Rank 6, the last docket item before the posture statements, and the throughput
frontier N-5 called "one ruling wide". The ruling landed. It closed the frontier
rather than opening it, and that is the correct outcome.
R-8 ruled C: committing to an entailment and correctly declining to commit are
DIFFERENT capabilities, licensed on DIFFERENT evidence, and may not be pooled.
THE FINDING: split, ZERO bands license — not four.
band unknown floor entailed floor
philosophy_theology_contrast 652 0.989925 8 0.000000
philosophy_theology_modal 652 0.989925 8 0.000000
physics_causal 653 0.989940 7 0.000000
systems_software_causal 653 0.989940 7 0.000000
(pooled, the old basis) 660 0.990046 -- clears by 0.000046
N-5 recorded that "four bands would earn SERVE the moment a ledger is sealed."
That is true on the POOLED basis and false on the ruled one. Those four cleared
theta_SERVE=0.99 only because 7-8 entailments were counted alongside 652-653
correct refusals to reach 660. The licence was manufactured by the pooling, not
earned by the evidence. conservative_floor(9,9) is 0.000000 — the Wilson lower
bound at nine trials is not merely below theta, it is zero.
This is exactly why the plan blocked PR-14 on R-8 instead of sealing first and
ruling after. A ledger sealed on the pooled basis would have granted four
licences that the mix rule then had to revoke — and revoking a granted licence
is the expensive direction, as PR-12 had just demonstrated across 21 deduction
bands in this same session.
DELEGATED RULING — R-8 C's entailed floor N: no new constant.
The packet recommended "C, with a floor from A applied to the entailed
capability only," and N was never named. It does not need naming. theta_SERVE
=0.99 through conservative_floor — the bar every other capability already meets,
657 distinct correct decisions — applied to each separated capability on its own
evidence licenses nothing, by a factor of 73. Inventing a second, weaker
constant for the capability that most needs the strong one would institutionalise
two standards, which is precisely the objection that sank option B. Recorded
under the standing delegation with its reasoning, so it can be overturned.
NO LEDGER IS SEALED, AND THAT IS THE DELIVERABLE. Under the rule there is
nothing to license, and the registered missing_ok=True absence already says so
once. An artifact whose only content is its own emptiness would be a second
statement of the same fact — the defect class registered as G-23 this same week.
THE USEFUL RESULT IS THE SHAPE OF THE GAP, WHICH POOLING HAD HIDDEN.
Non-commitment serving is FOUR TO FIVE distinct query atoms short per band.
Entailed serving is ~648 short. Those are content tasks of completely different
size, and a single pooled figure could not distinguish "almost there" from "two
orders of magnitude away". Four cases is a morning's work; 648 is a program.
Nobody could see that before the split.
Delivered:
- curriculum_serve_entailed registered in CAPABILITY_LEDGERS, missing_ok=True
(absent = nothing licensed, the honest state), with the rule declared in the
manifest table rather than at a call site (ADR-0263 rule 5)
- an audit source for it — demanded immediately by the manifest's own pin
(test_every_licensed_capability_has_an_audit_source went red the moment the
capability was declared, which is PR-5's declared-table discipline working)
- ADR-0264 §5 amendment recording the ruling and correcting §4.1's "four bands
would earn SERVE" expectation. Changes no decision in that ADR;
curriculum_serving_enabled stays False
- tests/test_curriculum_outcome_mix.py on the gate: both capabilities pinned,
the shortfall pinned exactly, AND the counterfactual pinned — pooling
licenses 4 — so the argument for the rule cannot drift away from the number
it rests on
The serving path needs no change, and that is stated rather than left implicit:
under the rule nothing is licensed, so there is no licensed-vs-disclosed branch
to route. Building that machinery now would be building for a case that cannot
occur yet.
Closes G-10.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wcw2pnMBwyvmNyQg4uPEt4
Rank 1 on the adopted docket, and the cheapest item on it: two ratified ADRs
whose records contradicted the code, plus the ADR-0252 obligation that Track
A's ratified NO-GO created. All four land in two files because they are two
files under one authority — splitting them would have bought two reviews of
the same document.
ADR-0146 (R-12a, option A) — the daemon it rejected, shipped.
The Shape-A rejection stands AS REASONING: a background daemon does require
process-supervision infrastructure that Shape B does not. That infrastructure
was subsequently built. chat/always_on_daemon.py implements the three items
"What is NOT in Scope" excludes, each mapped to where:
- cross-process file locking -> advisory fcntl.flock(LOCK_EX|LOCK_NB) at :82,
acquired BEFORE any signal or runtime setup so a second life fails fast
- signal handling -> SIGINT/SIGTERM graceful stop at :145
- daemon synchronization -> the load-time strict-identity guard; the flag is
forced at :48 and a different-identity checkpoint is refused, so a restart
is the same life or it is nothing
Shape B remains the persistence model and the CLI default; the daemon is an
additional shape layered on it, owned by this ADR. A new ADR for a shape that
shipped six weeks earlier adds a document without adding a decision.
The stale bullet gets an INLINE pointer, not only a trailing addendum. H-8's
mechanism is that an authoritative line converts "I should check" into "I
already checked" — the reader who stops at the excluded-scope list is exactly
the reader this gap is about, and they never scroll to the end.
ADR-0252 (R-12b, option A) — the "34 organs" basis footnote.
Footnote at the first use, marking the count as underived: the reproducible
figure is 18 resolve_promotable_* organs, ALL in generate/derivation/ and none
anywhere else, with exactly 32 modules in the package as the likely origin of
"34". The diagnosis, supersession plan and §4 conformance bar are unaffected —
none depends on the count. Option B (replace every "34" with "18") rejected: it
rewrites a ratified document's prose where a note at the point of use is all
that is owed.
ADR-0252 §5 — the verdict banner. NO-GO, ratified. Criterion pre-registered at
299c92be BEFORE the run, run at 797ebad5, artifact digest b3d9d275…, with the
mechanism stated in one measured sentence: the similarity quotient that
delivers attribute-invariance is the same quotient that annihilates structural
contrast. Scope held narrow on purpose — this refutes H1 for point-position
role encodings aligned under similarity, not every Cl(4,1) representation, and
not the symbolic lane. Also records N-8 (two prior GO verdicts on unmerged
branches, both unsound) and G-21.
ADR-0252 §6 — the amendment the NO-GO forces, and the load-bearing half.
§6 retired the surface organs "until the structure-mapper proves out" and named
no replacement for the NO-GO branch. Left alone that is a live instruction that
can never fire — an authoritative-looking dead instrument, the H-9 class
exactly. Amended: the organs are RETAINED, and that is the operative state
rather than a pause in a transition; the retirement condition is re-stated as a
demonstrated replacement passing the §5 criterion, which does not exist. The
"Build (gated on §5 GO)" bullet is marked NOT AUTHORIZED with the reason.
Retiring a working organ on the strength of a hypothesis ABOUT its replacement
is backwards; the hypothesis has now been tested.
Verification — every factual claim re-derived at ca5e614e rather than copied
from the packet: 18 organs, 0 outside generate/derivation/, exactly 32 modules
(tightening the draft's "~32"); lock, signals and identity guard each cited by
line; report digest read back from the artifact file.
