docs: define CLOSE/FrameVerdict posture

Define the long-term architectural posture for CLOSE-derived facts and FrameVerdict as deliberate non-interaction.

Adds the ratification artifact and updates runtime contracts to preserve the open/proposal/review lane separately from the closed-world FrameVerdict lane, with INV-30/INV-31 and pillar references.

PR: #795

docs/analysis/close-derived-facts-frameverdict-posture-ratification-2026-06-16.md

@@ -0,0 +1,115 @@
+# Ratification: Define Long-Term Architectural Posture for CLOSE-Derived Facts and FrameVerdict
+
+**Date:** 2026-06-16  
+**Branch:** `feat/define-close-derived-facts-frameverdict-posture` (fresh from `origin/main` at 7e5ac0ac which merges #794)  
+**Governing brief:** "Title: Define Long-Term Architectural Posture for CLOSE-Derived Facts and FrameVerdict" (the query for this session)  
+**Preceding work (locked):** #791 (Claim-B hardening of `evals/close_derived_climb` with `content_replay_checksum`, `semantic_positives_determined_direct`, `wrong_total=0`, full proposal posture), #792 (hermetic embedding recommendation), #793 (Dedicated CLOSE Flywheel Regression Surface: `make test-close-flywheel`, dedicated testing-lanes.md section, anti-regression participation), #794 (structured `proposal_review_posture` in the climb + `proposal_review_summary` (scenes + log_transitions + close_derived merge) in the anti-regression demo + visibility subsection in testing-lanes + cross-refs). Parallel B4 closed-world substrate (ADR-0222 + implementation lookback 2026-06-15).
+
+## Context: The Two Lanes and the Recent Richness
+
+CLOSE-derived facts are accretive, open-world products of the derivation / determine / consolidate / idle_tick path (under `RuntimeConfig.review_derived_close_proposals`). When the flag is on, eligible realized derived facts (derived=True, entailed derivation, speculative epistemic status, member/subset/TRANSITIVE_PREDICATES) are emitted as review-gated proposal-only artifacts (`source="derived_close_fact"`) carrying full derivation metadata, structure/dedupe keys, and explicit review posture (`status="proposal_only"`, `epistemic_status="speculative"`, `requires_review=true`). These are written under `teaching/proposals/derived_close_facts/` (or exercised via the older ProposalLog/ReviewState teaching-chain path in hermetic demos). Promotion to durable (corpus append or COHERENT via `apply_certified_promotion` or eligible paths) is always reviewed or proof-carrying (INV-29); nothing auto-promotes.
+
+#791–#794 made the *review/ratification half* of this flywheel first-class observable inside the same composable heavy verification surface that already hosts Claim-B derivation measurement:
+- `evals/close_derived_climb/runner.py` now surfaces `proposal_review_posture` (emitted_count, all_proposal_only, all_speculative, all_requires_review, review_eligible, none_accepted_or_promoted) derived from the already-returned proposal bodies.
+- `evals/anti_regression/run_demo.py` now emits `proposal_review_summary` (scenes by review_state + log_transitions from exercised ProposalLog + close_derived merge of the climb posture).
+- These appear in `--json` output, verbose RESULT blocks, `DemoReport`, the `make test-close-flywheel` lane, and `tests/test_anti_regression_demo.py`.
+- All guarantees preserved: hermetic tempdir runs, `all_gates_held`, `active_corpus_byte_identical`, `wrong_total=0`, content_replay_checksum covering the proposal bodies, proposal-only/SPECULATIVE/requires_review asserted at emission.
+
+(See `evals/close_derived_climb/contract.md`, the visibility ratification artifact, `docs/testing-lanes.md` "Dedicated CLOSE Flywheel Regression Surface" + new "Review / Ratification Posture..." subsection, `docs/runtime_contracts.md` Derived CLOSE proposal bridge section, and `chat/runtime.py:IdleTickResult.derived_close_proposals_emitted`.)
+
+FrameVerdict (and ClosedFrame) is the B4 closed-world substrate (ADR-0222, implemented and lookback-audited 2026-06-15 on `feat/b4-frameverdict-complete`):
+- `ClosedFrame` requires an explicit `world_assumption` (CLOSED / BOUNDED_CLOSED) + `closure_declared=True` + a complete enumerated proposition set. It is a *declared-complete snapshot* for the purpose of two-sided entailment/refutation.
