docs/README.md
Index
Standing objective — Perceptual Fidelity
The architectural programme is complete for the domains exercised. The architecture carries a rebuttable presumption of sufficiency within them. The optimisation target has changed:
Not "can the system represent reality correctly?" but "can a knowledgeable human naturally reconstruct organizational reality from the rendered world?"
The renderer is not an output stage. It is the final information transformation:
Reality → Observed Facts → Derived Structure → Geometry → Rendered World → Human Understanding
The remaining frontier is that last projection. Every visible feature should satisfy four conditions:
| Condition | Machine-measurable? | |
|---|---|---|
| 1 | Observational truth — represents an observed fact, never an invented one | yes — provenance tests, W7/W8/W9 |
| 2 | Traceability — appearance traces back to the observations that produced it | yes — scene-graph and rendered-dom witnesses |
| 3 | Perceptual accuracy — independent knowledgeable observers consistently infer the intended reality | NO — requires human observers |
| 4 | Necessity — removing it measurably reduces correct understanding | partially — see below |
Condition 3 cannot be self-certified. No test in this repository can establish that an observer understood something. Claiming otherwise would be the substitution defect at its worst: measuring pixels and reporting comprehension. Work on condition 3 requires an evaluation with people, and until one exists, statements about it are hypotheses.
Condition 4 has a measurable lower bound. A visual property that never varies with the facts carries zero information and is decoration by definition. That is necessary, not sufficient: varying with the facts does not prove an observer reads it correctly.
Quiet is not truthful — required on every change that reduces visual activity
Every visualization change that reduces visual activity must also improve an independent discrimination metric, or it is not progress.
Measured, not asserted. Constraining the embedding drove false motion from 51.3% to exactly zero while discrimination stayed flat — AUC 0.675 at every anchor weight from λ=0.3 up, against the incumbent's 0.831 (embedding-stability). The noise went away and the signal went with it.
Less visual noise is not the same as more information. A channel is not improved by being made quieter; it is improved by being made discriminative, and those are independent properties. Reporting a reduction in visual activity without a discrimination number is therefore not a result — it will look like progress while being none.
These two belong together, and they are duals:
A quiet visualization is not evidence of a truthful one. An empty channel is not evidence of a missing ontology.
The first refuses to read reduced activity as increased information. The second refuses to read an unused carrier as a gap in the world. Both close the same loophole: a property of the display is not evidence about the substrate. Introducing a canonical fact to fill a channel inverts the derivation discipline — the fact must earn its place first, and the channel is where it lands, never why it exists.
And the result that outranks both, from the channel falsification: the channels collapsed from 0% to 95% false firings while attribution held at 100% soundness and 0 mislabels.
The stable semantic object is not the visualization. It is the explanation.
A channel is a projection through a reference, and the reference is a free parameter no observation fixes. The attribution compares a retained magnitude against itself and has nothing to destabilise. When the two disagree, the explanation is right — see reference-mechanisms.
Absence has exactly three states — required wherever something is not shown
A subject absent from the scene must answer one of exactly three questions. There is never a silent fourth state.
| state | question | carried by |
|---|---|---|
| placed | where is it? | it is a building |
| refused | why isn't it placed? | World.unplaced, with a basis |
| unobserved | why don't we know about it? | World.unobserved, with the vocabulary applied |
Both silent states were found by using the product, not by reasoning about
it. unplaced never left acquisition, so a repository with 8 source files
rendered 7 buildings and said nothing about the eighth. Non-matching paths were
dropped at the tree scan, so a Python repository rendered 0 buildings beside an
empty refusal list — and an empty refusal list is a claim that nothing was
withheld. 265 files, 133 of them Python, and the display said the repository
was empty.
Neither was a false statement in isolation. Both were the composite failure: individually true claims a reader fuses into a false one. The partition is asserted total, so a fourth state cannot be introduced without a home.
Verification grades — required on every perceptual claim
Never report a semantic improvement without its grade. Verification strength depends on closure grade, not on the existence of a test.
| Grade | Condition |
|---|---|
| Verified | every representation carrier is observationally closed |
| Structurally verified | every carrier derives from tested logic, but one or more remain observationally open |
| Unverifiable | at least one carrier remains open |
| Unknown | representation graph not yet established |
Current standing: unstaffed/idle is Verified — the only one. The
identity/alert and uncertainty separations are Unverifiable, both blocked at
span.style.