Three things caught before landing, recorded because this commit is about
records being wrong.
1. The date. The addendum drafted "landed 2026-06-14". This container's clone
was SHALLOW — 168 commits, roots grafted at 2026-07-19 — so git log
reported 2026-07-20, which is the shallow boundary and not a fact. Neither
figure was verifiable until the clone was deepened to 2340 commits, which
confirmed the packet: 18e25580, 2026-06-14, the same commit introducing
both the lock and the signal handling. The addendum now cites the SHA. A
date that cannot be re-derived is testimony.
2. A wrong section reference — the amendment cited §9 for a sentence in §8.
3. A misquote — "the existing reader" for "the existing 34-organ reader".
Writing a misquote into a ratified document while amending that document for
accuracy would have been this ruling's own failure mode committed inside its
own fix. Both were found by re-reading the amendment against the source it
quotes, which is standing philosophy 7.
Records closed: H-8(a), H-8(b), G-15. Track A's outstanding obligation
discharged. H-8(c)/(d) remain open on R-3 and land with PR-5.
No runtime behavior. No test changes. Two ADR files and four register/plan
files.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wcw2pnMBwyvmNyQg4uPEt4
Serving-path authorization for the negation fix in this PR. The ADR is
Accepted rather than Proposed because the defect it removes was LIVE behind a
shipped flag (realizer_grounded_authority), not latent: CORE served the
affirmative of propositions users denied.
CORE served the affirmative of propositions the user denied. Measured live on
main @ 536d6e55 with realizer_grounded_authority=True:
"evidence does not support truth" -> 'Evidence is verified: what supports truth.'
"evidence supports truth" -> 'Evidence is verified: what supports truth.'
Byte-identical.
Phase 4 (#136) pinned "render_semantic has no negated parameter" as a defect.
Sizing the exposure before acting on it -- the step §7 requires -- showed the
pin was correct and INCOMPLETE. The defect is two drops in series, and the
first is in the graph:
intent.negated parsed from the user's words, always has been
GraphNode NO FIELD FOR IT <-- first drop
ground_graph rebuilds nodes field-by-field; nothing to carry
depth enrichment rebuilds nodes field-by-field; nothing to carry
plan_articulation cannot carry what the node does not hold
realize_semantic never read step.negated
render_semantic no parameter for it <-- second drop
Five separate constructors, each silently defaulting to the affirmative.
Why every gate was green
------------------------
On the default config the ungrounded realizer emits "...", _is_useful_surface
rejects it, and the runtime echo wins the resolver -- and the echo contains the
user's own "does not". The truth path was correct BY ACCIDENT. ADR-0088 Phase B
grounds the graph first, which is exactly when the realizer's surface becomes
useful enough to win. So the defect sat behind a shipped flag, invisible to
every property-of-one-surface test, because nothing compared a denial to its
assertion.
Delivered
---------
- GraphNode.negated, threaded intent -> graph -> ground -> enrich -> step ->
surface. Serialized ONLY when True, so every pre-existing as_dict and every
trace_hash folded from one stays byte-identical -- which is why no lane pin
moves.
- Clause grammar delegated to its one owner. Four of the eight intent
"templates" were never frames; they were plain clauses. They now call
render_step. Writing a second negation implementation in semantic_templates
was the tempting fix and is rejected: Phase 2A spent a unit giving every
linguistic fact one owner, and that design rebuilds the disease one level up.
- Frames that keep a finite verb (VERIFICATION, PROCEDURE, COMPARISON) get an
explicit negated form. RECALL is a speech act with no proposition to deny, so
it falls back to the clause path rather than drop the denial (ADR-0261 §5.1).
Measured
--------
delegation on affirmatives 192/192 byte-identical
serving realizer, all corpora 85/347 -> 109/347 (+24 = the denials)
feature-bearing bucket 49/214 -> 73/214
CONTROL (nothing droppable) 33/33 -> 33/33 unchanged
multi-node (clause joining) 3/100 -> 3/100 unchanged, out of scope
lane pins 11/11 byte-identical, none edited
The control staying 33/33 and multi-node staying 3/100 is the evidence that
this moved the denials and nothing else.
The exhaustive control earned its keep immediately
--------------------------------------------------
It found FIVE more intents serving a denial as its own assertion --
TRANSITIVE_QUERY, FRAME_TRANSFER, NARRATIVE, EXAMPLE, DEDUCTION -- because an
intent with no frame fell back to the UNKNOWN *template* (which cannot say
"not") rather than the UNKNOWN *clause* (which can). The default is now the
capable path, so the next intent added inherits correctness. Found by the
control, not by inspection.
Mutation -- every link reverted individually
--------------------------------------------
baseline 19 pass
graph_from_intent drops intent.negated 8 FAIL
plan_articulation drops node.negated 6 FAIL
ground_graph drops it on rebuild 2 FAIL
realize_semantic stops passing step.negated 6 FAIL
unframed intents fall back to the template 1 FAIL
pipeline depth-enrichment drops it 1 FAIL
The last row was GREEN on the first run -- my fix there was unguarded. That is
what added the structural invariant: every GraphNode(...) built on the serving
path must NAME `negated` or be recorded in an allowlist with a reason. The
defect was five constructors; a per-site test must be written per site, and a
site added without one is invisible. Only recognition/connector.py is exempt
(an EpistemicNode has no polarity to carry).
Four Phase 4 pins are revised, not relaxed -- #136's M2 mutation ("render_semantic
GAINS a negated parameter -> FAIL") has now happened for real, and forced the
deliberate revision it was built to force.
Registered in `smoke` in the same PR that creates it, per the #136 finding that
an unregistered pin runs nowhere.
Still unexpressed, deliberately: quantifier, tense, aspect. NO PRODUCER sets
them anywhere on the serving path, so threading them would be machinery with no
caller. render_step already handles all three the moment a producer exists.
[Verification]: in-worktree on CPython 3.12.13 with `uv sync --locked` --
smoke 641 (was 621), deductive 503, lane pins 11/11 with no pin edited.
Ratified by Joshua Shay 2026-07-26. All nine rules are implemented and merged to
main @ 803703fc: R5-R7 (#120), R9 (#117), R1-R4/R8 (#125). The status line names
the enforcement pins so the record points at what holds it up.
Also discharges a staleness the ratification would otherwise have blessed. §4.1's
heading — "No curriculum band can earn a SERVE license under the current
architecture" — is NO LONGER TRUE of the running system, and it was falsified by
this ADR's own R5: the finding rested on "the premise cap holds a family to <=16
chains", and query-scoped compilation removed that cap. Post-R5, four bands would
earn SERVE the moment a ledger is sealed. Leaving that heading unqualified in an
Accepted ADR is precisely the ADR-0256 shape — a governance record asserting
something false about live code.
