**: stands in for *a customer cannot assemble a cart too large to check out or fulfil*; known divergence: *the cap counts lines, not units — 50 lines at quantity 20 is 1,000 units and passes* | +| ground / verdict | ground `Cart` (internal) · verdict `ItemAddedToCart` (internal) | +| provenance | build-time · `cart-workshop-2026-08-21` · 2026-08-21T09:45:00Z | +| basis | **counter-conventional, departs and specific** — the default imposes no line cap; 50 is produced by no default | + +### AC-05 — repeat delivery is absorbed + +| Construct | Content | +|---|---| +| act | `command:AddToCart`, act scale | +| determination | An add whose line identifier is already present in the cart is a repeat delivery of an earlier add. It succeeds, emits nothing, and changes nothing. | +| extent | slice-type: bound here · context: bound here · sector: silent | +| allocation | **checked** | +| acceptance relation | predicate: *for any `AddToCart` whose line identifier already appears in the cart, no `ItemAddedToCart` is emitted and the command reports success* · closure: **operational** — runnable by `integration-test:RepeatAddIsAbsorbed`; terminates · tolerance: exact · ranges over: `ItemAddedToCart` | +| coverage and residual | covers: repeat delivery of one add · does not cover: a repeat arriving before the projection reflects the first; a second, distinct add of the same product (a new line, per AC-01) | +| ground / verdict | ground `Cart` (internal) · verdict `ItemAddedToCart` (internal) | +| provenance | build-time · `cart-workshop-2026-08-21` · 2026-08-21T10:00:00Z | +| basis | **counter-conventional, departs** — the default rejects a duplicate as a conflict, or emits a second event | + +### AC-06 — price capture, residual + +| Construct | Content | +|---|---| +| act | `command:AddToCart`, act scale | +| determination | Whether a line is priced at the moment of adding, from a price the caller supplies, or only when the order is placed, is not settled here. | +| extent | slice-type: bound here · context: bound here · sector: silent | +| allocation | **residual**; carried by a team; accountable principal: team `pricing` | +| ground / verdict | verdict `ItemAddedToCart` (internal) | +| provenance | build-time · `cart-workshop-2026-08-21` · 2026-08-21T10:15:00Z | +| basis | not applicable — residual | + +### AC-07 — caller-to-cart binding, residual + +| Construct | Content | +|---|---| +| act | `command:AddToCart`, act scale | +| determination | The command names the customer whose cart receives the line. Whether the caller must be that customer, and what happens when it is not, is not settled here. | +| extent | slice-type: bound here · context: silent · sector: silent | +| allocation | **residual**; carried by a human; accountable principal: team `identity-and-access` | +| ground / verdict | none in the fact vocabulary — the act reads no `ActorIdentity` (§1.3) | +| provenance | build-time · `cart-workshop-2026-08-21` · 2026-08-21T10:20:00Z | +| basis | not applicable — residual | + +### AC-08 — cart per customer, created by first add + +| Construct | Content | +|---|---| +| act | `command:AddToCart`, act scale | +| determination | A cart is identified by the customer identifier the command carries. No separate act creates a cart: the first add to a customer's cart brings it into existence, and an add for a customer with no cart succeeds. | +| extent | slice-type: bound here · context: bound here · sector: silent | +| allocation | **pinned**; settled by `cart-workshop-2026-08-21: cart-per-customer` | +| ground / verdict | ground `Cart` (internal) | +| provenance | build-time · `cart-workshop-2026-08-21` · 2026-08-21T10:30:00Z | +| basis | **conventional** — create-on-first-add keyed by customer is the default | + +### AC-09 — rejections are named; travels + +| Construct | Content | +|---|---| +| act | `command:AddToCart`, act scale — reached by travel | +| determination | A rejected command reports the rejection with the name of the field or condition that caused it. Commands never fail silently and never partially succeed. | +| extent | slice-type: travels to all command slices — a pattern-level determination, collected by every command slice · context: travels to all contexts · sector: silent | +| allocation | **pinned**; settled by `arch-decision-14: named-rejections` | +| ground / verdict | none declared — a rejection is not a fact in the vocabulary | +| provenance | build-time · `arch-decision-14` · 2026-08-19T15:00:00Z | +| basis | **conventional** — a named rejection is the default | + +### AC-10 — caller-supplied line identifier; act-time + +| Construct | Content | +|---|---| +| act | `command:AddToCart`, act scale | +| determination | The line identifier is supplied by the caller in the command, as a UUID. The handler does not generate identifiers. A command with no line identifier, or one that is not a UUID, is rejected. | +| extent | slice-type: bound here · context: bound here · sector: silent | +| allocation | **pinned**; settled by `session-ruling:2026-08-27-cart-projection` | +| ground / verdict | verdict `ItemAddedToCart` (internal) | +| provenance | **act-time** · `session:2026-08-27-implement-cart-projection` · 2026-08-27T16:40:00Z | +| basis | **counter-conventional, departs** — the default has the handler assign the identifier | + +### AC-11 — event content + +| Construct | Content | +|---|---| +| act | `command:AddToCart`, act scale | +| determination | `ItemAddedToCart` carries the customer identifier, the line identifier, the product identifier, the quantity, and the time the command was accepted. Whether it also carries a price is not settled here (AC-06). | +| extent | slice-type: bound here · context: does not travel to `fulfilment` — fulfilment never reads cart events · sector: silent | +| allocation | **pinned**; settled by `cart-workshop-2026-08-21: event-content` | +| ground / verdict | verdict `ItemAddedToCart` (internal) | +| provenance | build-time · `cart-workshop-2026-08-21` · 2026-08-21T10:40:00Z | +| basis | **conventional** — these are the fields a competent actor carries; the accepted-at timestamp is a defaultable choice | + +## 3. What the set contains, summarised + +| Property | Count | Which | +|---|---|---| +| determinations | 11 | AC-01 … AC-11 | +| pinned | 7 | AC-01, -02, -03, -08, -09, -10, -11 | +| checked | 2 | AC-04 (logical-only closure, with proxy), AC-05 (operational closure) | +| residual | 2 | AC-06 (team-carried), AC-07 (human-carried) | +| counter-conventional, **departs** basis | 6 | AC-01, -02, -03, -04, -05, -10 | +| of which also **specific** | 2 | AC-02 (20), AC-04 (50) | +| conventional | 3 | AC-08, -09, -11 | +| act-time provenance | 1 | AC-10 | +| extent states used | all four | bound here (throughout); travels to (AC-09, two axes); does not travel (AC-01, AC-11, with region and reason); silent (sector throughout; context in AC-07) | +| boundary kinds used | internal only | see §1.3 and §7 | +| constructs not exercised | — | external ground (B-1), terminal verdict (B-2), supersession, `asserted-none` coverage | + +The prompt's minimums are met: at least one of each allocation class, and at least one declared +residual. `CG-R-22`'s requirement is met with six counter-conventional determinations; the +minimum subset size is Gate 3's to fix, and Gate 3 should consider fixing it on the *departs* +basis only, since *specific* is the weaker of the two (a match on a number is evidence of +retrieval; a match on a departure is evidence of retrieval against a pull). + +## 4. Internal consistency, checked + +- AC-01 (distinct line identifiers are distinct lines, same product or not) and AC-05 (the same + line identifier is a repeat) partition the "same product again" case cleanly; AC-05's uncovered + set says so. +- AC-10 (caller supplies the identifier) is what makes AC-05 decidable; AC-05 makes no sense + with handler-assigned identifiers. +- AC-02 (quantity ≤ 20 per line) and AC-04 (≤ 50 lines) compose to AC-04's proxy divergence + (1,000 units passes). +- AC-03 (no catalogue at add) and AC-06 (price residual) are coherent: with no catalogue read, a + price at add time can only be caller-supplied, which is the alternative AC-06 leaves open. +- AC-08 (cart keyed by the customer identifier in the command) and AC-07 (caller binding + residual) are coherent: the identifier is trusted as supplied because nothing here binds it. +- AC-11 names the fields and defers price to AC-06; AC-06 is the only residual AC-11 depends on. +- Every ground and verdict declared is one the event model gives `AddToCart`; the binding's + address-validity check will accept arm R's positions if arm R follows the inventory. + +**What arm R can and cannot be checked against.** Schema validity and address validity, yes. +The context-level resolution condition, only together with the shipped example's boundary +declarations (`ActorIdentity` external, `OrderConfirmed` terminal), which are not in this set and +belong to other acts. The executing session should run the resolution check over the union, not +over arm R alone, and say so. + +## 5. Consequences for later gates + +- **Closure (`CG-R-21`).** After Gate 2, every frame category the set neither disposes of nor + declares is closed. Recommendation: closure adds **residual declarations only**. Adding new + determinations once the frame is visible would let the determined partition, and the + counter-conventional subset, be tuned to the denominator; a new determination at closure needs + a stated reason and separate ratification. +- **Frame vocabulary and coverage vocabulary (Gate 2).** AC-04 and AC-05 name properties in + their covers and uncovered sets. Gate 2 draws the list from the act type, not from this set; if + a frame category coincides with one of those names, both arms carry it by parity and the + leakage check passes as §8 words it. +- **Parity (Gate 3).** The inventory above is the parity list. Gate 3 enumerates it as a + numbered checklist, one item per cell fragment, and the check is: every item present in R, + every item present in P, no item present in one and absent from the other. The P author + receives §2 and §1.3, never arm R. +- **Base delivery (Gate 3).** §1.2's recommendation: the slice stated in prose, identically, in + both arms. +- **Rubric (Gate 4).** An explicit override — the output says the specification settles a + category and resolves it otherwise — needs a cell; see §7. + +## 6. Threats specific to this selection + +- **Domain oddness.** Six of nine determined-partition determinations depart from convention. + An actor may read the specification as mistaken and "correct" it. That scores inferred in both + arms and is not a bias unless notation affects it (§7). +- **Thin act.** One ground, one verdict, both internal. Boundary categories in the frame will be + disposed of trivially or closed as residual; the set exercises the notation's allocation, + extent, acceptance and coverage constructs and not its boundary constructs. +- **Small frame.** Eleven determinations on one handler bound the determined partition at the + low tens. Gate 3's detectable effect will be coarse. Stated here so Gate 3 does not discover it. + +## 7. Weakest point of the selection + +**Counter-conventional content tests compliance as well as retrieval, and notation may affect +compliance without affecting legibility.** `CG-R-22` makes a match evidence of retrieval; it also +makes a mismatch ambiguous between *did not retrieve* and *retrieved and overrode*. An explicit +override is distinguishable — stage 1 can mark "resolved contrary to a stated determination" — +and Gate 4 must give it a cell, because scoring it *inferred* is wrong (the actor retrieved) and +scoring it *determined* is wrong (the disposition is not the set's). A silent override is not +distinguishable from inference and scores inferred. If records read as more authoritative than +prose, R's override rate falls for a reason that is not legibility, and the primary measure moves +in the predicted direction on it. This is the price of `CG-R-22` and is not removable by choosing +determinations differently; it is reported per arm as the explicit-override count, which is the +only part of it that can be seen. + +--- + +**Hold.** Gate 2 is not entered. Awaiting explicit ratification of Gate 1 as provisional, per +`CG-R-21`. From 6d5d02080c6075e309a49f06777e1359907e17fd Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 3 Sep 2026 17:42:06 +0000 Subject: [PATCH 06/19] Record the Gate 1 rulings CG-R-29..34; Gate 1 ratified as provisional Files Emil's rulings verbatim: closure adds residual declarations only (CG-R-29); the base is one identical prose statement to both arms (CG-R-30); explicit override is a fourth cell, its rate per arm is the proxy for the authority effect, and authority-as-benefit is recorded as a candidate hypothesis (CG-R-31); the subset minimum is fixed on the departs basis with the two specifics analysed distinctly (CG-R-32); runs rise, acts do not, and the smallest detectable effect is stated at Gate 3 (CG-R-33); boundary declarations are out of scope, stated as a substantive limit (CG-R-34). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../arrived-inputs.md | 6 + .../inputs/rulings-cg-r-29-34.md | 74 ++++++++++ .../rulings-gate1.md | 126 ++++++++++++++++++ 3 files changed, 206 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-29-34.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gate1.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md index 1b5758b..c6e046f 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md @@ -64,3 +64,9 @@ Appended, not rewritten (`CG-rule-02`). | File | sha256 | Lines | Status | |---|---|---|---| | `inputs/rulings-cg-r-20-28.md` | `dfd5b58f8bc6091b5aebfd9aba42ca2bd33278e8d238c85a6bbc13be818900fc` | 105 | **rulings, issued** — `CG-R-20` … `CG-R-28`, by Emil, ratifying Gate 0. Filed byte-identical; quoted with consequences in `rulings-gate0.md`. Not yet rows in the `canon-governance` register, by the issuer's own statement | + +## Addendum, 2026-09-03 — the Gate 1 rulings arrived + +| File | sha256 | Lines | Status | +|---|---|---|---| +| `inputs/rulings-cg-r-29-34.md` | `d86e1294b6c99f277e5fb4c12fab1dded722c48e91d11efc7c2076005a197d5c` | 74 | **rulings, issued** — `CG-R-29` … `CG-R-34`, by Emil, ratifying Gate 1 as provisional. Filed byte-identical; quoted with consequences in `rulings-gate1.md`. Not yet register rows | diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-29-34.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-29-34.md new file mode 100644 index 0000000..d76966c --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-29-34.md @@ -0,0 +1,74 @@ +# Rulings CG-R-29 … CG-R-34 — notation falsifier Gate 1 + +**Issued by Emil, 2026-09-03.** Gate 1 ratified **provisionally** per CG-R-21: the determination set closes against the frame after Gate 2, and the closure is ratified before Gate 3 fixes quantities. + +The selection rule is accepted — fixed before application, alternatives recorded with what each would have yielded, and it excludes the shipped example per CG-R-27 without being fitted to do so. + +--- + +## CG-R-29 — Closure adds residual declarations only + +Accepted as recommended. A determination added once the frame is visible tunes the determined partition to the denominator, which is the same defect as adjusting the category list after results. + +**Ruled:** closure may add **declared residuals** and nothing else. If a frame category is neither settled by the eleven nor declarable as residual without adding a determination, that is reported as a Gate 2 finding, not resolved by writing one. + +--- + +## CG-R-30 — Base delivery is an identical prose statement to both arms + +The event model is YAML. Giving arm P's actor YAML beside prose contaminates the control with the notation under test; the base must be held constant and must not be in the treatment's form. + +**Ruled:** both arms receive the slice as **one short prose statement, byte-identical across arms**, carrying only what the slice is — name, what it reads, what it writes. Not the determinations, which are the treatment. + +Two constraints on it: it must not contain frame category names, per the leakage guard; and it is fixed and hashed at Gate 3 with the other pre-registered items. + +--- + +## CG-R-31 — Explicit override gets its own cell. Authority is named as a separate hypothesis. + +The weakest point is correctly identified and is the real cost of CG-R-22. A mismatch against a counter-conventional determination is ambiguous between *did not retrieve* and *retrieved and overrode*. + +**Ruled, in three parts.** + +**Explicit override is a fourth cell at Gate 4** — the output resolves against the determination and says that it is doing so. Visible, and it must not be scored as inference. + +**Explicit override rate is reported per arm**, and is the observable proxy for the authority effect. If it differs materially between arms while the primary measure also differs, authority is a live alternative explanation and the result is reported with that stated. If override rates are comparable and the primary measure differs, authority is a weaker explanation — not excluded, weakened. + +**Silent override is unmeasurable and stays that way.** It scores inferred, by construction, and no choice of determinations removes it. Stated as a permanent limit wherever the result is cited. + +**And name it properly:** an actor treating a schema-typed record as more binding than prose may be a real benefit of the notation. It is a **different claim** from inference load, this design cannot test it, and it must not be absorbed into a pass. Record it as a candidate hypothesis rather than a nuisance. + +--- + +## CG-R-32 — The counter-conventional subset minimum is fixed on the departs basis + +Accepted. A matched departure is stronger evidence of retrieval than a matched count, because a conventional determination can be matched by defaulting. + +**Ruled:** Gate 3 fixes the minimum on the *departs* basis alone. The two determinations carrying non-defaultable specifics are recorded distinctly — matching a specific no default supplies is the strongest single retrieval signal in the set, and it should be visible in the analysis rather than pooled. + +--- + +## CG-R-33 — Coarse detectability is accepted; runs increase, scope does not + +The act has one ground and one verdict, both internal, so the frame will be small and each classification moves the rate materially. + +**Ruled:** accepted. Gate 3 raises **runs per arm**, not acts. Adding a second act would improve granularity and would break the single-act design, introduce a second frame, and turn a session into a project. + +**Stated at Gate 3 and wherever the result is cited:** the smallest effect this design can detect, and whether it is smaller than the effect worth caring about. If it is not, that is a finding about the design and should be reported before execution rather than after. + +--- + +## CG-R-34 — Boundary declarations are out of scope, and this is a substantive limit + +The set exercises no external ground and no terminal verdict, so the result says nothing about whether the notation helps with boundary declarations. + +That is not a minor gap. Boundary declaration is a large part of what the notation adds over the base — it is DP-7, it is what makes the resolution condition sound, and it is where the composition check lives. + +**Ruled:** accepted as a scope limit for this experiment, stated explicitly in the pre-registration and in any citation of the result. Not repaired by extending the set: an act that does not cross a boundary should not have one bolted on to widen the frame. + +--- + +## Carried + +- Register debt now runs CG-R-17 … CG-R-34. Mine, and this session remains the only record of the last nineteen. +- CI-1 remains unwritten. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gate1.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gate1.md new file mode 100644 index 0000000..0746c58 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gate1.md @@ -0,0 +1,126 @@ +# Rulings — Gate 1 + +**Issued by Emil, 2026-09-03, ratifying Gate 1 as provisional under `CG-R-21`.** Filed verbatim +below the rule; six rulings, `CG-R-29` … `CG-R-34`, and two carried items. Arrived as +`rulings-cg-r-29-34.md`, sha256 `d86e1294b6c99f277e5fb4c12fab1dded722c48e91d11efc7c2076005a197d5c`, +74 lines, filed byte-identical under `inputs/`. The covering message is quoted at the end. + +**Register state.** Rows owed to `canon-governance` now run `CG-R-17` … `CG-R-34`, by the +issuer's statement. This session's filings are the only record of the last nineteen. + +--- + +> +> ## CG-R-29 — Closure adds residual declarations only +> +> Accepted as recommended. A determination added once the frame is visible tunes the determined partition to the denominator, which is the same defect as adjusting the category list after results. +> +> **Ruled:** closure may add **declared residuals** and nothing else. If a frame category is neither settled by the eleven nor declarable as residual without adding a determination, that is reported as a Gate 2 finding, not resolved by writing one. +> +> --- +> +> ## CG-R-30 — Base delivery is an identical prose statement to both arms +> +> The event model is YAML. Giving arm P's actor YAML beside prose contaminates the control with the notation under test; the base must be held constant and must not be in the treatment's form. +> +> **Ruled:** both arms receive the slice as **one short prose statement, byte-identical across arms**, carrying only what the slice is — name, what it reads, what it writes. Not the determinations, which are the treatment. +> +> Two constraints on it: it must not contain frame category names, per the leakage guard; and it is fixed and hashed at Gate 3 with the other pre-registered items. +> +> --- +> +> ## CG-R-31 — Explicit override gets its own cell. Authority is named as a separate hypothesis. +> +> The weakest point is correctly identified and is the real cost of CG-R-22. A mismatch against a counter-conventional determination is ambiguous between *did not retrieve* and *retrieved and overrode*. +> +> **Ruled, in three parts.** +> +> **Explicit override is a fourth cell at Gate 4** — the output resolves against the determination and says that it is doing so. Visible, and it must not be scored as inference. +> +> **Explicit override rate is reported per arm**, and is the observable proxy for the authority effect. If it differs materially between arms while the primary measure also differs, authority is a live alternative explanation and the result is reported with that stated. If override rates are comparable and the primary measure differs, authority is a weaker explanation — not excluded, weakened. +> +> **Silent override is unmeasurable and stays that way.** It scores inferred, by construction, and no choice of determinations removes it. Stated as a permanent limit wherever the result is cited. +> +> **And name it properly:** an actor treating a schema-typed record as more binding than prose may be a real benefit of the notation. It is a **different claim** from inference load, this design cannot test it, and it must not be absorbed into a pass. Record it as a candidate hypothesis rather than a nuisance. +> +> --- +> +> ## CG-R-32 — The counter-conventional subset minimum is fixed on the departs basis +> +> Accepted. A matched departure is stronger evidence of retrieval than a matched count, because a conventional determination can be matched by defaulting. +> +> **Ruled:** Gate 3 fixes the minimum on the *departs* basis alone. The two determinations carrying non-defaultable specifics are recorded distinctly — matching a specific no default supplies is the strongest single retrieval signal in the set, and it should be visible in the analysis rather than pooled. +> +> --- +> +> ## CG-R-33 — Coarse detectability is accepted; runs increase, scope does not +> +> The act has one ground and one verdict, both internal, so the frame will be small and each classification moves the rate materially. +> +> **Ruled:** accepted. Gate 3 raises **runs per arm**, not acts. Adding a second act would improve granularity and would break the single-act design, introduce a second frame, and turn a session into a project. +> +> **Stated at Gate 3 and wherever the result is cited:** the smallest effect this design can detect, and whether it is smaller than the effect worth caring about. If it is not, that is a finding about the design and should be reported before execution rather than after. +> +> --- +> +> ## CG-R-34 — Boundary declarations are out of scope, and this is a substantive limit +> +> The set exercises no external ground and no terminal verdict, so the result says nothing about whether the notation helps with boundary declarations. +> +> That is not a minor gap. Boundary declaration is a large part of what the notation adds over the base — it is DP-7, it is what makes the resolution condition sound, and it is where the composition check lives. +> +> **Ruled:** accepted as a scope limit for this experiment, stated explicitly in the pre-registration and in any citation of the result. Not repaired by extending the set: an act that does not cross a boundary should not have one bolted on to widen the frame. +> +> --- +> +> ## Carried +> +> - Register debt now runs CG-R-17 … CG-R-34. Mine, and this session remains the only record of the last nineteen. +> - CI-1 remains unwritten. + +--- + +## Covering message, verbatim + +> Gate 1 ratified as provisional under CG-R-21. Six rulings. +> +> Both your recommendations accepted. Three things worth flagging in the rulings. +> +> CG-R-31 turns your weakest point into three separate things. Explicit override gets its own +> cell and must not score as inference. Explicit override rate per arm becomes the observable +> proxy for the authority effect — if it differs while the primary measure differs, authority is +> a live alternative explanation; if rates are comparable, authority is weakened rather than +> excluded. Silent override stays unmeasurable and is stated as permanent. +> +> And the part I'd emphasise: an actor treating a typed record as more binding than prose may be +> a real benefit. It's a different claim, this design can't test it, and it must be recorded as a +> candidate hypothesis rather than absorbed into a pass. That's the failure mode where a result +> gets read as validating more than it did. +> +> CG-R-34 makes the boundary gap explicit rather than a footnote. No external ground, no +> terminal verdict, so nothing here says whether the notation helps with the declarations that +> make the resolution condition sound. That's DP-7 and the composition check — a substantial +> share of what the notation adds over the base. Not repairable by bolting a boundary onto an +> act that doesn't cross one. +> +> CG-R-33 asks Gate 3 to state the smallest detectable effect before execution, and to say +> plainly whether it's smaller than the effect worth caring about. If it isn't, that's a finding +> about the design, and it's much cheaper to report then than after a null result nobody can +> interpret. + +--- + +## Consequences carried forward by this session + +The Gate 1 proposal stays as written (`CG-rule-02`); these rulings sit beside it. + +| Ruling | What it settles | Where it lands | +|---|---|---| +| `CG-R-29` | Closure adds **declared residuals only**. A category neither settled nor declarable without a new determination is a **Gate 2 finding**, not resolved by writing one | the closure step after Gate 2 | +| `CG-R-30` | Both arms receive the slice as **one short prose statement, byte-identical** — name, reads, writes; no determinations; no frame category names; fixed and hashed at Gate 3 | Gate 3 | +| `CG-R-31` | **Explicit override is a fourth cell**, never scored as inference; **explicit-override rate per arm** is the proxy for the authority effect, with the reporting rule stated; **silent override** scores inferred and is a permanent limit; **authority as a benefit is a candidate hypothesis**, a different claim, recorded and never absorbed into a pass | Gate 4 (cell and rubric); Gate 5 (reporting rule, limit, candidate hypothesis) | +| `CG-R-32` | The counter-conventional subset minimum is fixed on the **departs** basis; the two **specific** determinations (AC-02, AC-04) are recorded and analysed distinctly, not pooled | Gate 3 | +| `CG-R-33` | Coarse detectability accepted; Gate 3 raises **runs per arm, not acts**; the smallest detectable effect and whether it is smaller than the effect worth caring about are stated at Gate 3 and wherever cited | Gate 3; Gate 5 | +| `CG-R-34` | Boundary declarations are **out of scope** for this experiment — no external ground, no terminal verdict at this act — a substantive limit stated in the pre-registration and every citation; not repaired by extending the set | Gate 2 (the list still carries the boundary categories for the act type; this act maps them to the base); Gate 5 | + +Gate 2 begins. From 0053c8941c83108a156f90e23b72da8e4dd1f72d Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 3 Sep 2026 17:43:53 +0000 Subject: [PATCH 07/19] Gate 2 proposal: the category list; hold MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Nineteen consequential-property categories for a command slice in the domain-state-change binding, derived from a fixed grid — the five stages of a command slice crossed with the foundation's constructs in both states — under four admission conditions, each row citing its cell. Nine candidates rejected with reasons. Names avoid the schema's vocabulary; the leakage check is stated. Checked against the Gate 1 set after fixing: about 23 instances expected, six closing as residual, one settled by the base. Finding: the layer pre-registration's SPETLR corpus cannot reuse these rows, only the method. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../gate2-proposal.md | 275 ++++++++++++++++++ 1 file changed, 275 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/gate2-proposal.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/gate2-proposal.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/gate2-proposal.md new file mode 100644 index 0000000..1e600e2 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/gate2-proposal.md @@ -0,0 +1,275 @@ +# Gate 2 proposal — the category list + +**Status: `[PROPOSED]`.** The frame's denominator. Once ratified and committed it is fixed for +execution and never adjusted after results are visible (`CG-rule-08`, provisional, applied as in +force). It is drawn for the **act type** — a command slice in the domain-state-change binding, +software projection, act scale — not for the Gate 1 instance, and §7 says what that means for +the reuse the prompt anticipates. + +**The warning, taken.** A plausible list of this shape can be written in a minute, and the +session that wrote the determination set a gate ago is the least independent author this list +could have. Three things are done about that, and none removes it. The derivation runs from a +fixed grid — the stages a command slice passes through, crossed with the constructs the +foundation names — and every category cites its cell, so each can be checked against the source +rather than accepted on presentation. Candidates the grid produced and the list rejects are +recorded with the reason (§4), so the pruning is visible. And the check against the Gate 1 set +(§6) was done **after** the list was fixed and is reported as a check, not used as a source. +The session cannot prove the order in which it thought; it can only show its working. + +--- + +## 1. Derivation + +### 1.1 What a category is + +A **consequential-property category** is a decision point that performing an act of this type +entails: something an actor implementing the slice must resolve, explicitly or by default, +whose resolution has consequence for what the act does. The frame is the set of such points. +The specification either settles a point, declares it unsettled, or — after closure under +`CG-R-21` — cannot fail to do one or the other. + +Four admission conditions, each applied to every candidate: + +1. **Entailed by the act type.