These grades are currently prose, not enforced. By this project's own
paid/closed distinction that means the discipline is maintained by whoever is
writing, not by the system — the same status the composition exemption had
before COMPOSITION_OF made it fail on regression. Recorded as a known gap
rather than left implicit.
Closure and sufficiency — orthogonal
Two properties of a representation graph, kept apart because measurement showed they differ:
| Property | Question | Measures |
|---|---|---|
| Closure | can every carrier be observed? | confidence |
| Sufficiency | does at least one truthful carrier survive for every fact? | robustness |
Demonstrated: flattening building emissiveIntensity removed a carrier of
activity, and the fact stayed fully represented because district ring
opacity also carries it. A channel can disappear while the fact remains
sufficient. Merging the two would have scored that as a loss.
Mutation targets and outcome classes
Every mutation declares its target — channel, carrier, fact, semantic,
invariant — and the harness refuses to run if a target is undeclared, or if
a fact target edits a single site (a carrier target wearing a fact's name).
Outcomes are not interchangeable:
| Class | Detected by |
|---|---|
| Instrument failure | SKIP, BROKEN EXPECTATIONS, INSTRUMENT BROKEN, UNDECLARED TARGET — automatic |
| Specification failure | the mutation does not produce the defect it names |
| Implementation failure | the guard really is decorative |
| Genuine regression | a CAUGHT mutation failing in normal use |
ESCAPED cannot distinguish specification failure from implementation failure — both produce zero failures and only one is a finding. The harness now prints that ambiguity and declines to adjudicate, because treating ESCAPED as a finding is exactly the error that produced a false result here.
The pipeline — one responsibility per stage
Observation → Canonical semantics → Projection → Presentation
acquires determines determines determines
truth organizational meaning representation human perception
The ownership work has progressively removed places where those responsibilities leaked into one another. That is the accomplishment of this phase, and the three invariants below are what keep them separate.
Three orthogonal properties
| Property | Unit | Dynamics | Failure |
|---|---|---|---|
| Semantic ownership | quantity | binary | dual origin |
| Projection purity | projection | continuous | hybrid sourcing |
| Projection coherence | system | emergent | divergent interpretation |
Coherence is not optimised directly — it emerges from the other two. Chasing it pairwise is what produced accidental agreement.
Canonical Semantic Coverage — the primary architectural KPI
WorldScene 100% deriveAnswers 100% verifyWorld 100% /api/world 100%
toCityNodes 67% metricsFor 41%
Not because higher is always better, but because it measures convergence toward every projection being a pure function of one canonical semantic model. Observable, enforced, continuously improvable.
Blockers name absences, never effort
Every declared blocker must correspond to a measured missing capability, never to implementation effort.
Enforced structurally: each blocker lists the capabilities that do not yet exist, and the test checks them against the World's real measurement vocabulary. When a capability appears, the test fails — the blocker retires because reality changed, not because someone remembered to edit it.
Deliberately not enforced by scanning wording for effort language. That would
be the identical defect repaired in answers.ts, where an organizational answer
depended on a label containing the word "quiet".
Ownership and purity — two properties, two dynamics
Measurement showed these are independent and move differently, so they are enforced differently:
| Property | Unit | Dynamics | Rule |
|---|---|---|---|
| Semantic ownership (correctness) | the quantity | binary | migrate atomically |
| Projection purity (verifiability) | the projection | continuous | converge incrementally |
Never tolerate dual semantic ownership. Accept hybrid projections temporarily while canonical coverage increases — but they must declare their impurity.
A quantity has one canonical origin or it does not; there is no intermediate state. A projection genuinely has one: 0%…100%. Forcing both into one rule would have blocked the six-quantity migration that removed three live constitutional divergences, purely to preserve cleanliness — trading correctness for tidiness.
Declaration is what makes a hybrid a managed migration rather than accidental
architecture. src/lib/ledger/purity.ts records canonical inputs, external
inputs, coverage and blocker per projection; the test checks each declaration
against the real signature, so a projection cannot silently acquire a
semantic input.