+- `FrameVerdict` is a sealed, distinct type (five `FrameVerdictKind`: ENTAILED_TRUE / ENTAILED_FALSE / UNDETERMINED / CONTRADICTION / SCOPE_BOUNDARY; carries `ClosedWorldProof` with positive-refutation discipline for both true and false cases). `__post_init__` enforces the negation law: `ENTAILED_FALSE` is illegal under `OPEN` (absence never false) and requires a named positive refutation (ROBDD_REFUTATION or PERCEPTION_CHANGED_SLOT).
+- Construction is funneled through a single allowlisted site (`generate/frame_verdict/_construct.py:build_frame_verdict`). The evaluator (`evaluate_frame_verdict`) and perception adapter are the only producers. The path is deliberately default-dark / off-serving (no production callers into `disposition_for_frame_verdict`; `core.response_governance` package init does not re-export the adapter).
+- It is *not* `Determined`; it never carries an `answer` bool.
+
+INV-30 and INV-31 are the mechanical expression of the separation (non-vacuously verified in `tests/test_architectural_invariants.py` on every relevant PR):
+- **INV-30 (Open-world DETERMINE never asserts False):** `determine()` produces only `Determined(answer=True, ...)` (three construction sites: direct, one-hop relational, transitive) or `Undetermined` refusals. Absence never refutes. "The open-world determination gear answers a question ONLY from what the held self has realized, under the OPEN-WORLD assumption".
+- **INV-31 (Closed-world FrameVerdict cannot reach the open-world runtime):** Two-part firewall. (A) Transitive import containment (the open-world spine modules `chat.runtime`, `session.context`, `vault.store` must not reach `generate.frame_verdict` or `core.response_governance.frame_verdict`) + exact construction allowlist (only the one `_construct.py` file). (B) Typed data-flow ( `determine(ClosedFrame, ...)` refuses at the eligibility gate before ctx; forged/untagged objects are `TypeError` rejected at the sole disposition adapter).
+
+The B4 lookback (2026-06-15) and subsequent relational work explicitly record "No FrameVerdict serving or default wiring", "No edits to ... FrameVerdict, closed-world reasoning", and full INV-30/31 green (128+ tests in the B4 slice, 74/74 in later snapshots).
+
+## Current Relationship (Deliberate Non-Relationship)
+
+There is **no data-flow, no type sharing, no import, and no semantic composition** between the CLOSE-derived proposal/fact lifecycle and FrameVerdict / ClosedFrame:
+- CLOSE emission and consolidation live entirely in the open-world determine + epistemic (SPECULATIVE by default) + reviewed-teaching promotion path. The artifacts are intentionally "proposal-only, review-gated"; the contract in runtime_contracts.md states "no ... no determine change".
+- A CLOSE-derived fact (even after review, corpus append, or promotion to COHERENT) is never packaged as a `ClosedFrame.propositions` set, never passed to `evaluate_frame_verdict`, and never used to construct a `FrameVerdict`.
+- Conversely, a `FrameVerdict` (or `ClosedFrame`) is never injected into `determine()`, never becomes a premise in CLOSE derivation / consolidate, never appears in `IdleTickResult`, never participates in `ProposalLog` / teaching review states, and never affects epistemic_status or vault promotion.
+- The two systems make incompatible assumptions: CLOSE facts are accretive (open-world accumulation from conversation + derivation; "I was told" / SPECULATIVE until reviewed), while a ClosedFrame is a *deliberately declared-complete* snapshot that licenses a committed two-sided verdict (including negation) under CWA or perception. Mixing them would be a category error.
+
+The recent richness (#791–#794) lives *entirely inside* the CLOSE proposal/teaching surfaces and the dedicated heavy verification lane. It gives operators precise, contract-level, replayable signals about *how the review/ratification side of the flywheel behaves* (birth posture of every emitted artifact, transition counts from exercised gates in hermetic scenes, "none accepted inside the yardstick" guarantee) — without ever touching, observing, or depending on the closed-world lane.