** An actor performing any command slice meets this decision + point, whatever the domain. A point that arises only for carts, or only for this instance, + fails here. +2. **Within a construct the foundation names.** A determination in the layer can settle it: it + lies inside ground, position, allocation, acceptance, coverage, or a boundary declaration. + A point the layer has no form for is out of the frame, however consequential. +3. **Outside what the act vocabulary fixes.** The foundation §4: the language is *not a + replacement for the act vocabulary's own artefacts*. Which act this is, and which facts it + reads and writes by name, are the base's — delivered identically to both arms per `CG-R-30` + and not in the frame. What the act does with them is. +4. **Recognisable from output.** A stage-1 reader (`CG-R-23`), seeing output and frame only, + can say whether the output addresses the point without reconstructing what the points should + have been. Each category is therefore one question with a stated answer form. + +### 1.2 The grid + +**Axis A — the stages of a command slice.** From event modelling as the binding's base: a +command slice receives a command, reads its declared ground, decides, writes its verdict, and +reports an outcome. Five stages: *receive*, *read*, *decide*, *write*, *report*. Cross-cutting +points that attach to the act as a whole are a sixth row. + +**Axis B — the constructs, in both states of the foundation.** + +| Construct | Source | State | +|---|---|---| +| ground requirement — what the act must have available, with provenance | foundation §2.2 | original; **retired by S-2** into position | +| position — read is ground, write is verdict | S-2; resolution condition | superseding | +| determination addressed to the act | foundation §2.3 | both | +| allocation — pinned, checked, residual | foundation §2.5 | both | +| acceptance relation — predicate, operational closure | foundation §2.6 | both | +| coverage and residual — what a check reaches and does not | foundation §2.7 | both | +| C-1, C-2, C-3 — ground resolves, verdict resolves, checks range over produced objects | resolution condition | superseding | +| B-1 external ground — source, read provenance, tick rate | boundary declarations | superseding; made necessary by S-2 | +| B-2 terminal verdict — consumer, observability | boundary declarations | superseding | + +Both states are used deliberately. The original §2.2 supplies the *receive* and *read* rows +directly — the command payload is ground the act requires and no act in scope produces, which +under S-2 is external ground from the caller, so the two states agree on the cell and differ +only in name. Where the derivation uses the retired construct it says so. + +A category is the intersection of a stage and a construct at which the four conditions hold. +The schema is consulted only as enforcement (`CG-R-7`'s search obligation): where it requires a +field, the field marks a decision point the binding's authors already judged consequential, and +the derivation notes that as corroboration, never as the source. + +## 2. The list + +Nineteen categories, `F-01` … `F-19`. Each carries: the question a reader answers; what an +answer looks like in output; its grid cell. Names are in plain words and avoid the schema's +vocabulary entirely (§5). + +### Receive — the command as ground from the caller + +| Id | Name | Question | An answer looks like | Cell | +|---|---|---|---|---| +| F-01 | command fields | Which values does the command carry? | the handler's input definition | receive × ground requirement (§2.2); B-1 under S-2 | +| F-02 | acceptable values | What makes a supplied value unacceptable, and what happens then? | validation of format, type or range, and the response to a failure | receive × acceptance relation (§2.6) — the check the act runs on its own input | +| F-03 | target identity | How does the act find the thing it changes? | the key by which existing state is looked up | receive × C-1 — the ground the act resolves to | +| F-04 | caller binding | Does the act check who is calling, and against what? | an authorisation step, or its stated absence | receive × allocation (§2.5) — the residual the foundation says a machine actor cannot carry; B-1 for the identity source | +| F-05 | repeat delivery | When the same command arrives twice, what happens the second time? | absorbed, rejected, applied again | receive × coverage (§2.7) — the canonical uncovered property of any message-driven act | + +### Read — the act's ground + +| Id | Name | Question | An answer looks like | Cell | +|---|---|---|---|---| +| F-06 | outside sources | What does the act read beyond what the slice declares, and does it decide on it? | a lookup against something the base does not name, or its stated absence | read × B-1, C-1 | +| F-07 | freshness | Is the state read guaranteed to reflect earlier writes, and what if it does not? | a consistency assumption about the projection, stated or embodied | read × B-1 tick rate; §2.2 provenance of the read path | +| F-08 | absent state | What happens when the state the act reads does not exist yet? | creation, rejection, or a default | read × C-1 — absent is not dangling, and the act must say which it is | +| F-09 | unreadable state | What happens when the state cannot be read at all? | an error path, a retry, or silence | read × §2.2 — an act is performable only with its ground available | + +### Decide + +| Id | Name | Question | An answer looks like | Cell | +|---|---|---|---|---| +| F-10 | what current state forbids | Which conditions of the existing state cause rejection? | invariant checks against what was read | decide × allocation pinned/checked (§2.5); acceptance (§2.6) | +| F-11 | concurrent commands | When two commands on the same target race, what happens? | locking, versioning, last-writer-wins, or nothing | decide × coverage (§2.7) — the example's own uncovered sets name it twice | + +### Write — the verdict + +| Id | Name | Question | An answer looks like | Cell | +|---|---|---|---|---| +| F-12 | outcome content | What does the written fact carry? | the event's fields | write × position (S-2) — verdict resolves in the fact vocabulary, C-2 | +| F-13 | effect on existing state | Does the act create, change, or leave untouched what already exists? | a new record, a mutation, a no-op | write × position — what the verdict does to the ground it will become | +| F-14 | identity of created things | Who assigns the identifier of anything the act creates, and in what form? | generated in the handler, supplied by the caller, derived | write × C-2 — a produced object must be nameable to be read later | +| F-15 | partial outcomes | Can the act report one thing and have written another? | atomicity of write and response, or its absence | write × C-2 — a partial verdict is a fact the vocabulary cannot name | +| F-16 | outcome leaving the scope | Is the written fact consumed outside the scope, by whom, and observably? | a declared receiver beyond the scope, or its absence | write × B-2 | + +### Report + +| Id | Name | Question | An answer looks like | Cell | +|---|---|---|---|---| +| F-17 | reporting rejection | What does the caller learn when the command is rejected? | a named cause, a code, silence | report × acceptance (§2.6) — a check whose verdict is not delivered is not operationally closed | +| F-18 | reporting success | What does the caller learn when the command succeeds? | an acknowledgement, the created identifier, nothing | report × position — the verdict as the caller sees it | + +### Cross-cutting + +| Id | Name | Question | An answer looks like | Cell | +|---|---|---|---|---| +| F-19 | stated versus tested | Which of the act's rules are made runnable in the arrangement, and which are only stated? | tests or analysers present for some rules and not others | act × acceptance closure (§2.6) — operational versus logical closure is the distinction the foundation insists on | + +## 3. One decision point per category + +Each category is one question (U-11). At the act-type level a category is a **kind** of decision +point; an instance may exhibit it more than once — `F-02` for an act with several fields, `F-19` +for an act with several checked rules. The rule for that is fixed now, before the mapping exists: + +**At closure, each category is instantiated into the decision points the determination set +exhibits for it.** Each instance names the determination or determinations that jointly settle +it, or is declared residual. The instance list is the frame for the run, identical across arms, +fixed and ratified with the closure. An instance settled jointly by several determinations — +`F-01` will be, since no single determination states a command's whole shape — agrees only if +the output matches all of them. + +Resolutions in the output that no instance covers are **out of frame**: not counted, reported +as a descriptive tally so the frame's reach is visible. + +## 4. Candidates rejected, with the reason + +The grid produced these; the list does not carry them. + +| Candidate | Cell | Rejected because | +|---|---|---| +| where a shared rule is implemented — local code or a shared mechanism | act × extent (§2.4) | fails condition 4 and, on reflection, 1: extent is a property of a determination's reach, not of the act's performance; where the actor places code is implementation structure, and the consequential content is already in `F-17` | +| the act's own record — who performed it, when | act × provenance (§2.8) | fails condition 2 as a property of the *act*: provenance attaches to determinations, and whether the actor records its act-time determinations is the accrual claim's object, not a property of this act's outcome | +| which rejection is reported when several apply | report × acceptance | a sub-question of `F-17`; folded into its answer form rather than counted twice | +| business rules on supplied values beyond format and type | receive × acceptance | folded into `F-02`: the question asks what makes a value unacceptable, and a range is one answer | +| the act's latency, throughput, resource use | — | fails condition 2: the foundation names no construct for it; a determination could carry one as a checked predicate with a tolerance, but no stage entails it as a decision point | +| logging and observability of the act's execution | — | fails condition 2, same reason; `F-16`'s observability is of the verdict's consumption, a different thing | +| retry on failure | — | the caller's decision, not the act's; the act's side is `F-05` | +| security beyond who may call — injection, sanitisation | — | folded into `F-02` where it is a property of acceptable values; otherwise fails condition 2 | +| what the act settles that it did not before — the act-time write form | act × provenance `made_at` | the notation's write side is a property of the *store*, not of the act's performance; out of frame, and it is what the layer and accrual claims are about | + +## 5. Leakage: names, and how the check runs + +**Names avoid the schema's vocabulary.** Every schema key and enum value appears in arm R by +construction and in arm P only where content requires it, so a category named after one would +leak structurally. The avoided set, read from the schema: *address, act_type, act_instance, +scale, statement, extent, axes, state, region, reason, allocation, class, settled_by, +acceptance, predicate, closure, kind, runnable_by, terminates, tolerance, ranges_over, covers, +does_not_cover, proxy, stands_in_for, known_divergence, positions, fact_type, role, boundary, +source, consumer, read_provenance, tick_rate, consumption_observable, provenance, made_at, +made_by, recorded, supersedes*; and *bound-here, travels-to, does-not-travel, silent, pinned, +checked, residual, external, terminal, internal, operational, logical-only, unestablished, +asserted-none, build-time, act-time, static, slow, fast, unknown, human, machine, team, +external-party*. No name in §2 is on that list, and none uses the words *external*, *terminal*, +*residual*, *coverage*, *closure* or *provenance*, which the foundation's prose would otherwise +make natural. + +**The check, run before execution, by the executing session, recorded with the run:** + +1. The term list is every category name in §2, every content word of every question in §2 + (stop words excluded), and the schema vocabulary above. +2. Each term is searched, case-insensitive and whole-word, in arm R, arm P, the structured-prose + arm, and the base statement (`CG-R-30`). +3. A category term present in one arm and absent from another **fails**; the arm carrying it is + revised by its own author to remove the term without altering content, and the check reruns. + A schema term present in P and absent from R is reported, not failed — it means P's author + reached for the notation's word, which is worth knowing. +4. The base statement must contain no category term at all. +5. The full term table, with counts per arm, is filed with the run. + +**Limit, stated.** The check is verbatim. A paraphrase — *idempotent* for `F-05`, *optimistic +concurrency* for `F-11` — leaks the same cue and is not mechanically detectable. The arms' +authors are instructed not to name categories; the instruction is pre-registered with the +authorship instructions at Gate 3; and residual semantic leakage is a reported limit, not a +checked one. + +## 6. Check against the Gate 1 set — done after the list was fixed + +Reported so the closure can be seen coming. This is not the closure, which is a separate step +after ratification (`CG-R-21`), and it is not a source for the list. + +| Category | What the eleven do | Expected at closure | +|---|---|---| +| F-01 command fields | no single determination; AC-02, AC-03, AC-08, AC-10 jointly imply customer, product, quantity, line identifier | one instance, settled jointly | +| F-02 acceptable values | AC-02 (quantity), AC-10 (line identifier) | two determined instances; product identifier and customer identifier formats unsettled → **two residuals to declare** | +| F-03 target identity | AC-08 | determined | +| F-04 caller binding | AC-07 | residual, already declared | +| F-05 repeat delivery | AC-05 | determined | +| F-06 outside sources | AC-03 | determined (none consulted) | +| F-07 freshness | nothing; AC-05's uncovered set names the case | **residual to declare** | +| F-08 absent state | AC-08 | determined | +| F-09 unreadable state | nothing | **residual to declare** | +| F-10 what current state forbids | AC-04 | determined | +| F-11 concurrent commands | nothing; AC-04's uncovered set names the case | **residual to declare** | +| F-12 outcome content | AC-11 (fields), AC-06 (price) | one determined instance, one residual already declared | +| F-13 effect on existing state | AC-01 | determined | +| F-14 identity of created things | AC-10 | determined | +| F-15 partial outcomes | AC-09 (never partially succeed) | determined | +| F-16 outcome leaving the scope | the base: `Cart` reads it | **settled by the base**, in both arms identically — `CG-R-34`'s limit made visible | +| F-17 reporting rejection | AC-09 | determined | +| F-18 reporting success | AC-05 says "reports success" for one case only | **residual to declare** | +| F-19 stated versus tested | AC-04 (stated), AC-05 (tested) | two determined instances | + +Expected frame after closure: **about 23 instances** — 16 determined by determinations, 1 by +the base, 2 residual already, 6 residual to declare at closure. Every closure candidate is +declarable as residual without a new determination, so no `CG-R-29` finding is expected; if one +arises at closure it is reported there. + +Two things this check shows that the list did not set out to show. `F-16` is settled by the +base and not by any determination, which is exactly `CG-R-34`: the boundary category exists in +the frame for the act type and does no work in this instance. And six of nineteen close as +residual — the actor will meet a specification that declares a third of the frame open, which +is realistic for a first-cut specification and is stated so the size of the residual partition +does not surprise anyone at Gate 3. + +## 7. Reuse by the layer pre-registration — a finding + +The prompt says this artefact is reused by the layer-claim pre-registration and should be drawn +for the act type. It is. **But the layer pre-registration's corpus is SPETLR — Extractor, +Transformer, Loader — not command slices in an event model.** A list derived from the stages of +a command slice does not transfer to an ETL role type; `F-03`, `F-12`, `F-13` and `F-17` have no +obvious counterpart for a Transformer, and a Transformer has decision points a command slice +lacks. What transfers is the **method** — the stage grid crossed with the constructs, the four +admission conditions, the rejection register — not the nineteen rows. Reported, not resolved: +either the layer pre-registration re-derives its list for its act types by this method, or its +corpus changes. Nothing here depends on which. + +## 8. What the list omits, and why + +Beyond §4: everything condition 3 excludes — the act's name, which facts it reads and writes — +because the base carries it; everything the notation says *about* a determination rather than +about the act — its reach, who settled it, when, what it supersedes — because those are +properties of the record, not of the performance, and the actor is not asked to resolve them; +and correctness against the world, because the frame is a set of questions, not answers, and +whether the specification's answers are right is nobody's measure here. + +## 9. Weakest point + +**The list and the set have the same author, a gate apart.** `CG-rule-08` fixes the list before +results; nothing fixes it before the set, and the prompt's instruction to draw for the act type +is a discipline the session applied to itself, unverifiably. The derivation, the rejection +register and the after-the-fact check are what a reader has instead of independence. The +specific way this would bite: a category shaped to what the set happens to settle inflates the +determined partition with easy matches. The reader's test is §1.2 — does each row survive as a +decision point for a command slice about *anything*, with the eleven determinations forgotten? +If any row does not, it should be struck before ratification, and the session would rather lose +a row now than carry one that was fitted. + +--- + +**Hold.** Closure and Gate 3 are not entered. Awaiting explicit ratification of the list, after +which the closure step maps the set onto it and is itself ratified before Gate 3. From 80fff266b45064d6b2e718fafc07687c66732855 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 4 Sep 2026 06:47:01 +0000 Subject: [PATCH 08/19] Record the Gate 2 rulings CG-R-35..38; Gate 2 held for blind re-derivation Files Emil's rulings verbatim: the category list is confirmed by a blind re-derivation in a separate session and reconciled row by row before Gate 3 (CG-R-35); only the derivation method transfers to the layer claim, whose corpus stays SPETLR (CG-R-36); the frame is the instantiated list and Gate 3 computes detectability against it (CG-R-37); the verbatim leakage check is accepted and paraphrase leakage is a permanent limit (CG-R-38). Records why this session does not run the re-derivation through a subagent of its own. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../arrived-inputs.md | 6 + .../inputs/rulings-cg-r-35-38.md | 64 +++++++++ .../rulings-gate2.md | 123 ++++++++++++++++++ 3 files changed, 193 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-35-38.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gate2.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md index c6e046f..29eef1b 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md @@ -70,3 +70,9 @@ Appended, not rewritten (`CG-rule-02`). | File | sha256 | Lines | Status | |---|---|---|---| | `inputs/rulings-cg-r-29-34.md` | `d86e1294b6c99f277e5fb4c12fab1dded722c48e91d11efc7c2076005a197d5c` | 74 | **rulings, issued** — `CG-R-29` … `CG-R-34`, by Emil, ratifying Gate 1 as provisional. Filed byte-identical; quoted with consequences in `rulings-gate1.md`. Not yet register rows | + +## Addendum, 2026-09-04 — the Gate 2 rulings arrived + +| File | sha256 | Lines | Status | +|---|---|---|---| +| `inputs/rulings-cg-r-35-38.md` | `d6b8f4e1aa1b8cbaab210da9db173a22099eddc94df7e67033654c5ed7168b4f` | 64 | **rulings, issued** — `CG-R-35` … `CG-R-38`, by Emil, 2026-09-03, holding Gate 2 pending blind re-derivation. Filed byte-identical; quoted with consequences in `rulings-gate2.md`. Not yet register rows | diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-35-38.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-35-38.md new file mode 100644 index 0000000..f3d99d5 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-35-38.md @@ -0,0 +1,64 @@ +# Rulings CG-R-35 … CG-R-38 — notation falsifier Gate 2 + +**Issued by Emil, 2026-09-03.** Gate 2 is **held**, not refused. The derivation, the four admission conditions, the rejection register and the two fixed rules are accepted. What is withheld is ratification of the list itself, pending CG-R-35. + +--- + +## CG-R-35 — The list is confirmed by blind re-derivation, not by inspection + +The weakest point is correctly named and it is the one that matters: the list and the set have the same author, a gate apart, and nothing fixes the list before the set the way CG-rule-08 fixes it before results. The derivation grid and the rejection register are a real independence proxy, and they are a proxy. + +The test proposed — *does this row survive as a decision point for a command slice about anything, with the eleven determinations forgotten?* — is the right test. It cannot be applied by the author, who cannot forget the set, and it should not be applied by the ruling authority on a summary of the rows. + +**Ruled: a blind re-derivation.** A separate session is given the derivation grid, the act type, and the four admission conditions, and **not** the determination set, not the Gate 1 output, and not the proposed list. It produces its own category list by the same method and stops. + +The two lists are then compared: + +- **Rows in both** — the derivation is reproducible and the row is not set-fitted. +- **Rows only in the proposed list** — candidates for set-fitting. Each is defended on the derivation alone or struck. +- **Rows only in the re-derivation** — candidates for omission. Each is admitted or refused on the admission conditions. + +Divergence is the finding, in both directions. A large overlap is evidence the method carries the list rather than the author; a small one means the grid does not determine what it appeared to determine, which is a finding about the method and is worth more than a ratified list. + +The re-derivation is filed with the proposed list, and the reconciliation is ratified before Gate 3. + +**Cost, stated:** one session and a delay to Gate 3. The category list is the denominator of the entire measure and the artefact most likely to be fitted. This is the cheapest available independence and it is worth the gate. + +--- + +## CG-R-36 — The layer pre-registration re-derives. Only the method transfers. + +The finding is correct and it corrects me. `prereg-notation-inference-load.md` §10 claims the category list is the byproduct the layer pre-registration defers to a separate session. That is wrong: the layer claim's corpus is SPETLR, whose act types are Extractor, Transformer and Loader, and rows drawn from a command slice's five stages do not transfer to a Transformer. + +**Ruled:** §10 is amended. What transfers is **the derivation method** — the stage-by-construct grid, the four admission conditions, the rejection register, and the blind re-derivation of CG-R-35. The layer pre-registration re-derives its own list for its own act types, by this method. + +Its corpus does not change. SPETLR was chosen because it encodes almost nothing, which remains the right reason. + +This weakens the ordering argument that put the notation claim first, and does not overturn it: the layer claim inherits an exercised method rather than an exercised list, which is less than claimed and still real. + +--- + +## CG-R-37 — The frame is instances, and its size is set-dependent + +Accepted, with a consequence Gate 3 must carry. + +One decision point per category, instantiated at closure into the points the set exhibits, is right — a category is a kind of decision and the frame must be the decisions themselves. + +But the instance count then depends on the determination set. Both arms share the set, so there is no bias between them. What it means is that **frame size is not a property of the act type alone**, and the smallest detectable effect Gate 3 must state is computed against the instantiated frame, not against nineteen. + +Roughly twenty-three instances is a materially better position than the small frame CG-R-33 anticipated, and Gate 3 should say what that does to detectability rather than letting the earlier pessimism stand unrevised. + +--- + +## CG-R-38 — The leakage check is accepted; paraphrase leakage is permanent + +Verbatim whole-word checking across both arms, the structured-prose arm and the base statement, with category names avoiding every schema key and enum value: accepted and written out. + +Paraphrase leakage is unreachable by that check and is **stated as a permanent limit**, not carried as a gap awaiting an instrument. A category cued by a synonym is cued, and no verbatim check finds it. This is the same class as meaning across the seam and as whether a discrimination pair differs for its stated reason: checked by reading, by a named principal, or not at all. + +--- + +## Carried + +- The closure preview — twenty-three instances, six residuals to declare, no CG-R-29 finding expected — is noted. It was computed **after** the list was fixed, which is the correct order and should be recorded as having been so. +- Register debt: CG-R-17 … CG-R-38. Mine. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gate2.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gate2.md new file mode 100644 index 0000000..e123636 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gate2.md @@ -0,0 +1,123 @@ +# Rulings — Gate 2 + +**Issued by Emil, 2026-09-03. Gate 2 is held, not refused.** The derivation, the four admission +conditions, the rejection register and the two fixed rules are accepted; ratification of the +list itself waits on `CG-R-35`. Four rulings, `CG-R-35` … `CG-R-38`, filed verbatim below +the rule. Arrived as `rulings-cg-r-35-38.md`, sha256 `d6b8f4e1aa1b8cbaab210da9db173a22099eddc94df7e67033654c5ed7168b4f`, 64 lines, filed byte-identical +under `inputs/`. The covering message is quoted at the end. + +**Register state.** Rows owed to `canon-governance` run `CG-R-17` … `CG-R-38`, by the +issuer's statement. + +--- + +> +> ## CG-R-35 — The list is confirmed by blind re-derivation, not by inspection +> +> The weakest point is correctly named and it is the one that matters: the list and the set have the same author, a gate apart, and nothing fixes the list before the set the way CG-rule-08 fixes it before results. The derivation grid and the rejection register are a real independence proxy, and they are a proxy. +> +> The test proposed — *does this row survive as a decision point for a command slice about anything, with the eleven determinations forgotten?* — is the right test. It cannot be applied by the author, who cannot forget the set, and it should not be applied by the ruling authority on a summary of the rows. +> +> **Ruled: a blind re-derivation.** A separate session is given the derivation grid, the act type, and the four admission conditions, and **not** the determination set, not the Gate 1 output, and not the proposed list. It produces its own category list by the same method and stops. +> +> The two lists are then compared: +> +> - **Rows in both** — the derivation is reproducible and the row is not set-fitted. +> - **Rows only in the proposed list** — candidates for set-fitting. Each is defended on the derivation alone or struck. +> - **Rows only in the re-derivation** — candidates for omission. Each is admitted or refused on the admission conditions. +> +> Divergence is the finding, in both directions. A large overlap is evidence the method carries the list rather than the author; a small one means the grid does not determine what it appeared to determine, which is a finding about the method and is worth more than a ratified list. +> +> The re-derivation is filed with the proposed list, and the reconciliation is ratified before Gate 3. +> +> **Cost, stated:** one session and a delay to Gate 3. The category list is the denominator of the entire measure and the artefact most likely to be fitted. This is the cheapest available independence and it is worth the gate. +> +> --- +> +> ## CG-R-36 — The layer pre-registration re-derives. Only the method transfers. +> +> The finding is correct and it corrects me. `prereg-notation-inference-load.md` §10 claims the category list is the byproduct the layer pre-registration defers to a separate session. That is wrong: the layer claim's corpus is SPETLR, whose act types are Extractor, Transformer and Loader, and rows drawn from a command slice's five stages do not transfer to a Transformer. +> +> **Ruled:** §10 is amended. What transfers is **the derivation method** — the stage-by-construct grid, the four admission conditions, the rejection register, and the blind re-derivation of CG-R-35. The layer pre-registration re-derives its own list for its own act types, by this method. +> +> Its corpus does not change. SPETLR was chosen because it encodes almost nothing, which remains the right reason. +> +> This weakens the ordering argument that put the notation claim first, and does not overturn it: the layer claim inherits an exercised method rather than an exercised list, which is less than claimed and still real. +> +> --- +> +> ## CG-R-37 — The frame is instances, and its size is set-dependent +> +> Accepted, with a consequence Gate 3 must carry. +> +> One decision point per category, instantiated at closure into the points the set exhibits, is right — a category is a kind of decision and the frame must be the decisions themselves. +> +> But the instance count then depends on the determination set. Both arms share the set, so there is no bias between them. What it means is that **frame size is not a property of the act type alone**, and the smallest detectable effect Gate 3 must state is computed against the instantiated frame, not against nineteen. +> +> Roughly twenty-three instances is a materially better position than the small frame CG-R-33 anticipated, and Gate 3 should say what that does to detectability rather than letting the earlier pessimism stand unrevised. +> +> --- +> +> ## CG-R-38 — The leakage check is accepted; paraphrase leakage is permanent +> +> Verbatim whole-word checking across both arms, the structured-prose arm and the base statement, with category names avoiding every schema key and enum value: accepted and written out. +> +> Paraphrase leakage is unreachable by that check and is **stated as a permanent limit**, not carried as a gap awaiting an instrument. A category cued by a synonym is cued, and no verbatim check finds it. This is the same class as meaning across the seam and as whether a discrimination pair differs for its stated reason: checked by reading, by a named principal, or not at all. +> +> --- +> +> ## Carried +> +> - The closure preview — twenty-three instances, six residuals to declare, no CG-R-29 finding expected — is noted. It was computed **after** the list was fixed, which is the correct order and should be recorded as having been so. +> - Register debt: CG-R-17 … CG-R-38. Mine. + +--- + +## Covering message, verbatim + +> Gate 2 held rather than refused. The derivation, admission conditions, rejection register and +> both fixed rules are accepted; only the list itself waits. +> +> CG-R-35 is the substantive one. A separate session gets the grid, the act type and the +> admission conditions — not the determination set, not your list — and derives its own. Rows in +> both are evidence the method carried them. Rows only in yours are set-fitting candidates and +> get defended on the derivation or struck. Rows only in the re-derivation are omission +> candidates. +> +> The divergence is the finding either way. A small overlap would say the grid doesn't +> determine what it appears to, which is worth more than a ratified list. +> +> CG-R-36 corrects me. The notation pre-registration's §10 claims the category list is the +> byproduct the layer claim inherits. It isn't — SPETLR's act types are Extractor, Transformer +> and Loader, and command-slice rows don't transfer. Only the method does. That weakens the +> ordering argument I gave for running notation first, without overturning it. +> +> And CG-R-37 revises the pessimism. Twenty-three instances is a materially better frame than +> CG-R-33 anticipated from "one ground, one verdict, both internal". Gate 3 should compute +> detectability against the instantiated frame and say what changed, rather than carrying the +> earlier estimate forward unrevised. + +--- + +## Consequences carried forward by this session + +The Gate 2 proposal stays as written (`CG-rule-02`); these rulings sit beside it. + +| Ruling | What it settles | What this session does | +|---|---|---| +| `CG-R-35` | The list is confirmed by **blind re-derivation** in a separate session, given the grid, the act type and the admission conditions and nothing else; the two lists are reconciled row by row; reconciliation is ratified before Gate 3 | **This session cannot be the separate session.