The §4.1 CONCLUSION survives, for a different and stronger reason, and the note
says so: reliability is commitment precision and a correct UNKNOWN is a
commitment, so a band clears theta_SERVE on non-commitments alone
(conservative_floor(660,660)=0.990046). Licensable evidence is 99.0-99.98%
non-entailed; max entailed volume in any band is 9. So §4.1's "≥97.6%
non-entailed" arithmetic was directionally right and its CAUSE was wrong — it is
not the premise cap that makes a curriculum license dishonest, it is the absence
of a mix rule. The binding constraint is now the outcome-mix ruling (§5, still
open), and nothing is licensed while it is unmade: the ledger is absent and
`core proposal-queue reseal` refuses to grant a license without
--allow-new-licenses.
[Verification]: in-worktree on canonical CPython 3.12.13 with `uv sync --locked`:
smoke 621 (unchanged), and 335 passed across test_adr_status_governance.py /
test_adr_index.py / test_volume_honesty.py. Status parses as "Accepted …" under
the governance regex and the banned `ratify-on-merge` predicate is absent. No
flag moved; no code changed.
Every correction here is to something I wrote earlier in this arc. Original text
is preserved in place; nothing was rewritten to look right in hindsight.
ADR-0264 §4.2 — CORRECTED block. I sized the eleven band ceilings from per-TERM
exclusivity; `resolve_domain`'s predicate is per-PAIR, which is looser, so every
ceiling was understated and one verdict was wrong: systems_software_causal is
720, not 630, i.e. reachable rather than impossible. Seven of eleven bands
cannot reach 657, not eight. Downstream conclusions survive — physics·modal (480)
is still impossible and philosophy_theology·modal is still the target.
ADR-0264 R5 + DIVISION-OF-WORK ×2 + compile_premises docstring — the
"verdict-identical" claim is exact only where the full family was READABLE. Over
MAX_PREMISE_SENTENCES, full-family compilation refuses outright, so narrowing is
verdict-IMPROVING there. Read literally the unqualified phrasing implies a
17-chain family keeps declining, which is backwards — the opposite of the
unblock.
E2 rename staleness, 4 sites: ADR-0256 (Accepted) named
`gold.py::assert_corpus_sound`, which #119 deleted; the plan's E2 item and
DIVISION-OF-WORK's §2 row, §4 heading and "renaming after that is strictly more
work" reasoning were all still written as pending.
DIVISION-OF-WORK §0b — new status table: which PR each unit is, what stacks on
what, and the four things the units found that the plan did not predict.
Adds the arc-close brief from ARC-CLOSE-TEMPLATE.md. Its §3 (falsified
assumptions) is the section that cannot be recovered from the diff: nine
entries, five of them corrections to my own claims. Records that the
articulation trigger is not merely unmet but STRUCTURALLY unmeetable — the
previous arc left it unrecorded, which is what kept it re-triggerable — and
names four pieces of stale reasoning still in the tree, with files, since that
is the class of staleness nobody greps for.
[Verification]: in-worktree on canonical CPython 3.12.13 with `uv sync
--locked`: smoke 569, deductive 291 — both baseline, since the only non-doc
change is one docstring.
Phase B of the curriculum-license-loop arc. Stacked on the ADR-0264 branch.
The invariant: conservative_floor is a one-sided Wilson lower bound and Wilson
assumes INDEPENDENT trials. CORE's pipeline is deterministic, so replaying an
identical case is not a second trial -- it is the same trial with a guaranteed
outcome. A ledger's `committed` count is an upper bound on its evidence; the
defensible figure is its distinct-decision count.
Phase B was scoped as a precaution for a curriculum producer that does not
exist yet. Running the instrument against the producers that DO exist found it
already violated:
21 of the 25 ratified deduction_serve bands do not clear theta_SERVE=0.99 on
distinct evidence. Three inflate 28 distinct cases into 720 committed
(honest floor 0.8084 vs claimed 0.9909). deduction_serving_enabled was
ratified ON 2026-07-24 and is live.
The estimation producer (ADR-0175) is clean -- 660 committed, 660 distinct,
zero repeats, evidently chosen just above the 657 a perfect record needs. So
this is a regression from a standard already established in the repo, not an
architectural gap. `claimed` is identical for all 25 deduction bands because
every band commits 720 with a perfect record: the gate sees 25
indistinguishable passes while honest floors span 0.8084..0.9909.
NOT REPAIRED. The ledger is SHA-sealed, ratified, and gating a live flag, so
re-sealing it is Shay's ratification, not a test's. wrong=0 still holds -- no
band answered anything incorrectly. What is not established is reliability at
the volume claimed. Measured, pinned in both directions, written down.
Added:
- core/reliability_gate/evidence.py -- pure measurement, imported by no serving
path. volume_for_theta() DERIVES 657 from conservative_floor rather than
restating it, so a WILSON_Z change cannot leave a stale literal behind.
- tests/test_volume_honesty.py -- 13 tests. AUDIT_SOURCES is checked against
CAPABILITY_LEDGERS, so a new licensed capability cannot ship unaudited; the
curriculum entry is a declared None that fails the moment its ledger exists.
That is Phase C's forcing function against repeating the pattern.
- docs/research/distinct-evidence-audit-2026-07-25.md -- full audit + the open
outcome-mix ruling for Shay.
- ADR-0264 R9 amended with the measured exposure.
Decision key is case TEXT deliberately: a tighter key (normalized atom) would
collapse spelling variants and report MORE inflation, so text-identity
under-reports and every number is a floor on the real gap.
Outcome mix is deliberately NOT pinned. ClassTally has no verdict axis, the
deduction producer already balances 240/240/240 by construction, and imposing
a per-verdict-class floor would retroactively fail all 25 bands on a criterion
no ADR has ratified (smallest per-band class count is 120). Recorded for a
ruling with numbers instead.
[Verification]: uv sync --locked on canonical CPython 3.12.13; in-worktree
smoke 569 passed (556 baseline + 13), deductive 285 passed. Registered in the
`smoke` curated suite -- not left to `full`, which gates nothing. Mutation-
checked: doubling CASES_PER_BAND -> 2 failed; reporting committed as distinct
-> 4 failed; gating on `claimed` instead of `honest` -> 3 failed; tree restores
to 13 passed.
Phase A of the curriculum-license-loop arc. Design only; no production code,
no flag, no default changed.
Rules R1-R9: polarity is a row-level field (absent => affirmative), negatives
compile to the sentential-not form and MUST reuse the affirmative connective
(atom identity), contradiction is rejected at ratification, premise
compilation becomes query-scoped, an empty scope is UNKNOWN, premise_count
keeps reporting family size, the oracle learns polarity independently, and a
band's honest ceiling must be reported before anyone authors for it.
Three findings, each measured in-tree and each reversing something:
1. `polarity` is read by nothing. A row authored to refute a question today
serves a confident wrong "Yes" -- and the independent oracle ignores the
field for the same reason, so gold agrees and wrong=0 stays green. This is
the silent-failure class Phase A existed to prevent, now demonstrated.
2. The 16-premise honesty cap holds a family to <=16 chains; at 17 the band
declines everything, including the taught positive that works today. So
ADR-0262 §5.1's own remedy (author ~219 relations) destroys the capability
at row 17, tripping the fix §6 deferred as a future contingency. Jointly:
a band has <=16 entailed cases against a 657-committed threshold, so no
curriculum band can earn SERVE until scoping lands. The blocker is
engineering, not content -- inverting the conclusion two arcs closed on.