+
+## Evaluation of Strict Separation vs. Controlled Future Interaction
+
+**Maintain strict deliberate non-interaction (recommended):**
+
+- **Benefits.** Preserves the precise, non-negotiable meanings of the two lanes (Semantic Rigor). Keeps the B4 substrate sealed, default-dark, and off-serving until (if ever) a future dedicated serving PR discharges its recorded obligations (dataclasses.replace guard, etc.). Allows the CLOSE flywheel (both halves) to be measured, hardened, and evolved *inside its own surfaces* (the composable heavy lane just ratified in #793/#794) with zero cross-cutting cost or complexity. No new firewall surface, no new allowlist maintenance, no risk of subtle soundness interactions between accretive open facts and snapshot closed assumptions. The increased observability of review/ratification outcomes is already achieved without any bridge.
+- **Risks of relaxing.** Low in the current state; the richness does not create technical pressure to cross the boundary for correctness or visibility. Any bridge (even "read-only use of COHERENT CLOSE facts as optional premises inside a declared-closed frame") would:
+  - Require new or extended INV-31 construction/ import allowlists and new non-vacuous test anchors.
+  - Require new INV-30-adjacent reasoning (does using a reviewed CLOSE fact inside CWA ever let absence become false elsewhere?).
+  - Introduce a new semantic surface (what does "complete frame" mean over a body whose growth path was open + selective reviewed proposals?).
+  - Add replay, provenance, and standing discipline obligations (a FrameVerdict proof over CLOSE-derived premises must not masquerade as open-world determination).
+  - Impose Mechanical Sympathy cost (extra code, tests, scans, and review surface in both the derivation and the closed lanes).
+- **Long-term implications.** The separation remains a load-bearing architectural commitment. The CLOSE flywheel can continue to grow richer (more predicates, better consolidation, finer review telemetry) without ever needing closed-world machinery for its own health measurement. B4 can mature independently toward (or away from) serving. Future operators inherit a clean, auditable distinction rather than an accreted hybrid.
+
+**Allow any form of controlled interaction (even future-gated):**
+
+- **Potential benefits.** In principle, a COHERENT CLOSE-derived fact (e.g. a transitive math relation proven through the derivation path) could serve as a high-quality premise inside a deliberately constructed ClosedFrame for a targeted CWA consistency check, or a FrameVerdict could inform a downstream teaching gate. This might strengthen certain verification scenarios or allow "closed snapshot over ratified CLOSE corpus subset" tooling.
+- **Risks and costs (material).** The category mismatch (accretive open vs. declared-complete closed) is not a small impedance; it is the reason INV-30 and INV-31 exist. Any bridge creates a new trust boundary that must be proven not to create wrong>0 candidates, not to weaken the "absence never false" contract, and not to let a closed negation leak into open runtime surfaces. It would expand the INV-31 scan surface and the construction allowlist, increasing the cost of every future change on either side. It would require updates to runtime_contracts, the architectural invariants test, the B4 lookback obligations, and new dedicated ratifications. The visibility objective of the current brief (and #794) is already satisfied without it. The "Third Door" for richer measurement was the dedicated heavy lane, not a cross-world bridge.
+- **Long-term implications.** Once a bridge exists, even if initially narrow and opt-in, pressure to widen it ("just this one more predicate", "just for serving disposition") becomes a recurring tax. The clean lane separation that lets each system be understood, tested, and evolved on its own terms erodes. The project would have to re-argue the pillars for every incremental mixing.
+
+## Architectural Recommendation (Ratified Posture)
+
+**Deliberate, long-term non-interaction is the architectural posture.**
+
+CLOSE-derived facts (including the full proposal emission, review/ratification lifecycle under `teaching/proposals`, epistemic transitions from SPECULATIVE to COHERENT, and any promotion or corpus-append outcomes) shall not be used as direct or indirect premises for `ClosedFrame` construction or `FrameVerdict` evaluation. `FrameVerdict` outputs (and `ClosedFrame` contexts) shall not feed back into CLOSE derivation, `determine()`, idle consolidation, proposal emission, teaching review paths, vault promotion, or any open-world runtime surface.
+
+The two systems address orthogonal concerns:
+- CLOSE / derivation / reviewed teaching: open-world accumulation, sound inference under "as told", proposal-gated durable growth, exact CGA recall, replayable content checksums, and human/HITL ratification of what the autonomous half emits.
