docs/warrant-audit.md

The Warrant Audit

Not a colour audit. For every visual channel: what it claims, what sourced it, what licenses it, and what a viewer cannot distinguish as a result.

src/lib/ledger/warrant.ts, tests/warrant-audit.test.ts.

8 channels · illegal 1 · unsafe 2 · misplaced 4 · safe 3
warrant visible on 1/8 channels
8 channels state their loss; 2 claim none

⚠️ The alert entry is retracted and corrected below. It was recorded as an undeclared threshold, worse than activity. Measurement says it is a bijection.

Three axes, deliberately not collapsed

"Do not make derived mean allowed." Each channel is judged on three independent questions, and may fail any combination:

Axis	Question	Failure
truth	is the claim sourced?	fabricated
layer	is this the right kind of thing to be true of?	misplaced
warrant	how many warrants reach one mark?	collapsed

The independence is asserted, not assumed:

identity hue — sourced, and misplaced.
box footprint — fabricated.
box emissive intensity — sourced, collapsed, and misplaced.

A single-axis audit would have called the first one fine and the third one fine.

Illegal — a claim with no source

box footprint

One channel. Nothing about it can be right, because there is nothing for it to be right about.

Unsafe — two warrants, one mark

box emissive intensity · district ring opacity

Each names its basis and, required by the test, what a viewer cannot tell apart:

emissive intensity — a workload change from a threshold change. Measured: 4 items over a ceiling of 4, and 8 over a ceiling of 8, render bit-identically at 0.970.
district ring opacity — compounded: the mean of several already-mixed warrants, so it also hides which member moved.

The retraction

I recorded the alert channel as "an undeclared threshold, worse than activity", on seeing rank === 3 ? "fail". That was wrong. Following the number to its source:

severity: "info" | "warn" | "critical"      ← a closed observed vocabulary
  ↓ encode   critical→3, warn→2, info→1
  ↓ max()                                    ← the ONLY reason numbers exist
  ↓ decode   3→fail, 2→warn, else→ok
health:   "ok" | "warn" | "fail"

critical→fail, warn→warn, info→ok is a bijection. The mapping loses nothing, and rank === 3 is the inverse of an encoding, not a threshold on a magnitude. I pattern-matched a numeric comparison without following where the number came from — the same error as reading [object Object] from an untyped fixture.

The channel moves from unsafe to safe on the warrant axis.

What it actually discards

["warn"]        and  ["warn" × 12]                     → both render "warn"
["critical"]    and  ["critical","warn","warn",...]    → both render "fail"

Multiplicity. max() keeps only the worst incident. That is a real loss and it belongs to the fourth question, not the warrant one — which is why the distinction between the two questions earns its keep.

Two things remain genuinely undeclared, and both are smaller than what I claimed: the ordering critical > warn > info, and the rename info → "ok", which asserts that an informational incident means healthy.

Safe — and the exemplar is already here

capacity readout · co-change position · alert beacon and label colour

capacity is the proof that the fix is reachable, in this codebase. It distinguishes limit: null (unenforced) from 0, renders used · unbounded rather than a full meter, and shows (basis) beside the number. It obeys the rule core/fact.ts states: "a limit that nothing enforces may not be drawn as a capacity meter."

It is the only channel of eight that shows its warrant to the viewer.

Misplaced — derived, wrong layer

box emissive intensity · box height · district ring opacity · identity hue

All four are honestly derived and all four store a projection's output in the World. box height is the clearest: the World holds world units, not the magnitude — the scale decision already ran, inside the canonical model.

The fourth question: information discarded

discards is now required on every channel, so "we did not think about it" cannot pass as "nothing was lost". Two channels claim losslessness and must say so explicitly.

Channel	Discarded
emissive intensity	whether the change came from workload or normalisation; the raw count
ring opacity	which member moved; the spread; every ceiling folded into the mean
alert beacon	multiplicity — one warn and twelve render identically
box height	the magnitude itself — the World stores world units, so the quantity is unrecoverable from the scene
identity hue	the mapping rule — a viewer cannot invert a colour to its identity
co-change position	which commits coupled the pair, and every edge direction (the layout symmetrises first)
capacity	nothing — limit and basis are both rendered
footprint	nothing, because it carries nothing

box height is the one to note: the scene contains no way back to the measured quantity, because the scale decision ran before the World was written.

Dependency scope — a value can be truthful and scoped wrongly

The dimension warrant cannot catch. Measured in a generated world: adding ONE file moved all 8 existing buildings, the largest by 217 world units, and changed all 8 heights. Nothing about those files was re-observed.

subject  alert beacon · capacity readout · box footprint · identity hue
set      district ring opacity
world    box emissive intensity · box height · co-change position

Three of eight marks are world-scoped, so a viewer comparing two renders sees them move for reasons outside the subject. Each must state what it actually claims once scope is known:

Mark	Appears to claim	Actually claims
box height	this subject is large	tall relative to the current population of the world
emissive intensity	this subject is busy	as busy as the busiest subject currently observed
co-change position	these two are related	near, given every other subject

City Hall generalises: tallest × 1.9 was one building depending on the set, and the generated world does the same thing to every height via peakBytes and every position via a whole-graph MDS solve.

Two kinds of no-loss

irrelevant is split, because the repairs differ:

none — every input reached the mark. capacity.
unbound — nothing meaningful was ever supplied. footprint. Not a compression: an unconstrained visual choice. Compression wants another channel; an unbound field wants binding, or an explicit mark as decorative.

Standing


Measurable defect exposed?	yes — an undeclared alert threshold, worse than the admitted one
Measurable improvement?	none made — the audit is the deliverable
Axes collapsed?	no — independence asserted in both directions

What is still not established

Nothing was repaired. Every verdict set is asserted exactly, so a new illegal, unsafe or misplaced channel fails the gate; none was fixed.
agent status and readiness are not audited. They were named as likely members and I did not measure their sources, so they are absent rather than cleared.
The audit is hand-maintained, like the Derivation Register. It covers the channels WorldScene draws; a channel added elsewhere would not appear.
warrantVisible is a claim about the renderer, checked by two greps — that WorldView contains unbounded and capacity.basis. It verifies the mechanism exists, not that a viewer reads it. Condition 3, unchanged.

248 → 256 tests, 26 DOM, tsc clean.