docs/evolution-proof.md
Cognithamus — Proof of Core Stability Under Evolution
Status: PROOF. Not implemented. Assume five years have passed. Fifty connectors are registered. Thousands of subject subtypes exist. A fifty-first connector arrives from a domain nobody anticipated.
Claim under test: adding a connector can never require changing core/.
Method: invent a connector from a domain not previously modelled — not software, not hospital, manufacturing, shipping, university or space — trace every new concept it introduces, and show where each lands.
1. The new connector: commercial apiary and pollination services
Managed honeybee colonies are trucked to almond orchards and rented to growers during bloom. Contracts specify a minimum colony strength. Colonies are living populations that weaken, swarm, lose queens and die.
This domain was chosen because it stresses four things nothing before it did:
- Living subjects that change state with no operator action
- Populations rather than individuals
- Estimated quantities — colony strength is sampled, never counted
- Biological threat rather than security or mechanical failure
The event
14 March, almond bloom. During a contracted inspection of block 7, hive 214 is found queenless. Estimated strength is 5 frames against a contracted minimum of 8. Varroa load is above the treatment threshold. A replacement colony is trucked from the home yard that afternoon.
Modelled with the existing core
condition degraded of resource:hivewise/colony/H-214
validAt 2026-03-14T09:40 recordedAt 2026-03-14T17:05
evidence "inspection INS-8821: no eggs, no queen cells, 3 frames brood"
measure resource:hivewise/colony/H-214
metric apiary.colony-strength value 5 unit frames
validAt 09:40 recordedAt 17:05
evidence "sampled 4 of 10 frames, extrapolated"
measure resource:hivewise/colony/H-214
metric apiary.varroa-load value 4.1 unit mites-per-100-bees
evidence "alcohol wash, 300-bee sample"
condition vulnerable of resource:hivewise/colony/H-214
evidence "varroa 4.1 above treatment threshold 3.0"
condition drifted of resource:hivewise/colony/H-214
evidence "strength 5 frames against contracted minimum 8"
condition overcommitted of agreement:hivewise/pollination/PC-2026-441
evidence "placed strength 412 frames against contracted 480"
placement resource:hivewise/colony/H-214
at environment:hivewise/orchard-block/OB-7 since 2026-02-28
exchange moved resource:hivewise/colony/H-702
from environment:hivewise/yard/HOME-3
to environment:hivewise/orchard-block/OB-7
validAt 2026-03-14T15:20 evidence "load manifest LM-1187"
placement actor:hivewise/beekeeper/r-mendez
at environment:hivewise/orchard-block/OB-7 since 09:15
Nine facts. Four families. No sentence required a concept the core lacks.
2. Where every new concept landed
| New concept | Lands in | Core change? |
|---|---|---|
| Colony / hive | subtype resource/apiary.colony |
No |
| Orchard block | subtype environment/agriculture.orchard-block |
No |
| Home yard | subtype environment/apiary.yard |
No |
| Pollination contract | subtype agreement/apiary.pollination-contract |
No |
| Beekeeper | subtype actor/apiary.beekeeper |
No |
| Colony strength | metric apiary.colony-strength, unit frames |
No |
| Varroa load | metric apiary.varroa-load, unit mites-per-100-bees |
No |
| Queenlessness | condition degraded + evidence |
No |
| Mite infestation | condition vulnerable (Exposure) |
No |
| Contract shortfall | condition drifted / overcommitted |
No |
| Inspection record | evidence citation | No |
| Colony relocation | exchange with moved |
No |
| Bloom window | environment subtype + time window |
No |
Thirteen new concepts. Zero core changes. Every one landed in a declared subtype, a declared metric, an existing condition, or evidence.
Two mappings worth defending rather than asserting:
Queenlessness → degraded. A queenless colony still functions and still
pollinates; it is impaired, not dead. Had it been dead the condition would be
unavailable. The taxonomy distinguishes these correctly without knowing what a
queen is.
Varroa → vulnerable (Exposure). The Exposure family was written thinking
about credentials and attack surface. A parasite load is a known weakness
present in the subject. It fits without stretching — which is mild evidence the
families were cut along real joints rather than software ones.
3. The three things I could not land immediately
A proof that nothing ever strains the core would be a suspicious proof. Three things resisted, and I want the reasoning visible.