+- FrameVerdict / closed-world: lane-scoped, declared-complete snapshot reasoning for positive refutation (ENTAILED_FALSE) or support (ENTAILED_TRUE) under explicit CWA or perception falsification assumptions; currently sealed and off-serving.
+
+The increased richness and observability achieved in #791–#794 (structured birth posture, transition events in exercised gates, integration into the Claim-B + anti-regression heavy lane) *reinforces* rather than weakens this posture. We now have precise, contract-level, wrong_total=0, replayable telemetry on exactly the "review, accepted/rejected, and promoted into durable knowledge" side of the CLOSE flywheel — all without any data crossing the open/closed boundary or any change to FrameVerdict, determine, or the INV-30/INV-31 firewalls.
+
+Any future proposal for controlled interaction (however narrow or "read-only") must be treated as a material architectural change. It requires:
+- A new (or substantially amended) ADR.
+- Explicit updates to (or extensions of) INV-30 and/or INV-31, with new non-vacuous test anchors.
+- Re-verification that `wrong_total` remains 0 on all affected lanes, versor closure, epistemic standing rules (INV-21–24, INV-29), determination contracts, and proposal-only/review-gated boundaries.
+- Fresh ratification artifact + updates to `docs/runtime_contracts.md`, `tests/test_architectural_invariants.py`, and the relevant B4 / CLOSE ratif family.
+- Explicit alignment argument against the Three Engineering Pillars.
+
+Until such a ratified change, the current strong separation (SPECULATIVE status + proposal-gated + INV-31 firewall + INV-30 open-world True-only) is the invariant.
+
+## Alignment with Engineering Pillars (Whitepaper §IV)
+
+- **Mechanical Sympathy:** The two lanes have different cost profiles and different hardware/implementation sympathies (open derivation + teaching HITL vs. ROBDD + perception falsification substrate). We do not add cross-cutting bridges, new shared allowlists, or hybrid data structures "because the data is now richer." Each lane pays only its own cost. The visibility work used the already-ratified heavy composable lane (Third Door) rather than inventing always-on reporters or fast-path CLI.
+- **Semantic Rigor:** "Open-world determine" and "closed-world FrameVerdict" have precise, distinct meanings (absence never false; declared-complete snapshot licenses negation only with positive proof). CLOSE facts carry epistemic standing that is revised through review; a FrameVerdict carries a replayable closed entailment/refutation. We do not blur the terms or let one masquerade inside the other. The posture document makes the distinction durable and reviewable.
+- **Third Door:** We did not take the "obvious" door of "now that we can see the proposals clearly, let's wire them into the closed-world substrate for extra power." Nor did we take the "just use the existing teaching reporter in isolation." We used the ratify-first discipline, wrote the decision artifact on disk before touching runtime_contracts.md, and produced a clean, load-bearing documentation update inside the existing contract surface. The composable heavy lane (make test-close-flywheel + anti demo) already provides the measurement; the posture formalizes why no further integration is required or desired.
+
+## Verification Obligations (Post-Ratification)
+
+- This ratification artifact exists on disk (written first).
+- `docs/runtime_contracts.md` receives a substantial, self-contained addition documenting the posture, explicitly referencing this artifact, the B4 lookback, INV-30/INV-31, the #791–#794 richness, the Derived CLOSE proposal bridge section, and the Three Pillars.
+- Git diff limited to `docs/analysis/*-ratification-2026-06-16.md` (this file) + the update to `docs/runtime_contracts.md`. Zero changes to any `.py`, Makefile, evals runners, tests, or other behavior.
+- The full architectural invariants suite (`tests/test_architectural_invariants.py`) remains byte-identical and would continue to pass (INV-30/31 untouched).
+- Existing CLOSE references in runtime_contracts.md (the visibility sentence added in #794) remain accurate; the new posture section is additive and consistent.
+- `core test --suite smoke -q` (or equivalent) and the CLOSE-specific lanes continue to behave exactly as before (no behavior change by construction).
+- All prior invariants (versor_condition, INV-21/22/23/24/29/30/31, proposal_only/SPECULATIVE/requires_review at emission, wrong=0, content_replay_checksum, hermeticity of the heavy lane, active_corpus_byte_identical) continue to hold by construction.
+
+## References
+
+- Governing brief (this session).