** It prepares the blind brief — `blind-rederivation/` — as a self-contained bundle holding exactly what the re-deriving session may see, hashed; and it fixes the reconciliation rule now, before either list is compared (`rederivation-reconciliation-rule.md`). Launching the separate session is Emil's. The reconciliation is this session's next act once the re-derivation arrives | +| `CG-R-36` | The notation pre-registration's §10 is **amended**: only the derivation method transfers to the layer claim, which re-derives its own list for SPETLR's act types by that method; its corpus does not change | The arrived pre-registration is not edited (`CG-rule-02`; not this session's document). Gate 5's assembly carries the amended statement and cites the ruling | +| `CG-R-37` | The frame is the **instantiated** list; its size is set-dependent, without bias between arms; Gate 3 computes the smallest detectable effect against the instantiated frame and states what changed from `CG-R-33`'s anticipation | Gate 3 | +| `CG-R-38` | The verbatim leakage check is accepted; **paraphrase leakage is a permanent limit**, checked by reading by a named principal or not at all | Gate 3 (authorship instruction); Gate 5 (limit stated wherever cited) | + +**Carried, acknowledged.** The closure preview in the proposal's §6 was computed after the list +was fixed; the proposal records that order in its own heading, and this note records that the +ruling authority noted it. + +**On why no subagent of this session performs the re-derivation.** The tooling available here +could start a fresh agent with only the brief. It would be blind by instruction, not by +construction: it would run in a checkout where the set and the list exist, under the same +session's direction, and its independence would rest on its having obeyed a do-not-read. That +is a weaker instrument than `CG-R-35` describes, and whether it would be acceptable is the +principal's to rule, not the session's to assume. The brief is built so that either kind of +session can use it. From 9bc8692462f1afdfe526dd035e0a3e519defa3bb Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 4 Sep 2026 06:48:29 +0000 Subject: [PATCH 09/19] Blind re-derivation brief and reconciliation rule, per CG-R-35 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Files a self-contained bundle for the separate session: the brief (the act type, the stage-by-construct grid, the four admission conditions, the naming and one-question rules, the output form, what it must not do), the foundation in both states, the resolution condition, the boundary declarations and the schema, with a manifest of hashes. The bundle carries no determination set, no act instance and no proposed list. Fixes the reconciliation rule — matching, the three outcomes, the reported overlap, the order of steps — before the re-derivation exists. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../blind-rederivation/MANIFEST.md | 13 + .../blind-rederivation/README.md | 152 +++++++++++ .../boundary-declarations.md | 79 ++++++ .../determination.schema.json | 255 ++++++++++++++++++ .../blind-rederivation/foundation.md | 142 ++++++++++ .../resolution-condition.md | 58 ++++ .../supersession-foundation-construct-list.md | 75 ++++++ .../rederivation-reconciliation-rule.md | 57 ++++ 8 files changed, 831 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/MANIFEST.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/README.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/boundary-declarations.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/determination.schema.json create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/foundation.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/resolution-condition.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/supersession-foundation-construct-list.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/rederivation-reconciliation-rule.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/MANIFEST.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/MANIFEST.md new file mode 100644 index 0000000..0e9d016 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/MANIFEST.md @@ -0,0 +1,13 @@ +# Manifest — blind re-derivation bundle + +sha256 of every file in this directory as filed on 2026-09-04. The re-deriving session checks +these before starting and records what it checked; a bundle that does not match was not this one. + +| File | sha256 | Lines | +|---|---|---| +| `README.md` | `224bf88670ad85ee7871f7b2c6c841171f8145c3c0bb1f2b750a44e78791fb44` | 152 | +| `foundation.md` | `3d9a52546fc35b05fffb2b0de2a97faa656b813e61c3c893ab2a093571219510` | 142 | +| `supersession-foundation-construct-list.md` | `0c2c17cce8e9abe01b7a1dbc27a5e8148ce0bb31cfcacc9436e01a215940b700` | 75 | +| `resolution-condition.md` | `802fc286cfcbb308b178066386bc1da6bceb4d006d33dbdc62fb2b40264b0055` | 58 | +| `boundary-declarations.md` | `0690cb5577d24e7b27077141c06f4572451797de406c41bfb8d6cdf05fcb131e` | 79 | +| `determination.schema.json` | `4df4db09cf11d9a0cc02b4fee762fb9b71c3194dd1cb59691ccb6cba52fc67c6` | 255 | diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/README.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/README.md new file mode 100644 index 0000000..d0bdefd --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/README.md @@ -0,0 +1,152 @@ +# Blind re-derivation brief — consequential-property categories for a command slice + +**Read this file first. It is the whole of your instruction set.** You are performing the +re-derivation ruled at `CG-R-35`. You derive a category list by a stated method and stop. You +are not told, and must not try to learn, what any other session derived, what act instance is +under test, or what determinations it carries. If anything you are given or find seems to tell +you, stop and report it rather than reading on. + +**You propose; Emil ratifies. Produce one file and stop.** Commit identity, if you commit at +all, is `Claude `. If this bundle is all you were given, work from it +alone; if you have repository access, use nothing outside this directory. + +--- + +## 1. The task + +Produce the list of **consequential-property categories** for one act type: a **command slice** +in the domain-state-change binding, in the software projection, at act scale. The list is drawn +for the act type — any command slice, in any domain — never for an instance. + +Your output is a single markdown file, `rederived-category-list.md`, containing: + +1. the list, in the form fixed at §5; +2. a **rejection register** — every candidate the method produced that you did not admit, with + the admission condition it failed and why; +3. any point at which you had to invent a category the grid did not produce, marked as + invented at the point of invention; +4. the weakest point of your list, named. + +Nothing else. No experiment design, no measure, no discussion of what the list is for beyond +what §2 says. + +## 2. What a category is + +A **consequential-property category** is a decision point that performing an act of this type +entails: something an actor implementing the slice must resolve, explicitly or by default, +whose resolution has consequence for what the act does. A specification written in the binding +either settles such a point by a determination, or declares it unsettled. The list is the set of +such points for the act type. + +## 3. The act type + +The binding sits on an **event model**, which supplies the act vocabulary (slices, by type and +name) and the fact vocabulary (the types of things acts read and write). Slice types are +*command*, *read-model*, *automation* and *translation*. Position is relative to the act: each +slice declares which facts it reads and which it writes. The determination layer adds, at each +slice's address, determinations — extent, allocation, acceptance with coverage, boundary +declarations, provenance — whose record shape is `determination.schema.json`, enclosed. + +A **command slice** receives a command from a caller, reads the facts the event model declares +it reads, decides, writes the facts the model declares it writes, and reports an outcome to the +caller. That gives the stages of the grid below. + +## 4. The method + +### 4.1 Admission conditions — apply all four to every candidate + +1. **Entailed by the act type.** An actor performing any command slice meets this decision + point, whatever the domain. A point that arises only in one domain or one instance fails. +2. **Within a construct the foundation names.** A determination in the layer can settle it: it + lies inside ground, position, allocation, acceptance, coverage, or a boundary declaration + (the enclosed `foundation.md`, `resolution-condition.md`, `boundary-declarations.md`). A + point the layer has no form for is out of the list, however consequential. +3. **Outside what the act vocabulary fixes.** The foundation §4: the language is *not a + replacement for the act vocabulary's own artefacts*. Which act this is, and which facts it + reads and writes by name, are the event model's and are not categories. What the act does + with them is. +4. **Recognisable from output.** A reader who sees only an actor's output and your list can say + whether the output addresses the point, without first reconstructing what the points should + have been. Each category is therefore one question with a stated answer form. + +### 4.2 The grid + +**Axis A — stages of a command slice:** *receive* (the command arrives), *read* (the declared +ground is obtained), *decide*, *write* (the verdict is produced), *report* (the caller learns +the outcome). A sixth row, *act as a whole*, holds cross-cutting points. + +**Axis B — the foundation's constructs, in both states.** The foundation is enclosed in its +**original** state (`foundation.md`) together with the **supersession record** that retired +two of its positions (`supersession-foundation-construct-list.md`). Use both: where the +original names a construct the supersession replaced, the cell is the same and the name +differs, and you say which state you used. + +| Construct | Where | +|---|---| +| ground requirement | foundation §2.2 — retired by S-2 into position | +| position: read is ground, write is verdict | supersession S-2; resolution condition | +| determination addressed to the act | foundation §2.3 | +| allocation: pinned, checked, residual | foundation §2.5 | +| acceptance relation; operational closure | foundation §2.6 | +| coverage and residual | foundation §2.7 | +| C-1, C-2, C-3 | resolution condition | +| B-1 external ground; B-2 terminal verdict | boundary declarations | + +A category is the intersection of a stage and a construct at which all four conditions hold. +Work the grid cell by cell; a cell may yield nothing, one category, or several. + +**The schema is consulted as enforcement only.** Where it requires a field, that marks a +decision point the binding's authors judged consequential — corroboration for a category, never +its source. Do not derive categories from schema fields. + +### 4.3 Rules on the rows + +- **One question per category.** Each row is one question with one recognisable answer form. + A category may be a *kind* of decision point that an instance exhibits more than once; that + is acceptable and is handled after your work, not by you. +- **Names in plain words, avoiding the schema's vocabulary.** No category name may be a schema + key or enum value: *address, act_type, act_instance, scale, statement, extent, axes, state, + region, reason, allocation, class, settled_by, acceptance, predicate, closure, kind, + runnable_by, terminates, tolerance, ranges_over, covers, does_not_cover, proxy, stands_in_for, + known_divergence, positions, fact_type, role, boundary, source, consumer, read_provenance, + tick_rate, consumption_observable, provenance, made_at, made_by, recorded, supersedes*, nor + *bound-here, travels-to, does-not-travel, silent, pinned, checked, residual, external, + terminal, internal, operational, logical-only, unestablished, asserted-none, build-time, + act-time, static, slow, fast, unknown, human, machine, team, external-party*. Avoid also the + words *external, terminal, residual, coverage, closure, provenance* in names. +- **Cite the cell.** Every row states its stage and its construct, with the section or clause. +- **Record what you reject.** Every candidate the grid produced and you did not admit goes in + the rejection register with the failing condition. A list without a rejection register is + incomplete. + +## 5. Output form + +For each stage, a table: + +| Id | Name | Question | An answer looks like | Cell | +|---|---|---|---|---| + +Ids `R-01`, `R-02`, … in order. Then the rejection register as a table: candidate, cell, +condition failed, why. Then invented categories, if any. Then the weakest point. + +## 6. What you must not do + +- Do not look for, ask about, or reason from any act instance, event model, example + determination, or other session's list. The enclosed schema's one example name is not an + instance under test and tells you nothing. +- Do not read anything outside this directory. The bundle is complete. +- Do not design the experiment, the measure, thresholds, or a rubric. +- Do not tune the list to be long, short, or to any expectation. The number of rows is an + outcome of the method. + +## 7. Enclosed + +| File | Role | +|---|---| +| `README.md` | this brief | +| `foundation.md` | the foundation, original state | +| `supersession-foundation-construct-list.md` | S-1 and S-2, the superseding state | +| `resolution-condition.md` | C-1, C-2, C-3 | +| `boundary-declarations.md` | B-1, B-2 | +| `determination.schema.json` | the binding's record shape, for §4.2's corroboration and §4.3's naming rule | +| `MANIFEST.md` | sha256 of every file above — check them before starting | diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/boundary-declarations.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/boundary-declarations.md new file mode 100644 index 0000000..99e2853 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/boundary-declarations.md @@ -0,0 +1,79 @@ +# [PROPOSED] Boundary declarations + +**Status:** `[PROPOSED]`. Not ratified. Depends on supersession S-2, which is itself unratified. + +**Why this exists.** The resolution condition treats a dangling reference as incompleteness: every ground requirement resolves in the fact vocabulary, every acceptance relation ranges over produced objects, every produced object has a producing act. + +Applied without boundaries, this is false of every real specification. Some ground arrives from outside and no act in scope produces it. Some verdicts are delivered outward and no act in scope reads them. Both would register as dangling references, so the condition would fail every specification that touches anything, and a predicate that nothing passes is as useless as one everything passes. + +Boundaries make the condition sound by converting *unresolved* into *declared unresolved*. This is the same move as declared extent: absence becomes a positive fact rather than an unexplained gap. + +--- + +## B-1 — External ground + +**Declaration.** An object may be declared **external**: required by an act in scope, and produced by no act in scope. + +**Requirements on the declaration.** Each declared external object states: + +- what it is, in fact vocabulary terms +- where it comes from, sufficient to identify the producing party +- its read provenance — the path by which the act obtains it +- its tick rate, or a statement that the tick rate is unknown + +Tick rate is not decoration. It determines whether the object may be encoded or must be read at act time, and an external object with unknown tick rate is a staleness hazard that should be visible. + +**What the declaration does not license.** Declaring an object external settles that the specification does not produce it. It does not settle its correctness, availability, or stability, and it does not transfer accountability for acts that depend on it. + +**Candidates.** Regulation and standards; customer data; third-party service responses; environment and infrastructure facts; human intent arriving through channels the specification does not model. + +--- + +## B-2 — Terminal verdicts + +**Declaration.** An object may be declared **terminal**: produced by an act in scope, and read by no act in scope. + +**Requirements on the declaration.** Each declared terminal object states: + +- what it is, in fact vocabulary terms +- who or what consumes it outside the scope +- whether consumption is observable to any act in scope + +That last field is the one that matters. A terminal verdict whose consumption is unobservable is a place where consequence leaves the system with no return path, which is where undetected divergence accumulates. + +**Candidates.** Outputs delivered to users; notifications; exports to systems not in scope; audit records written and never read back by any modelled act. + +--- + +## B-3 — Scope, and the honest consequence + +Both declarations are relative to a declared scope. An object external to one specification is produced within another; a verdict terminal in one is ground in another. + +This means the resolution condition is **scope-relative and not composable by default**. Two specifications each internally complete may leave a dangling reference between them: A declares an object terminal, B declares the same object external, and nobody has checked that what A produces is what B expects. + +That gap is exactly the seam where divergence is predicted to concentrate. It is not a defect in the boundary mechanism — it is the mechanism making the seam visible instead of leaving it implicit. + +**Closed by R-4.** The composition check is committed as a design constraint: where A declares an object terminal and B declares the same object external, the fact-vocabulary types must agree. It is mechanically stateable and is the highest-value check in the scheme, since it addresses the case the accrual argument identifies as most costly. + +The build is deferred — it requires two conforming specifications to exist. The declaration fields below must not be designed in any way that forecloses it. Until it exists, the resolution condition holds within a scope only, and that limit is stated wherever closure is claimed. + +--- + +## B-4 — Constraints on declaration + +**Declaring is not free.** If external and terminal declarations cost nothing, the cheapest way to pass the resolution condition is to declare everything at the boundary. The condition would then be satisfied by a specification that resolves nothing. + +Two constraints follow: + +- the declaration fields above are mandatory, not optional; an external object without provenance or a terminal object without a stated consumer is not a declaration +- the ratio of declared-boundary objects to internally resolved objects is a reported measure, not a hidden one + +**Ruled: reporting, no ceiling.** A ceiling is arbitrary and invites tuning to it, which converts a measure into a target. The ratio is reported per specification alongside the exception rate, and a specification whose boundary ratio is high is visibly one that resolves little — which is the information a reader needs, without a threshold anyone can argue with. + +--- + +## Dependencies + +- Requires S-2. Without the position reduction, ground and verdict are separate ontologies and these declarations have no shared object to attach to. +- The resolution condition itself is not yet written as canon. These declarations make it sound; they do not state it. +- No falsifier attached. The nearest candidate: a specification passing the resolution condition with boundaries declared should show fewer escaped decisions at the seams it declares than one without declared boundaries. Untested, and it is a different claim from the one the current pre-registration tests. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/determination.schema.json b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/determination.schema.json new file mode 100644 index 0000000..eca0483 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/determination.schema.json @@ -0,0 +1,255 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://github.com/Hafeok/specification-languages/domain-state-change/schema/determination.schema.json", + "title": "Determination — domain state change binding", + + "$comment": "This schema is the enforcement mechanism for PR-1, PR-2 and PR-3. The prohibitions are not advice: the forbidden shapes have no valid representation here. A conformance claim citing this file cites required fields and closed unions, not prose.", + + "$defs": { + + "address": { + "$comment": "PR-1. An act address. Type plus bound parameter; the parameter is drawn from the act vocabulary, which makes the instance set computable rather than authored.", + "type": "object", + "required": ["act_type", "act_instance"], + "additionalProperties": false, + "properties": { + "act_type": { + "type": "string", + "enum": ["command", "read-model", "automation", "translation"], + "$comment": "Event modelling's slice types. Closed." + }, + "act_instance": { + "type": "string", + "minLength": 1, + "$comment": "A name in the act vocabulary, e.g. PlaceOrder. Checked against the event model by the validator, not by this schema." + }, + "scale": { + "type": "string", + "enum": ["act", "slice", "context", "system"], + "default": "act", + "$comment": "Composition granularity. Independent of projection depth." + } + } + }, + + "extent": { + "$comment": "DP-1. Four states, and silence is one of them. A determination filed before an axis existed is SILENT on it; one deliberately bounded is DOES-NOT-TRAVEL. Collapsing them makes the revisit computation unsound the first time an axis is added.", + "type": "object", + "required": ["axes"], + "additionalProperties": false, + "properties": { + "axes": { + "type": "object", + "minProperties": 1, + "additionalProperties": { + "type": "object", + "required": ["state"], + "additionalProperties": false, + "properties": { + "state": { + "type": "string", + "enum": ["bound-here", "travels-to", "does-not-travel", "silent"] + }, + "region": { + "type": "string", + "$comment": "Required when state is travels-to or does-not-travel." + }, + "reason": { "type": "string" } + }, + "allOf": [ + { + "if": { "properties": { "state": { "enum": ["travels-to", "does-not-travel"] } } }, + "then": { "required": ["state", "region"] } + }, + { + "if": { "properties": { "state": { "const": "silent" } } }, + "then": { + "not": { "required": ["region"] }, + "$comment": "Silence has no region. A silent axis was not considered; naming a region would make it a stated boundary." + } + } + ] + } + } + } + }, + + "allocation": { + "$comment": "PR-2 and DP-4. Every determination is allocated. Residual requires a carrying actor kind AND an accountable principal, and the principal cannot be a machine.", + "type": "object", + "required": ["class"], + "properties": { + "class": { "type": "string", "enum": ["pinned", "checked", "residual"] } + }, + "oneOf": [ + { + "properties": { + "class": { "const": "pinned" }, + "settled_by": { "type": "string", "minLength": 1 } + }, + "required": ["class", "settled_by"], + "additionalProperties": false + }, + { + "properties": { + "class": { "const": "checked" }, + "acceptance": { "$ref": "#/$defs/acceptance" } + }, + "required": ["class", "acceptance"], + "additionalProperties": false + }, + { + "properties": { + "class": { "const": "residual" }, + "carried_by": { + "type": "string", + "enum": ["human", "machine", "team", "external-party"] + }, + "principal": { + "type": "object", + "required": ["kind", "identifier"], + "additionalProperties": false, + "properties": { + "kind": { + "type": "string", + "enum": ["human", "team", "external-party"], + "$comment": "Machine is absent by design. A model identity cannot be an accepting principal." + }, + "identifier": { "type": "string", "minLength": 1 } + } + } + }, + "required": ["class", "carried_by", "principal"], + "additionalProperties": false + } + ] + }, + + "acceptance": { + "$comment": "PR-3, DP-2, DP-3, DP-5. A coverage claim with no stated uncovered set has no representation: does_not_cover is required and may not be empty by omission. Absence of uncovered properties must be asserted explicitly.", + "type": "object", + "required": ["predicate", "closure", "ranges_over", "covers", "does_not_cover"], + "additionalProperties": false, + "properties": { + "predicate": { + "type": "string", + "minLength": 1, + "$comment": "Predicate form, not extension. Scenarios are evidence about a predicate; they are not the predicate." + }, + "closure": { + "$comment": "DP-2. Logical closure and operational closure are different claims and the notation records which was established.", + "type": "object", + "required": ["kind"], + "additionalProperties": false, + "properties": { + "kind": { "type": "string", "enum": ["operational", "logical-only", "unestablished"] }, + "runnable_by": { "type": "string" }, + "terminates": { "type": "boolean" }, + "tolerance": { "type": "string" } + }, + "allOf": [ + { + "if": { "properties": { "kind": { "const": "operational" } } }, + "then": { "required": ["kind", "runnable_by", "terminates"] } + } + ] + }, + "ranges_over": { + "$comment": "C-3 of the resolution condition. The facts this predicate is evaluated against. A check over something no act produces is not a check, so this is required and the resolution check verifies each entry is written by some act in scope.", + "type": "array", + "minItems": 1, + "items": { "type": "string" } + }, + "covers": { + "type": "array", + "minItems": 1, + "items": { "type": "string" }, + "$comment": "Property categories this predicate reaches." + }, + "does_not_cover": { + "$comment": "DP-3. Required. Use the explicit sentinel to assert the empty case; omission is not permitted, because an omitted uncovered set is indistinguishable from an unconsidered one.", + "oneOf": [ + { "type": "array", "minItems": 1, "items": { "type": "string" } }, + { "type": "string", "const": "asserted-none" } + ] + }, + "proxy": { + "$comment": "DP-5. A proxy without its divergence is a coverage claim that overstates itself, so divergence is required whenever proxy is present.", + "type": "object", + "required": ["stands_in_for", "known_divergence"], + "additionalProperties": false, + "properties": { + "stands_in_for": { "type": "string", "minLength": 1 }, + "known_divergence": { "type": "string", "minLength": 1 } + } + } + } + }, + + "position": { + "$comment": "DP-6. Ground and verdict are positions relative to an act, not separate vocabularies. Read position is ground; write position is verdict. Both resolve into the fact vocabulary.", + "type": "object", + "required": ["fact_type", "role"], + "additionalProperties": false, + "properties": { + "fact_type": { "type": "string", "minLength": 1 }, + "role": { "type": "string", "enum": ["read", "write"] }, + "boundary": { + "$comment": "DP-7. external: read here, produced by no act in scope. terminal: written here, read by no act in scope. internal: resolves within scope.", + "type": "object", + "required": ["kind"], + "properties": { + "kind": { "type": "string", "enum": ["internal", "external", "terminal"] }, + "source": { "type": "string" }, + "consumer": { "type": "string" }, + "read_provenance": { "type": "string" }, + "tick_rate": { "type": "string", "enum": ["static", "slow", "fast", "unknown"] }, + "consumption_observable": { "type": "boolean" } + }, + "allOf": [ + { + "if": { "properties": { "kind": { "const": "external" } } }, + "then": { "required": ["kind", "source", "read_provenance", "tick_rate"] } + }, + { + "if": { "properties": { "kind": { "const": "terminal" } } }, + "then": { "required": ["kind", "consumer", "consumption_observable"] } + } + ] + } + } + }, + + "provenance": { + "type": "object", + "required": ["made_at", "made_by", "recorded"], + "additionalProperties": false, + "properties": { + "made_at": { + "$comment": "SR-1. The ONLY field that distinguishes a build-time determination from an act-time one. The schema is otherwise identical, which is what stops the store bifurcating.", + "type": "string", + "enum": ["build-time", "act-time"] + }, + "made_by": { "type": "string", "minLength": 1 }, + "recorded": { "type": "string", "format": "date-time" }, + "supersedes": { "type": "string" } + } + } + }, + + "type": "object", + "required": ["id", "address", "statement", "extent", "allocation", "provenance"], + "additionalProperties": false, + "properties": { + "id": { "type": "string", "pattern": "^DSC-[0-9]{4}$" }, + "address": { "$ref": "#/$defs/address" }, + "statement": { "type": "string", "minLength": 1 }, + "extent": { "$ref": "#/$defs/extent" }, + "allocation": { "$ref": "#/$defs/allocation" }, + "positions": { + "type": "array", + "items": { "$ref": "#/$defs/position" } + }, + "provenance": { "$ref": "#/$defs/provenance" } + } +} diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/foundation.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/foundation.md new file mode 100644 index 0000000..5e4a9cd --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/foundation.md @@ -0,0 +1,142 @@ +# [PROPOSED] Foundation of the specification language + +**Status:** `[PROPOSED]`. Not ratified. No falsifiers attached to the design constraints below; several are stated as requirements derived from the closure claim, and inherit its unratified status. + +**Method.** Nothing here is designed forward from taste. Every requirement is derived backwards from one question: what must be expressible for layer completeness to be decidable? A construct that is not needed for that, or for the write side, is not in the foundation. + +**Naming.