Current purity: WorldScene 100% · deriveAnswers 100% · verifyWorld 100% ·
toCityNodes 67% · metricsFor 41%. Those are progress, not failures. The
architectural failure would be a quantity with two origins, and that remains
binary.
The two conservation laws — kept separate
| Law | Question | Failure mode |
|---|---|---|
| Projection conservation | did information survive computation? | a transform discards what it never declared |
| Semantic conservation | did meaning survive distribution across the visual language? | a carrier is cleaned and the meaning re-homes elsewhere |
They are independent. A projection can preserve information perfectly while
semantic distribution destroys meaning — measured: the World carried
live/unreachable/not-wired faithfully, and the renderer collapsed all three.
And semantic coherence cannot recover information already lost upstream — no
carrier can render a fact composeWorld dropped.
Evaluation order for any proposed rendering change
- Does it reduce decision loss?
- Does it reduce semantic ambiguity?
- Does it improve graph closure?
- Does it improve semantic locality?
- Does it increase perceptual complexity?
Reject any change whose perceptual cost exceeds its measured informational gain. The optimisation target is truthful human understanding together with the proportion of Verified representation graphs — not distinguishable states, which is retired.
Decision observables — the optimization target
Not facts. A decision observable is a property of the world that lets a knowledgeable observer answer an organizational question correctly. Facts are inputs to it; visual carriers are implementations of it.
world/answers.ts already declares seven standing questions, so they are the
measured set rather than an invented one. Six of seven are distinguished at
the render; all seven at some surface.
Reject any change whose net effect is only redistribution. Improving one
fact at the expense of another that serves the same decision is not progress —
measured twice: switching department height from load to completed would
have destroyed "which agent is busiest" to serve "what has this team
finished".
The render is not the only decision surface. The answers panel is a second projection of the same generated world, and for at least one standing question it is the only one that works. A fact absent from the render is a projection gap; it is a decision gap only if no surface carries the decision it serves.
Two notions of correctness — never conflated
| Notion | Question | Verifiable by |
|---|---|---|
| Projection correctness | does the rendered world faithfully preserve the generated world? | machine |
| Decision correctness | do humans make the same decisions from the render as from the facts? | observers only |
An improvement in the first must never be reported as an improvement in the second without evidence. Every perceptual result in this repository is currently a projection-correctness result.
The canonical experimental object
Generated organizational worlds, not fixtures. The pipeline now names the stage explicitly:
Reality → Observed facts → GENERATED WORLD → Spatial projection
→ Rendered world → Human understanding → Correct decisions
Perceptual work begins from composeWorld, varying only observed organizational
inputs and letting every downstream projection recompute. Hand-constructed
worlds are exceptional fixtures, ratcheted downward, never the primary object —
because the invariant they violated is now enforceable:
Every perceptual claim must be evaluated over worlds the system can actually produce.
The perceptual ledger
The perceptual state-space map is the rendering equivalent of the projection ledger, and the pairing is exact:
| Ledger | Asks |
|---|---|
| Projection ledger | What information survives transformation? |
| Perceptual ledger | What meaning survives observation? |
The pipeline is now measured end to end, and every arrow carries the same obligation — what was lost, and was that loss necessary?
Reality → Observed Facts → Derived Structure → Geometry
→ Scene Graph → Rendered Channels → Human Interpretation
The optimisation target is truthful decision support per unit of perceptual complexity. Two earlier metrics were retired by measurement, each after it had served its purpose:
- Channel count — retired because de-overloading
emissivereduced varying channels 6→5 while raising distinguishable states 5→7. Counting channel variation rewards ambiguity. - Distinguishable-state count — retired because it demanded nine encodings for states an observer may never need. Decision-sufficiency analysis reduced the real figure to two facts whose absence makes a decision wrong.
A state space must be enumerated over reachable states, never the Cartesian product of field values, and a fact must be verified emitted before it enters any budget. Two errors came from skipping that.
The former metric, retained only as a diagnostic: That correction was forced by measurement: de-overloading emissive
reduced the number of varying channels from 6 to 5 while raising
distinguishable states from 5 to 7. An overloaded channel varies for many facts
precisely because it is ambiguous, so counting channel variation rewards the
defect it should punish.