+- CLOSE family: `docs/analysis/close-derived-climb-yardstick-claim-b-ratification-2026-06-16.md`, `close-derived-proposal-bridge-2026-06-16.md`, `close-flywheel-dedicated-regression-surface-ratification-2026-06-16.md`, `close-flywheel-proposal-review-visibility-ratification-2026-06-16.md`, `integrate-hardened-close-yardstick-determinism-teaching-regression-ratification-2026-06-16.md`.
+- B4 / FrameVerdict: `docs/analysis/b4-frameverdict-implementation-lookback-2026-06-15.md`, `docs/handoff/b4-pr1-frameverdict-type-inv31-brief-2026-06-15.md`, ADR-0222.
+- `docs/runtime_contracts.md` (Derived CLOSE proposal bridge §, determination surface, epistemic surface, provisional vs durable standing §, INV-30 reference).
+- `tests/test_architectural_invariants.py` (INV-30 and INV-31 sections with exact claims and non-vacuity anchors).
+- `generate/determine/determine.py` (Determined/Undetermined contract), `generate/frame_verdict/types.py` (ClosedFrame, FrameVerdict, __post_init__ guards, WorldAssumption, FrameVerdictKind), `generate/frame_verdict/_construct.py` (single construction funnel).
+- `teaching/proposals.py` (ProposalLog, ReviewState, accept/reject/withdraw, events), `chat/runtime.py` (IdleTickResult, derived_close_proposals_emitted, the bridge emission).
+- `evals/close_derived_climb/runner.py` + `contract.md` (posture), `evals/anti_regression/run_demo.py` (summary), `docs/testing-lanes.md` (Dedicated CLOSE section + review posture subsection).
+- Engineering Pillars: `docs/Whitepaper.md` §IV.
+- Core agent instructions (Claude.md / AGENTS.md / CLAUDE.md) ratify-first, INV discipline, lookback, pillar alignment, and "no hidden normalization / stochastic / approximate" rules.
+
+**Ratification Status:** COMPLETE AND LOCKED. This artifact was created via the `write` tool on the clean branch *before any search_replace, write (other than this file), or other implementation edit to runtime_contracts.md, tests, evals, source, or any other documentation*. All preceding activity on this branch was git operations (fetch, checkout main, clean, branch creation) plus strictly read-only exploration (list_dir, read_file, grep with no edits). The decision is now on disk and may be referenced. Implementation of the required documentation update to `docs/runtime_contracts.md` (and only that) may now proceed exactly within the scope above. Any deviation, code change, or broadening requires a new ratification or explicit brief amendment.
+
+---
+
+*This ratification follows the project's ratify-first discipline for architectural posture decisions on core boundaries (open-world vs. closed-world, derivation vs. refutation, autonomous growth vs. reviewed ratification). It prioritizes clarity, intentionality, long-term alignment with the Three Engineering Pillars, preservation of INV-30/INV-31 and the epistemic proposal-only boundary, and the ability to measure the full CLOSE flywheel (both halves) inside its own composable heavy lane — over any temptation to mix lanes because one side has become more visible.*

docs/runtime_contracts.md

@@ -218,6 +218,27 @@ The Dedicated CLOSE Flywheel Regression Surface (Claim-B Level) plus the review-
 See `docs/analysis/close-derived-proposal-bridge-2026-06-16.md` for the full artifact
 schema, dedupe key, test gates, and the PR-1→PR-2 composition.
 
+### Architectural Posture: CLOSE-Derived Facts and FrameVerdict (deliberate long-term separation)
+
+CLOSE-derived facts and the proposals that carry them for review (source=`"derived_close_fact"`, born with `status="proposal_only"`, `epistemic_status="speculative"`, `requires_review=true`) operate entirely within the open-world derivation / determine / reviewed-teaching promotion path. They are accretive (sound inference over realized content under the open-world assumption), replayably checksummed in the Claim-B yardstick, and subject to the full proposal-only / SPECULATIVE / review-gated / provisional-standing discipline (INV-21–24, INV-29). Promotion to durable standing (corpus append or COHERENT) occurs only through reviewed teaching gates or the certificate-carrying `apply_certified_promotion` path — never autonomously and never by crossing into closed-world machinery.