** `protocol` is unavailable — He and Yu used it in May 2026 for an adjacent construct. See the closing section; the artefact may already be named in canon. + +--- + +## 1. The design driver + +A layer is complete when every determination that could bind acts in that layer either binds there or is declared not to travel there. + +This is a universal quantification over acts, evaluated against declared extent. Everything the language must express follows from making that sentence decidable: + +- quantification requires a **closed, countable act set** +- *binds there* requires **determinations addressed to acts** +- *declared not to travel* requires **extent as a positive statement** +- *decidable* requires every predicate involved to be **operationally closed**, not merely well formed + +A language that expresses less than this cannot state its own completeness. A language that expresses more is carrying constructs the predicate does not need, and each one is a place where filing becomes a judgement call. + +--- + +## 2. What must be expressible + +Presented in dependency order. No construct refers forward. + +### 2.1 Act + +The unit of address. Named, countable, and closed for a bounded scope. + +Closure of the act set is not a nicety. Without it there is nothing to quantify over and completeness is unstatable. This is also the property that most architectures fail to supply, which is why the language cannot be defined independently of an architecture that names acts. + +An act is a happening, not a thing. If a name in the act set can be read as a noun denoting a component, it is a topic and the address space has been compromised. + +### 2.2 Ground requirement + +What an act must have available to be performable, with provenance. + +Provenance is not optional and cannot be deferred. Two actors with nominally identical ground and different read paths are not substitutable, and a record that omits the read path cannot support the substitution question later. + +### 2.3 Determination + +Something settled, addressed to an act. + +A determination floating free of an address is a prose rule, and prose rules are the failure mode the whole scheme exists to avoid. The language should have no way to express one. + +### 2.4 Extent + +The axes a determination travels on, and where it stops. + +Four states must be distinguishable, and the fourth is the one that is usually lost: + +| State | Meaning | +|---|---| +| bound here | applies at this address only | +| travels to X | applies across the named region | +| does not travel to X | stated boundary; a positive fact | +| silent on axis A | the axis was not considered | + +*Silent* is not the same as *does not travel*. A determination filed before an axis existed is silent on it; one filed after and deliberately bounded is not. Collapsing these makes the revisit computation unsound the first time a new axis is added, and the loss is unrecoverable after the fact. + +**Default extent is the narrowest.** Travel is the deliberate act that costs something. Any other default reintroduces judgement at write time and placement stops happening. + +### 2.5 Allocation + +Who carries the determination. Mandatory; a determination without an allocation is not well formed. + +Three classes, exhaustive: + +- **pinned** — settled in advance; the act has no discretion +- **checked** — discretion exists, and a predicate settles acceptability regardless of producer +- **residual** — discretion exists and no predicate reaches it + +For residual, the language must record which actor carries it and which principal answers for the outcome. The principal is a role a machine actor cannot occupy. + +### 2.6 Acceptance relation + +For checked determinations: the predicate, and its closure status against the ground and tools the arrangement actually has, at the stated tolerance. + +Two requirements distinguish this from an assertion of quality. + +**Predicate form, not extension.** State what admits, do not enumerate what is admitted. Enumerations are silently incomplete and their incompleteness is invisible. There is independent evidence that predicates are more reliably authored than the sets they induce. + +**Operational closure, not logical closure.** A predicate that is decidable in principle and unrunnable by this arrangement at act time is not a specification. The language must record which of the two has been established, because they are routinely conflated. + +### 2.7 Coverage and residual + +For each acceptance relation: which consequential properties of the act it reaches, and which it does not. + +This is the construct that distinguishes the language from every adjacent approach. Elsewhere the conjunction of constraints is treated as defining the admissible space by fiat, and the uncovered remainder is invisible. Here it is named. + +The residual is not a defect to be minimised to zero. It is the part that must be allocated to an actor competent to carry it, and it cannot be allocated if it cannot be seen. + +Where a predicate stands in for another, three fields are required: the proxy, the original predicate, and the known divergence. A proxy recorded without its divergence is a coverage claim that overstates itself. + +### 2.8 Provenance and supersession + +Who settled it, when, and what it supersedes. + +Correction files a superseding record; it does not rewrite. A determination whose extent has been narrowed twice is evidence about the original extent claim, and that evidence is destroyed by editing in place. + +--- + +## 3. Properties the language must have + +Stated as properties, not mechanisms. + +**It is closed under its own completeness predicate.** The language can express the check that decides whether a layer is complete. If it cannot, the closure claim is decorative. + +**It is symmetric across build and act time.** The same schema expresses a determination taken in advance and one produced while acting. Any asymmetry bifurcates the store and the second half rots. This is the property no existing specification language has, and it is the one that stops the method being a waterfall. + +**Filing requires no judgement about location.** The act supplies the address. If an author must understand a taxonomy before recording something, recording will not happen. + +**Silence is expressible.** *This layer does not settle X* is a statement the language can make. Absence must never be the only way to say it. + +**Generality is expensive and specificity is free.** The inverse of a prose rules file, where generality costs nothing and rots the artefact. + +**Every quantitative construct declares its measurement.** Tolerance, assurance and coverage are unusable without stated units and a stated instrument. + +--- + +## 4. Non-goals + +Naming these prevents the language absorbing work it should not carry. + +- **Not executable code, and not a generator input.** It allocates determinations; it does not produce implementations. +- **Not a domain ontology.** It carries decisions about acts, not a model of the world the acts operate on. +- **Not a replacement for the act vocabulary's own artefacts.** The architecture produces the act names; the language addresses them. +- **Not complete over outcomes.** It closes over its own declared scope. Completeness of the specification is not coverage of the act, and conflating the two would sell closure as assurance. +- **Not an elicitation method.** How determinations are arrived at, prioritised, or disagreed over is untouched. + +--- + +## 5. Open + +1. **Falsifier for the closure requirement.** A specification passing the layer completeness predicate should show measurably fewer escaped decisions than one failing it. Until measured, section 1 is an assertion. +2. **Whether the axis set is a clean product.** Sectors carry act vocabularies and impose acceptance relations, so sector and act interact. If the axes are not independent, extent is not a Cartesian region and the completeness predicate must close over the actual shape. +3. **Related-work check.** Design-by-contract, Z and B, ADLs, policy languages, and the invariants-plus-evidence line all occupy adjacent ground. Only the closure claim has been checked, against six sources. +4. **Name.** The artefact written in this language may already exist in canon as the What — a store allocation declaring which determinations a built actor carries over run acts. If so, the language is the language in which a What is written, and no new name is required. Deciding this is cheap now and expensive after adoption. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/resolution-condition.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/resolution-condition.md new file mode 100644 index 0000000..b234334 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/resolution-condition.md @@ -0,0 +1,58 @@ +# [PROPOSED] The resolution condition + +**Status:** `[PROPOSED]`. Depends on supersession S-2, unratified. Falsifier deferred per R-1: this condition is not what the current closure pre-registration tests. + +**What it is.** The completeness predicate for a specification. It replaces the per-act category check the foundation was originally drafted around, and it generalises event modelling's information-completeness rule from data to the whole triple. + +--- + +## Statement + +A specification is complete when it contains no dangling references across act vocabulary, fact vocabulary and position. + +**C-1 — Ground resolves.** Every object an act reads resolves to a type in the fact vocabulary, and is either produced by some act in scope or declared external. + +**C-2 — Verdict resolves.** Every object an act writes resolves to a type in the fact vocabulary, and is either read by some act in scope or declared terminal. + +**C-3 — Acceptance relations range over produced objects.** Every acceptance relation ranges over objects that some act in scope writes. A check over something no act produces is not a check. + +Incompleteness is a dangling reference. Nothing else is. + +--- + +## Scope of a single evaluation + +The condition is evaluated at **one scale, within one projection, over one declared scope.** + +- **Scale**, per R-2: acts compose, and the condition holds over the act set at a given granularity. It does not automatically hold at a coarser or finer one. +- **Projection**, per R-2: independent of scale. A specification at sector depth is evaluated against its own act and fact vocabularies. +- **Scope**: the boundary declarations are relative to it. An object external to one specification is produced within another. + +**Consequence, stated rather than hidden.** The condition is **not composable by default**. Two specifications each internally complete may leave a dangling reference between them. That gap is addressed by the boundary composition check committed at R-4, and until that exists, closure is claimed within a scope only and must be stated that way wherever it is claimed. + +--- + +## What passing does not establish + +- **Not coverage of the act.** The condition closes over what the specification declares. It says nothing about whether the acceptance relations reach the consequential properties, which is the separate coverage measure and is reported separately. +- **Not correctness.** Every reference can resolve and every determination be wrong. +- **Not that the act vocabulary is right.** A specification over a badly drawn act set can resolve perfectly. +- **Not assurance.** A green run means well formed. + +The condition makes incompleteness *statable*. It does not make specifications complete, and a specification that passes it may still leave most of the work to the actor — declared, rather than silently. + +--- + +## Why declaration is not free + +If external and terminal declarations cost nothing, the cheapest way to pass is to declare everything at the boundary, and a specification resolving nothing would pass. + +The boundary declarations therefore carry mandatory fields, and the ratio of declared-boundary objects to internally resolved objects is reported per specification. No ceiling is imposed: a ceiling is arbitrary and invites tuning to it. Reporting with the exception rate is the discipline. + +--- + +## Open + +1. No falsifier. The candidate is stated in the boundary declarations and requires two conforming specifications to exist. +2. Whether C-3 should also require the converse — that every written object is ranged over by some acceptance relation. As stated it does not, which permits verdicts nobody checks. That may be correct, since not everything warrants a check, but it means the condition is silent on a real gap and the coverage measure carries it instead. +3. Whether the condition holds across scales when acts compose, or whether composition requires its own check. Currently unaddressed. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/supersession-foundation-construct-list.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/supersession-foundation-construct-list.md new file mode 100644 index 0000000..ad272f9 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/supersession-foundation-construct-list.md @@ -0,0 +1,75 @@ +# [PROPOSED] Supersession record: foundation construct list + +**Status:** `[PROPOSED]`. Two supersessions against `specification-language-foundation.md`. Neither is ratified. Both arose in session; neither has a falsifier attached. + +**Purpose.** The construct list is the derivation source for the falsifier's category list. Any session deriving from it must see both the superseded and the superseding state, or it will derive from a stale list without knowing it has. This record exists so that resolving the changes into the text does not destroy what the derivation needs. + +**Rule applied.** Supersession never rewrites. The original statements below are retained verbatim in substance and marked retired, not deleted. + +--- + +## S-1 — Specification is a peer projection, not a child + +### Retired position + +The foundation was drafted with specification-driven development treated as a layer above the software projection, in an ordering of actor → specification → decision. The construct list was written without ruling on where the specification projection sits relative to `decision-driven-design`. + +### Superseding position + +Specification is a **peer projection** of the decision layer, alongside the software projection. Both project from `actor-indexed-determination`. Neither depends on the other. + +### Basis + +The retired ordering contains a forward reference. A specification is a set of decisions taken in advance; closure is a property of decisions declared with their extent; slices, acceptance relations and the pinned/checked/residual partition are all decision vocabulary. A layer cannot sit above the layer supplying its primitives. + +The peer reading is admitted on the structural test rather than on preference: the specification projection has vocabulary the software projection does not need — specification, closure, releasable increment — so it is not a naming variant. + +### Consequence + +- Two projections, therefore two completeness predicates and two term registries, with a drift check between them. This is a real cost of the peer ruling and is accepted knowingly. +- The conformance relation to `specification-languages` is **not** projection and requires separate rules. A conforming instance may fail the criterion; a projection may not fail its upstream. + +### Open + +Whether the peer ruling survives the structural test properly run. It has been asserted on inspection, not checked construct by construct against the software projection. + +--- + +## S-2 — Ground and verdict are positions, not ontologies + +### Retired position + +The construct list treated ground requirement (§2.2) and the objects an acceptance relation ranges over as separate constructs, and a later session framing proposed three ontologies per specification: verdict, ground, and act. + +### Superseding position + +Ground and verdict are **roles an object occupies relative to an act**, not separate vocabularies. + +A specification carries: + +- **act vocabulary** — what can be done +- **fact vocabulary** — the type space of objects acts read and write; the domain model +- **position** — whether a given object is read or written by a given act + +Read position is ground. Written position is verdict. + +### Basis + +The reduction was reached by way of a rejected argument and a sound one. Both are recorded, because the rejected one will be re-proposed otherwise. + +**Rejected.** *A verdict's outcome varies with the actor, therefore verdicts are ground.* Actor-variance cannot be the criterion. Under actor-indexed determination everything varies with the actor; that is what the index is for. What varies is the determination — the mapping from what an act reads to what it produces — and variance is a property of the mapping, not evidence about position. + +**Sound.** The verdicts of prior acts are what later acts read. This is why event sourcing functions as an outcome record: the log of past outcomes is the ground for future acts. Ground and verdict are therefore the same objects in different positions, and modelling them as separate ontologies duplicates the type space and loses the relation between them. + +### Consequence + +- Position must remain marked. Merging without it makes acceptance relations unstatable, because an acceptance relation ranges over what an act **produces**. +- The completeness predicate becomes a **resolution condition** across act, fact and position: every ground requirement an act declares resolves in the fact vocabulary; every acceptance relation ranges over objects some act produces; every produced object has a producing act. Incompleteness is a dangling reference. +- This generalises the information-completeness rule from data to the whole triple. +- Two sets do not fully overlap, and the resolution condition is unsound without declarations on both sides: not every verdict becomes ground, and not all ground is a prior verdict. See the boundary declarations. + +### Open + +- ~~The actor is absent from the triple.~~ **Closed by R-3.** Actor kinds come from Layer 1 and remain stable. Actor **instances** are declared per specification and read at act time, not held in a further vocabulary: they are deployment facts and tick far faster than any ontology should. +- The three tick at different rates — fact vocabulary slow, act vocabulary medium, business-driven objects fast — so a single staleness policy across them is likely wrong. +- The falsifier's completeness predicate is per-act category coverage, not the resolution condition. These are not the same predicate. Whether the falsifier still tests the right thing is unresolved and blocks the amended pre-registration. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/rederivation-reconciliation-rule.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/rederivation-reconciliation-rule.md new file mode 100644 index 0000000..ee49bef --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/rederivation-reconciliation-rule.md @@ -0,0 +1,57 @@ +# Reconciliation rule for the blind re-derivation + +**Status: `[PROPOSED]`, fixed before either list is compared.** `CG-R-35` sets the three +outcomes per row; this file fixes how rows are matched and how each outcome is worked, so that +the reconciliation cannot be shaped by what the re-derivation turns out to contain. Filed +2026-09-04, before the re-derivation exists. + +## 1. Inputs + +- the proposed list, `gate2-proposal.md` §2, nineteen rows `F-01` … `F-19`, as committed; +- the re-derived list, filed byte-identical under `inputs/` with its hash on arrival, rows + `R-nn`, together with its rejection register. + +## 2. Matching + +Two rows **match** when the same feature of an actor's output would answer both questions. The +test is on the questions and answer forms, not the names. Three cases: + +- **one-to-one** — matched; counted *in both*; +- **one-to-many** — one row's question spans two or more of the other's; recorded as a split; + counted *in both* if the finer rows together cover exactly the coarser row's decision points, + and the finer partition is taken forward, since the frame wants the finer grain (U-11); +- **no match** — the row is *only in* its list. + +Matching is done by this session, shown row by row with the reason, and ratified by Emil. The +session cannot be blind to its own list; the mitigation is that every match is written down and +arguable. + +## 3. Working the three outcomes + +- **In both.** Reproducible; the row stands as proposed, in whichever wording is plainer. +- **Only in the proposed list.** A set-fitting candidate. Defended in writing on the derivation + alone — cell and the four conditions. **The defence may not cite the determination set, + the Gate 1 act, or the closure preview.** If the defence does not stand on the grid, the row + is struck. A struck row is recorded, not deleted. +- **Only in the re-derivation.** An omission candidate. Admitted or refused on the four + conditions, in writing; refusals are checked against the proposed list's own rejection + register — a candidate the proposed list already rejected for a stated reason is refused for + that reason unless the re-derivation's derivation defeats it. + +The re-derivation's rejection register is also read against the proposed list: a row the +re-derivation considered and rejected that the proposed list admits is reported as a +disagreement about the conditions, and ruled. + +## 4. The overlap, reported + +Counts: rows in both, only-proposed, only-rederived, struck, admitted. The reproduction rate is +*in both* over the proposed list's row count. **No threshold is fixed here**, because none is +principled; one is offered for ruling: if fewer than two-thirds of the proposed rows are +reproduced, the method section of the Gate 2 proposal is revised before any list is ratified, +per `CG-R-35`'s reading that a small overlap is a finding about the grid. + +## 5. Order + +Reconciliation → ratification of the reconciled list → closure of the determination set +against it (`CG-R-21`, `CG-R-29`) → ratification of the closure → Gate 3. The closure preview in +`gate2-proposal.md` §6 is redone against the reconciled list, not carried forward. From 227b114eb724c149ce91c5b0e45d1b15880ef49c Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 4 Sep 2026 08:15:38 +0000 Subject: [PATCH 10/19] Record CG-R-39 and CG-R-40; the reconciliation rule's threshold refused, provenance grade substituted MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit No subagent performs the re-derivation: blindness by instruction is a constraint held in prose, and prose does not enforce (CG-R-39). No numeric overlap threshold: a proposed-only row is retained only if defended on the grid alone, and the aggregate sets the list's provenance grade — derived or authored — rather than its ratification (CG-R-40). The rule file keeps its refused §4 and carries the substitution as an appended note. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../arrived-inputs.md | 6 ++ .../inputs/rulings-cg-r-39-40.md | 47 ++++++++ .../rederivation-reconciliation-rule.md | 30 ++++++ .../rulings-rederivation.md | 101 ++++++++++++++++++ 4 files changed, 184 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-39-40.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-rederivation.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md index 29eef1b..03874c4 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md @@ -76,3 +76,9 @@ Appended, not rewritten (`CG-rule-02`). | File | sha256 | Lines | Status | |---|---|---|---| | `inputs/rulings-cg-r-35-38.md` | `d6b8f4e1aa1b8cbaab210da9db173a22099eddc94df7e67033654c5ed7168b4f` | 64 | **rulings, issued** — `CG-R-35` … `CG-R-38`, by Emil, 2026-09-03, holding Gate 2 pending blind re-derivation. Filed byte-identical; quoted with consequences in `rulings-gate2.md`. Not yet register rows | + +## Addendum, 2026-09-04 — rulings on the re-derivation bundle arrived + +| File | sha256 | Lines | Status | +|---|---|---|---| +| `inputs/rulings-cg-r-39-40.md` | `e85c32509831353a9d06e10956c414c1b957bc59abca497dda408a1b08ddfa0d` | 47 | **rulings, issued** — `CG-R-39`, `CG-R-40`, by Emil, 2026-09-03, accepting the bundle and the reconciliation rule. Filed byte-identical; quoted with consequences in `rulings-rederivation.md`. Not yet register rows | diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-39-40.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-39-40.md new file mode 100644 index 0000000..d151624 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-39-40.md @@ -0,0 +1,47 @@ +# Rulings CG-R-39 and CG-R-40 — blind re-derivation + +**Issued by Emil, 2026-09-03.** The bundle and the reconciliation rule are accepted. The reconciliation rule being fixed before any comparison could shape it is the right order and is recorded as having been so. + +--- + +## CG-R-39 — A subagent does not count + +**Ruled: no.** The re-derivation is a separate session, separate context, bundle only. + +The reason is the framework's own. A subagent would be blind **by instruction**, in a checkout where the set and the list exist, under this session's direction. That is a constraint held in prose, and the admission test the governance seed applied says plainly that a rule held in prose is not enforced. The whole content of CG-R-35 is independence from the author; a guarantee of independence that rests on the author's instruction is the thing it was ruled against. + +There is a second reason, weaker but real: a subagent inherits its framing from this session's prompt, and framing is the channel by which a list gets fitted without anyone intending it. + +**The honest middle, stated so it is not discovered later:** a subagent result would not be worthless — it would still exercise the grid. It could not be cited as independent, which is the only property it was wanted for. So it costs a session to get the thing and nothing to skip it. + +--- + +## CG-R-40 — No numeric threshold. The overlap decides the list's provenance grade, not its ratification. + +The proposal is right that no threshold is principled, and offering two-thirds anyway would be an arbitrary ceiling of exactly the kind already refused for the boundary ratio. + +But the aggregate is the wrong place to look. The signal is not what fraction of rows reproduced; it is **why** any row failed to. + +**Ruled, in two parts.** + +**Per row, and this needs no threshold.** A proposed-only row is retained only if it is defended **on the grid alone**, without citing the determination set. A row that can only be defended by pointing at the set is set-fitted and is struck. One such row is a finding regardless of overlap; the reconciliation rule already forbids the citation, and this makes the consequence explicit. + +**In aggregate, the overlap sets the list's provenance grade.** Two grades, both usable, recorded on the list and carried into every citation of the result: + +| Grade | Condition | +|---|---| +| **derived** | every retained row is defended on the grid alone | +| **authored** | some retained rows survive on author judgement the grid does not reach | + +An **authored** list is not disqualifying. It is a weaker provenance, and it changes what the experiment may claim: the frame is then an artefact of this author's reading of the act type, not of a reproducible method, and any downstream reuse of the method inherits that. + +This is the same shape as *extracted* versus *originated* in the governance seed and *provisional* versus in-force under CG-R-1. A thing may be in force and weakly warranted, provided the difference is visible. + +**What triggers revising the method section** is therefore not a percentage. It is a **derived** grade failing to be achievable — if the grid cannot defend the rows the author believes belong, the grid underdetermines the list, and that is a finding about the method reported before any list is ratified. + +--- + +## Carried + +- CG-R-36's amendment to §10 correctly recorded rather than applied to the arrived pre-registration. Gate 5 carries it. +- Register debt: CG-R-17 … CG-R-40. Mine. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/rederivation-reconciliation-rule.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/rederivation-reconciliation-rule.md index ee49bef..31248e9 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/rederivation-reconciliation-rule.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/rederivation-reconciliation-rule.md @@ -55,3 +55,33 @@ per `CG-R-35`'s reading that a small overlap is a finding about the grid. Reconciliation → ratification of the reconciled list → closure of the determination set against it (`CG-R-21`, `CG-R-29`) → ratification of the closure → Gate 3. The closure preview in `gate2-proposal.md` §6 is redone against the reconciled list, not carried forward. + +--- + +## Note appended 2026-09-04 — §4's offered threshold refused; provenance grade substituted (`CG-R-40`) + +§4 above offered a two-thirds threshold for ruling. **Refused**: an arbitrary ceiling of the +kind already refused for the boundary ratio, and the aggregate is the wrong place to look. §4 +stays as written; this note governs. + +**Per row.** A proposed-only row is retained only if defended on the grid alone. §3 already +forbids citing the determination set, the Gate 1 act, or the closure preview in the defence; +the consequence is now explicit: a row defensible only by pointing at the set is set-fitted and +struck, and **one such row is a finding regardless of overlap**. + +**In aggregate.** The overlap sets the list's provenance grade, recorded on the reconciled list +and carried into every citation of the result: + +| Grade | Condition | +|---|---| +| **derived** | every retained row is defended on the grid alone | +| **authored** | some retained rows survive on author judgement the grid does not reach | + +An authored list is usable and weakly warranted; the frame is then an artefact of this +author's reading of the act type, not of a reproducible method, and downstream reuse of the +method inherits that. The reconciliation states the grade and, for an authored grade, names +every row that carries it. + +**Revision trigger.** Not a percentage. If a derived grade is unachievable — the grid cannot +defend rows the author believes belong — the grid underdetermines the list, and that is +reported as a finding about the method before any list is ratified. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-rederivation.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-rederivation.md new file mode 100644 index 0000000..4c05d53 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-rederivation.md @@ -0,0 +1,101 @@ +# Rulings — blind re-derivation + +**Issued by Emil, 2026-09-03, accepting the bundle and the reconciliation rule.** Two rulings, +`CG-R-39` and `CG-R-40`, filed verbatim below the rule. Arrived as `rulings-cg-r-39-40.md`, +sha256 `e85c32509831353a9d06e10956c414c1b957bc59abca497dda408a1b08ddfa0d`, 47 lines, filed byte-identical under `inputs/`. The covering message is quoted +at the end. Gate 2 remains held for the re-derivation itself. + +--- + +> +> ## CG-R-39 — A subagent does not count +> +> **Ruled: no.