More information can reduce truthfulness if the mapping becomes ambiguous. The objective is the smallest visual language in which every important distinction has exactly one stable interpretation.
Rendering is epistemology, not aesthetics. The default action remains implementation; architecture must justify itself.
Three epistemic states
The organising result of the foundation phase. Everything below is an instance of one of these, and conflating them is what the machinery exists to prevent:
| State | Meaning | Example |
|---|---|---|
| Enforced | the system mechanically prevents or detects violation | a projection cannot exist outside the ledger; a claim cannot cite a witness that was never written |
| Observed | an instrument exists that can measure the phenomenon | CityMap's rendered markup; the coupling metric over a fact set |
| Honestly stated | the claim matters and its truth exceeds current instrumentation | PRESUMPTION_SCOPE; UNWITNESSED; the coverage boundary |
The third category is the load-bearing one. A methodology becomes unreliable the moment it converts "we have not measured this" into "therefore this is true." Uncertainty is preserved here as an explicit state with a name, printed on every ledger report — not as a silence that reads like a pass.
The strongest claim currently justified: the current vocabulary has earned a
rebuttable presumption of sufficiency for the observed facts → metrics → geometry pipeline, including prospective implementation and retrospective
application to existing code. Not that the architecture is complete; not that
rendering or enterprise requirements are solved. The limits are part of the
result.
Next progress requires either a decision that unlocks the blocked path, or a measured phenomenon the vocabulary cannot represent. Absent one of those, further architectural expansion would be speculation rather than discovery.
Four categories. They should not be allowed to drift into one another. Each has a different evidence standard, and conflating them is what produced most of the errors recorded inside them.
Engineering — measured, executable
Claims here are backed by tests that have been observed failing.
tripwires.md |
W1–W5: known defects with defined triggers. W5 is the measured Article II.3 violation |
platform-architecture.md |
the core/connector split |
core-proof.md, universality-proof.md, evolution-proof.md |
the Step-1 architectural proofs |
proposed-condition-taxonomy.md |
the approved condition vocabulary |
open-decisions.md |
the two open decisions: evidence, options, consequences |
public-surface.md |
what Cognithamus intentionally publishes — an open investigation, not a plan |
platform-boundary.md |
measured inventory: which concepts are platform, HQ, or application, and why |
types-classification.md |
every field of world/types.ts classified against three domains, with decompositions |
decomposition-experiment.md |
implementing them: what worked, what was falsified, and the exact phenomenon |
perceptual-audit.md |
first audit of the rendered world against the four fidelity conditions |
visual-channel-separation.md |
fact-by-channel matrix: overloading, collisions, and what never renders |
perceptual-state-space.md |
the perceptual ledger: facts mapped to carriers and collisions (partly corrected) |
perceptual-information-budget.md |
derivability classification, carrier budget, and two corrections |
decision-sufficiency.md |
decision loss = 2 (scope-corrected); the four-level state discipline |
carrier-purpose.md |
state / decision / explanation per carrier; the cross-purpose finding |
semantic-locality.md |
the representation graph and its dual; semantic migration measured; the locality metric |
cessation-composition.md |
cessation composes; collapse is order-dependent and fabricates a fact |
identity-law.md |
a universal fact identity exists: (subjects, dimension, validAt); the four families are four wrong approximations of it |
identity-axes.md |
per-axis falsification: subjects and dimension survive, validAt falsified; the primitive is observational separation, not time |
truth-kinds.md |
three truth kinds derived from interpolability — state, occurrence, constraint; identity follows from kind; id is semantic identity duplicated |
truth-reduction.md |
constraint eliminated, interpolability eliminated as primitive; two kinds survive, conditional on partial observation |
occurrence-falsification.md |
occurrence attacked across 7 domains and 6 failure classes; both reductions circular; state and occurrence promoted |
world-identity.md |
current standing — a world names its own revision; the picker is an identity boundary showing names, never paths |
world-diff.md |
current standing — identity decides cacheability (×182); of 146 reported changes across 12 real commits, 11 were real; the embedding is too unstable to animate |
embedding-stability.md |