3.1 Uncertainty — colony strength is estimated, never counted
measure.value is a single number. Real strength is "5 frames, ±1, extrapolated
from 4 of 10 frames sampled". Manufacturing had tolerances and the space mission
had noise; this domain makes it unavoidable.
Resolution — declared metrics, no core change. Because metrics are connector-declared and open, uncertainty is expressible as additional declared metrics:
apiary.colony-strength value 5
apiary.colony-strength.lower value 4
apiary.colony-strength.upper value 6
The honest weakness: this is a convention, and conventions drift. A
different connector might emit .ci95 or .stddev, and no renderer could draw a
uniform confidence band across fifty connectors.
Where that gets solved: the projection layer, not core. Uncertainty display
is a representation concern, exactly as place and legend were. The projection
layer can declare a canonical uncertainty convention that connectors map into,
without the core learning what a confidence interval is. If that convention is
ever needed, it is a projection change, not a core change.
3.2 Intervals — "the hive was queenless for three weeks"
A condition carries validAt, an instant. Duration is a question about
history, not about now.
Resolution — derived, no core change. A condition asserted at T₁…T₅ and
absent at T₆ yields the interval [T₁, T₆). The core stores point assertions; the
world derives intervals. This is the same shape as placement.since, and it is
why bi-temporality mattered: with validAt and recordedAt, the interval can
be reconstructed as it was known at any past moment, not just as it appears now.
3.3 Seasonality — bloom recurs annually; time does not
Time is linear instants. Bloom is cyclical.
Resolution — an environment subject, no core change. environment/apiary.bloom/2026-almond
is a subject with a window. Next year's bloom is a different subject with the
same subtype. The core never learns that seasons repeat; the connector declares
each occurrence. Cyclicality is a property of the domain, and domains live in
connectors.
4. What would force a core change — and why a connector cannot cause it
The proof is only meaningful if the boundary is falsifiable. Exactly three things would change the core:
| Change | Requires |
|---|---|
| A new condition or condition family | Constitutional amendment (Article X) |
| A new subject kind beyond the six | Constitutional amendment |
| A new fact family beyond the four | Constitutional amendment |
No connector can trigger any of these unilaterally. The connector contract requires that an unmappable condition be dropped and reported as a gap, never coerced and never invented. A gap report is not a change — it is evidence, accumulating in the ledger, which a human then rules on under Article X.
That is the actual mechanism, and it is the honest answer to "can a connector ever force a core change": no — but it can produce the evidence on which a person decides. The core is not immune to change; it is immune to change by accretion, which is the failure mode that kills platforms.
5. At fifty connectors and thousands of subtypes
| Dimension | Growth | Core impact |
|---|---|---|
| Subtypes | thousands, namespaced per connector | none — strings in a registry |
| Metrics | thousands, declared with units | none — strings with dimensions |
| Conditions | 20, fixed | none unless amended |
| Subject kinds | 6, fixed | none unless amended |
| Fact families | 4, fixed | none unless amended |
| Core modules | 6 | constant |
Collision handling. Subtypes and metrics are namespaced by connector prefix
(apiary.colony, k8s.pod) and registered from the manifest. A collision is a
registration failure — loud, at startup, in one place — never runtime drift.
This is the same principle as the allocator that throws at capacity: loud
failure beats silent degradation.
Predicted pressure. Over fifty connectors I expect the condition taxonomy to face perhaps a handful of genuine gaps — a wholly new family would surprise me, since the six were derived from what an operational world can be wrong about, not from any domain's furniture. Each gap arrives as accumulated evidence, not as a merge.
Falsifiable prediction: the core's public type signatures are unchanged by
connector fifty-one. Subject, Condition, Fact, Evidence, Instant and
World have identical shapes with one connector or with fifty. If a future
connector changes one of them without an amendment, this proof was wrong.
6. Verdict
Evolution occurs through exactly three channels:
connector-declared subtypes → what kind of thing this is
connector-declared metrics → what can be measured about it
observations → what was seen, when, citing what
The apiary connector introduced thirteen new concepts and touched none of the six core modules. The three that resisted — uncertainty, intervals, seasonality — resolved into declared metrics, derived history, and a subject respectively, with the one genuine weakness (uncertainty conventions) landing in the projection layer where representation belongs.
The core is architecturally stable. Not because nothing can change it, but because the only things that can are constitutional acts requiring evidence and a human decision — and a connector, by contract, can produce evidence but never a change.