** The re-derivation is a separate session, separate context, bundle only. +> +> The reason is the framework's own. A subagent would be blind **by instruction**, in a checkout where the set and the list exist, under this session's direction. That is a constraint held in prose, and the admission test the governance seed applied says plainly that a rule held in prose is not enforced. The whole content of CG-R-35 is independence from the author; a guarantee of independence that rests on the author's instruction is the thing it was ruled against. +> +> There is a second reason, weaker but real: a subagent inherits its framing from this session's prompt, and framing is the channel by which a list gets fitted without anyone intending it. +> +> **The honest middle, stated so it is not discovered later:** a subagent result would not be worthless — it would still exercise the grid. It could not be cited as independent, which is the only property it was wanted for. So it costs a session to get the thing and nothing to skip it. +> +> --- +> +> ## CG-R-40 — No numeric threshold. The overlap decides the list's provenance grade, not its ratification. +> +> The proposal is right that no threshold is principled, and offering two-thirds anyway would be an arbitrary ceiling of exactly the kind already refused for the boundary ratio. +> +> But the aggregate is the wrong place to look. The signal is not what fraction of rows reproduced; it is **why** any row failed to. +> +> **Ruled, in two parts.** +> +> **Per row, and this needs no threshold.** A proposed-only row is retained only if it is defended **on the grid alone**, without citing the determination set. A row that can only be defended by pointing at the set is set-fitted and is struck. One such row is a finding regardless of overlap; the reconciliation rule already forbids the citation, and this makes the consequence explicit. +> +> **In aggregate, the overlap sets the list's provenance grade.** Two grades, both usable, recorded on the list and carried into every citation of the result: +> +> | Grade | Condition | +> |---|---| +> | **derived** | every retained row is defended on the grid alone | +> | **authored** | some retained rows survive on author judgement the grid does not reach | +> +> An **authored** list is not disqualifying. It is a weaker provenance, and it changes what the experiment may claim: the frame is then an artefact of this author's reading of the act type, not of a reproducible method, and any downstream reuse of the method inherits that. +> +> This is the same shape as *extracted* versus *originated* in the governance seed and *provisional* versus in-force under CG-R-1. A thing may be in force and weakly warranted, provided the difference is visible. +> +> **What triggers revising the method section** is therefore not a percentage. It is a **derived** grade failing to be achievable — if the grid cannot defend the rows the author believes belong, the grid underdetermines the list, and that is a finding about the method reported before any list is ratified. +> +> --- +> +> ## Carried +> +> - CG-R-36's amendment to §10 correctly recorded rather than applied to the arrived pre-registration. Gate 5 carries it. +> - Register debt: CG-R-17 … CG-R-40. Mine. + +--- + +## Covering message, verbatim + +> On the subagent: no, and the reason is your own admission test. A subagent would be blind by +> instruction, which is a constraint held in prose — and prose does not enforce. That's the +> same rule that failed event modelling on PR-1. Independence guaranteed by the author's +> instruction is precisely what CG-R-35 was ruled against. +> +> The honest part: a subagent result wouldn't be worthless, it just couldn't be cited as +> independent, which is the only property it was wanted for. So it costs a session to get it +> and nothing to skip it. +> +> On the threshold: no number. Two-thirds would be an arbitrary ceiling of the same kind +> already refused for the boundary ratio, and the aggregate is the wrong place to look anyway. +> +> The per-row rule needs no threshold: a proposed-only row is retained only if defended on the +> grid alone. One row that can only be defended by pointing at the set is a finding regardless +> of overlap. +> +> The aggregate then sets the list's provenance grade rather than its ratification — derived if +> every retained row is defended on the grid alone, authored if some survive on judgement the +> grid doesn't reach. An authored list is usable, weakly warranted, and changes what the +> experiment may claim: the frame becomes an artefact of one author's reading rather than of a +> reproducible method. +> +> Same shape as extracted/originated and provisional/in-force. A thing can be in force and +> weakly warranted as long as the difference is visible. +> +> What would trigger revising the method section isn't a percentage — it's a derived grade +> being unachievable. If the grid can't defend rows you believe belong, the grid +> underdetermines the list, and that's a finding about the method worth more than a ratified +> list. + +--- + +## Consequences carried forward by this session + +| Ruling | What it settles | What this session does | +|---|---|---| +| `CG-R-39` | No subagent. The re-derivation is a separate session, separate context, bundle only. Blindness by instruction is a constraint held in prose, and prose does not enforce | Nothing is run here. The bundle stands as filed; its launch is Emil's | +| `CG-R-40` | No numeric threshold. **Per row:** a proposed-only row is retained only if defended on the grid alone; one row defensible only by the set is a finding regardless of overlap. **In aggregate:** the overlap sets the list's **provenance grade** — *derived* if every retained row is defended on the grid alone, *authored* if any survives on judgement the grid does not reach — recorded on the list and carried into every citation. The method section is revised only if a derived grade is unachievable | The offered threshold in `rederivation-reconciliation-rule.md` §4 is **refused**; the file is not rewritten — a note is appended to it recording the refusal and the grade rule. The reconciliation, when it runs, assigns the grade and states it | + +**On the framing channel.** `CG-R-39`'s second reason — that a subagent inherits this session's +framing, and framing is how a list gets fitted without intent — applies to the brief as well. +The brief was written by this session and carries its framing of the act type in §3 and of the +grid in §4.2. That is unavoidable, since the grid is the thing being tested for whether it +carries the list; it is recorded here so the reconciliation reads the re-derivation's rows +against the grid and not against the brief's phrasing of it. From 0c41d0d7a0fb0d1bb4fe89923c44bafd782f9d38 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 4 Sep 2026 12:31:52 +0000 Subject: [PATCH 11/19] Record the scrub-and-package task and its ruling basis before the first act MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A bounded task inside the CG-R-35 hold: the bundle's folder name and contents disclose the design to the receiving session, which is the framing channel CG-R-39 named. Three gates — audit, apply, package — each holding for ratification. Gate 2 remains held. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../arrived-inputs.md | 6 ++ .../inputs/task-scrub-and-package-bundle.md | 83 +++++++++++++++++++ .../task-scrub-bundle.md | 30 +++++++ 3 files changed, 119 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/task-scrub-and-package-bundle.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/task-scrub-bundle.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md index 03874c4..5f0e85e 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md @@ -82,3 +82,9 @@ Appended, not rewritten (`CG-rule-02`). | File | sha256 | Lines | Status | |---|---|---|---| | `inputs/rulings-cg-r-39-40.md` | `e85c32509831353a9d06e10956c414c1b957bc59abca497dda408a1b08ddfa0d` | 47 | **rulings, issued** — `CG-R-39`, `CG-R-40`, by Emil, 2026-09-03, accepting the bundle and the reconciliation rule. Filed byte-identical; quoted with consequences in `rulings-rederivation.md`. Not yet register rows | + +## Addendum, 2026-09-04 — the scrub task arrived + +| File | sha256 | Lines | Status | +|---|---|---|---| +| `inputs/task-scrub-and-package-bundle.md` | `7784cadc977f0c61fe98fcb9b4df56aded5f7ad2cfbd62a1810b28a2fc526b98` | 83 | **task**, issued by Emil — a bounded task inside the `CG-R-35` hold; recorded in `task-scrub-bundle.md` before the first act | diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/task-scrub-and-package-bundle.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/task-scrub-and-package-bundle.md new file mode 100644 index 0000000..29ccab9 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/task-scrub-and-package-bundle.md @@ -0,0 +1,83 @@ +# Session task: scrub and package the category derivation bundle + +**For the held notation falsifier session on `claude/notation-falsifier-prereg-b590ym`.** A bounded task inside the existing hold, not a new gate. Gate 2 remains held pending CG-R-35. + +**Record this task and its ruling basis in the session log before the first act.** + +--- + +## Why + +The bundle prepared for CG-R-35 is filed as `blind-rederivation/`. That folder name discloses the design: *re-derivation* implies a prior derivation, and one step gets a competent reader to what it is being compared against. CG-R-39 named the framing channel; this is that channel left open in a path. + +The receiving session must be able to derive a category list without learning that its list will be compared, or that a proposed list exists. If it knows, it will produce what it infers is wanted, which is the fitting CG-R-35 exists to detect arriving from the other side. + +## Standing rules + +As in force for this session. In particular: supersession never rewrites, errors are corrected by appended note, you propose and Emil ratifies, and each output names its weakest point. + +**The rename is a change, not a rewrite.** Use `git mv` so the old path stays in history. Do not force-push and do not rewrite the commits that filed the bundle. + +## Prohibitions + +- **Do not modify the proposed category list, the Gate 1 determination set, or the reconciliation rule.** This task touches the bundle only. +- **Do not weaken the brief while scrubbing.** A scrub that would change what the derivation is asked to do is reported, not performed. See Gate B. +- **The scrub record does not go in the bundle.** It enumerates the leaking terms, so filing it inside would reintroduce every leak it documents. It goes in the session directory. +- Do not hand the receiving session repository access. See Gate C. + +--- + +## Gate A — leak audit + +Enumerate, do not fix. + +Search the bundle — every file, plus path names, the manifest, and any header or provenance line — for anything that would let a reader infer the purpose. At minimum: + +| Class | Terms | +|---|---| +| the comparison | blind, re-deriv, reconcil, independent, compare, overlap, proposed list, set-fitted, grade | +| the experiment | falsifier, arm, inference, notation, experiment, measure, denominator | +| **the frame** | frame, category list as a measured object, anything implying the list is counted against something | +| the act | the Gate 1 act instance, every determination identifier, the eleven determinations | +| provenance | session names, gate numbers, ruling identifiers, branch names | + +**The frame row is the one to search hardest.** If the brief describes the output as a frame, the receiving session knows there is a measure and will reason about what makes a good denominator rather than what makes a category. + +For each hit: the file, the location, the term, and **what a reader could infer from it**. A term that leaks nothing in context is reported as a hit and marked as such rather than silently passed over. + +Report the count of files searched as well as the count of hits, so a search that missed a file is visible. + +**Hold.** + +--- + +## Gate B — apply + +On ratification of the audit: + +1. `git mv blind-rederivation/ command-slice-categories/` — or a better neutral name, proposed at Gate A. +2. Apply each ratified substitution. **Neutral wording that preserves meaning, never deletion**, unless deletion is ratified for a specific hit. +3. Where a substitution would change what the derivation is asked to do — the grid, the four admission conditions, the naming rules, the output form — **do not perform it**. Report it, and state what the receiving session will therefore be able to infer. A brief scrubbed into something that asks a different question is worse than a brief that leaks, because the leak is visible and the change is not. +4. Regenerate the manifest with fresh hashes over the scrubbed files. +5. Add `INVOCATION.md` to the bundle, from the arrived invocation file, so the receiving session's instruction set and its brief are filed together and their consistency is checkable. +6. File the **scrub record in the session directory, outside the bundle**: every substitution as before-and-after, every hit not substituted with its reason, the old and new manifests, and the old folder name. + +**Hold.** + +--- + +## Gate C — package and open the PR + +1. Produce a distributable copy of `command-slice-categories/` — an archive — with its sha256 recorded in the session log. **This is what gets handed over.** The receiving session works from the archive: no clone, no branch, no repository access, per CG-R-39. +2. Open a PR from this branch. Its description states: what the bundle is for in terms safe to read publicly, the scrub record's location, both manifests, and that the bundle is handed over as an archive rather than cloned. +3. State plainly in the PR that **the PR is the provenance record, not the delivery mechanism**. Anyone reading the PR can see the whole design; the receiving session sees only the archive. + +**Hold.** Then return to the CG-R-35 hold. + +--- + +## Carried + +- The rename does not discharge CG-R-39's framing observation. The brief remains this session's phrasing of a grid that is itself under test, and the reconciliation reads the re-derived rows against the grid rather than against the brief's wording of it. +- If Gate B reports a substitution refused under rule 3, that inference is a stated limit on the re-derivation's independence and belongs in the reconciliation, not only in the scrub record. +- Register debt CG-R-17 … CG-R-40 is unaffected and remains outstanding. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/task-scrub-bundle.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/task-scrub-bundle.md new file mode 100644 index 0000000..9783031 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/task-scrub-bundle.md @@ -0,0 +1,30 @@ +# Task record — scrub and package the category derivation bundle + +**Recorded before the first act, 2026-09-04.** A bounded task inside the `CG-R-35` hold, not a +new gate; Gate 2 remains held. Issued by Emil as `task-scrub-and-package-bundle.md`, sha256 +`7784cadc977f0c61fe98fcb9b4df56aded5f7ad2cfbd62a1810b28a2fc526b98`, 83 lines, filed byte-identical under `inputs/`. + +## Ruling basis + +- **`CG-R-35`** — the list is confirmed by blind re-derivation; the receiving session gets the + grid, the act type and the admission conditions and nothing else. +- **`CG-R-39`** — a subagent does not count, and the **framing channel** is named: framing is how + a list gets fitted without anyone intending it. This task is that channel found open in a + path name: `blind-rederivation/` says there is a prior derivation and a comparison. +- **`CG-rule-02`** — the rename is a change, not a rewrite: `git mv`, no force-push, the filing + commits stand. +- **`CG-rule-09`** — the leak is an error of this session's, attributed here: the bundle was + built to exclude the set and the list and was named after the design it was built to hide. + +## Gates + +| Gate | Act | Holds for | +|---|---|---| +| A | leak audit — enumerate every hit with what a reader could infer; fix nothing; propose a neutral folder name | ratification of the audit and the name | +| B | `git mv`; apply ratified substitutions, neutral wording never deletion; refuse any that would change what the derivation asks; regenerate the manifest; add `INVOCATION.md`; file the scrub record outside the bundle | ratification | +| C | archive with sha256 in the session log; open the PR as provenance record, not delivery | ratification; then back to the `CG-R-35` hold | + +## Prohibitions carried + +The proposed list, the Gate 1 set and the reconciliation rule are not touched. The scrub record +never enters the bundle. The receiving session gets an archive, never repository access. From 618a2e233cfc7df08ad375c6e3397e72a13c470c Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 4 Sep 2026 12:34:50 +0000 Subject: [PATCH 12/19] Gate A: leak audit of the category derivation bundle; hold MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Seven files and one path searched with forty patterns across the task's five term classes, then the brief read in full. Thirty-eight hits, each with what a reader could infer and a proposed disposition: fourteen substitutions, two deletions requiring ratification, nineteen left and reported, three needing a ruling — the supersession record's statement that the construct list is the falsifier's derivation source, its open bullet naming per-act category coverage as the falsifier's predicate, and the schema's $id pointing at the GitHub owner. Nothing is changed. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../gateA-leak-audit.md | 138 ++++++++++++++++++ 1 file changed, 138 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/gateA-leak-audit.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/gateA-leak-audit.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/gateA-leak-audit.md new file mode 100644 index 0000000..ae9786e --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/gateA-leak-audit.md @@ -0,0 +1,138 @@ +# Gate A — leak audit of the category derivation bundle + +**Enumerates; fixes nothing.** Every hit carries the file, the location, the term, what a +reader could infer from it, and a proposed disposition for Gate B. Hits that leak nothing in +context are listed and marked so. Dispositions are proposals; Emil ratifies each. + +**Searched:** 7 files (`README.md`, `MANIFEST.md`, `foundation.md`, +`supersession-foundation-construct-list.md`, `resolution-condition.md`, +`boundary-declarations.md`, `determination.schema.json`) plus 1 path name — every object in the +bundle. Method: the task's five term classes expanded to 40 case-insensitive patterns run over +every file, then a full read of the brief and the manifest for prose-level leaks the patterns +cannot see. The four canon documents were read for context around each pattern hit, not +re-read in full; their §1–§3 construct sections are the derivation source and carry no hit. + +**Hits: 38.** By disposition: substitute 14 · delete, ratification required 2 · leave and +report 19 · **rule needed 3** (SS-1, SS-3, SC-3 — the three that matter most). + +--- + +## 1. Path + +| Id | Location | Term | What a reader could infer | Disposition | +|---|---|---|---|---| +| P-1 | directory `blind-rederivation/` | *blind*, *re-derivation* | a prior derivation exists and this one is kept from seeing it; therefore a comparison; therefore the list will be judged against another | **rename** to `command-slice-categories/` — names the deliverable, not the process. Alternatives considered: `category-derivation/` (names the method, harmless, but *derivation* is the brief's own word and gains nothing), `act-type-categories/` (drops the act type, which the receiving session needs anyway). The task's suggestion is the best of the three | + +## 2. `README.md` — the brief + +The brief is where the leaks are, because it was written knowing the design. Line numbers are +the filed copy's. + +| Id | Line | Term | What a reader could infer | Disposition | +|---|---|---|---|---| +| R-1 | 1 | *Blind re-derivation brief* | as P-1 | substitute: *Brief — consequential-property categories for a command slice* | +| R-2 | 3–4 | *performing the re-derivation ruled at `CG-R-35`* | a re-derivation; a ruling series with a numbered authority; thirty-five rulings means a mature programme; the identifier is searchable | substitute: *You are producing a category list by a stated method and stopping.* | +| R-3 | 4–7 | *must not try to learn what any other session derived, what act instance is under test, or what determinations it carries* | **the largest leak in the brief**: another session derived a list; an act instance is under test; a determination set exists for it. Names all three hidden objects in one sentence | substitute, preserving the stop-and-report behaviour without naming what is hidden: *Work from this bundle only; it is complete. If anything you are given or find goes beyond it, stop and report it rather than reading on.* | +| R-4 | 9 | *Emil ratifies* | a named principal; a reader who knows the programme identifies it | substitute: *the principal who issued this brief ratifies*. Leaks little on its own and the invocation will carry the name anyway; listed for the ruling | +| R-5 | 9–10 | *Commit identity, if you commit at all, is `Claude `* | the programme's convention; the actor kind | **delete, ratification required**: under Gate C the receiving session has no repository and never commits, so the sentence is moot; neutral wording has nothing to preserve | +| R-6 | 10–11 | *if you have repository access, use nothing outside this directory* | a repository exists holding more | substitute, merged into R-3's replacement (*work from this bundle only*) | +| R-7 | 21 | output filename `rederived-category-list.md` | as P-1 | substitute: `category-list.md` | +| R-8 | 30 | *No experiment design, no measure* | an experiment exists and has a measure; the list is an input to it | substitute: *Nothing else. No discussion of what the list is for beyond what §2 says.* — the prohibition's work is done by *nothing else* | +| R-9 | 35–39 | §2: *a specification either settles such a point by a determination, or declares it unsettled* | that category lists are held against specifications for what they settle — the foundation's own stated purpose (§1, §2.7), not this experiment's; does not say counted, frame, or measure | **leave and report.** This is the concept of a category as the source states it; removing it changes the question. Frame-class, searched hardest, found not to leak the measure | +| R-10 | 105–106 | *that is acceptable and is handled after your work, not by you* | the list is processed downstream against an instance — an instantiated, measured object. Frame-class | substitute: *that is acceptable — do not split a kind into instances.* Preserves the rule, removes the downstream hint | +| R-11 | 134–136 | *any act instance, event model, example determination, or other session's list. The enclosed schema's one example name is not an instance under test* | as R-3: an instance under test; another session's list. The second sentence draws attention to the schema's example name and thereby to the existence of a real instance | substitute: *Do not reason from any particular act, event model or example determination; the list is for the act type. The enclosed schema's one example name is illustrative and says nothing about any domain.* | +| R-12 | 138 | *Do not design the experiment, the measure, thresholds, or a rubric* | the whole design shape in one line: experiment, measure, thresholds, rubric | substitute: *Do not produce anything beyond §1's four items.* (or **delete**, ratification required; the substitution is preferred because the constraint survives) | +| R-13 | 139–140 | *Do not tune the list … to any expectation* | an expectation exists somewhere. Mild; the instruction is protective | leave and report; the residual inference is only that someone will read the list, which the brief cannot hide | +| R-14 | 24–28, 118–120 | *rejection register*, *invented … at the point of invention*, *weakest point* | the programme's idiom; a reader who knows it recognises it. Method content, not design content | leave and report — these are the method, and the method is what the receiving session must be given | +| R-15 | 79–87, 148 | *S-1*, *S-2*, *supersession* | identifiers internal to the enclosed canon; they name what the enclosed document names | leave and report — leaks nothing beyond the enclosure | +| R-16 | 18 | *the domain-state-change binding* | the binding's name; the binding may be discoverable | leave — the act type cannot be stated without it; see SC-3 for the discoverability path | + +## 3. `MANIFEST.md` + +| Id | Line | Term | Inference | Disposition | +|---|---|---|---|---| +| M-1 | 1 | *blind re-derivation bundle* | as P-1 | substitute: *Manifest — command-slice categories bundle* | +| M-2 | 3 | *The re-deriving session* | as P-1 | substitute: *The receiving session* | +| M-3 | 3 | *as filed on 2026-09-04* | a date; provenance, harmless | leave and report | +| M-4 | 6–12 | hashes | will be stale after Gate B | regenerate over the scrubbed files (task step B.4); old and new manifests go in the scrub record | + +## 4. `foundation.md` — canon, original state + +**Required in its original state**: the derivation needs it as written, and every substitution +here produces a copy that is not the canon. Dispositions weigh that. + +| Id | Line | Term | Inference | Disposition | +|---|---|---|---|---| +| F-1 | 3 | *No falsifiers attached to the design constraints below* | the framework attaches falsifiers to claims — a falsification programme exists. Nothing about this list's use | leave and report: the framework's vocabulary, in a status header; does not reach the comparison, the measure, or the proposed list | +| F-2 | 139 | §5.1 *Falsifier for the closure requirement … measurably fewer escaped decisions* | a falsifier of the closure claim is planned, measuring escaped decisions — the **layer** claim's shape, not this experiment's. With SS-1 a reader could connect the category list to a falsifier | leave and report, **or** withhold the bullet with a visible marker — ruling. Recommendation: leave; the inference is to the wrong experiment, and a withheld bullet in an *Open* section signals that something is hidden without hiding it | +| F-3 | 34, 85, 140 | *independent* | none — used in the mathematical or evidential sense | listed as hits; leak nothing | +| F-4 | 121 | *measurement* | none — a property of quantitative constructs | leak nothing | +| F-5 | §1 | *universal quantification over acts, evaluated against declared extent* | that a per-act completeness check is the foundation's design driver — which is why the original state is enclosed | leave; this is the source, not a leak | + +## 5. `supersession-foundation-construct-list.md` — canon, superseding state + +| Id | Line | Term | Inference | Disposition | +|---|---|---|---|---| +| **SS-1** | 5 | *The construct list is the derivation source for **the falsifier's category list**. Any session deriving from it must see both … states* | **the highest-value leak in the bundle.** The reader learns that a category list derived from these documents is a falsifier's instrument, and that a session deriving one is anticipated — so their list has a role in a test. It does not reveal a prior list or a comparison. Frame-class by implication: a falsifier's category list is something counted against | **rule needed.** Two options. (a) Substitute the four words: *the derivation source for **category lists drawn from it***, keeping the both-states instruction intact — a minimal rewording of a canon copy. (b) Withhold line 5 with a visible marker. Recommendation: (a), with the scrub record carrying before-and-after, and the manifest noting that enclosed canon copies are for derivation and may differ from the filed originals in their headers. Whether a canon copy may be reworded at all is the principal's call, not the session's | +| SS-2 | 3 | *neither has a falsifier attached* | as F-1 | leave and report | +| **SS-3** | 75 | *The **falsifier's** completeness predicate is per-act category coverage, not the resolution condition … blocks the amended **pre-registration*** | the falsifier's predicate is *per-act category coverage*: the list is a coverage denominator. A pre-registration exists and is being amended. Frame-class, direct | **rule needed.** (a) Substitute: *A per-act category-coverage predicate is not the resolution condition. These are not the same predicate, and which one a given test should use is unresolved.* — rewords an *Open* bullet of a canon copy and drops the pre-registration clause. (b) Withhold the bullet with a marker. (c) Leave: the original foundation §1 already states per-act coverage as the design driver, so the concept is not new to the reader; what is new is *the falsifier's* and *pre-registration*. Recommendation: (a) | +| SS-4 | 42 | *a later session framing proposed* | sessions exist; harmless | leave and report | +| SS-5 | 69 | *overlap* | none — set-theoretic sense | leaks nothing | +| SS-6 | 73 | *Closed by R-3*, *Layer 1* | a ruling series exists; the programme has layers | leave and report — canon's own cross-references; same for RC-4 and BD-2 | + +## 6. `resolution-condition.md` — canon + +| Id | Line | Term | Inference | Disposition | +|---|---|---|---|---| +| RC-1 | 3 | *Falsifier deferred per R-1: this condition is not what the current closure **pre-registration** tests* | a closure pre-registration exists and tests something other than this condition — the layer claim again | leave and report; recommendation as F-2. If SS-1 and SS-3 are substituted, this is the strongest remaining pointer to a pre-registration programme, and it points at the other one | +| RC-2 | 56 | *No falsifier. The candidate … requires two conforming specifications* | as F-1 | leave and report | +| RC-3 | 37 | *consequential properties* | the term the brief uses — this is its source | leave; needed | +| RC-4 | 27–28 | *per R-2* | as SS-6 | leave and report | + +## 7. `boundary-declarations.md` — canon + +| Id | Line | Term | Inference | Disposition | +|---|---|---|---|---| +| BD-1 | 79 | *No falsifier attached … a different claim from the one the current **pre-registration** tests* | as RC-1 | leave and report; same recommendation | +| BD-2 | 56 | *Closed by R-4* | as SS-6 | leave and report | +| BD-3 | 69, 71 | *measure*, *a measure into a target* | none — about the boundary ratio, and the ceiling refused for it | leaks nothing | + +## 8. `determination.schema.json` + +| Id | Line | Term | Inference | Disposition | +|---|---|---|---|---| +| SC-1 | 24 | *e.g. PlaceOrder* | the binding's worked example name. Not the act under test; a reader who finds the binding recognises it | leave and report. The leak was the brief's sentence pointing at it (R-11), not the schema | +| SC-2 | 140 | *the notation records which was established* | the binding is called a notation; no inference toward the notation claim | leaks nothing | +| **SC-3** | 3 | `$id` = `https://github.com/Hafeok/specification-languages/domain-state-change/…` | **a pointer out of the bundle**: the GitHub owner. If that owner's repositories are public, one click reaches `specification-foundation`, this branch, the set, the list, and the whole design. The brief's *read nothing outside this directory* is then a constraint held in prose — `CG-R-39`'s point exactly | **rule needed**, on a fact the session cannot check: the repositories' visibility. If public, substitute the `$id` with a neutral URN (`urn:domain-state-change:determination-schema`) — metadata only, enforcement unchanged, hash changes and is recorded. If private, leave and report. Recommendation: substitute regardless; the pointer does no work in the derivation | +| SC-4 | 6, 11, 78, 129, 229 | *PR-1 … DP-5*, *SR-1* | the conformance criterion's requirement identifiers; a reader learns a criterion exists | leave and report — the schema's own comments, and the corroboration rule in §4.2 reads them | + +## 9. What the audit did not find + +No hit for *frame*, *denominator*, *arm*, *inference*, *counted*, *compare*, *grade*, +*set-fitted*, *proposed list*, any `AC-` or `F-` identifier, the Gate 1 act, or any +determination of the set. The bundle was built to exclude the set and the list and does; what +it failed to exclude is the design around them, in the brief, the path, and the canon's own +status lines. + +## 10. Two things Gate B needs that the session does not have + +- **Task step B.5, `INVOCATION.md` "from the arrived invocation file".