current standing — similarity alignment cuts false motion 78.4%; constrained (SMACOF) embedding FALSIFIED (AUC 0.675 vs 0.831); position is identity, not a change channel |
change-channels.md |
current standing — ChangeSet is the model; the "subject-scoped channels are clean" law is FALSIFIED (height 0% → 97% FP under a moving reference); attribution survived at 100% soundness |
fact-visibility.md |
current standing — no dormant channel should be filled: both invisible candidates lack variance, not carriers; the condition carrier gap is a recorded defect |
hesitations.md |
current standing — defects found by USING the product on unfamiliar repositories; 3 truth failures repaired, 4 recorded |
reference-mechanisms.md |
current standing — truthfulness depends on reference stability; spurious ← moving reference, invisible ← cap; observed-peak pays both; the explanation outlived the visualization |
repository-in-the-app.md |
generated worlds reach the running app via /api/world?repo=<name>; the param is a name, never a path |
the-demo.md |
a real repository becomes a city that states its own reasoning; fact, interpretation and refusal separated |
challenge.md |
stages get adversaries; two discards witnessed, and a probe caught min documented as average |
position-pipeline.md |
position executes end to end, 6/6 stages, coordinates identical to layoutFrom; three-way loss taxonomy with zero deceptions |
projection-rules.md |
transforms are data; scope and warrant are folded from steps, and the fold caught two rules declaring the wrong warrant |
projection-manifest.md |
every mark explains its source, transform, scope, warrant and loss; wired into the inspector |
height-ownership.md |
height is set-dependent and scene-only, so it belongs to projection; loss kinds separate expected compression from claim-changing loss |
warrant-audit.md |
8 channels on 3 independent axes: 1 illegal, 3 unsafe, 4 misplaced; only capacity shows its warrant |
derivation-register.md |
documentation made testable: every declared derivation cites a site the gate resolves; collapsed warrants enumerated |
footprint-and-convention.md |
footprint is decoration and its docs contradict the code; a convention change and a world change render bit-identically |
geometry-provenance.md |
height/accent/activity audited; 4 declared constants were read by nothing, now wired |
world-vocabulary.md |
BuildingKind/DistrictKind split into presence + open subtype; zero coercions remain |
density-audit.md |
verdicts survive at 113 buildings but degrade: occlusion 11%→50%, labels 0%→17%; the 'unreachable' candidate was an instrument artifact |
generated-worlds.md |
worlds now generated from facts alone; two unseen repos produce structurally different cities |
label-attachment.md |
labels recoverable; and the estate is a fixed constant table, not derived from the repository |
camera-occlusion.md |
camera is exploration freedom: 11.1% concealed by the default pose, 0 unreachable from any pose |
light-interference.md |
three of four classified collisions retracted by measurement; only fog was real |
fog-interference.md |
first result under renderer-as-laboratory: fog inverted 36.3% of activity comparisons; bound to the estate, now 0% |
worldscene-freedoms.md |
all 15 WorldScene realization choices classified; 4 ungrounded freedoms sit on the activity channel |
degrees-of-freedom.md |
a freedom is a symmetry group; realization correctness is independent of representation correctness |
selection.md |
selection is derivable to the Pareto frontier and produces proofs; ties are declared conventions |
representation-calculus.md |
seven representation classes, each with a derived false-claim mode; one law covers six |
representability.md |
licensing and representability are orthogonal; fidelity counts false claims, no threshold invented |
repository-reconstruction.md |
first uncontrolled ingestion: 662 facts, 0 gaps, 38 refusals; the binary-state cell met in real data |
worldscene-audit.md |
WorldScene audited: one illegal visual claim (position is a hash of the id); repair class representation |
external-calibration.md |
instrument 15/16 externally, blind to warrant (not fixed); modality overloaded; the projection grammar, executable |
semantic-typing.md |
the anti-collapse test, validated; capability → state retracted; modal force belongs to relations |
separation-audit.md |
algebra is 4-to-1 ambiguous; the relation layer, repaired and diagnostic; convention is a constitutive warrant |
asymmetry.md |
precedence and dependence survive; equality stays conventional (transitive closure is available and degenerate); asymmetry is a property, not an entity |
sufficiency-test.md |
Distinction is half the floor: symmetric, and everything it cannot generate is asymmetric; the meta-law falsified, reduces to functionality |
constraint-floor.md |