3. Honest volume is bounded by taught vocabulary, not corpus size. 8 of 11
bands cannot reach 657 at all, including the plan's chosen first target
physics·modal (ceiling 480, counting every possible question). Retargets
Phase F to philosophy_theology·modal (ceiling 44,104, same 8-chain start).
R5 is the only rule that could change an existing answer, so it is the only
one carrying evidence: 8,520 routable questions, 0 verdict mismatches for both
candidate scopes. Verdict-identity holds for any scope that is a superset of
the query-atom rows, since each premise mints one independent atom. That is
stronger than ADR-0262 §6's soundness argument, and it is why this narrowing
is not the ADR-0261 §5.1 premise-dropping failure.
ADR-0262 §5.1/§5.2/§6 carry forward-pointers; original text preserved.
[Verification]: uv sync --locked on canonical CPython 3.12.13; in-worktree
`core test --suite smoke -q` 556 passed (555 baseline + 1: the derived
ratify-on-merge pin picked up ADR-0264 and discharged it), `--suite
deductive -q` 285 passed. Four probes reproducible from
docs/research/curriculum-premise-scope-2026-07-25.md; the corpus-mutating one
restores the file and asserts byte-identity.
Nine ADRs (0254, 0256-0263) were merged into main and left stamped Proposed.
Two carried an explicit ratify-on-merge predicate their own merge had already
discharged, and ADR-0256 governs deduction_serving_enabled, which was ratified
True on 2026-07-24 and is serving live traffic. So the governance record
asserted "not yet decided" about a decision already in force.
That is the asymmetry the assessment arc (#113) found one file over in
workbench/api.py: the honest path degrades, the stale record lies. An unwritten
ADR is a visible gap; a Proposed one that is actually in force is a false
statement.
Each stamp records the ACTUAL ratifying act -- "Accepted, ratified by Joshua
Shay via <merge> (<sha>, <date>)" -- derived from the commit that added the file
and verified an ancestor of main, not assumed. Merge authority is Shay's alone
(AGENTS.md: no merge automation), so the merge IS the ratifying act.
No ADR content changed. No flag changed. ADR-0262's stamp says so explicitly:
accepting it does NOT enable curriculum_serving_enabled, which stays False
pending ratified volume -- eleven bands re-measured today, still 24x-73x short.
tests/test_adr_status_governance.py pins two independent invariants in the
smoke (pre-push) suite:
1. A default-ON flag is not governed by a Proposed ADR. The flag -> ADR mapping
is DERIVED by walking core/config.py for `<name>: bool = True` and reading
ADR refs from the preceding comment block -- not a hand-written table, which
would be the same second-copy-of-a-closed-set defect ADR-0256's arc fixed.
2. A ratify-on-merge predicate cannot coexist with Proposed. Self-discharging:
the file being on main IS the merge having happened.
Plus a vacuity guard, because a derivation that parses zero flags would make
every other assertion pass on an empty set.
Registered two orphans found in passing: test_adr_index.py (5) and
test_ratification_ceremony.py (14) landed in #113 in NO curated suite, so 19
tests -- including the one mechanism that can move curriculum volume -- ran
only under `full`, which gates nothing. Fifth instance of this shape.
Deliberately NOT fixed, recorded in the research doc: the 312-file corpus has
27 unparseable status lines and draft/ratified/active variants. A closed-vocab
assertion would fail on ~35 pre-existing files and get muted, and a muted gate
reads as coverage.
[Verification]: smoke 555 passed in 137.73s (236 baseline + 314 + 5, +1.2s);
governance pin 314 passed in 1.18s standalone and MUTATION-CHECKED -- reverting
ADR-0256 to Proposed fails both invariants independently (2 failed/312 passed);
orphans 19 passed; ruff clean. Canonical Python 3.12.13, uv sync --locked.
Squashes the arc's work into one commit; the workflow-file edit it originally
carried is excluded (see the end of this message).
## Lane 1 — Workbench recorded a proved answer as ungrounded
With deduction_serving_enabled ratified ON (ADR-0256), workbench/api.py's live
chat route builds a bare ChatRuntime(), so the deduction composer decides
Workbench turns and stamps grounding_source="deduction" — but
_coerce_grounding_source carried a hand-copied whitelist of the six pre-arc
labels and silently rewrote anything else to "none". The runtime comment
reasoned this was inert because "REPL turns do not flow through Workbench's
CognitivePipelineRecord path". True, and irrelevant: the traffic flows the
other way. Stale since 2026-07-24.
Scope is one field. workbench/api.py:818 prefers TurnEvent.epistemic_state,
which read epistemic_state_needed — honest. So the UNregistered path degraded
honestly while the hand-copied whitelist asserted a falsehood; a second copy of
a closed enum was worse than no copy. Hence registration AND derivation:
GROUNDING_SOURCES exposes the Literal's members, and the coercion reads it.
workbench-ui badges/tokens/snapshot follow; enumCoverage.test.ts forces atomicity.
## Lane 2 — the ratification ceremony
The discovery loop was instrumented but not closed. teaching/ratification.py
turns a reviewed decision into a chain record, a corpus commit, and a receipt.
Its design turns on one observation: _ratified_rows DROPS unadmissible rows
silently — correct when serving, a trap when ratifying, because the file grows,
the commit lands, and the band count does not move. So the ceremony refuses to
call an append a ratification until it has re-read the curriculum through the
real loader and seen the chain arrive; a non-admitted append is rolled back.
Validation is a pre-flight courtesy, admission is the proof.
Arena queue entry and ledger reseal are deliberately NOT performed (bridge rule
1); the receipt names them. Front door: `core proposal-queue ratify`, a sibling
of `review` rather than a flag on it.
## Lane 3 — structural closures
- ADR-0263 gains rule 5: absence policy is DECLARED in CAPABILITY_LEDGERS, not
passed at the call site. An AST-matched test fails if a serving path passes
missing_ok again.
- Deductive suite added WHOLE to the pre-push gate: 285 tests in 29s against
smoke's 216 in 62s, so no coverage trade was needed.
- Smoke/CI parity assertion made bidirectional. It was one-directional, and had
drifted.
- test_prior_surface_deduction_binding.py pins correction binding on the
deduction path. The review's diagnosis did NOT reproduce — hash_surface moves
in lockstep — so it pins what is there. Mutation-checked.
- Domain-keyed ADR index over 312 flat-numbered files, explicitly partial.
- Arc-close brief template, plus this arc's own brief filled in against it.
## Lanes 4 and 5 — two premises falsified by measurement, one of them mine
Math 4.2: baseline reproduced (correct=5 wrong=0 refused=495); all four named
cases traced to one seam with each gap isolated by one-variable probes. Then the
number that changes the recommendation: the gap blocking case 0000 affects 1
case in 500, the 'than' gap blocking 0001 affects 2. ADR-0251's prohibition on
per-case growth now rests on a count. No reader change made.