** No invocation for the + receiving session has arrived. It is Emil's to write; the session files it when it arrives + and checks it against the scrubbed brief for consistency, per the step's purpose. +- **SC-3 needs the repositories' visibility**, or the ruling to substitute regardless. + +## 11. Weakest point + +**The canon copies.** Three of the strongest hits (SS-1, SS-3, RC-1) are in canon documents the +derivation needs in their filed state. Every substitution there hands the receiving session a +text that is not the canon, and every withholding tells it something is hidden. The audit +recommends minimal substitution at SS-1 and SS-3 and leaving the rest, which means the +receiving session will still be able to infer that a falsification programme exists and that a +pre-registration tests the closure claim. That is the layer claim, not this one; it is a real +inference and it is reported here as the residual the scrub cannot remove without changing the +source. + +--- + +**Hold.** Gate B is not entered. Awaiting ratification of the audit, the folder name, and +rulings on SS-1, SS-3 and SC-3. From dac60719f5c41a8b4aa1814206801780a7fc0c01 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 7 Sep 2026 06:59:50 +0000 Subject: [PATCH 13/19] Record the Gate A rulings CG-R-41..44 and the receiving session's invocation Canon copies are extracted, never substituted (CG-R-41); the organisation is public, so the schema is dropped if the grid does not cite it (CG-R-42); the residual inference is accepted, recorded and not relied upon (CG-R-43); the invocation is filed unscrubbed (CG-R-44). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../arrived-inputs.md | 7 ++ .../inputs/invocation-category-derivation.md | 35 ++++++ .../inputs/rulings-cg-r-41-44.md | 61 ++++++++++ .../rulings-gateA.md | 105 ++++++++++++++++++ 4 files changed, 208 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/invocation-category-derivation.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-41-44.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gateA.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md index 5f0e85e..a6f88eb 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md @@ -88,3 +88,10 @@ Appended, not rewritten (`CG-rule-02`). | File | sha256 | Lines | Status | |---|---|---|---| | `inputs/task-scrub-and-package-bundle.md` | `7784cadc977f0c61fe98fcb9b4df56aded5f7ad2cfbd62a1810b28a2fc526b98` | 83 | **task**, issued by Emil — a bounded task inside the `CG-R-35` hold; recorded in `task-scrub-bundle.md` before the first act | + +## Addendum, 2026-09-07 — Gate A rulings and the receiving session's invocation arrived + +| File | sha256 | Lines | Status | +|---|---|---|---| +| `inputs/rulings-cg-r-41-44.md` | `00402d71bf94218e1e74fbf7b0d87f95c90e203db00d1f631ab89f75c6de84a5` | 61 | **rulings, issued** — `CG-R-41` … `CG-R-44`, by Emil, 2026-09-03, ratifying the leak audit. Quoted with consequences in `rulings-gateA.md`. Not yet register rows | +| `inputs/invocation-category-derivation.md` | `424e53963e2fce9eb55e7b6b5858a3d3480ef3ae34f53b48c8fbdf1084af977d` | 35 | the receiving session's invocation, Emil's; filed into the bundle byte-identical as `INVOCATION.md` per `CG-R-44`, unscrubbed | diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/invocation-category-derivation.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/invocation-category-derivation.md new file mode 100644 index 0000000..81e4ab1 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/invocation-category-derivation.md @@ -0,0 +1,35 @@ +# Invocation — command-slice category derivation + +**Paste the text below the line, with the bundle attached. Nothing else.** + +Read the pre-flight note first. Do not paste any part of it. + +--- + +Derive the consequential-property categories for a **command slice**. + +Attached is a bundle containing the brief, the constructs the categories are drawn from, and a manifest with hashes. Read the brief first; it is the instruction set and it carries the derivation grid, the admission conditions, the naming rules and the output form. Where anything below conflicts with the brief, the brief wins and you say so. + +**Work from the bundle only.** Do not clone or read any repository, and do not search the web. Everything the derivation needs is in the bundle; anything not in it is out of scope by design. + +**What to produce.** One file: the category list, in the output form the brief specifies, with each row citing the grid cell it came from. Alongside it, a rejection register — every candidate the grid produced that you did not admit, with the admission condition it failed. The rejection register is not optional and is not a summary: it is how the pruning gets checked rather than trusted. + +**Standing rules.** + +- You propose. You do not ratify your own output, and nothing you produce is settled by your having produced it. +- Keep three registers distinct in your output: what is settled, what is `[PROPOSED]`, what is `[OPEN]`. +- British spelling. +- Errors are corrected by an appended note, never by amendment. A wrong figure stays visible with its correction beside it. +- Report defects honestly, including in the brief and in your own earlier reasoning. +- Name the weakest point of what you produce, rather than leaving it for a reader to find. +- Prose describes what you have actually done. Anything you considered and did not do is marked as such. + +**Two rules on the derivation itself.** + +Apply the grid exhaustively before pruning. Produce every candidate the grid yields, then admit or reject each against the conditions. A candidate never generated cannot be rejected on the record, and the register is the only evidence the pruning was disciplined. + +Each row must stand as a decision point for a command slice **about anything** — any domain, any system. A row that only makes sense for a particular kind of command is out of scope for this list, and saying so is a finding rather than a failure. + +**Do not ask what this is for.** The brief contains what you need. If the brief is insufficient, say precisely what is missing and stop; do not fill the gap by inference about intent. + +Produce the file, state your weakest point, and stop. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-41-44.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-41-44.md new file mode 100644 index 0000000..297782e --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-41-44.md @@ -0,0 +1,61 @@ +# Rulings CG-R-41 … CG-R-44 — Gate A leak audit + +**Issued by Emil, 2026-09-03.** The audit is ratified. The fourteen substitutions, the two deletions and the nineteen leave-and-report dispositions are accepted as proposed. `command-slice-categories/` is accepted. + +--- + +## CG-R-41 — Canon copies are extracted, never substituted + +SS-1 and SS-3 sit in a canon copy the derivation needs. The two options offered were substitute or withhold, and both are wrong for the same reason. + +**Substituting inside a canon copy produces a document that looks like canon and is not.** In a programme whose discipline is byte-identical filing and supersession-never-rewrites, a doctored canon text in circulation is a worse artefact than the leak it repairs. Withholding signals concealment and removes something the derivation needs. + +**Ruled: extract.** The bundle carries an **extract** of the supersession record, not a copy — the construct content the derivation requires, with a provenance line naming the source document, its sha256, and the section range extracted. + +This drops SS-1 and SS-3 without altering a word: both are purpose and open-item lines, which are metadata about why the record exists rather than construct content. If the derivation needs both construct-list states, the extract carries both. + +What the receiving session sees is that it was given an extract. That is ordinary and uninformative — being handed the relevant part of a document is unremarkable, and it discloses far less than either a modified text or a missing one. + +**This generalises.** No canon document is modified for a bundle, ever. Extract with provenance, or hand it over whole and accept the leak. + +--- + +## CG-R-42 — SC-3: prefer dropping the schema; substitute only if the grid cites it + +**The visibility fact you asked for: the organisation is public.** Two of its repositories were confirmed publicly readable during the governance seed, and a third was fetched over the open web during this programme. Treat the pointer as reaching a public org, and the brief's do-not-read as a constraint held in prose, which does not enforce. + +**Ruled, in preference order:** + +1. **If the grid does not cite the schema, drop it.** No substitution, no leak, no modified artefact. Check whether the derivation actually needs it before doing anything else — the categories are drawn from the constructs, and the schema may be redundant. +2. **If the grid cites it**, substitute the `$id` with a neutral URN, and add a header line in the bundled copy stating that it is a modified copy with a URL neutralised, carrying the original's sha256. Record both hashes in the scrub record. + +The header is not optional. A silently altered schema is the same defect as a doctored canon copy, one register down. "A URL was neutralised" is routine and discloses nothing worth having. + +--- + +## CG-R-43 — The residual inference is accepted, recorded, and not relied upon + +The weakest point is correctly stated. With the ratified changes the receiving session can still infer that a falsification programme exists and that a pre-registration tests a closure claim. + +**Ruled: accepted as residual.** It is not removable without changing the source, and changing the source is refused under CG-R-41. + +Two things about it, both to be recorded rather than assumed: + +**It mis-points, and that is not protection.** The inference reaches the layer claim rather than this one, which is mildly favourable and must not be treated as a safeguard. A session that infers *some* falsification programme may still reason about what makes a defensible list rather than a derived one, and that is the fitting channel regardless of which claim it thinks it is serving. + +**It belongs in the reconciliation, not only in the scrub record.** A stated limit on the re-derivation's independence is an input to grading the list, and the reconciliation reads it alongside CG-R-39's framing residual. + +--- + +## CG-R-44 — The invocation is supplied and is filed as arrived + +`invocation-category-derivation.md` is the arrived file for step B.5. It is filed into the bundle byte-identical with its sha256, as arrived, and is not scrubbed — it was written for this purpose and carries no design vocabulary. + +**Two notes for the scrub record.** Its prohibition on cloning and web search is prose and does not enforce; the enforcement is that the receiving session is given an archive and no repository access, per CG-R-39. And its instruction not to ask what the task is for is likewise prose, and the session may ask anyway — if it does, that is reported in the reconciliation as an observation about what the bundle disclosed, not answered. + +--- + +## Carried + +- Gate B proceeds on these rulings. If any substitution would change the grid, the admission conditions, the naming rules or the output form, it is refused under the task's rule 3 and reported. +- Register debt: CG-R-17 … CG-R-44. Mine. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gateA.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gateA.md new file mode 100644 index 0000000..7c4a3f4 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gateA.md @@ -0,0 +1,105 @@ +# Rulings — Gate A (leak audit) + +**Issued by Emil, 2026-09-03, ratifying the audit.** Four rulings, `CG-R-41` … `CG-R-44`, filed +verbatim below the rule. Arrived as `rulings-cg-r-41-44.md`, sha256 `00402d71bf94218e1e74fbf7b0d87f95c90e203db00d1f631ab89f75c6de84a5`, 61 lines, with the +receiving session's invocation `invocation-category-derivation.md`, sha256 `424e53963e2fce9eb55e7b6b5858a3d3480ef3ae34f53b48c8fbdf1084af977d`, 35 lines; +both filed byte-identical under `inputs/`. The covering message is quoted at the end. + +--- + +> +> ## CG-R-41 — Canon copies are extracted, never substituted +> +> SS-1 and SS-3 sit in a canon copy the derivation needs. The two options offered were substitute or withhold, and both are wrong for the same reason. +> +> **Substituting inside a canon copy produces a document that looks like canon and is not.** In a programme whose discipline is byte-identical filing and supersession-never-rewrites, a doctored canon text in circulation is a worse artefact than the leak it repairs. Withholding signals concealment and removes something the derivation needs. +> +> **Ruled: extract.** The bundle carries an **extract** of the supersession record, not a copy — the construct content the derivation requires, with a provenance line naming the source document, its sha256, and the section range extracted. +> +> This drops SS-1 and SS-3 without altering a word: both are purpose and open-item lines, which are metadata about why the record exists rather than construct content. If the derivation needs both construct-list states, the extract carries both. +> +> What the receiving session sees is that it was given an extract. That is ordinary and uninformative — being handed the relevant part of a document is unremarkable, and it discloses far less than either a modified text or a missing one. +> +> **This generalises.** No canon document is modified for a bundle, ever. Extract with provenance, or hand it over whole and accept the leak. +> +> --- +> +> ## CG-R-42 — SC-3: prefer dropping the schema; substitute only if the grid cites it +> +> **The visibility fact you asked for: the organisation is public.** Two of its repositories were confirmed publicly readable during the governance seed, and a third was fetched over the open web during this programme. Treat the pointer as reaching a public org, and the brief's do-not-read as a constraint held in prose, which does not enforce. +> +> **Ruled, in preference order:** +> +> 1. **If the grid does not cite the schema, drop it.** No substitution, no leak, no modified artefact. Check whether the derivation actually needs it before doing anything else — the categories are drawn from the constructs, and the schema may be redundant. +> 2. **If the grid cites it**, substitute the `$id` with a neutral URN, and add a header line in the bundled copy stating that it is a modified copy with a URL neutralised, carrying the original's sha256. Record both hashes in the scrub record. +> +> The header is not optional. A silently altered schema is the same defect as a doctored canon copy, one register down. "A URL was neutralised" is routine and discloses nothing worth having. +> +> --- +> +> ## CG-R-43 — The residual inference is accepted, recorded, and not relied upon +> +> The weakest point is correctly stated. With the ratified changes the receiving session can still infer that a falsification programme exists and that a pre-registration tests a closure claim. +> +> **Ruled: accepted as residual.** It is not removable without changing the source, and changing the source is refused under CG-R-41. +> +> Two things about it, both to be recorded rather than assumed: +> +> **It mis-points, and that is not protection.** The inference reaches the layer claim rather than this one, which is mildly favourable and must not be treated as a safeguard. A session that infers *some* falsification programme may still reason about what makes a defensible list rather than a derived one, and that is the fitting channel regardless of which claim it thinks it is serving. +> +> **It belongs in the reconciliation, not only in the scrub record.** A stated limit on the re-derivation's independence is an input to grading the list, and the reconciliation reads it alongside CG-R-39's framing residual. +> +> --- +> +> ## CG-R-44 — The invocation is supplied and is filed as arrived +> +> `invocation-category-derivation.md` is the arrived file for step B.5. It is filed into the bundle byte-identical with its sha256, as arrived, and is not scrubbed — it was written for this purpose and carries no design vocabulary. +> +> **Two notes for the scrub record.** Its prohibition on cloning and web search is prose and does not enforce; the enforcement is that the receiving session is given an archive and no repository access, per CG-R-39. And its instruction not to ask what the task is for is likewise prose, and the session may ask anyway — if it does, that is reported in the reconciliation as an observation about what the bundle disclosed, not answered. +> +> --- +> +> ## Carried +> +> - Gate B proceeds on these rulings. If any substitution would change the grid, the admission conditions, the naming rules or the output form, it is refused under the task's rule 3 and reported. +> - Register debt: CG-R-17 … CG-R-44. Mine. + +--- + +## Covering message, verbatim + +> SS-1 and SS-3 get a third option: extract, don't substitute. Modifying a canon copy produces +> a document that looks like canon and isn't — in a programme built on byte-identical filing +> and supersession-never-rewrites, a doctored canon text in circulation is worse than the leak +> it repairs. An extract carrying the source document's name, hash and section range drops both +> hits without altering a word, since both are purpose and open-item lines rather than +> construct content. +> +> The receiving session sees that it got an extract. Being handed the relevant part of a +> document is unremarkable and discloses far less than a modified text or a missing one. +> +> The visibility fact for SC-3: the organisation is public. Two repositories were confirmed +> publicly readable during the governance seed, and I fetched a third over the open web in this +> conversation. So the pointer does reach the design, and the brief's do-not-read is prose. +> +> Preference order: drop the schema if the grid doesn't cite it — check that first, since the +> categories come from the constructs and the schema may be redundant. Only substitute if it's +> actually needed, and then say in the file that it's a modified copy. +> +> The invocation is attached for step B.5. It's filed as arrived and not scrubbed. +> +> One thing in CG-R-43 worth holding onto: the residual inference mis-points at the layer claim +> rather than this one, and that is not protection. A session that infers some falsification +> programme may still reason about what makes a defensible list rather than a derived one — the +> fitting channel doesn't care which claim it thinks it's serving. + +--- + +## Consequences applied at Gate B + +| Ruling | What it settles | Applied as | +|---|---|---| +| `CG-R-41` | Canon copies are **extracted, never substituted**; an extract carries the source's name, sha256 and section range; generalises to every bundle | the supersession record is replaced in the bundle by an extract of its construct content (both supersessions' retired position, superseding position, basis and consequence), dropping SS-1 and SS-3 without altering a word | +| `CG-R-42` | The organisation is public; the `$id` reaches the design; **drop the schema if the grid does not cite it**, else neutralise the URL with a header | the grid (Axis A × Axis B) cites the four canon documents and not the schema; the schema's only roles were optional corroboration and the naming vocabulary, which the brief already enumerates. **Dropped.** The brief's two references to it are reworded; recorded in the scrub record as a method-adjacent change with the reasoning | +| `CG-R-43` | The residual inference — a falsification programme exists; a pre-registration tests a closure claim — is accepted, recorded, **not relied upon**; mis-pointing is not protection; it belongs in the reconciliation as a limit on independence | recorded in the scrub record and carried to the reconciliation beside `CG-R-39`'s framing residual | +| `CG-R-44` | The invocation is filed into the bundle byte-identical, unscrubbed; its no-clone, no-search and do-not-ask instructions are prose; a question about purpose, if asked, is reported in the reconciliation, not answered | filed as `INVOCATION.md`; its consistency with the scrubbed brief checked and recorded | From 7ed4950012a174fc0a9d7a760215a7d77f9ad670 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 7 Sep 2026 06:59:50 +0000 Subject: [PATCH 14/19] Gate B: rename blind-rederivation/ to command-slice-categories/ (git mv, history kept) The old name disclosed the design: a re-derivation implies a prior derivation and a comparison. The new name states the deliverable. Nothing inside the directory changes in this commit. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../{blind-rederivation => command-slice-categories}/MANIFEST.md | 0 .../{blind-rederivation => command-slice-categories}/README.md | 0 .../boundary-declarations.md | 0 .../determination.schema.json | 0 .../foundation.md | 0 .../resolution-condition.md | 0 .../supersession-foundation-construct-list.md | 0 7 files changed, 0 insertions(+), 0 deletions(-) rename meta/sessions/2026-09-03-notation-falsifier-prereg/{blind-rederivation => command-slice-categories}/MANIFEST.md (100%) rename meta/sessions/2026-09-03-notation-falsifier-prereg/{blind-rederivation => command-slice-categories}/README.md (100%) rename meta/sessions/2026-09-03-notation-falsifier-prereg/{blind-rederivation => command-slice-categories}/boundary-declarations.md (100%) rename meta/sessions/2026-09-03-notation-falsifier-prereg/{blind-rederivation => command-slice-categories}/determination.schema.json (100%) rename meta/sessions/2026-09-03-notation-falsifier-prereg/{blind-rederivation => command-slice-categories}/foundation.md (100%) rename meta/sessions/2026-09-03-notation-falsifier-prereg/{blind-rederivation => command-slice-categories}/resolution-condition.md (100%) rename meta/sessions/2026-09-03-notation-falsifier-prereg/{blind-rederivation => command-slice-categories}/supersession-foundation-construct-list.md (100%) diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/MANIFEST.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/MANIFEST.md similarity index 100% rename from meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/MANIFEST.md rename to meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/MANIFEST.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/README.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/README.md similarity index 100% rename from meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/README.md rename to meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/README.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/boundary-declarations.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/boundary-declarations.md similarity index 100% rename from meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/boundary-declarations.md rename to meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/boundary-declarations.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/determination.schema.json b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/determination.schema.json similarity index 100% rename from meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/determination.schema.json rename to meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/determination.schema.json diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/foundation.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/foundation.md similarity index 100% rename from meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/foundation.md rename to meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/foundation.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/resolution-condition.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/resolution-condition.md similarity index 100% rename from meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/resolution-condition.md rename to meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/resolution-condition.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/supersession-foundation-construct-list.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/supersession-foundation-construct-list.md similarity index 100% rename from meta/sessions/2026-09-03-notation-falsifier-prereg/blind-rederivation/supersession-foundation-construct-list.md rename to meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/supersession-foundation-construct-list.md From eb33cb71156d862db608caa8dd5ccf436ceade91 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 7 Sep 2026 07:01:45 +0000 Subject: [PATCH 15/19] Gate B: apply the ratified scrub to the bundle Thirteen substitutions in the brief, neutral wording preserving each instruction. The supersession record is replaced by an extract of its construct content with a provenance line (CG-R-41); the schema is dropped because the grid does not cite it (CG-R-42); the receiving session's invocation is filed byte-identical as INVOCATION.md (CG-R-44); the manifest is regenerated over the scrubbed files. Canon copies of the foundation, the resolution condition and the boundary declarations are unchanged. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../command-slice-categories/INVOCATION.md | 35 +++ .../command-slice-categories/MANIFEST.md | 12 +- .../command-slice-categories/README.md | 49 ++-- .../determination.schema.json | 255 ------------------ ...struct-list.md => supersession-extract.md} | 18 +- 5 files changed, 69 insertions(+), 300 deletions(-) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/INVOCATION.md delete mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/determination.schema.json rename meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/{supersession-foundation-construct-list.md => supersession-extract.md} (71%) diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/INVOCATION.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/INVOCATION.md new file mode 100644 index 0000000..81e4ab1 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/INVOCATION.md @@ -0,0 +1,35 @@ +# Invocation — command-slice category derivation + +**Paste the text below the line, with the bundle attached. Nothing else.** + +Read the pre-flight note first. Do not paste any part of it. + +--- + +Derive the consequential-property categories for a **command slice**. + +Attached is a bundle containing the brief, the constructs the categories are drawn from, and a manifest with hashes. Read the brief first; it is the instruction set and it carries the derivation grid, the admission conditions, the naming rules and the output form. Where anything below conflicts with the brief, the brief wins and you say so. + +**Work from the bundle only.** Do not clone or read any repository, and do not search the web. Everything the derivation needs is in the bundle; anything not in it is out of scope by design. + +**What to produce.** One file: the category list, in the output form the brief specifies, with each row citing the grid cell it came from. Alongside it, a rejection register — every candidate the grid produced that you did not admit, with the admission condition it failed. The rejection register is not optional and is not a summary: it is how the pruning gets checked rather than trusted. + +**Standing rules.** + +- You propose. You do not ratify your own output, and nothing you produce is settled by your having produced it. +- Keep three registers distinct in your output: what is settled, what is `[PROPOSED]`, what is `[OPEN]`. +- British spelling. +- Errors are corrected by an appended note, never by amendment. A wrong figure stays visible with its correction beside it. +- Report defects honestly, including in the brief and in your own earlier reasoning. +- Name the weakest point of what you produce, rather than leaving it for a reader to find. +- Prose describes what you have actually done. Anything you considered and did not do is marked as such. + +**Two rules on the derivation itself.** + +Apply the grid exhaustively before pruning. Produce every candidate the grid yields, then admit or reject each against the conditions. A candidate never generated cannot be rejected on the record, and the register is the only evidence the pruning was disciplined. + +Each row must stand as a decision point for a command slice **about anything** — any domain, any system. A row that only makes sense for a particular kind of command is out of scope for this list, and saying so is a finding rather than a failure. + +**Do not ask what this is for.** The brief contains what you need. If the brief is insufficient, say precisely what is missing and stop; do not fill the gap by inference about intent. + +Produce the file, state your weakest point, and stop. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/MANIFEST.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/MANIFEST.md index 0e9d016..2ff2957 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/MANIFEST.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/MANIFEST.md @@ -1,13 +1,13 @@ -# Manifest — blind re-derivation bundle +# Manifest — command-slice categories bundle -sha256 of every file in this directory as filed on 2026-09-04. The re-deriving session checks -these before starting and records what it checked; a bundle that does not match was not this one. +sha256 of every file in this bundle as filed on 2026-09-07. The receiving session checks these +before starting and records what it checked; a bundle that does not match was not this one. | File | sha256 | Lines | |---|---|---| -| `README.md` | `224bf88670ad85ee7871f7b2c6c841171f8145c3c0bb1f2b750a44e78791fb44` | 152 | +| `README.md` | `41aa14480d5d65be31395f66f4606650149fddb3eeeedf1084eb93c16c2989b9` | 147 | +| `INVOCATION.md` | `424e53963e2fce9eb55e7b6b5858a3d3480ef3ae34f53b48c8fbdf1084af977d` | 35 | | `foundation.md` | `3d9a52546fc35b05fffb2b0de2a97faa656b813e61c3c893ab2a093571219510` | 142 | -| `supersession-foundation-construct-list.md` | `0c2c17cce8e9abe01b7a1dbc27a5e8148ce0bb31cfcacc9436e01a215940b700` | 75 | +| `supersession-extract.md` | `ffd2b368ee5c4c5c867f97855f1d70edf0a1fab0091717ebdf58b1f5c8c68a7f` | 69 | | `resolution-condition.md` | `802fc286cfcbb308b178066386bc1da6bceb4d006d33dbdc62fb2b40264b0055` | 58 | | `boundary-declarations.md` | `0690cb5577d24e7b27077141c06f4572451797de406c41bfb8d6cdf05fcb131e` | 79 | -| `determination.schema.json` | `4df4db09cf11d9a0cc02b4fee762fb9b71c3194dd1cb59691ccb6cba52fc67c6` | 255 | diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/README.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/README.md index d0bdefd..28ea235 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/README.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/README.md @@ -1,14 +1,11 @@ -# Blind re-derivation brief — consequential-property categories for a command slice +# Brief — consequential-property categories for a command slice -**Read this file first. It is the whole of your instruction set.** You are performing the -re-derivation ruled at `CG-R-35`. You derive a category list by a stated method and stop. You -are not told, and must not try to learn, what any other session derived, what act instance is -under test, or what determinations it carries. If anything you are given or find seems to tell -you, stop and report it rather than reading on. +**Read this file first. It is your instruction set; where the invocation and this brief +differ, this brief wins.