Observe falls (a warrant mistaken for the verb); H(O) eliminated; distinction is the ontological floor |
inference-operations.md |
the five operations reduce to one verb plus a warrant; the empty cell explains the never-invent-information rule |
hypothesis-space.md |
H(O) as the inference layer; authority splits into evidence vs selection policy; provenance is second-order |
co-reference.md |
co-reference is partially derivable; the bound is data association, not open/closed; authority is evidence; subject identity is the one unprovenanced claim |
subject-reduction.md |
Subject is four things; three reduce, continuants resist by co-reference circularity; identity = lineage + convention |
dimension-algebra.md |
a dimension is a value space plus a persistence behaviour; exclusivity is functionality; binary survives 8 interval phenomena |
minimal-ontology.md |
current standing — Fact reduces to one form; State/Occurrence derive from a persistence law, which is promoted instead |
phenomenon-ledger.md |
13 phenomena, ontology and canonicalization scored independently: 13/13 expressible, 7 erased |
ownership-remainder.md |
the three exceptions classified: two do not want the obvious repair |
semantic-ownership.md |
ownership table: 8 of 10 quantities computed twice; three live divergences |
semantic-quantity-audit.md |
8 duplicated quantities; verifier coverage of the second root is 0% |
coherence-classification.md |
Structural/Derived/Accidental/Unknown; a live constitutional divergence |
projection-coherence-matrix.md |
the canonical-truth matrix; five accidental-coherence defects, one fixed |
decision-observables.md |
the seven standing questions measured against the render |
generated-world-findings.md |
first results from generated worlds: the render shows written, not done |
graph-closure.md |
closure per fact and per carrier; the measured identity/state structural law |
closure-verification.md |
animation closed; span.style blocked; every separation re-run over its graph |
Live state: 124 tests + 4 DOM, 26 architectural mutations, constitution gate.
Position, stated precisely: the architectural foundation has earned a rebuttable presumption of sufficiency within the observed domain. Rebuttable is load-bearing — the burden now falls on future implementation to demonstrate where the vocabulary is insufficient. Earlier, each implementation carried the burden of showing the foundation was adequate; the adversarial retrofit — applying the vocabulary to nine projections that predate it, with no new authority, justification category or projection field required — reverses that.
This is a presumption, not a proof, and it is deliberately bounded:
- It is earned for the
facts → metrics → geometryhalf of the pipeline, which has been exercised prospectively (P2, P3, allocation) and retrospectively (the nine legacy projections). - It is not earned for rendering.
rendered-domcarries a single claim;scene-graphhas no instrument at all, and six of eight known violations live there. P4 and P5 are untested and blocked. - It has been exercised only internally. Retrofitting nine legacy projections is a far stronger test than extending new code, because that code did not originate from the methodology — but it is still the same codebase, written by the same process under the same constraints. The architecture has not demonstrated explanatory power over an independent system with different design assumptions, and that distinction stays part of the claim.
A new foundational concept is now treated as a regression unless measurement forces it. If the architecture changes again, measurement must compel the change — not elegance.
The question that must precede any architectural change. Not "what concept do we need?" but:
Which observed phenomenon cannot be faithfully represented by the current vocabulary?
If no such phenomenon exists, the correct action is implementation, not architecture. Until instrumentation has been extended to reach the phenomenon and still fails to express it, the default is to extend instrumentation rather than ontology.
Default posture — a falsifiable strategy, not a preference:
Assume the architecture is sufficient. Assume the instrumentation is incomplete. Let implementation decide which assumption fails first.
Both remaining obligations are consistent with it: composeWorld-accounting and
renderer-traceability are blocked by observation, not vocabulary. That is
the debt profile a converged architecture should have — the concepts suffice,
the observable objects are not yet reachable. Those are engineering constraints.
When a dependency is justified. Two dependencies were taken during the scene-graph work, each measured before the next. The rule they establish needs both halves:
A dependency is justified when it expands the observable object space and the newly observed object can falsify claims that were previously unfalsifiable.