+
+`FrameVerdict` (and its `ClosedFrame` context) is the B4 closed-world substrate (ADR-0222). It requires an explicit declared-complete snapshot (`world_assumption` CLOSED or BOUNDED_CLOSED + `closure_declared=true`) and produces a distinct sealed type carrying `FrameVerdictKind` (ENTAILED_TRUE / ENTAILED_FALSE / UNDETERMINED / CONTRADICTION / SCOPE_BOUNDARY) plus positive-refutation proofs. Construction is funneled through a single allowlisted site; the path is default-dark and off-serving. It is type-distinct from `Determined` and never carries an `answer` bool.
+
+**There is no data flow, no type sharing, no import path, and no semantic composition in either direction.** A CLOSE-derived fact (even after review, corpus append, or COHERENT promotion) is never packaged as a `ClosedFrame`, never passed to `evaluate_frame_verdict` or the perception adapter, and never influences a `FrameVerdict`. A `FrameVerdict` (or `ClosedFrame`) is never supplied to `determine()`, never becomes a premise in CLOSE derivation or consolidation, never appears in `IdleTickResult.derived_close_proposals_emitted`, never participates in `ProposalLog` / `ReviewState` transitions, and never affects epistemic status or vault promotion.
+
+This deliberate non-interaction is mechanically enforced and non-vacuously verified by two invariants (see `tests/test_architectural_invariants.py`):
+
+- **INV-30 (open-world DETERMINE never asserts False):** `determine()` produces only `Determined(answer=True, ...)` at three visible sites or `Undetermined` refusals. Absence never refutes. Closed-world negation is a distinct, lane-scoped type.
+- **INV-31 (closed-world FrameVerdict cannot reach the open-world runtime):** Two-part firewall — (A) transitive import containment of the open-world spine (`chat.runtime`, `session.context`, `vault.store`) from `generate.frame_verdict` / `core.response_governance.frame_verdict` plus an exact construction allowlist (only `generate/frame_verdict/_construct.py`); (B) typed refusal (`determine` rejects `ClosedFrame` at eligibility; forged objects are type-rejected at the sole disposition adapter).
+
+The increased richness and observability of the CLOSE proposal review/ratification side (#791–#794) — `proposal_review_posture` (all_proposal_only / all_speculative / all_requires_review / none_accepted_or_promoted guarantees), `proposal_review_summary` (scenes by review_state + log_transitions from hermetic teaching gates + close_derived merge), integration into the anti-regression demo and the `make test-close-flywheel` lane — was achieved entirely *inside* the open/proposal/teaching surfaces and the dedicated heavy verification lane. No boundary was crossed and no FrameVerdict or closed-world reasoning was involved or required.
+
+**Long-term architectural posture (ratified):** Strict separation is the commitment. CLOSE-derived facts (and their full review/ratification lifecycle) address open-world accumulation, sound derivation, proposal-gated growth, and human/HITL ratification of what the autonomous half emits. FrameVerdict / closed-world addresses lane-scoped, declared-complete snapshot entailment and positive refutation under explicit CWA or perception assumptions. The two are orthogonal; the increased visibility of one does not create a requirement or justification to mix them.
+
+Any future controlled interaction (however narrow, read-only, or "for targeted CWA checks over a ratified CLOSE subset") is a material architectural change. It requires a new or amended ADR, explicit updates to INV-30 and/or INV-31 with new non-vacuous anchors, re-verification that `wrong_total` remains 0, versor closure, epistemic rules, and determination contracts, plus fresh ratification and updates to this document and the invariants test suite. Until such a ratified change, the current strong separation (SPECULATIVE + proposal-gated + INV-31 firewall + INV-30 open-world True-only) must be preserved by construction.
+
+See `docs/analysis/close-derived-facts-frameverdict-posture-ratification-2026-06-16.md` (the governing ratification artifact for this posture) for the full analysis of risks/benefits/implications, the explicit pillar alignment (Mechanical Sympathy, Semantic Rigor, Third Door), and the verification obligations. Cross-references: B4 lookback (`docs/analysis/b4-frameverdict-implementation-lookback-2026-06-15.md`), the Derived CLOSE proposal bridge and visibility ratifications (2026-06-16 family), `docs/Whitepaper.md` §IV, and the determination / epistemic / provisional-standing sections of this document.
+
 ### Estimation surface (Step E — ESTIMATION)
 
 When `estimation_enabled` and a turn is a **converse query** DETERMINE refused (told