CGA: versor_condition is 0.22% of a turn, not the "~10x proof latency" I claimed
— that multiplied an isolated microbenchmark by a call count and compared it to
a single verdict's latency. The real cost is geometric_product at 33,986
calls/turn (~73%) via cga_inner in search paths. The obvious closed form is NOT
bit-exact (954/4000 in f32); backend.vault_recall's serial fold IS (3000/3000,
worst-rel 0) and is the correct target. cargo test could not run —
static.crates.io is denied by the sandbox network policy — so the Rust parity
question stays open and the typestate lane is carried forward, not shipped
uncompiled.
## Not landed: three lines owed to .github/workflows/smoke.yml
The CI smoke gate is narrower than the local one —
test_pack_draft_serve_boundary.py (ADR-0253 INV-33) has been local-only, unseen
because the parity pin checked one direction. The edit was authored and rejected
at push for lacking the `workflow` OAuth scope, so it is recorded as a named,
dated PENDING_IN_CI exception rather than dropped: the assertion still fires on
any new divergence, and a second guard fires once the three land.
[Verification]: pre-push gates all green — smoke 236 passed, warmed_session 10
passed, deductive 285 passed. Ratification 14, ADR index 5, CLI suites 10.
Grounding/epistemic sweep 741 passed 1 skipped. workbench-ui 598 passed across
73 files, tsc -b clean. capability index 11 passed, digest unchanged. Math
holdout correct=5 wrong=0 refused=495. Committed chain corpora byte-unchanged
after the tests that write to them.
Environment caveat: the repo pins requires-python ==3.12.13, which uv cannot
fetch for linux-x86_64, so `uv sync --locked` fails. All Python runs used a
scratch venv on 3.12.11 with declared deps — not the locked universe, not the
full ~12k suite. The pin was left untouched. Re-run on a 3.12.13 host before
treating this as merge evidence.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FduW6Krm3PPQv3P5iwBYtx
The curriculum composer committed on question SHAPE — any `Does …?` text —
and then, being fail-closed, always returned a surface. With the flag on,
"Does the build pass?" would have been taken away from the rest of dispatch
and answered "I haven't been taught the or pass"; "Does anyone know the
time?" likewise. Found by checking the flag's readiness before recommending
ratification; never live, since the flag is default-off.
The asymmetry is the lesson: the deduction composer may commit on shape
because a sentence-initial "therefore" IS a signal of intent — text shaped
that way is an argument. `Does …?` is one of the most common ways to open
any English question and signals nothing. A fail-closed composer is only as
safe as its commit gate is narrow.
The gate is now `is_curriculum_question`: claim the turn only when the
question parses to three tokens AND its terms are vocabulary a served
subject actually teaches. Everything past the gate stays fail-closed —
including `ambiguous_reading` (both terms taught, two subjects claim them)
and `out_of_curriculum` (terms taught, relation unknown), which are real
curriculum questions with honest answers. The DECIDER is unchanged, so the
lane still records untaught-vocabulary probes as declined: the curriculum
path declines them AND does not speak for them.
[Verification]: tests/test_curriculum_serve.py 28 passed (+8: five ordinary
`Does …?` questions pass through untouched, three routable ones still
answered); core test --suite deductive 268 passed; curriculum lane 32/32
wrong=0 with its pinned report SHA unchanged.
Phase 3.3 of the generalization arc. Estimation (ADR-0175), deduction
serving (ADR-0256) and curriculum serving (ADR-0262) had each written the
same seal -> ratify -> SHA-verify -> serve-gate machinery. core/ratified_ledger.py
now owns it and states the four rules once: only sealed practice writes;
tamper-evidence is structural (a load that cannot reproduce content_sha256
REFUSES); ceilings are not negotiable at the call site; absent evidence is
never a license.
Each capability keeps a thin adapter that names its artifact and preserves
its public API. One real difference is now declared rather than implied:
missing_ok distinguishes a ledger a capability SHIPS with (absence = broken
deployment, refuse) from one whose practice volume is still being built
(absence = nothing earned yet, serve disclosed) — curriculum serving is the
second kind today.
Safety property is byte-identity, asserted not assumed: re-sealing the
committed 25-band deduction ledger through the bridge reproduces it
byte-for-byte, so no artifact and no lane pin moves.
Effect: a new subject arena now needs a gold corpus and a band key, not a
re-implementation of ratification — which is what §3 meant by sequencing
the bridge ahead of the second subject.
[Verification]: tests/test_ratified_ledger_bridge.py 8 passed; core test
--suite deductive 252 passed; estimation/license test set 355 passed;
committed deduction ledger byte-identical after reseal.
Phase 2 of the generalization arc, implementing the plan's §4
curriculum-entailment gold contract. "Does force cause acceleration?" is
answered from the ratified physics chain corpus and nothing else; "Does
gravity cause acceleration?" is declined because gravity is in no pack
CORE has been taught; "Does force cause motion?" is unsettled even though
the curriculum contains both links, because nothing ratified says
causation composes.
Path (flag-gated, default off): closed question grammar -> subject routing
by ratified vocabulary -> family-scoped premise compilation from reviewed,
pack-resident chains -> the SAME argument bands (ADR-0260/0261) -> the
ROBDD engine. Zero subject-specific decision code: physics differs from
philosophy only in which rows load.
Epistemology enforced mechanically, not by convention:
- gold is a function of (curriculum, question); cases pin chain ids and
the runner FAILS a case whose pinned chain is absent or unratified;
- untaught => UNKNOWN, never "no" (open-world; silence is not denial);
- an independent oracle (own loader, ratification predicate, family table,
agreement rules, verdict rule) re-derives every gold — it disagreed once,
on "entropy reveals energy" vs "entropy causes energy", and the ORACLE
was the side that was wrong;
- anti-recall probes are a lane GUARD: a split without >=3 true-but-untaught
probes refuses to run.
Findings recorded rather than worked around (ADR-0262 §5):
- every curriculum band is UNEARNED and every answer is hedged. A band needs
n>=657 with a real outcome mix; physics teaches 7 causal + 9 modal
relations, so at most 16 questions in the subject can ever be ENTAILED.
A balanced band needs ~219 taught relations per subject×family — a ~25x
gap that only ratified curriculum content closes. Phase 2's blocker is
curriculum volume, not machinery.
- REFUTED is unreachable from present corpora (every chain is positive).
- there is NO biology domain-chain corpus; the biology OOD lane measures
fluency, not truth. The four subjects with ratified chains and mounted
packs are physics, mathematics_logic, systems_software,
philosophy_theology — the composer serves all four.
[Verification]: curriculum lane 32/32 wrong=0 with 5 anti-recall probes and
all three contract guards passing; tests/test_curriculum_serve.py 20 passed;
core test --suite deductive 252 passed; lane pinned as curriculum_serve_v1.
Completes the all/no/some square. `some` is read for the first time:
"All mammals are vertebrates. Some whales are mammals. Therefore some
whales are vertebrates." is decided entailed; "All unicorns are horned.
Therefore some unicorns are horned." is decided unsettled, with the
no-existential-import reading disclosed in the surface.