The first half alone is insufficient — a dependency that only lets us look at
more of the same is not earning its place. @react-three/test-renderer plus
jsdom produced a previously impossible falsification within one run: every
accent in the 3D world was rendering white.
The object determines what a claim is about. That defect is the clearest instance the repository has produced. The source string was correct. The DOM rendering was correct. The architecture was correct. It was wrong only once it crossed into three.js, which accepts a different language for the same apparent concept and fails open to white rather than throwing.
So the architectural object was never "a colour". It was "a colour interpreted by a particular renderer" — and until that renderer's interpretation was observable, no claim about colour could be checked where it actually mattered. This is why observable objects are named before evidence, not after.
Layers exercised, and how each was reached:
| Layer | Observable object | Reached by |
|---|---|---|
| Facts | fact-set |
existing vocabulary |
| Metrics | fact-set |
instrumentation |
| Geometry | fact-set |
instrumentation |
| DOM rendering | rendered-dom |
second test condition |
| Scene-graph rendering | scene-graph |
two dev dependencies |
Every layer was reached by extending instrumentation, never ontology. Each time a new observable object became available, the existing vocabulary was sufficient to describe what was found — including the defect it found. That is the strongest evidence yet of convergence within the exercised domain.
Stated at the strength the evidence supports, and no further:
Every new observable object required more specialised instrumentation than the previous one, while no new architectural vocabulary was required.
That is descriptive, not a trend. Three observations do not establish that instrumentation cost will keep rising, and this record deliberately does not predict that it will.
The remaining rendering frontier is now narrow. The scene graph is observed; rasterisation is not. A future dependency must justify itself against that boundary — a defect surviving a correct scene graph and appearing only when drawn — not against "3D rendering" in general.
Restrict where privilege is, not where data originates. server-only was
read as "this code is server-related"; its measured behaviour is "this code
cannot participate in rendered-dom observation" — it throws without
--conditions=react-server, and react-dom/server throws with it. Those are
different properties, and conflating them made metric.ts and layout.ts
permanently unwitnessable at the render boundary for no security benefit: both
are pure functions importing only a type.
Removing the marker from them was not weakening a safety boundary. It was correcting a false classification of where the boundary belonged. Transformations need to be observable from the surfaces they feed; only privileged environments need restricting. The general form:
A witness must inhabit the same observable world as the thing it measures. A restriction placed on residence rather than on privilege will eventually exclude the witness rather than the threat.
Instruments graduate before they are trusted. A distinction the numerical errors in this cycle all fell along:
- Durable instruments carry their own controls — the mutation harness plants a failure and confirms it is detected; enumerators assert they found known members; structural tests count their own iterations.
- Exploratory instruments are written mid-investigation to answer one question. They are legitimate for that, and are not evidence beyond it.
Every measurement error recorded here came from the second kind being read as
the first: a grep -c whose output shape was never checked reported 0 failing
for four mutations that were all caught, and a later one inflated 23 mutations
to 27. So:
Any measurement that becomes part of the repository must first graduate from an exploratory instrument into a durable one.
That graduation happened repeatedly during this cycle — ad-hoc mutations became harness entries, ad-hoc greps became parser-backed enumerators. The rule names what was already being done, and makes the ungraduated case identifiable.
Four kinds of blocker, handled differently. Conflating them is how work gets attempted that cannot succeed, or abandoned that could:
| Blocker | Resolved by | Instance |
|---|---|---|
| Conceptual — the vocabulary cannot express it | architecture | none outstanding |
| Preservation — reality exists upstream and is discarded | engineering | tasks_done selected and dropped; the quarantine count held in label text; server-only excluding the witness |
| Governance — the evidence is sufficient, the meaning is not settled | a decision | whether "operational output" means completed tasks or successful runs |
| Operational — the evidence is lawful, preserved, and insufficient | the system being used | 0 completed tasks; 9 successful runs across 1 subject |
The last is new, and it is the one engineering must not attempt to solve. Fabricating or backfilling data to make a distribution look decidable would produce a unit fitted to invented evidence — the failure the whole method exists to prevent, committed at the last step.
The floor-unit decision moved from preservation to operational on 2026-08-03. Those look identical from outside — the decision is blocked either way — and they are not the same state: one required engineering, the other requires history to accumulate.