** You are producing a category list by a stated method and stopping. +Work from this bundle only; it is complete. If anything you are given or find goes beyond it, +stop and report it rather than reading on. -**You propose; Emil ratifies. Produce one file and stop.** Commit identity, if you commit at -all, is `Claude `. If this bundle is all you were given, work from it -alone; if you have repository access, use nothing outside this directory. +**You propose; the principal who issued this brief ratifies. Produce one file and stop.** --- @@ -18,7 +15,7 @@ Produce the list of **consequential-property categories** for one act type: a ** in the domain-state-change binding, in the software projection, at act scale. The list is drawn for the act type — any command slice, in any domain — never for an instance. -Your output is a single markdown file, `rederived-category-list.md`, containing: +Your output is a single markdown file, `category-list.md`, containing: 1. the list, in the form fixed at §5; 2. a **rejection register** — every candidate the method produced that you did not admit, with @@ -27,8 +24,7 @@ Your output is a single markdown file, `rederived-category-list.md`, containing: invented at the point of invention; 4. the weakest point of your list, named. -Nothing else. No experiment design, no measure, no discussion of what the list is for beyond -what §2 says. +Nothing else. No discussion of what the list is for beyond what §2 says. ## 2. What a category is @@ -45,7 +41,8 @@ name) and the fact vocabulary (the types of things acts read and write). Slice t *command*, *read-model*, *automation* and *translation*. Position is relative to the act: each slice declares which facts it reads and which it writes. The determination layer adds, at each slice's address, determinations — extent, allocation, acceptance with coverage, boundary -declarations, provenance — whose record shape is `determination.schema.json`, enclosed. +declarations, provenance — recorded in a typed record whose field vocabulary is listed at +§4.3. A **command slice** receives a command from a caller, reads the facts the event model declares it reads, decides, writes the facts the model declares it writes, and reports an outcome to the @@ -76,8 +73,8 @@ ground is obtained), *decide*, *write* (the verdict is produced), *report* (the the outcome). A sixth row, *act as a whole*, holds cross-cutting points. **Axis B — the foundation's constructs, in both states.** The foundation is enclosed in its -**original** state (`foundation.md`) together with the **supersession record** that retired -two of its positions (`supersession-foundation-construct-list.md`). Use both: where the +**original** state (`foundation.md`) together with an **extract of the supersession record** +that retired two of its positions (`supersession-extract.md`). Use both: where the original names a construct the supersession replaced, the cell is the same and the name differs, and you say which state you used. @@ -95,15 +92,14 @@ differs, and you say which state you used. A category is the intersection of a stage and a construct at which all four conditions hold. Work the grid cell by cell; a cell may yield nothing, one category, or several. -**The schema is consulted as enforcement only.** Where it requires a field, that marks a -decision point the binding's authors judged consequential — corroboration for a category, never -its source. Do not derive categories from schema fields. +**The record vocabulary is not a source.** §4.3 lists the binding's record fields so that names +avoid them. Do not derive categories from record fields. ### 4.3 Rules on the rows - **One question per category.** Each row is one question with one recognisable answer form. - A category may be a *kind* of decision point that an instance exhibits more than once; that - is acceptable and is handled after your work, not by you. + A category may be a *kind* of decision point that a given act exhibits more than once; that + is acceptable — do not split a kind into instances. - **Names in plain words, avoiding the schema's vocabulary.** No category name may be a schema key or enum value: *address, act_type, act_instance, scale, statement, extent, axes, state, region, reason, allocation, class, settled_by, acceptance, predicate, closure, kind, @@ -131,11 +127,10 @@ condition failed, why. Then invented categories, if any. Then the weakest point. ## 6. What you must not do -- Do not look for, ask about, or reason from any act instance, event model, example - determination, or other session's list. The enclosed schema's one example name is not an - instance under test and tells you nothing. -- Do not read anything outside this directory. The bundle is complete. -- Do not design the experiment, the measure, thresholds, or a rubric. +- Do not reason from any particular act, event model or example determination; the list is + for the act type. +- Do not read anything outside this bundle. It is complete. +- Do not produce anything beyond §1's four items. - Do not tune the list to be long, short, or to any expectation. The number of rows is an outcome of the method. @@ -145,8 +140,8 @@ condition failed, why. Then invented categories, if any. Then the weakest point. |---|---| | `README.md` | this brief | | `foundation.md` | the foundation, original state | -| `supersession-foundation-construct-list.md` | S-1 and S-2, the superseding state | +| `supersession-extract.md` | S-1 and S-2, the superseding state — an extract of the supersession record's construct content, with its provenance line | | `resolution-condition.md` | C-1, C-2, C-3 | | `boundary-declarations.md` | B-1, B-2 | -| `determination.schema.json` | the binding's record shape, for §4.2's corroboration and §4.3's naming rule | +| `INVOCATION.md` | the invocation you were given, filed beside this brief so the two can be checked against each other | | `MANIFEST.md` | sha256 of every file above — check them before starting | diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/determination.schema.json b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/determination.schema.json deleted file mode 100644 index eca0483..0000000 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/determination.schema.json +++ /dev/null @@ -1,255 +0,0 @@ -{ - "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://github.com/Hafeok/specification-languages/domain-state-change/schema/determination.schema.json", - "title": "Determination — domain state change binding", - - "$comment": "This schema is the enforcement mechanism for PR-1, PR-2 and PR-3. The prohibitions are not advice: the forbidden shapes have no valid representation here. A conformance claim citing this file cites required fields and closed unions, not prose.", - - "$defs": { - - "address": { - "$comment": "PR-1. An act address. Type plus bound parameter; the parameter is drawn from the act vocabulary, which makes the instance set computable rather than authored.", - "type": "object", - "required": ["act_type", "act_instance"], - "additionalProperties": false, - "properties": { - "act_type": { - "type": "string", - "enum": ["command", "read-model", "automation", "translation"], - "$comment": "Event modelling's slice types. Closed." - }, - "act_instance": { - "type": "string", - "minLength": 1, - "$comment": "A name in the act vocabulary, e.g. PlaceOrder. Checked against the event model by the validator, not by this schema." - }, - "scale": { - "type": "string", - "enum": ["act", "slice", "context", "system"], - "default": "act", - "$comment": "Composition granularity. Independent of projection depth." - } - } - }, - - "extent": { - "$comment": "DP-1. Four states, and silence is one of them. A determination filed before an axis existed is SILENT on it; one deliberately bounded is DOES-NOT-TRAVEL. Collapsing them makes the revisit computation unsound the first time an axis is added.", - "type": "object", - "required": ["axes"], - "additionalProperties": false, - "properties": { - "axes": { - "type": "object", - "minProperties": 1, - "additionalProperties": { - "type": "object", - "required": ["state"], - "additionalProperties": false, - "properties": { - "state": { - "type": "string", - "enum": ["bound-here", "travels-to", "does-not-travel", "silent"] - }, - "region": { - "type": "string", - "$comment": "Required when state is travels-to or does-not-travel." - }, - "reason": { "type": "string" } - }, - "allOf": [ - { - "if": { "properties": { "state": { "enum": ["travels-to", "does-not-travel"] } } }, - "then": { "required": ["state", "region"] } - }, - { - "if": { "properties": { "state": { "const": "silent" } } }, - "then": { - "not": { "required": ["region"] }, - "$comment": "Silence has no region. A silent axis was not considered; naming a region would make it a stated boundary." - } - } - ] - } - } - } - }, - - "allocation": { - "$comment": "PR-2 and DP-4. Every determination is allocated. Residual requires a carrying actor kind AND an accountable principal, and the principal cannot be a machine.", - "type": "object", - "required": ["class"], - "properties": { - "class": { "type": "string", "enum": ["pinned", "checked", "residual"] } - }, - "oneOf": [ - { - "properties": { - "class": { "const": "pinned" }, - "settled_by": { "type": "string", "minLength": 1 } - }, - "required": ["class", "settled_by"], - "additionalProperties": false - }, - { - "properties": { - "class": { "const": "checked" }, - "acceptance": { "$ref": "#/$defs/acceptance" } - }, - "required": ["class", "acceptance"], - "additionalProperties": false - }, - { - "properties": { - "class": { "const": "residual" }, - "carried_by": { - "type": "string", - "enum": ["human", "machine", "team", "external-party"] - }, - "principal": { - "type": "object", - "required": ["kind", "identifier"], - "additionalProperties": false, - "properties": { - "kind": { - "type": "string", - "enum": ["human", "team", "external-party"], - "$comment": "Machine is absent by design. A model identity cannot be an accepting principal." - }, - "identifier": { "type": "string", "minLength": 1 } - } - } - }, - "required": ["class", "carried_by", "principal"], - "additionalProperties": false - } - ] - }, - - "acceptance": { - "$comment": "PR-3, DP-2, DP-3, DP-5. A coverage claim with no stated uncovered set has no representation: does_not_cover is required and may not be empty by omission. Absence of uncovered properties must be asserted explicitly.", - "type": "object", - "required": ["predicate", "closure", "ranges_over", "covers", "does_not_cover"], - "additionalProperties": false, - "properties": { - "predicate": { - "type": "string", - "minLength": 1, - "$comment": "Predicate form, not extension. Scenarios are evidence about a predicate; they are not the predicate." - }, - "closure": { - "$comment": "DP-2. Logical closure and operational closure are different claims and the notation records which was established.", - "type": "object", - "required": ["kind"], - "additionalProperties": false, - "properties": { - "kind": { "type": "string", "enum": ["operational", "logical-only", "unestablished"] }, - "runnable_by": { "type": "string" }, - "terminates": { "type": "boolean" }, - "tolerance": { "type": "string" } - }, - "allOf": [ - { - "if": { "properties": { "kind": { "const": "operational" } } }, - "then": { "required": ["kind", "runnable_by", "terminates"] } - } - ] - }, - "ranges_over": { - "$comment": "C-3 of the resolution condition. The facts this predicate is evaluated against. A check over something no act produces is not a check, so this is required and the resolution check verifies each entry is written by some act in scope.", - "type": "array", - "minItems": 1, - "items": { "type": "string" } - }, - "covers": { - "type": "array", - "minItems": 1, - "items": { "type": "string" }, - "$comment": "Property categories this predicate reaches." - }, - "does_not_cover": { - "$comment": "DP-3. Required. Use the explicit sentinel to assert the empty case; omission is not permitted, because an omitted uncovered set is indistinguishable from an unconsidered one.", - "oneOf": [ - { "type": "array", "minItems": 1, "items": { "type": "string" } }, - { "type": "string", "const": "asserted-none" } - ] - }, - "proxy": { - "$comment": "DP-5. A proxy without its divergence is a coverage claim that overstates itself, so divergence is required whenever proxy is present.", - "type": "object", - "required": ["stands_in_for", "known_divergence"], - "additionalProperties": false, - "properties": { - "stands_in_for": { "type": "string", "minLength": 1 }, - "known_divergence": { "type": "string", "minLength": 1 } - } - } - } - }, - - "position": { - "$comment": "DP-6. Ground and verdict are positions relative to an act, not separate vocabularies. Read position is ground; write position is verdict. Both resolve into the fact vocabulary.", - "type": "object", - "required": ["fact_type", "role"], - "additionalProperties": false, - "properties": { - "fact_type": { "type": "string", "minLength": 1 }, - "role": { "type": "string", "enum": ["read", "write"] }, - "boundary": { - "$comment": "DP-7. external: read here, produced by no act in scope. terminal: written here, read by no act in scope. internal: resolves within scope.", - "type": "object", - "required": ["kind"], - "properties": { - "kind": { "type": "string", "enum": ["internal", "external", "terminal"] }, - "source": { "type": "string" }, - "consumer": { "type": "string" }, - "read_provenance": { "type": "string" }, - "tick_rate": { "type": "string", "enum": ["static", "slow", "fast", "unknown"] }, - "consumption_observable": { "type": "boolean" } - }, - "allOf": [ - { - "if": { "properties": { "kind": { "const": "external" } } }, - "then": { "required": ["kind", "source", "read_provenance", "tick_rate"] } - }, - { - "if": { "properties": { "kind": { "const": "terminal" } } }, - "then": { "required": ["kind", "consumer", "consumption_observable"] } - } - ] - } - } - }, - - "provenance": { - "type": "object", - "required": ["made_at", "made_by", "recorded"], - "additionalProperties": false, - "properties": { - "made_at": { - "$comment": "SR-1. The ONLY field that distinguishes a build-time determination from an act-time one. The schema is otherwise identical, which is what stops the store bifurcating.", - "type": "string", - "enum": ["build-time", "act-time"] - }, - "made_by": { "type": "string", "minLength": 1 }, - "recorded": { "type": "string", "format": "date-time" }, - "supersedes": { "type": "string" } - } - } - }, - - "type": "object", - "required": ["id", "address", "statement", "extent", "allocation", "provenance"], - "additionalProperties": false, - "properties": { - "id": { "type": "string", "pattern": "^DSC-[0-9]{4}$" }, - "address": { "$ref": "#/$defs/address" }, - "statement": { "type": "string", "minLength": 1 }, - "extent": { "$ref": "#/$defs/extent" }, - "allocation": { "$ref": "#/$defs/allocation" }, - "positions": { - "type": "array", - "items": { "$ref": "#/$defs/position" } - }, - "provenance": { "$ref": "#/$defs/provenance" } - } -} diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/supersession-foundation-construct-list.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/supersession-extract.md similarity index 71% rename from meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/supersession-foundation-construct-list.md rename to meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/supersession-extract.md index ad272f9..582643b 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/supersession-foundation-construct-list.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories/supersession-extract.md @@ -1,10 +1,10 @@ -# [PROPOSED] Supersession record: foundation construct list +# Supersession record — extract -**Status:** `[PROPOSED]`. Two supersessions against `specification-language-foundation.md`. Neither is ratified. Both arose in session; neither has a falsifier attached. - -**Purpose.** The construct list is the derivation source for the falsifier's category list. Any session deriving from it must see both the superseded and the superseding state, or it will derive from a stale list without knowing it has. This record exists so that resolving the changes into the text does not destroy what the derivation needs. - -**Rule applied.** Supersession never rewrites. The original statements below are retained verbatim in substance and marked retired, not deleted. +**Extract, not the whole document.** Source: `supersession-foundation-construct-list.md`, sha256 +`0c2c17cce8e9abe01b7a1dbc27a5e8148ce0bb31cfcacc9436e01a215940b700`, 75 lines. Extracted: §S-1 lines 11–33 and §S-2 lines 38–70 — each supersession's retired +position, superseding position, basis and consequence, verbatim. Not extracted: the document's +header and status lines (1–9), the two *Open* subsections (34–37, 71–75), and the horizontal rules +between sections. Every extracted line is byte-identical to the source. --- @@ -31,7 +31,6 @@ The peer reading is admitted on the structural test rather than on preference: t ### Open -Whether the peer ruling survives the structural test properly run. It has been asserted on inspection, not checked construct by construct against the software projection. --- @@ -68,8 +67,3 @@ The reduction was reached by way of a rejected argument and a sound one. Both ar - This generalises the information-completeness rule from data to the whole triple. - Two sets do not fully overlap, and the resolution condition is unsound without declarations on both sides: not every verdict becomes ground, and not all ground is a prior verdict. See the boundary declarations. -### Open - -- ~~The actor is absent from the triple.~~ **Closed by R-3.** Actor kinds come from Layer 1 and remain stable. Actor **instances** are declared per specification and read at act time, not held in a further vocabulary: they are deployment facts and tick far faster than any ontology should. -- The three tick at different rates — fact vocabulary slow, act vocabulary medium, business-driven objects fast — so a single staleness policy across them is likely wrong. -- The falsifier's completeness predicate is per-act category coverage, not the resolution condition. These are not the same predicate. Whether the falsifier still tests the right thing is unresolved and blocks the amended pre-registration. From 498d5fc3bb70218a9a83782d3eeb9dd13a57dd8f Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 7 Sep 2026 07:01:45 +0000 Subject: [PATCH 16/19] Gate B: scrub record filed outside the bundle; hold Every substitution before and after, every audited hit left in place with its reason, the supersession extract's provenance, the schema drop's reasoning, the invocation's consistency check, both manifests, the old folder name, the residual inference carried to the reconciliation, and one substitution not in the audit flagged for ratification. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../scrub-record.md | 366 ++++++++++++++++++ 1 file changed, 366 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/scrub-record.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/scrub-record.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/scrub-record.md new file mode 100644 index 0000000..5b93aeb --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/scrub-record.md @@ -0,0 +1,366 @@ +# Scrub record — category derivation bundle + +**Filed 2026-09-07 in the session directory, outside the bundle**, because it enumerates the +leaking terms. Records every change Gate B made to the bundle, every audited hit it did not +change and why, both manifests, and the old folder name. Read with `gateA-leak-audit.md` +(the hits) and `rulings-gateA.md` (the rulings). + +## 1. The rename + +`blind-rederivation/` → `command-slice-categories/`, by `git mv` in its own commit, so the old +path stays in history. Nothing inside changed in that commit. + +## 2. Substitutions in the brief (`README.md`), before and after + +Thirteen, applied by a script that required each *before* text to occur exactly once. Each is +neutral wording preserving the instruction; none touches the grid, the four admission +conditions, the naming rule's vocabulary, or the output form. Two are consequences of other +rulings rather than audit hits and are marked so: the §3 and §4.2 references to the schema +(dropped under `CG-R-42`) and the §7 table (extract, schema, invocation). + +### 1. R-1 + +**Before** + +``` +# Blind re-derivation brief — consequential-property categories for a command slice +``` + +**After** + +``` +# Brief — consequential-property categories for a command slice +``` + +### 2. R-2/R-3/R-6 (+S-1 consistency) + +**Before** + +``` +**Read this file first. It is the whole of your instruction set.** You are performing the +re-derivation ruled at `CG-R-35`. You derive a category list by a stated method and stop. You +are not told, and must not try to learn, what any other session derived, what act instance is +under test, or what determinations it carries. If anything you are given or find seems to tell +you, stop and report it rather than reading on. +``` + +**After** + +``` +**Read this file first. It is your instruction set; where the invocation and this brief +differ, this brief wins.** You are producing a category list by a stated method and stopping. +Work from this bundle only; it is complete. If anything you are given or find goes beyond it, +stop and report it rather than reading on. +``` + +### 3. R-4/R-5/R-6 + +**Before** + +``` +**You propose; Emil ratifies. Produce one file and stop.** Commit identity, if you commit at +all, is `Claude `. If this bundle is all you were given, work from it +alone; if you have repository access, use nothing outside this directory. +``` + +**After** + +``` +**You propose; the principal who issued this brief ratifies. Produce one file and stop.** +``` + +### 4. R-7 + +**Before** + +``` +Your output is a single markdown file, `rederived-category-list.md`, containing: +``` + +**After** + +``` +Your output is a single markdown file, `category-list.md`, containing: +``` + +### 5. R-8 + +**Before** + +``` +Nothing else. No experiment design, no measure, no discussion of what the list is for beyond +what §2 says. +``` + +**After** + +``` +Nothing else. No discussion of what the list is for beyond what §2 says. +``` + +### 6. SC-3 (§3 reference; schema dropped under CG-R-42) + +**Before** + +``` +declarations, provenance — whose record shape is `determination.schema.json`, enclosed. +``` + +**After** + +``` +declarations, provenance — recorded in a typed record whose field vocabulary is listed at +§4.3. +``` + +### 7. SC-3 (§4.2 corroboration paragraph; schema dropped under CG-R-42) + +**Before** + +``` +**The schema is consulted as enforcement only.** Where it requires a field, that marks a +decision point the binding's authors judged consequential — corroboration for a category, never +its source. Do not derive categories from schema fields. +``` + +**After** + +``` +**The record vocabulary is not a source.** §4.3 lists the binding's record fields so that names +avoid them. Do not derive categories from record fields. +``` + +### 8. R-10 + +**Before** + +``` + A category may be a *kind* of decision point that an instance exhibits more than once; that + is acceptable and is handled after your work, not by you. +``` + +**After** + +``` + A category may be a *kind* of decision point that a given act exhibits more than once; that + is acceptable — do not split a kind into instances. +``` + +### 9. R-11 + +**Before** + +``` +- Do not look for, ask about, or reason from any act instance, event model, example + determination, or other session's list. The enclosed schema's one example name is not an + instance under test and tells you nothing. +``` + +**After** + +``` +- Do not reason from any particular act, event model or example determination; the list is + for the act type. +``` + +### 10. R-6 (§6 repository line) + +**Before** + +``` +- Do not read anything outside this directory. The bundle is complete. +``` + +**After** + +``` +- Do not read anything outside this bundle. It is complete. +``` + +### 11. R-12 + +**Before** + +``` +- Do not design the experiment, the measure, thresholds, or a rubric. +``` + +**After** + +``` +- Do not produce anything beyond §1's four items. +``` + +### 12. §7 enclosed table (extract, schema dropped, invocation added) + +**Before** + +``` +| `supersession-foundation-construct-list.md` | S-1 and S-2, the superseding state | +| `resolution-condition.md` | C-1, C-2, C-3 | +| `boundary-declarations.md` | B-1, B-2 | +| `determination.schema.json` | the binding's record shape, for §4.2's corroboration and §4.3's naming rule | +| `MANIFEST.md` | sha256 of every file above — check them before starting | +``` + +**After** + +``` +| `supersession-extract.md` | S-1 and S-2, the superseding state — an extract of the supersession record's construct content, with its provenance line | +| `resolution-condition.md` | C-1, C-2, C-3 | +| `boundary-declarations.md` | B-1, B-2 | +| `INVOCATION.md` | the invocation you were given, filed beside this brief so the two can be checked against each other | +| `MANIFEST.md` | sha256 of every file above — check them before starting | +``` + +### 13. §4.2 table row wording (extract) + +**Before** + +``` +**original** state (`foundation.md`) together with the **supersession record** that retired +two of its positions (`supersession-foundation-construct-list.md`). Use both: where the +``` + +**After** + +``` +**original** state (`foundation.md`) together with an **extract of the supersession record** +that retired two of its positions (`supersession-extract.md`). Use both: where the +``` + +**One substitution not in the audit, S-1.** The brief's opening sentence said it was *the whole +of your instruction set*; with `INVOCATION.md` filed beside it that was no longer true, and the +invocation itself says the brief wins on conflict. The replacement states that rule from the +brief's side. Made for consistency under step B.5; flagged here for ratification with the rest. + +## 3. The supersession record: extracted, not substituted (`CG-R-41`) + +`supersession-foundation-construct-list.md` (sha256 `0c2c17cce8e9abe01b7a1dbc27a5e8148ce0bb31cfcacc9436e01a215940b700`, +75 lines) is removed from the bundle and replaced by `supersession-extract.md`: the S-1 and S-2 +sections' retired position, superseding position, basis and consequence — source lines 11–33 and +38–70 — verbatim, under a provenance line naming the source, its hash and the ranges. Not +extracted: the header and status lines (1–9, which held SS-1 and SS-2), the two *Open* +subsections (34–37 and 71–75, which held SS-3), and the rules between sections. A script +verified every extracted line byte-identical to the source. SS-1, SS-2 and SS-3 are gone +without a word altered. + +## 4. The schema: dropped (`CG-R-42`, preference 1) + +**The grid does not cite the schema.** Axis B of the grid names the foundation (both states), +the resolution condition and the boundary declarations; the schema's only roles in the brief +were optional corroboration ("never its source") and the naming rule's vocabulary, which the +brief enumerates in full at §4.3. No row of the proposed list cites it as a cell. So the file +(`determination.schema.json`, sha256 `4df4db09cf11d9a0cc02b4fee762fb9b71c3194dd1cb59691ccb6cba52fc67c6`) +is removed, and the two references in the brief are reworded (substitutions 6 and 7 above). + +**This is a method-adjacent change, reported under the task's rule 3 rather than refused.** +What the receiving session loses is a corroboration source it was told not to derive from. +What it keeps is everything the grid consists of. The reconciliation reads rows against the +grid, and the grid is unchanged. SC-1, SC-2, SC-3 and SC-4 are gone with the file. + +## 5. Hits not substituted, with the reason + +| Hit | Where | Why it stays | +|---|---|---| +| R-9 | brief §2 | the foundation's own concept of a category; removing it changes the question. Ratified leave | +| R-13 | brief §6, *any expectation* | protective instruction; residual inference is only that the list will be read. Ratified leave | +| R-14 | brief, *rejection register*, *invented*, *weakest point* | the method; must be given. Ratified leave | +| R-15 | brief §4.2, *S-1*, *S-2* | identifiers internal to the enclosed extract. Ratified leave | +| R-16 | brief §1, *the domain-state-change binding* | the act type cannot be stated without it. Ratified leave; its discoverability path (SC-3) is closed by dropping the schema, not by removing the name | +| M-3 | manifest date | harmless; updated to the filing date | +| F-1, F-2, F-3, F-4, F-5 | `foundation.md` | canon, handed over whole; `CG-R-41` forbids modification and `CG-R-43` accepts the residual | +| RC-1, RC-2, RC-3, RC-4 | `resolution-condition.md` | same | +| BD-1, BD-2, BD-3 | `boundary-declarations.md` | same | +| — | `INVOCATION.md` line 33, *by inference about intent* | the word in its ordinary sense; the invocation is filed as arrived and unscrubbed (`CG-R-44`); leaks nothing about any measure in context | + +## 6. Residual inference after the scrub (`CG-R-43`) + +From the three untouched canon copies a reader can still infer that the framework attaches +falsifiers to claims, and that a pre-registration tests a closure claim (`foundation.md` §5.1, +`resolution-condition.md` line 3, `boundary-declarations.md` line 79). **Accepted, recorded, not +relied upon.** It mis-points at the layer claim, and that is not protection: a session that +infers some falsification programme may still reason about what makes a defensible list rather +than a derived one. Carried to the reconciliation as a stated limit on the re-derivation's +independence, beside `CG-R-39`'s framing residual. + +## 7. The invocation (`CG-R-44`) + +Filed byte-identical as `INVOCATION.md` (sha256 `424e53963e2fce9eb55e7b6b5858a3d3480ef3ae34f53b48c8fbdf1084af977d`, +35 lines), unscrubbed. Checked against the scrubbed brief: + +- **Consistent:** the deliverable (list with cells, rejection register), the act type, work from + the bundle only, the brief wins on conflict, the *about anything* test (the brief's condition + 1), exhaustive grid before pruning (the brief's *work the grid cell by cell*). +- **One minor difference, not fixed:** the invocation says the rejection register comes + *alongside* the list; the brief says one file containing both. The brief wins by the + invocation's own rule; a session producing two files has not erred materially. +- **Two things the invocation adds that the brief does not:** British spelling, and the three + registers. Neither conflicts. +- **The pre-flight lines (1–7)** are in the bundled copy, as arrived. A reader sees an + instruction addressed to the issuer about what to paste. Unremarkable; disclosed as filed. +- **Its no-clone, no-search and do-not-ask instructions are prose** and do not enforce. The + enforcement is that the receiving session gets an archive and no repository access. If it + asks what the task is for, that is reported in the reconciliation as an observation about + what the bundle disclosed, and not answered. + +## 8. Manifests + +### Old (as filed 2026-09-04, under the old folder name) + + +``` +# Manifest — blind re-derivation bundle + +sha256 of every file in this directory as filed on 2026-09-04. The re-deriving session checks +these before starting and records what it checked; a bundle that does not match was not this one. + +| File | sha256 | Lines | +|---|---|---| +| `README.md` | `224bf88670ad85ee7871f7b2c6c841171f8145c3c0bb1f2b750a44e78791fb44` | 152 | +| `foundation.md` | `3d9a52546fc35b05fffb2b0de2a97faa656b813e61c3c893ab2a093571219510` | 142 | +| `supersession-foundation-construct-list.md` | `0c2c17cce8e9abe01b7a1dbc27a5e8148ce0bb31cfcacc9436e01a215940b700` | 75 | +| `resolution-condition.md` | `802fc286cfcbb308b178066386bc1da6bceb4d006d33dbdc62fb2b40264b0055` | 58 | +| `boundary-declarations.md` | `0690cb5577d24e7b27077141c06f4572451797de406c41bfb8d6cdf05fcb131e` | 79 | +| `determination.schema.json` | `4df4db09cf11d9a0cc02b4fee762fb9b71c3194dd1cb59691ccb6cba52fc67c6` | 255 | +``` + +### New (as filed 2026-09-07) + +``` +# Manifest — command-slice categories bundle + +sha256 of every file in this bundle as filed on 2026-09-07. The receiving session checks these +before starting and records what it checked; a bundle that does not match was not this one. + +| File | sha256 | Lines | +|---|---|---| +| `README.md` | `41aa14480d5d65be31395f66f4606650149fddb3eeeedf1084eb93c16c2989b9` | 147 | +| `INVOCATION.md` | `424e53963e2fce9eb55e7b6b5858a3d3480ef3ae34f53b48c8fbdf1084af977d` | 35 | +| `foundation.md` | `3d9a52546fc35b05fffb2b0de2a97faa656b813e61c3c893ab2a093571219510` | 142 | +| `supersession-extract.md` | `ffd2b368ee5c4c5c867f97855f1d70edf0a1fab0091717ebdf58b1f5c8c68a7f` | 69 | +| `resolution-condition.md` | `802fc286cfcbb308b178066386bc1da6bceb4d006d33dbdc62fb2b40264b0055` | 58 | +| `boundary-declarations.md` | `0690cb5577d24e7b27077141c06f4572451797de406c41bfb8d6cdf05fcb131e` | 79 | +``` + + +## 9. Bundle after Gate B + +Seven files: `README.md`, `INVOCATION.md`, `foundation.md`, `supersession-extract.md`, +`resolution-condition.md`, `boundary-declarations.md`, `MANIFEST.md`. A bundle-wide search for +the audit's term classes after the scrub returns only the canon status lines listed in §5 and +the invocation's *inference*. + +## 10. Weakest point + +**The brief still reads as written by someone who knows what the list is for.