Mechanism (generate/proof_chain/exist.py): v5-VP's per-individual
lowering over a domain widened by one Skolem witness per existential
premise and — the load-bearing part — one ARBITRARY element per
existential conclusion, at which every universal still instantiates and
about which no premise asserts anything. Refuting an existential means
deriving a universal, and the arbitrary element is what makes that
derivation genuine instead of an assumption of domain closure: without
it "Rex is a wolf. Rex is not tame. Therefore some wolves are tame."
reads as REFUTED from a domain of one wolf. With it, UNKNOWN.
Four `en_exist_*` bands earned SERVE at 720x wrong=0 on the first arena
seal (25-band ledger); the 32-case hand-authored v2_exist split passed
32/32 first run; full lane 166/166 wrong=0 across six splits.
Also fixes a wrong-answer path this work uncovered in Band v1b
(ADR-0261 §5.1): `to_syllogism` FILTERED premises it could not express
out of the projection and answered from the remainder, so "Aristotle is
a philosopher. All philosophers are scholars. Therefore some scholars
are philosophers." lost its only witness and was served "that doesn't
follow". It now refuses — matching its propositional sibling
`to_deductive_logic`, which always has — and the argument falls through
to the bands that can hold a singular fact. The categorical band
re-earned SERVE 720/720 after the change; both examples are pinned as
regression cases.
Promotion: `ds-mem-0020` declined -> unknown (ADR-0258's existential
scope-out, now read; an anonymous witness never transfers to a named
individual, so UNKNOWN is its honest verdict, not entailed).
[Verification]: core test --suite deductive 232 passed; reader tests
33/33; register+surface tests 52 passed; arena 25 bands x 720 wrong=0
(all SERVE); lane 166/166 wrong=0; lane SHAs 9/10 match (public_demo
drift is pre-existing on the base commit and unrelated — evidence in
the Tier-S brief).
Generalization arc Phase 1.1 (Tier F, docs/plans/generalization-arc-2026-07-24.md):
"All philosophers teach. Socrates is a philosopher. Therefore Socrates
teaches." now reads and decides — the ADR-0258 §6.3 verb-predicate
scope-out, and the reading gate for Phase 2's subject serving.
generate/proof_chain/verb.py extends v3-MEM's per-individual lowering with
a second atom family in one shared space: membership atoms (v3-MEM's own
parsers reused verbatim) + verb atoms (individual, verb-lemma-group,
object-term). Verb universals instantiate as mem(i,C) -> [~]verb(i), so a
copula-minted membership fact discharges a verb rule. The ONE new semantic
identification is closed 3sg agreement (verb-specific irregular table +
the three regular suffix rules — deliberately NOT the noun table, which
would misroute "lives"/"leaves"). Scope-tight segmentation: single-token
name/class/verb/object shapes only; everything longer refuses typed
(tense_out_of_band joins the closed reason vocabulary). Rendered by
render_entailment_verb (member surface, UNKNOWN scoping extended to the
verb reading). Rides deduction_serving_enabled (default off); pure
widening — every previously-served argument byte-identical, no existing
lane case changed outcome.
Earned: 4 en_verb_* bands x 720 arena wrong=0 (first seal), ledger resealed
at 21 bands; corpus soundness asserted against the independent truth-table
oracle over each template's intended lowering (15,120 cases, INV-25).
Lane: v2_verb 28 hand-authored real cases 28/28 first run; full lane
134/134 wrong=0 across five splits. Surgical single-line pin update +
CLAIMS regen.
Stacked on feat/generalization-phase0 (merge that first — shared
verify_lane_shas.py / CLAIMS.md / generate_claims.py lane-ADR mapping).
[Verification]: verb reader tests 34/34; deduction battery 86/86
(surface +5, e2e +1, lane +1) in-worktree; arena seal + oracle
cross-check green; smoke + warmed_session via pre-push gate.
Composes v2-EN's connective grammar (if/then, or, and, either) with
v3-MEM's singular-membership sentence reading over one shared
per-individual atom space, so "If Socrates is a man then Socrates is
mortal. Socrates is a man. Therefore Socrates is mortal." decides — the
exact gap ADR-0258 §6.1 reserved. Genuinely fuses the two mechanisms: a
bare universal's instantiated atom can unify (via the same closed
morphology relation) with a connective leaf's atom, deciding arguments
neither band alone could.
- generate/proof_chain/cond_member.py: new reader. A sentence is checked
for a connective token BEFORE the universal-lead check (so a stray
connective can never leak into an opaque name/class run); reuses v3-MEM's
own _parse_singular/_parse_universal verbatim (already negation-aware,
so no separate negation layer is needed, unlike v2-EN's opaque minter).
Four new shape-bands (fused/disjunctive/chain/conditional), each earning
its own SERVE license.
- chat/deduction_surface.py: new fallback tier tried strictly after v3-MEM
— pure widening, every previously-served argument stays byte-identical.
- evals/deduction_serve/practice/gold.py: 4 new synthetic template groups
(20 templates), reusing the v3-MEM case generator; intended formulas
cross-checked against the independent oracle (INV-25).
- evals/deduction_serve/v2_condmem/: 26 hand-authored real-English cases,
content-disjoint from the synthetic corpus.
- ds-mem-0024 promoted declined -> unknown (not entailed — the antecedent
is never asserted in that text; this is the first promotion in the
corpus that doesn't land on entailed).
- Ledger re-sealed to 17 bands; deduction_serve_v1 lane SHA re-pinned
(surgical single-line edit, not a blanket --update).
Verification: core test --suite deductive 160 passed (31 new reader
tests); practice arena 17 bands x 720 wrong=0, all SERVE-licensed; lane
splits v1 28/28, v2_en 26/26, v2_member 26/26, v2_condmem 26/26; smoke 180
passed; warmed_session 10 passed. Flag deduction_serving_enabled stays
default-off.
CORE now decides natural-English deductive arguments end-to-end:
'If it rains then the ground is wet. It rains. Therefore the ground
is wet.' -> ENTAILED, rendered over the user's own clauses. Both of
ADR-0256's documented boundary cases (multiword conditional, nested-
negation contraposition) are now decided; their lane gold updated
declined->entailed.
- generate/proof_chain/english.py (new): closed function-word grammar
over OPAQUE clause-atoms (minted ids); if/then, [either] or, and,
three negation forms (leading not / sentential / copular incl.
contractions); typed refusals; honesty caps. Soundness: positive
verdicts are substitution-closed; UNKNOWN is scoped + guarded
(quantifier-led, is-a membership, unnormalizable negation refuse
out of the opaque band).
- render_entailment_english: verdicts quoted back verbatim; UNKNOWN
phrasing explicitly scoped to the opaque reading.
- chat/deduction_surface.py: v2-EN fallback tier AFTER v1/v1b —
monotone widening, byte-identical on previously-served arguments.
- Four en_* shape-bands EARN SERVE via the ADR-0199 arena (720/band,
wrong=0, reliability 0.99087 >= 0.99); 9-band ledger re-sealed.
- evals/deduction_serve/v2_en: 26 hand-authored real-English cases
(content disjoint from the synthetic lexicon), wrong=0; report
re-pinned.
- realizer guard (ADR-0075): deduction surfaces exempt — quoted
templates are not slot-composed articulations (pack 'open'=VERB
was rejecting an honest quoted 'the door is not open'); pinned
cold+warm in e2e.