Paid is not closed. A debt is paid when the current state satisfies the
condition; it is closed when the condition becomes continuously enforceable.
Any justification of the form "X is acceptable because Y holds" remains open
until Y is checked rather than remembered — see COMPOSITION_OF in
src/lib/world/projection.ts for the case that made this visible.
Governance — decided by the ratifying authority
Claims here are decisions, not findings.
../CONSTITUTION.md |
Articles 0–XII |
../constitution/amendments.json |
the ledger; AMD-0003 pending |
amd-0003-decision.md |
the veto/approve rationale, criteria stated |
constitutional-review-final.md |
the pre-Step-2 review |
AMD-0003 was VETOED on 2026-08-03 — ledger fidelity: an approval recorded for an amendment never enacted would make the ledger permanently assert something untrue, and XII.1 forbids editing it away. The proposal is permanently abandoned per Article X. The gate is GOVERNING.
Note what the veto did not do. The Legend and constitution.ts remain
constitutional, so binding any new visible property still requires its own
Article X amendment — the requirement changed from wait for a decision to
propose one. And the ConditionId enforcement survives the proposal: it landed
as substrate before it (commit e3305b5) and is a test, not an article, so it
still holds — but now as an engineering invariant with no constitutional
standing. SUBJECT_KINDS and FACT_KINDS remain unprotected by any mechanism.
Two decisions remain open — see open-decisions.md for the evidence and
options: the floor/tier units (blocking II.2 and II.3); the Gap surfacing design
(blocking F6b).
Measurement re-framed the first. It was recorded as one decision; it is a
decision plus a prerequisite. Height derives from code-size
(structure.ts:266), which Article II.2 forbids in terms, and no cumulative
output metric exists in the fact vocabulary — though the evidence does exist,
in hq_task.state='done' and completed_at, and is discarded at the fact
boundary. Choosing units today would quantise a forbidden metric, closing
W5 while II.2 stayed violated.
Preservation is now fixed and the distribution measured: it is degenerate.
hq_task holds zero completed rows; the only cumulative output in the system is
9 successful agent runs, all belonging to one subject. The decision is blocked on
data accumulation, not analysis — band edges cannot be fitted to one point.
Methodology — derived from measured failure
foundation.md |
the witness lattice, admission rules, convergence theorem, assumptions |
verification-theory.md |
the eight conditions for a completeness claim, and why each is necessary |
visualization-invariant.md |
the provenance chain, its measured gaps, the exhaustive renderer audit |
Status is marked per claim. Negative results are preserved deliberately.
General projection — the vocabulary tested outside its domain
general-projection.md |
eight domains against the core vocabulary — boundary claim withdrawn |
projection-layers.md |
ontology vs projection; the measured cessation gap; engine falsification attempt |
Two findings, both falsifiable:
- The vocabulary is purposive, not domain-free.
actorpresupposes agency,workpurpose,agreementobligation, and all twenty conditions presuppose a norm. Cells and ecosystems breakagreement; planetary systems break four of six subject kinds.SubjectRefis universal;SubjectKindis not. - Embedding fidelity is structural, not semantic — measured. The metric and layout stages ran unchanged on glycolysis, settlement, n-body and freight. Stress varies 1800× with graph shape and weight range while the domain is held fixed, and does not track domain at all.
Smallest surviving vocabulary: identity · relation · magnitude · location · time · provenance.
Mathematics — a single candidate equivalence, unresolved
refinement-geometry.md |
marked B: analytical, unimplemented, refereed as containing no novel theorem |
The programme reduced to one statement:
For monotone real-valued μ on a preorder, with d(x,y) = μ(y) − μ(x) when x ⊑ y and ∞ otherwise: net-Yoneda completeness of d ⟺ every μ-bounded directed subset has a supremum at which μ is continuous.
Three external questions remain, ordered, each gating the next:
- Definition validation — do "forward-Cauchy net" and "Yoneda limit" as used match the literature? Cheapest, and gates the rest.
- Equivalence verification — a referee pass, not self-checking.
- Literature reduction — known, immediate corollary, or absent?
Everything else in that document is proved, reduced to existing theory, or explicitly withdrawn. Progress now requires a referee, the literature, or implementation — not further speculation.