** Every +substitution removed a term; none removed the shape of a document that carefully tells its +reader what not to do. A receiving session that notices how much care went into the +prohibitions can infer that the output matters to something, which is `CG-R-43`'s residual by +another route. That is not removable by scrubbing words, and it is recorded here rather than +claimed away. + +--- + +**Hold.** Gate C is not entered. Awaiting ratification of the applied scrub, including S-1 and +the schema drop. From 1e255d4f8d327334ffe5aa426bfa49df6819e7a1 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 7 Sep 2026 07:22:57 +0000 Subject: [PATCH 17/19] Record the Gate B rulings CG-R-45..47; aggregate the independence limit into the reconciliation rule MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit S-1 and the schema drop ratified. The three residuals on the re-derivation's independence are read as one limit — the receiving session can tell it is doing careful work for a programme that will scrutinise the result, without knowing what the scrutiny is — appended to the reconciliation rule as one input to the provenance grade. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../arrived-inputs.md | 6 ++ .../inputs/rulings-cg-r-45-47.md | 47 ++++++++++ .../rederivation-reconciliation-rule.md | 19 ++++ .../rulings-gateB.md | 86 +++++++++++++++++++ 4 files changed, 158 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-45-47.md create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gateB.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md index a6f88eb..5908d5c 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/arrived-inputs.md @@ -95,3 +95,9 @@ Appended, not rewritten (`CG-rule-02`). |---|---|---|---| | `inputs/rulings-cg-r-41-44.md` | `00402d71bf94218e1e74fbf7b0d87f95c90e203db00d1f631ab89f75c6de84a5` | 61 | **rulings, issued** — `CG-R-41` … `CG-R-44`, by Emil, 2026-09-03, ratifying the leak audit. Quoted with consequences in `rulings-gateA.md`. Not yet register rows | | `inputs/invocation-category-derivation.md` | `424e53963e2fce9eb55e7b6b5858a3d3480ef3ae34f53b48c8fbdf1084af977d` | 35 | the receiving session's invocation, Emil's; filed into the bundle byte-identical as `INVOCATION.md` per `CG-R-44`, unscrubbed | + +## Addendum, 2026-09-07 — Gate B rulings arrived + +| File | sha256 | Lines | Status | +|---|---|---|---| +| `inputs/rulings-cg-r-45-47.md` | `75f24bc235a799c6a5bedd932bd79503403b33c55078ff6147645b852dd0fa43` | 47 | **rulings, issued** — `CG-R-45` … `CG-R-47`, by Emil, 2026-09-03, ratifying Gate B. Quoted with consequences in `rulings-gateB.md`. Not yet register rows | diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-45-47.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-45-47.md new file mode 100644 index 0000000..5ea5023 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/inputs/rulings-cg-r-45-47.md @@ -0,0 +1,47 @@ +# Rulings CG-R-45 … CG-R-47 — Gate B + +**Issued by Emil, 2026-09-03.** Gate B ratified. Gate C proceeds. + +--- + +## CG-R-45 — S-1 ratified + +The brief's opening became false the moment the invocation was filed beside it. Correcting a statement that a change to the bundle made untrue is not a scrub, and reporting it as a substitution outside the audit is the right disposition — it keeps the scrub record's scope honest rather than absorbing an unrelated correction into a ratified set. + +The replacement stating the brief-wins rule from the brief's side is accepted. + +**On the residual invocation/brief inconsistency** — rejection register alongside the list, versus one file — leaving it is correct. Editing the invocation would mean silently altering a file received and filed byte-identical, which is the defect CG-R-41 refused one register up. The precedence rule resolves it, and if the receiving session flags the inconsistency that is evidence the rule works rather than a defect. + +--- + +## CG-R-46 — The schema drop is ratified + +The grid does not cite it; its roles were optional corroboration and a naming vocabulary the brief already enumerates. Preference one under CG-R-42, and the cleanest available outcome: no substitution, no leak, no modified artefact. + +Reporting the two reworded brief references under rule 3 rather than refusing them is right. Rule 3 refuses changes to what the derivation is *asked to do*; removing a reference to an optional corroborating document does not change the grid, the admission conditions, the naming rules or the output form. Reporting it anyway is the correct margin of caution, and the record is what makes the judgement checkable rather than trusted. + +--- + +## CG-R-47 — The three independence residuals are aggregated, not carried separately + +The weakest point is correct and irreducible. A brief that carefully tells its reader what not to do is a brief written by someone who knows what the list is for, and no word-level scrub reaches the shape of a document. + +**Do not make the brief less careful.** A brief stripped of its prohibitions to seem casual would produce a worse derivation, which is the over-scrubbing rule applied to tone rather than terms. + +**Ruled: the three residuals are aggregated into one stated limit**, not filed as three notes: + +1. **CG-R-39** — the brief is this session's phrasing of a grid that is itself under test. +2. **CG-R-43** — the receiving session can infer that a falsification programme exists and that a pre-registration tests a closure claim. +3. **This one** — the care in the document's prohibitions discloses that its output matters to something. + +Each is individually small and dismissible. Aggregated they describe a single channel: **the receiving session can tell it is doing careful work for a programme that will scrutinise the result, without knowing what the scrutiny is.** That is one limit on independence, and it belongs in the reconciliation as one input to the provenance grade rather than as three footnotes that get weighed and waved through separately. + +**What it does not disclose**, and this is why the aggregate is still tolerable: the audit found no frame vocabulary, so the inference does not reach *the list will be counted against something*. Between "this matters" and "this is a denominator" is the whole distance the scrub was for. + +--- + +## Gate C + +Proceeds. The archive with its hash in the session log; the PR as provenance, not delivery; the statement in the PR description that anyone reading it sees the whole design while the receiving session sees only the archive. + +Register debt: CG-R-17 … CG-R-47. Mine. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/rederivation-reconciliation-rule.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/rederivation-reconciliation-rule.md index 31248e9..eabff3a 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/rederivation-reconciliation-rule.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/rederivation-reconciliation-rule.md @@ -85,3 +85,22 @@ every row that carries it. **Revision trigger.** Not a percentage. If a derived grade is unachievable — the grid cannot defend rows the author believes belong — the grid underdetermines the list, and that is reported as a finding about the method before any list is ratified. + +--- + +## Note appended 2026-09-07 — the aggregated independence limit (`CG-R-47`) + +Three residuals on the re-derivation's independence were filed separately as they arose: +`CG-R-39` (the brief is this session's phrasing of a grid that is itself under test), `CG-R-43` +(the receiving session can infer that a falsification programme exists and that a +pre-registration tests a closure claim), and the scrub record's weakest point (the care in the +brief's prohibitions discloses that its output matters to something). **Ruled: they are read as +one limit, not three.** Aggregated they describe a single channel — *the receiving session can +tell it is doing careful work for a programme that will scrutinise the result, without knowing +what the scrutiny is.* + +**How the reconciliation uses it.** One input to the provenance grade under `CG-R-40`, weighed +once. It does not by itself make the list *authored*; it bounds how much a *derived* grade can +claim, and the grade statement names it. What keeps it tolerable is recorded with it: the audit +found no frame vocabulary in the bundle, so the inference reaches *this matters* and stops +short of *this is a denominator*. diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gateB.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gateB.md new file mode 100644 index 0000000..b93b896 --- /dev/null +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/rulings-gateB.md @@ -0,0 +1,86 @@ +# Rulings — Gate B (scrub applied) + +**Issued by Emil, 2026-09-03, ratifying Gate B. Gate C proceeds.** Three rulings, `CG-R-45` … +`CG-R-47`, filed verbatim below the rule. Arrived as `rulings-cg-r-45-47.md`, sha256 `75f24bc235a799c6a5bedd932bd79503403b33c55078ff6147645b852dd0fa43`, +47 lines, filed byte-identical under `inputs/`. The covering message is quoted at the end. + +--- + +> +> ## CG-R-45 — S-1 ratified +> +> The brief's opening became false the moment the invocation was filed beside it. Correcting a statement that a change to the bundle made untrue is not a scrub, and reporting it as a substitution outside the audit is the right disposition — it keeps the scrub record's scope honest rather than absorbing an unrelated correction into a ratified set. +> +> The replacement stating the brief-wins rule from the brief's side is accepted. +> +> **On the residual invocation/brief inconsistency** — rejection register alongside the list, versus one file — leaving it is correct. Editing the invocation would mean silently altering a file received and filed byte-identical, which is the defect CG-R-41 refused one register up. The precedence rule resolves it, and if the receiving session flags the inconsistency that is evidence the rule works rather than a defect. +> +> --- +> +> ## CG-R-46 — The schema drop is ratified +> +> The grid does not cite it; its roles were optional corroboration and a naming vocabulary the brief already enumerates. Preference one under CG-R-42, and the cleanest available outcome: no substitution, no leak, no modified artefact. +> +> Reporting the two reworded brief references under rule 3 rather than refusing them is right. Rule 3 refuses changes to what the derivation is *asked to do*; removing a reference to an optional corroborating document does not change the grid, the admission conditions, the naming rules or the output form. Reporting it anyway is the correct margin of caution, and the record is what makes the judgement checkable rather than trusted. +> +> --- +> +> ## CG-R-47 — The three independence residuals are aggregated, not carried separately +> +> The weakest point is correct and irreducible. A brief that carefully tells its reader what not to do is a brief written by someone who knows what the list is for, and no word-level scrub reaches the shape of a document. +> +> **Do not make the brief less careful.** A brief stripped of its prohibitions to seem casual would produce a worse derivation, which is the over-scrubbing rule applied to tone rather than terms. +> +> **Ruled: the three residuals are aggregated into one stated limit**, not filed as three notes: +> +> 1. **CG-R-39** — the brief is this session's phrasing of a grid that is itself under test. +> 2. **CG-R-43** — the receiving session can infer that a falsification programme exists and that a pre-registration tests a closure claim. +> 3. **This one** — the care in the document's prohibitions discloses that its output matters to something. +> +> Each is individually small and dismissible. Aggregated they describe a single channel: **the receiving session can tell it is doing careful work for a programme that will scrutinise the result, without knowing what the scrutiny is.** That is one limit on independence, and it belongs in the reconciliation as one input to the provenance grade rather than as three footnotes that get weighed and waved through separately. +> +> **What it does not disclose**, and this is why the aggregate is still tolerable: the audit found no frame vocabulary, so the inference does not reach *the list will be counted against something*. Between "this matters" and "this is a denominator" is the whole distance the scrub was for. +> +> --- +> +> ## Gate C +> +> Proceeds. The archive with its hash in the session log; the PR as provenance, not delivery; the statement in the PR description that anyone reading it sees the whole design while the receiving session sees only the archive. +> +> Register debt: CG-R-17 … CG-R-47. Mine. + +--- + +## Covering message, verbatim + +> Both ratified. The extract verified line-by-line against the source is the right level of +> care for a canon substitute — that's what makes it an extract rather than a paraphrase. +> +> CG-R-47 is the one worth attention. You now have three residuals on independence, and each +> is individually small enough to wave through: the brief is your phrasing of the grid under +> test, the receiving session can infer a falsification programme exists, and the care in the +> prohibitions discloses that the output matters. Filed as three notes they get weighed +> separately and dismissed. Aggregated they describe one channel — the receiving session can +> tell it is doing careful work for a programme that will scrutinise the result, without +> knowing what the scrutiny is. +> +> That belongs in the reconciliation as one input to the provenance grade. +> +> And the reason the aggregate is still tolerable: the audit found no frame vocabulary. So the +> inference reaches "this matters" and stops short of "this is a denominator." That gap is the +> whole thing the scrub was for, and it held. +> +> Don't make the brief less careful. A brief stripped of prohibitions to seem casual would +> produce a worse derivation — over-scrubbing applied to tone instead of terms. +> +> Gate C proceeds. + +--- + +## Consequences applied + +| Ruling | What it settles | Applied as | +|---|---|---| +| `CG-R-45` | S-1 ratified; the invocation/brief inconsistency stays, resolved by precedence; a receiving session flagging it is the rule working | nothing further | +| `CG-R-46` | The schema drop ratified; reporting the reworded references under rule 3 was the right margin | nothing further | +| `CG-R-47` | The three independence residuals — `CG-R-39` framing, `CG-R-43` inferable programme, the care in the prohibitions — are **one stated limit**: *the receiving session can tell it is doing careful work for a programme that will scrutinise the result, without knowing what the scrutiny is.* One input to the provenance grade. The brief is not made less careful | appended to `rederivation-reconciliation-rule.md` as the aggregated limit the reconciliation reads; the three separate notes stand where filed and are superseded as inputs by the aggregate | From 2aa799374e1c84c647a212cc91f995f2dd683dff Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 7 Sep 2026 07:22:58 +0000 Subject: [PATCH 18/19] Gate C: the handover archive, built deterministically and verified against its manifest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit command-slice-categories.zip is the artefact the receiving session works from — no clone, no repository access. Its sha256 and contents are recorded in gateC-package.md. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../command-slice-categories.zip | Bin 0 -> 15824 bytes .../gateC-package.md | 25 ++++++++++++++++++ 2 files changed, 25 insertions(+) create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories.zip create mode 100644 meta/sessions/2026-09-03-notation-falsifier-prereg/gateC-package.md diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories.zip b/meta/sessions/2026-09-03-notation-falsifier-prereg/command-slice-categories.zip new file mode 100644 index 0000000000000000000000000000000000000000..3eb8625556762847739e21f3bf14770162866a7f GIT binary patch literal 15824 zcma*OV~i->_U_xZZQFMDYTLHESKGF2_iEd=ZQHhOowaXn?*H!hWbboQnMqZB_@y#4 zYmD&>$V&l(pa1{>K>S_gI>wfJmHQw70Qyh>0AzpP7};7|8`v1rI$D_~CovNTBEAoPOHgL#Oz2$20WlMo{Z(EO@c``&bu;&8-!Rwr=R4Gj2T$g-d5wD_ z2$pY!NJQqRWS^jUgHE*SD_O3}5!+Tt_c9R~ysmfe%#HZ>Ay)Zo8I(5p^(h zxIw-Ln=aid-Bl+KC+W_sE^e4$LE+o&B5fBZ{G)hL8MFQ<-!l2jvE(g_rY#$_3Qx)^ zRU@O(&y~SEj)NAX2;veZdL54G#S!6<<%?x9^Nb5t!>uNwF_TQQWMX|rI`Oe}c*DmG z$MOU+EeG$;LWb}%sbiEP8Tnt02FmQ$ICIFprxQ70z! z=wKbogyIC^)UjE@wrbVi?FADW%ksZZjM-PR^ke2_{&Xf`Sv+$j+fxBe+l%Re$woNi zs^HS~>vPRtnY5xaSUiy{R}h|XD6lafwIVlrg`dgPwH^z@_<#YY0BYd_qal+D2!mz0 zMXjO6)d;RG1*Xf?H~AsoxIW%am#Mr1WBIpD02M;3h1=3+NpM`MGy?k1Qfb+RJPW>F z!sRXhN)sdv$gj(&yiLgtU|4*Zdb<5R`zv)S;Rb4vI_`dS`3XZe5i-yz3B*9UjFr%l zWMX?o17BlqV-A;}%Xq~fUEBy@E=Rj9{?%_WQ@NieZkHFPn^~p=tDcpBSxk(HG*ccU zi2g{j_19kP;ym^v3}(;%s9XZDC?uMg23vQ1Q#Ix|GD_-kM##%7j*)cY_(kt7+T-sX zc|E38Nky_;Y2*M`uJ9R=Kbof%VD&{ibD`qA{fduyjGzMAzoat4i5AsQ6vj~gz)wBt z2#7=k3_@Wgy1n=$sB{jwS2wX zFW{D|B}Q`q&fQg@1Qgo4H4p^Rmd3fzF<}EQasHSUl?RrxcHMR-7~-$$dVRDJO|U;-3Z?OKU7!`K*t7rdh~eJlgx5JgvtCI>Br{ha~dd8-|I zAj#}(54RR|O6P?1&gqYwZ=8XH)dn)C-Dj^wcEDR0!v`>B2<^bXiR(>%UH-z7?x%r) zXhuWAns#OkPI`Pn$tD%OCx#D{f9XkjvBg2OqY?Y*%|O6zLtlA~X`T60o4B8x@>6lV zR(Dfg5lXdto z>-ogZ!Bq}w)prkWofCCF(5}!8FFXz(d4W6EGs{4c4c4kr(ygQ+PyVr2KYV2UyuTb7 zI}kJUbU1ywkBDpg=$oyOnO1zPFtPv@+s{;rs0T&c>7~fQ?VflFJBfHsi|N~maR^E> zHFefR!7LTaxeO1!m(8_^suGPw4pO3R&YnGHn;eHVb5;_rOsvS#D-Ci(?paJ8r@@7mrPw@7-f)C zwIVpyLAAO&Itms<(b;$Q`Z&|1u|96bl&;0DuWF007BqO3Ht2 zq>Q4J#U?+()(j<9{qk(jIlM;tAfS+y5Q9cXMf*B26ESGhaEt*Or?6~VVj=5&8U%^i z+0sWcU)ToAWAFvd_xCrk84u2UTu1v&IA~FN&T!cY)h)*%uPvK%DhmfATHg#$SH%2{ z#$#Zb>lY}AB5%*MAx==rx-*l@yzS869UmP0a{R>;KHl^UE5Kch--Kv)1nYoFj^-@8 z(CPOl)x9s*2?9`%X^q8z zj;yW@6lR@2ZV=>zh?B{5VpcQlr4$A9EB*-mZHM8bHK^UW<{b zEJ1#}wDW$Gh@W2tD^6Ryn}&q0nhSZw-dEeui3P6h=a+n36&WrLsvt|f{p;+qet?i7 zXA^nBlw!M;^suxny}$JbqBSzOx;Q~4ms_=^#}(58pUlbrxrlf>MHy{@$|l>Pg6COR zeT4A_kDIl?+bOfw*(enaMtuPq@*hSM6nYXL$j5)2vo3w@gf|!f0D61?0HXhP&J;xi zgk?njp0Z$#DF{ts&9Xn_N@{t`7sw%kp>^|@IxP=HVenbMa2R}(zm7Ms8_d7>#&0r^%0G(vbkZbQ zMi}9nE^uV)`}UEK4GNStJ+!vkhkNldpd4E8mNhyOM_$S&n6HVko3D2_Vvw{V51Ln} z*f5$%gWpU=KJGYJTHvn*qa4gCic8^|L-Kf>AiFaDgw&VA;?y(wqC?Bumki651f|zo zwP~BKx$dN+Q$Ii&a%0=n)6njT8dCQ#Mh@w5;hUCxw8hhMEo8x6^O~_j{0(k$8N65vOxq_Wu4P%?%$eN#>$A&wsM#g z)A^WXwM`Oo!WN{Nb6<63tP30eR8!UfO~$LsEE9@B6YFU;bH1Gh$O8J4lg5X zDm*f%K;n)_!x+H2MS_VNRv*M!a7(M)B)*L!+@fO^g$>F>Xa#Jfp{5qE*`LV zZ6DRG9+U;wW5spmxh^*(uXmNUoI!E+VkyQbvemlGbcyviGGu~+R~AG+A0w?afey;x z^W#HbgSTiXXkdra#VdxeDJ8}3a3$SzI${OY!9~DO!|MpmUqLn;vPW-`*b@{R$xQmK z*OQs9FK0l?2}u7rJU3QX9%qv3n+{FhDv@94Btn`|F~5&ASvUfkfCZ^wMwUJyKZR3J z1a}hV<>8bGrb696m7QUzTpws}^~@`~(7t=2wYsu}%b@A}6ut_aM7=fq%t`<*j+iNX zIkd!$EhE7Bjr0oS;mTS|_ZWtVEk~!X z1w`d;SD_I#rJsW}hKu3kT|hnIE;_-88=Vv`9AA>1QQYcrSyU|(sPSyR2u~U5tSG$8 zPY&4eQdEH+$s_7?3SXNA9cYY}?F^49ckEf`JnD|phhi)?-0F!}fi(GI2MNx}E{x8; z!CxmZtFr)I>@=fxT)?4t(odifAYIzLdst)@d=ozeI1@g7||%oPMHH0i_F8+VGi*v`!UXFYq@Nh?Lb&K>24#tvow zPQRIiB4~>+D6YM^+Q@n2CEpI*Ut553kj!q{2653c_8dCHw7g+_43g@$fF^fx8MT|% zpA5vM&J=SbYM778P)Ak=gqm>{#IL?a&quvWy9gvFnI^)X!6YpXI}dCyq@4^>p`wUm z);5s>yE2Ou`UD7`)JSsbL;uce?KId+5c`yDne;SiGqX(a5%seUwTLvFOPxv7aPYXP z;!A<~1pKKA4Kc>-XYE zOT-)1cFZKpvc+&72%n=~>G4ruR9J0kIH0Gna1ij!o!AzrQ7vsIyqG+RASc%12pt18#M`{2*f?!qfYxVCIV)Qq2eYTz7si4mZ=moWp4 zynkPsp|s`0H2#o4LqZ!-i8{^pOBRNKsuS6ngenQ!H%kjI(-TkmoR#Nl5I23$p}fqY zs5Nw1QiC9)Bp640(^|7*f*o{Z`|{Y6IqUY zS3HfF4P#X!3SDbxA1{h}{Clk{)n{{AfKG!W(J2Mu(rN))but}6E6PbYBM)?Vqhh!} zgSqm0qE)M7-G$wNcJNggHsxF{hBtLpMy|#AYFty`kD)VMnr13WPebW1%agcdTLr9Q z=?G{|@EQhU*km@o=vpn)KRHNimiKOI4#h<57j=XD+CdET6@q3``Fm6;@>$KOPHasL z*2wi{&iyZrgqlmZa69kB)Vw4bXgIIU$GWflyQo$01{#l9>bkJqSeLhns|Ii?GyP$P z0_!oXZuMBNT5F(;z&^@W5I}{*W-a_2wWK;`-M#>{GYTNhSW@Q#c^a;{gjWEP|_{c6`IYoV)UQ*3P}Wv`ZZ_cCP`TFXE_v?JhN|ZzvD=)QH${VUV(W* zXvekjP~liG|%xt%*^uIKD0@Uur& zEdV1qI(nDBaE_-DF2=1Ex%~dbPB6QHg0iQF3WnmJjMLitDXWw4bH?RA`1p8@cBHX^ z8j*{)Jo`k5Kg_B^zOKvxkfKEbXDcUX z`&M;_ivx0b0{}jgX&2)5?xX8tq{T@b#pSy3caagt>?7RPfc=y;#3US;fsWX};U#(| z;c1<-;Y5Fxk%a7ks9dd_7xxMfBAIjCr#V8iw%9=vJPG2H@`haKzSR()2=*@Ea3eKM z_>CHRUa&t9@1p7aTVymX9NK)U>A-plHl`!@qkHLb!wq}X%iguaLdI*uQ-GSu4dgv| zGRSEg$L!V7($u%i1=38GGJ=~DgybB`@pe=V$i>eJ0P7pyfKCvVmS+=#0Q3co57S%1 zQ~T{s{BgpKP6wdLCR3ZDwRk5(OY7wthm?xdjbnw?yvs+*;>bfJm749kXb1bfo7;uy zo?s?Q+b;eVsHndxMkIpH_`P-JnqxHBSur4uLYo81-p1V$e+tqRzSDD38KURT; zrk>pTDo=6rCR~V5&ilwkU0%^`HI+@Z7H|3_xBP9B9{9@kz4`)N8oOmtN3+gnKXOS3 zhg@8&4YF|l9c>}Ka0clG(&b!0>5{>kJMRb5Z@qH@w1U8bne3oDFFz3l?tFvlQL-Jf z)vSzl+r3&3iRwQY-2&HpEGnxCWL{VN6H;cgv&P;ksT0-fks|u?Uv%+GsIQe0DQqcK zqB~*Sy-6PO-0OJ&y?0L2*J8M-;J4q%6hB4!u~mU=)1u77G$8}hF-&;QmjfYo*j=^y z@8*^ilyAimD-DCX0(j<$ki6qPL1$5JGkU=LCqmr%A@{RPxV;R@pP^12h&LWj!)}|u zeMD$P3|a|fQA}NaRo+lixg-FU#Mzf=MR2-*G#C}St7{R4FB06PyXvv*T5xh(GL}!R{ z9J{(}1S`}y-c>vi_c!~tMafE?b>Yt8y4rcs@1e*cB|sKk*}HkXI$cx{4>CEvj)eU9 z8=5bM6L<6lDF?TUJCh5i4hOHNBcorx+znE;@1wu*mWRc0Qb#IYYxHz^pe60%ct034 z<^gF$kK_Rr3M}N{0#h2Uf;#n+z+GLzU!^vX&+Oz|m+i2qSR?|HG(z0lc_V2fw*AVQ ze1#XVunEDo>AgH%Z24Z_3FCi0_pXj+db&-70w5Dt?C$Nh$;X1sdqj$iTJm{=XgtdI z`tD{L~Ywdg1T>+e7AgLJcZmqOBN9)e;Q? zIUCYJ8qpc+IK!K2JE`a6{r-4SauSRGZGks%YRRoFO{-!Fo}qnvcWu+)F3T2uXVAdd zLqFlWlddPor0rs-cryupHncJaV!OXOfj}yHsh{0qdo$H$uVSRlLMLJlZ~FKU%CpyU zY^WHxa=&jF!Hx6OhR7@qb0y9#jp}vv*uoMfGpDYk@FE264(p1y*rr% z4~z$c6H=QC&IykC2V;vM>otk}7i3TGnju`XCfLf(i+3bJT7#4fM&jBD4o4p!7Q!cv z74}e&&>F^d3)!6HVoDyY1Lat zptJSe!?*}d^H?E+DlAO%cfjuJLD!$bQpu^{gw(fOTNzs;6j;Ja41aEbfF3aVx2Pv3 zk^_6V?z2nuHbw>urx$d-{*mw;8@~gX0*}D7LVdP2H-x683f$RD$1&Ohky36yu|Q_p zRCEG1UW|@dsG}}`k^D4BM6^sOK?Qc$eJC;B&JoJ{`IcpOEBi*?&Q+ThS6AEZw2`Zv z$)4{!xd%jSc)YZ+SN%3`b*Rju=WRKHt4mODdQodO#qMn@yyEjYg4;(_I0rJ*Nuxek z`NqkdlzXLYeU@`eEk4cLK^6JMXG1*@WC<_7M12(F^*wO?enR#o%Ud0EXH0?-XU;z~ zP=2;N0O~O`eo1+JJguks$26ep8-zNwz!*{r(`w{*;~-HL)uK$NR>kamd6)({aR|#Q zZ#-@1(8!?-ph?0mLJ|}MSUXcvVF`1-cYBvN*L*cOK+93m6n#v;9^~G`55>4N{Rr9D zKr#iVnDC_8hX=*Z;bn`P#+*sLN6)N#$D|TDSJ=wYs}g8huWk;(oypiVM>!4;^EX-) zA-Z4NBwNY?jcYX3!ejeCf16PWOqXUxMGT1bU0lkd?r&pEB%Pj~x>YI*bS!h>H#bLNg0N)}%+q2F| z(dQg;r0Dj4+2e$l#N0>+!vK~6t23{;UIGersZjL4?;SS64&h~K)M|c?!S+!nEz0|1 zSV<447uk;n`KwH=5~k&n>kL2lz7~Ud*;z@0lHJV@-+(p(`>j*kxL2^=YRrXBN@pGP z7^f=-o?0{pak#8Yo}^Ul75b+KH*!3*>jp+*L3ti8 z=8KOCom!~HnzQS-BT=Cs$8!=l1x;mj?l?pumq*j+a|phPhtVw=~_F zOY;gg&tr#ywm$(J0(mlHLB6E&!O+ynM~$Cm0zFT!B2HnU<+tZaP6rBkIfT2jeF70e zV=2YyFx6^hrXQ^a+~A|^%s{_mgoDM$n&Xm3ge+=Pnxe{SP-Q#lqA!~CR!bTdvsD^t z)?C2bXH^93xjvF2NZ2_~KW2J#9^<{1i}#s)#pw4(%J%A>PgJa9QL|yQI&gc&spPQ9 zQy_{=XEXQr#aOS)Z)6TMZN=SHvLeBGThf~*97+O0RjoXI=+0{hPqcUfluPaImt#tA zZ)c1gJ<(Ly^n2)4?u5SQL*d-ly%QCwn4fj)o$aRK^CFoo-ghVlAgGFlBIg!PaS=vb zL7l3JuLLPX7Q+|`qh-<7{k9;d(#Z_t5T|ptY0e?5ksTeTbBW+PBG9Sj31yf%)RCr; zLF3ND1F(sLjG|w;bqvB4ENRR|i^_$0Z~U^ys&i0vd}ig~L4xN_k+pU*D!&4aha-5&1TB<7{UWjA5bGwpsY-4M2%nnyvK~@HWckOZN@dZ zA4BH?tCpXcGq108)){D2udJ|2BHAxECtYl3<@)b5{+{+vg05C^4Q7lB^Bq{AORz866 z!Z*ac{Dv9O`ja4b@nMVZi|jT($ZXOL-Q6V(GHQC*9wiCuon_B&dK8|7BMd(rFAM$= zEbF`I_sK#mp7A(7Bf?JM;Fyk+=DPcMGSHuBF&0!yy>22{JV);tZncpeR88-bc_9$rg!uPekoX(@E+bt7*@8pOnLyow_j=~RKywloO} z?^5${z%LrCLV4RCzzDs5Vf}HfWs%(iQz0RG60gO`Qq`dJC$bxJ8Kn7;POHo}&bQd6 zCCj`@JNmS?i6z*aCtI(A05gaePj0R}tn|Y{|G)x;5Igg{3sL4Hk7hYYC|!AfRZiJS z*7vk{V4JY9b8@cO%^@6>)5An@HHnN+Nz`*)A!bI2R}h3QPBCXq2_0R_Gw7IWsTua0 z zi`w1MtNeU2#A#%6n z4`9r&fSwSd^@F$m9>X=5^^@(thg&|X#T6QG z003CT|A(rv>HiaM{VT}&SJhZ^YZ|)+v1>&MVN?WAAV;2CLTeR0*zyG442jq!zEK2F zsUvC7t!XoEQ!WQe?~(95$U7mMS?Id@ag85Ft3%3xgU9iBk|8JkZ@T(yWaU@)+xb$@ z#Q30SQyf_PF8Eo~mEgQCC_AAH?0`!v`OAHKt=xM(YmPI~`syS7;l4 zdty8IFrpj>N{lhkL2k`;bjC_9S`Vm`9W+;Sh!%6xY&V=lXK}OK4;!aQImA@rUZ$HY zs(7|BK81Wa97B+I#dq3ezBXU(O@HCGwH|o_%c*}Zh}+9MJSJsX~GZEaaRt^Gb8Tkg!VU!4E4Z}L$1gy^WC-g8;OCNEju zcO7IyUD)p@i^83rGLll~D|5WnKC#Ce7IDuqBfmw=$K$9)Gr+=?los>6;raqm?dILb z{`|eirDbP@0bqgI?S45wz+AIS_aRBUBhUApCUj;&g05x-qfOV%m=|8VriLdf zeLW?`eABUk>-}K6$Fv&hVnj-E-gJ(Cpk5YeID3a|W=Yid!mM!6+``^}RGmLi^bF+0!N9QRe+2 zcr=flN*Dn|?>VL*;pC>+?Y2aq_ApHA0C{5Z*oW&S8LWJ-m=?0ACIWH;?2*;|-0al6zp{7& z`(n1&UcO+tv%Uc3J zG3qTNh3G-X94etHAKnJvvG~ru&520}JL>(=pN<23tv6-swOM~eKc*gol_Yx>aJwRF zkmB28U{xKPP0SqV<@eu=9$z#!>_j{611^voc{`1ekI=|Z=^1TM@rpJ_N%D(gVmb$Z z5FPyqeB0It$$qPS2M9?1Keg1Tnio`7cD4(&y45ye<-{AmcQi0c*)!=t56=Dq%WWlX*@Q4XAS zV%ji1>xs{~yo886TpV@8p+)ML;=V;0k z+%bVJTocg28rwdI98E!0KZ6IP_<2~VS83UZ;_2GAuyJ}$VbUPuiZgL9I+hVNp-1ln za0%Bl?Z!04m9#S8WcQPqpdI4$bs}*B1`qZrdUHyaDGqHivrj-pS)P6r=ss-*!H>w; z8pgP69jR5t+yVS1o0W2}a-Y{HqOD_ucIEOxh*T7LArQ#7{YLije5C;bBj&nMz~kqO z>%Pf{@lHiL#GGE8N?HU8A-tBLn~Sr~FqI`Gr19|65p(J*DQ{b?;uqLb^<|YE&W}n@nytelLj&b93L9<;rw;j4Ht6MuO$bL)O7}~LzB0S*68bnL9mTPJ z0{p>ipy{@9SFF^lzla9n?%^$bqP3%e%SJB`DBM-04TwO=%4qi*6-5~m(4V4alJVFg zPlp%&XrgZQXqhDRO1w;Zd)~CG4m8NCYPB)*XtPiTox;<|+Po#*Y`_-1Q9dENNAFwAX})<$$t^+nX0B>H~aCSR*HmRILP~u$WOFfrP2NvF-Bgq#V7Rei@ z#}zlzkq=o#qLyNO`b7OfP~kQsoKJZKFE`>{zlsNQ_|x%AEjov1qkx@EB!|Lz zb2+ZO`|XsZ1(Cn}S#!Gb;blEvtEOj}ZF})>upHW%ez$7AolCx*%cu+!eG1bW;E8mP z8UR#SP}=HjHFP#~p-9yf%e}rw)58i4eg+RIn_>w`a5A~QHfVKIw9v%TK3~ux!pH>j zVM0^G%;KKUB2EG_RB4kmUDxU+ePp!tT+PL{$vKWjLhJGk4Dhd_Molc;yoNSU7NVwK z`!1yurX%_hXFn|85eQgMD(*MP)`D(a*FjN0a6qm0=psBmg-vM2YZx3Qa!p-st)=BR zz*Kb#!B8=|3ej|qLOvwlH$BGqU<{8cSJo3|+^8-?;XH~@RWW%_ukO|tYU$wy*(h3) ztO=HcjBe;ehxPv3SClHa35g--ML$_Rg=3D%;Azw3_aWfaVA;qHRVQGwgnN(Ks#=7mm+NLhENEz%AR00 zixBh%Fi{6Bw&?^}XgvBn^sa9kYpE@PPPUc7z{=CT2UoAfP5z%nu9J02U^eER1>W{0 z9dUtZq)%tMc)Ft1?JW0)G%Rj$QXPBBFPn=%`HF&3;SIBelgD&`+qkv%K6U(FHvhF?B^tD7d~AE0Ko!3+mZch6SS7 z{L%R)>w4{e?p(xqE^roObr+9St!XU&Q3Cn)5}~b#FCB-4YXt88by0Oz3EWt)dCoiM z^5pyP;&i+j!Bhnd0Kfqr0D$4Y)dCz$9Br+f|0Paojcjd<&HrDSnx)nkv%!YY^+64B zD9>LDYP_(p9Y8|sAQ7;Y%ZmakDPa^IElfpXGScEB+*7MJ&n`5c(5VGNfj|&W3b)hg z{$Tnj`1O3YcTf@=d$avr&F5Ok1G*wN$5CPN8++hq{VHOg@th<0BVXQ^hWwjiNegR? zO^lbNUo34W!P8f_jIvip>HQ zSKHSn=O<2AU*zbA9mk~$y)FeE5^Px4M%VUnanLRbddV0Q2?JhJ-6UK7MoOI@fO05} zQm*9<&=2a;*i!o+k1Kjl=gn^d$QU~Dt3n7{IQpeuzF$>7XkZD2vLvYPu0)x3OF2Op z>ylP-SU`Vv_EF+bOi1DqO1nV`q5?z$OYm5or<4P4&+`MY#SQn(N^uQ2mbIcC-Tb>n z?kN<(+{p=i3E?FMZ}NFOfz!Wy(=v}<2!VF>(ZXs#_AlCt87&q;6g<>ZP339}}_{qU_HP&CHdlxrGpk6?O2LV}eEuzh&-@Q=Hf&a4Y>w{04uPTn!| zlFtLB0L$P9t2z{&3{OY9BG?H$xXyg$$5Ir1YpjTW9bQM4Q)H4F=X0*>Lp009&6+@IyI{;p~7IEhlCZsRW-whsi#S~GTe14KrlV8W}?3>;RY zrRqguydz3k;20m2nX3a|+$YANz^%v%sqsJ?pIZfKMRCiiF0*35+6bd? zyWITyyWAsFZd7^dh-6cj^BmWK}nFokpHZ5Oo71HGHjH&lHc*c&0~8xvh9p)0mci!|`XO|kmyVjGBPTXVI_ne)0cHKB%I*S8mMenD!wWOZaF40f-zz+7fjVW4ZMwHXit`%*12oMigIHs zzPQ{uCvY{7>xO(MLXU7Zvm2%cJ}O^u+#Y$JTAIMkU_pje26xW$BzlCYIF+W|B6wLC zg(@Zu_HRVUxWa`Fe30JwH1(xab2oA1KSg}4;+n|slatj}gfD;bYsQ8QcDMZKKUdUPgC zG@Issa0s+abpd~jZpYw0otd%)40CgZT8%I^qIdmuK07wIlI3-nn00}L$b&(U*hl{8 zTn^&v=Smjs}*rFfBU!<{dtd}fuc4S8Z_PrN%DP16`9 zdik$lTy7s-FA1JGQfqy$$D2?V+7@0_pL{xZSDxHAH9nLlHS0Z*c{k;Ql6hv`9$oAG zyNe>p9a4%12LQN1{6DxTM`t?|2S*b}$A38~6E`OZ10$!unbc@?sRZH{#H|OEu(aSp zs014qxr*N&s>GoKd%?dLX+vA01xY2`%ArgEL?SfJkAPRZ1F!Q6CM7sg)y~avM!})_+I8KTrrFOIR?wb-AdV?Imly~BK1?3dONR&*XZl?`faZ+diicG9#O+!;c) zXSH+|riy)LGm6<-;NP>it#o@Bos?Ewu^U*|(^_h7x`%MRJKB6d-iv)&+x*KyJ(t$A z`!$dB%iNWFK0h1R3mu!*yxz}tTwNt!qBD1nA3E4Md|M?bEgRGxK)Rv$Ni^lA4DI?H zh$bBJ>b_*N|S9{dfPEk+I&h~m+uUa49!w7*0>guv`32aMS<3A_Ep`zHB0H-2foal4^*E+pvMZ(sL{$2Z-mAcm`a@RS0~y&iTyxmAf}3ol-r z2i#<%Powf!_||+3q3La?Z0VYd^TmeOR1#Tg1^?Hk%Vk@hH$(Ar)bM>h=%rpC7WM%; z8dY&DhA&5$)9&GQMI#E>x7tKSb)*fAWqZXO^j~sffMTRM((>7j%JQQ7a;~Td^Bqc8C<5GmyuJjcxfxoWQ508#yLjxL{bhbkTdH$7D=%>=BCKf`|U z!{$dFa&Jh1%;^6DgnhMzc(ev8=o`kxKUVHOfRh9nm2s^OH-Os6MqcBJwZqz61Cn7` z)9mu~FCoF9a0no6%gz4|E4Qo52psNk9dD$I%4X8&0#3SfdV}z7T1USp)Vyd@;cs-M zYFw5F(3P(ytRK_n^ijvMtM!(fvYpJH6#HB$@R$m7!D@_Eq#as4Z{|(i+l{IgYvr}K z2=5nt+2o`EQmPWc$StULn)AdbJ{ipiSn!o zh5E9IJUJEcaFCkb0sb@-?;FE4%TtO~GLKv&;Amj45m9eUBLS{sG{3s-mT;W{4wvpg zB_ZpvWp4p~RW-~YY5abr5k#nR?n!aN8Ajj`F_&&5|@`Q;@J;PE=XDS;t1ew}+Z*yGJlMZ&OAffwBs?g9HW`8{5Ub-^p9W zd0I#xR^LI8I@(_Z*WA7n?IE_8KBa;hC*V7y|62^tFSiOv6Zldnz?_6(tR6cL0z_uh z`Mt1ty&0*|zcde3=ZCIIvTh=^6~-a{jUCP(wROUI*SskWK2nQv?}k^ZQ#kkxxV4~B zK%q8H6!gz_lMVP_4-2iXxZT{3jzfGR+P&A;#7xV@hHde-6KhGIN%!)=X%Jo*l~cxv zIa3}RCye>@eOmZtn0xs8`=Gcg3b=I$y&TH~7|LyGqc05ujpOE8eYoD@+f1*z3f@Qh zVX~s~beg^X%)=a!c_2CDC1qDxc$L|xls)VEL#mifMR|a~#!8^0_SS)}m@3U9$a@!g zTU(ch%JQFu-u8TdUQJ`FhIJwM?(*akZ`>#3KMn)61!n;Vt3pc z0L;+=%E*34fD=v9*qr_dteCtZg`bI_+94PQ9*bVBe<;WUpUi-5EmWQe^-g5EJoE%d zTq3_f*2Rdj^~Eq9%mM#Y82ccR6vIdrZBIPjI7YkSd!yn+Dc3wvee?9*JaI>HBAXW@al5NkzZNO==nLTsWtgh2u` zC`haxl*}8E&gs#@Fb|Yvoc3lgR~u>?fzu4eTkw!RQX#%Vs;l>1y6_?97^H9{G)hm| zWz&p&g)0EN8g}sD$8z@{xe|R}Zx=o$$ z+8XtQBgLG<^IX&XivNr;qSE3%-!U+NS!wBr4>dmAI^0bC89_;3fNf8HQ&BlF_qB#M zfLA2j-e>I5;U*(>@m30w!@da!J5~&zXOaYc9a+>}5jBJ(t7)5LO#2n59JlA4w|-M! z^pkA1C!qgc7oK3r828gddEU9wR%AyNiI}AFmDd9x++OXEPB`QKgMO=CWe;mvNxN8U z?mYhU$-q2lDR=JsIlg$5YW*$-OXJqsI?YY&BkUJJSH)qpkxkO23V))vx&qao7eEx? zLZ}?T@eukp4mHzL-*2P}GhFnjM)~H29p{X$m@|Dk+gpj|2b~- zKg5{7!O4I8%KvZp=%2iQcH#XGZ{+XR{72q@>dE^j{-0In|G~52{TKYd)u8{${AaS@ yf0zq2|AqM Date: Mon, 7 Sep 2026 07:23:58 +0000 Subject: [PATCH 19/19] Gate C: record the PR and one corrected transcription slip; return to the CG-R-35 hold Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01Y3FvW1MXgLTHziNsn6V4fY --- .../gateC-package.md | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/meta/sessions/2026-09-03-notation-falsifier-prereg/gateC-package.md b/meta/sessions/2026-09-03-notation-falsifier-prereg/gateC-package.md index 7e82039..b8a8266 100644 --- a/meta/sessions/2026-09-03-notation-falsifier-prereg/gateC-package.md +++ b/meta/sessions/2026-09-03-notation-falsifier-prereg/gateC-package.md @@ -23,3 +23,23 @@ Opened from this branch against the repository's default branch as **the provena not the delivery mechanism.** Anyone reading the PR sees the whole design — the set, the proposed list, the reconciliation rule, the audit and the scrub record. The receiving session sees only the archive. The PR's URL is appended below when it exists. + +## PR opened + +, from +`claude/notation-falsifier-prereg-b590ym` against `claude/seed-specification-foundation-g6a2y0`, +2026-09-07. Its description states what the bundle is for, where the audit and scrub record are, +both manifests, that the bundle is handed over as an archive and not cloned, and that the PR is +the provenance record while the receiving session sees only the archive. The archive was also +delivered to Emil directly in the session conversation. + +**Correction, appended (`CG-rule-09`).** The PR description as first posted carried the dropped +schema's sha256 in the *before* manifest with one digit wrong (`…cba53fc67c6` for +`…cba52fc67c6`) — a transcription error by this session, caught by re-reading the posted body +against the committed manifests. The PR body is corrected in place, since a PR description is +not a repository record; this note is the record of the slip and the catch. The committed +manifests and the scrub record were never wrong. + +--- + +**Task complete. Back to the `CG-R-35` hold**: awaiting the re-derived list.