[Verification]: deductive 84 passed; smoke 180 passed; cognition 122
passed 1 skipped; arena 9x720 wrong=0 all SERVE; lanes v1 28/28,
v2_en 26/26.
core chat now decides Aristotelian syllogisms end-to-end -- the marquee
'basic logical work' widening. Closes Phase 0's fork: the ONLY categorical
decider was evals/syllogism/oracle.py (the sealed independence oracle serving
must not import; INV-25). This ships a production decider.
generate/proof_chain/categorical.py lowers a categorical argument to the
propositional regime (one Boolean atom per term-membership profile) and rides
the already-verified ROBDD engine -- no new decision procedure, soundness
inherits from the flagship. Sound AND complete for the modern/Boolean reading
(Darapti + existential-import-only forms correctly INVALID), with no reliance
on a lucky domain size. Independent of the eval oracle by mechanism (ROBDD-
over-profiles vs brute-force finite-model enumeration); proven by case-for-case
agreement with it across the whole syllogism gold lane.
New: generate/proof_chain/categorical.py, render_syllogism (deterministic
valid/invalid/inconsistent templates), CATEGORICAL shape-band, arena
categorical band (4 valid forms + 2 invalid, by-construction gold cross-checked
vs the independent syllogism oracle), tests/test_categorical_decider.py (8
tests incl. the independence-by-agreement proof).
Changed: chat/deduction_surface.py (categorical branch, license-gated via a
shared _license_gate helper; propositional path byte-identical), arena
DeductionSolver dual-path in lock-step with the composer, re-sealed ledger (5
bands, categorical earns SERVE at 0.99087 wrong=0), Phase-2 lane decide()
mirrors the dual path with the 3 categorical cases reclassified to their true
valid/invalid verdicts + 1 invalid case (n 27->28), report+SHA regenerated.
Honest wrinkles: irregular plurals ('fish') decline with unknown_morphology
(a reader limit, correctly not a wrong); surfaces read in singularized terms
('all whale are animal') -- the exact ids the engine reasoned over, no cosmetic
re-pluralization that could drift from the decision.
[Verification]: smoke 180 passed; cognition 122 passed/1 skipped; core test
--suite deductive 45 passed; test_categorical_decider 8 passed; practice
runner 5 bands all SERVE wrong=0; deduction_serve lane SHA regenerates to the
committed pin.
Deduction serving stops being a bare flag and becomes an EARNED capability
governed by the ADR-0175 reliability gate over the ADR-0199 learning arena
-- the arena's second concrete instance (GSM8K math is the first) and the
reliability substrate's first non-estimation serving consumer, a concrete
dent in that zone's standing 'designed, not wired' critique.
Non-circular thesis: the ROBDD engine is sound+complete (never wrong on the
problem it's handed), so the license does NOT certify it. It certifies the
full pipeline (reader -> projector -> engine) per argument shape -- the
FALLIBLE part is the template reader, which can misparse an argument and
hand the engine the wrong problem. The arena catches that as a 'wrong' by
comparing the pipeline's committed outcome to by-construction gold.
New: generate/proof_chain/shape.py (4 exhaustive structural shape-bands, the
capability axis, shared by arena + serving), evals/deduction_serve/practice/
(the deduction arena instance: deterministic synthetic corpus, by-construction
gold independent of the reader per ADR-0199 L-2, cross-checked against the
INDEPENDENT truth-table oracle before sealing), chat/data/deduction_serve_
ledger.json (committed SHA-sealed ledger, 4 bands x 720 correct/0 wrong),
chat/deduction_serve_license.py (tamper-evident serving reader, mirrors
estimation_license.py), tests/test_deduction_serve_license.py (13 tests),
docs/adr/ADR-0256 (+ resolves the ADR-0206 numbering collision in doc form).
Changed: chat/deduction_surface.py (composer consults the license: earned
band -> authoritative Phase-1 surface; unearned/stripped ledger -> same sound
answer served DISCLOSED/hedged -- authority now rests on committed evidence,
not a boolean), core/config.py (flag docstring: enables an EARNED path),
core/cli_test.py (deductive suite runs the license test).
All four structural bands earn SERVE at reliability 0.99087 (>= theta_SERVE
0.99) with wrong=0, so Phase-1 behavior is preserved byte-for-byte; the
gate's teeth are proven by injecting an empty ledger (the same sound answer
degrades to a disclosed hedge). Did NOT reuse the ADR-0206 govern_response
bridge (its STRICT/APPROXIMATE 'widen-past-strict' semantics are the opposite
shape from deduction's always-sound answer); did NOT rewrite report.json's
stale adr field (SHA-pinned bytes, documented in ADR-0256 s2a instead).
[Verification]: smoke 180 passed; cognition 122 passed/1 skipped;
core test --suite deductive 38 passed; architectural_invariants 75 passed;
practice runner 4 bands all SERVE wrong=0.
2026-07-23 directive: instrument candidates-proposed-per-served-turn on
clean, post-reset traffic. Adds an additive-optional turn_count_baseline
manifest field (engine_state) stamping the turn_count at the last clean
reset of the discovery-candidate ledger, a pure compute_discovery_yield
function (teaching/discovery_yield.py), and a read-only `core teaching
discovery-yield` CLI surface. Fails closed (returns None / exits 1) when
no baseline has been stamped rather than fabricating a denominator.
scripts/ops/stamp_discovery_yield_baseline_20260723.py stamps the T11
reset epoch into the live store, mirroring reset_candidate_corpus_t11's
atomic generation-dir pattern. Dry-run verified against a throwaway copy
of the live store's gen-21703; not yet executed against the real store
(see PR body).
Weekly-audit 2026-07-22, T13 decision (2) ruling (Shay). The Shadow Coherence
Gate hard-refused open-geometry surfaces even when the surface was pack-grounded
and the openness was a geometric-coherence residual the pack never claimed to
certify — a false refusal (the warmed "What is doubt?" case:
"To doubt means to think maybe not. pack-grounded (en_core_meta_v1)." was
replaced by "I cannot certify an answer: ... contract is open (goldtether_residual).").
Fix the reading, not the question: route open-geometry-but-pack-grounded
surfaces to a hedge arm (authoritative=False), discriminated purely by grounding
provenance (structural), never by question type. The query-type classifier
bypass was rejected as a fail-open cue-table (ADR-0252 / INV-34).
- core/cognition/surface_resolution.py: the decision lives INSIDE the gate.
Predicate: pack_grounded (grounding_provenance in {pack, teaching}) AND every
open token in {versor_condition, goldtether_residual}. The ¬hazard clause is
enforced structurally by that residual allowlist — any unrecognized open token
(where a genuine safety/harm/imperative hazard lands), non-pack grounding, or a
None assessment falls through to the unchanged fail-closed refusal. New
authority tag grounded_open_hedge; hedged=True; walk/compose folds suppressed.
- core/cognition/pipeline.py: thread grounding provenance into resolve_surface
(read once at the gate seam, reused for the OOV telemetry).
- docs/adr/ADR-0254: the serving-physics decision + fail-closed argument.
- tests/test_grounded_open_hedge_arm.py: RED->GREEN unit suite + real-data
warmed-session integration.
Genuine safety/harm hazards are unaffected: they ride separate axes
(SafetyVerdict refusal, logos-morph override) that supersede this surface.
[Verification]: hedge suite 15 passed; warmed_session lane pin + architectural
invariants 85 passed (155.8s); GSM8K wrong=0 preserved (16 passed, 3 skipped);
smoke 180 passed (131.65s), exit 0. worktree core-wt-hedge @ base 19847f90.
Reconcile Master Blueprint ADR-0240–0253 titles with the live Accepted
registry without renumbering history. Claim ADR-0253 for the freeze policy
itself; reserve 0254–0261 for Blueprint gaps. Document packs/data vs
packs/he|grc dual boundary and pin serve isolation in smoke/packs suites.
[Verification]: Smoke 180 passed (includes 4 dual-pack boundary pins)
Archive the six competing, unratified problem-solving-paradigm formulations
(semantic-substrate master plan, state-transition blueprint, binding-graph
proposal, capability roadmap v2, eight sprint lookbacks, and ADR-0174's
deprecated dispatch prescription) to docs/paradigm-archive/, each prefixed
with a SUPERSEDED header. ADR-0164 and ADR-0174 stay in place (Accepted,
permanent record) with a Superseded-by: ADR-0252 line added. ADR-0252 itself
is a decision record only — it records the retirement and reserves the
governing paradigm content for a separate, human-led step.
No code changes; no behavior changes.
Records the reader-arc recalibration: halt bespoke-per-case regex work,
verified clean-base reset to main@854ce023, and eradication of
feat/reader-inc2-caseband's (PR #80) debt (loosened _token_in, empty
proof file, bundled provenance) without merging that branch.
Preserves the genuinely-general knowledge before the branch is retired:
the has_numeric_token multiplier-blindness bug (root cause + minimal fix
idea, deliberately not landed) and case 0148's correct-for-the-right-reason
decomposition, both independently re-verified against source rather than
copied from the branch's own claims (which included a stale narrative
about a graph-dump proof file that was actually committed empty).
Adds a file:line-cited overfit inventory (31 bespoke/single-case surface
patterns) as inventory only -- nothing removed, the existing regex reader
keeps serving unmodified.
ADR-0251 proposes (not builds) a geometric surface->canonical
normalization spike using existing off-serving primitives
(conformal_procrustes, VocabManifold, the cognition pipeline's Phase C
anti-unification telemetry), wrong=0-gated against holdout_dev/v1, with
Smith-chart algebra and any Fibonacci "dimensional cascade" explicitly
disclaimed. Awaiting ruling -- no implementation started.
Folds in Shay's rulings on the spike:
- ERRATA sections added to ADR-0249, ADR-0250, and both acceptance-evidence docs
(statuses stay Accepted): corpus label 'real GSM8K dev holdout' -> 'CORE-authored
GSM8K-style corpus (ADR-0119.2)'. Mechanism claims (wrong=0, PARITY, conservation,
atomicity, chain-of-custody, 200/200) all stand; reframe not retraction. Covers the
#74 review comment that repeated the label. (Also fixed ADR-0250 evidence status ->
RATIFIED, which the ratification housekeeping missed.)
- Two instruments named + never-blended scoreboard: authored = mechanism-correctness
(200/200 stands as that); official holdout = generalization (5/500 symbolic / 0/500
corridor). public/dev-1 floors relabeled MECHANISM floors, composition-disclosed.
- Censored-incidence fix: parse-INDEPENDENT tagging of 100 official cases (documented
heuristic). 70/100 carry frontier markers (rate 31, fraction 28, compare_mult 20) ->
(c) refuted, frontier COMMON not rare; the table is the reader-arc curriculum by
real-world frequency.
- Reader-practice-loop design with the four non-negotiable constraints (real held-out
data only; wrong=0 gates consolidation; sealed test untouched; holdout_dev split
disjoint from the measured metric). Sequencing: capability->practice->calibration->
serve; reader is the critical path for all three; serve-landing de-prioritized (0/500).
Spike verdict for ruling; nothing built.
Ratification: ADR-0250 Status Proposed->Accepted; §10 ruling record stamped
(Shay, citing the acceptance-evidence pack as-is; full-holdout 50/50 wrong=0
affirmed; next arc = seal dev-holdout-2, dev-1 pinned as regression floor).
Review findings (Shay, PR #74, non-blocking):
1. Instrument module docstring updated from 'Three deterministic domains' +
'GSM8K NOT ingestible / no compiler' to the four-domain post-0250 reality
(arithmetic-chain solves the full dev holdout; frontier surfaced in scope).
2. Restored per-case refusal reasons: _corridor_and_baseline now raises
MultiRegisterError (not bare None); the domain loop records refusal.reason
and distinguishes graph_parse_failed. 'Recorded, never silently dropped'
stays literal (0 rows at refused=0, but the path is honest).
3. Tightened the Tier-1 try to wrap compile_turn_program only (execute outside),
so a future typed execute raise surfaces as a Tier-1 failure instead of
silently rerouting into Tier-2 and masking a regression; added the note that
Tier-2 fails closed on non-convergence while Tier-1 records-only, gold
comparison binding wrong=0 on both.
10/10 instrument pins green.
[Verification]: uv run python -m pytest tests/test_adr_0249_arithmetic_lift.py tests/test_generalized_lift_instrument.py -q
Instrument: the arithmetic-chain domain now routes each real GSM8K dev case to
Tier-1 (single-accumulator) or Tier-2 (multi-register / summation) and compares
the corridor to a symbolic fold of the SAME compiled program. Recorded coverage
moves 26/50 -> 50/50, 0 refused, PARITY (wrong=0) — the measurement catching up
to the capability. Scope note corrected (full holdout closed; remaining frontier
= derived-operand transfers + non-affine kinds + >5-atom deduction, all 0 on this
holdout). Updated the ADR-0249 instrument test pins (26->50, refused 24->0).
ADR-0250 (Status Proposed, no self-Accept; §10 ruling awaits Shay) + acceptance
evidence: multi-register model, relative conservation, atomicity, certified
summation, chain-of-custody, and the full-holdout 50/50 wrong=0 result.
10/10 instrument pins green.
[Verification]: uv run python -m pytest tests/test_adr_0249_arithmetic_lift.py tests/test_generalized_lift_instrument.py -q
Stamp the §10 ruling record: Status Proposed→Accepted; four design rulings
affirmed; honest-by-construction measurement (0 wrong / 26 correct / 24 refused
on real GSM8K, PARITY vs symbolic fold) affirmed as the definitive outcome.
Next arc selected: Tier-2 arithmetic (multi-entity/transfer/rate/comparison/
fraction). Acceptance-evidence status updated to RATIFIED. Doc-only.
ADR-0249 documents the reader→Hamiltonian compiler (P1-P5): thesis (composition
= certified turn sequences), the five components, anti-hollow discipline, the
Ring-2 non-mutating correction, three-tier reproducibility, Tier-1 scope +
recorded frontier, and the honest-measurement done-when. Status Proposed — no
self-Accept; §10 ruling record awaits Shay.
Acceptance evidence: phases + merge SHAs, the real GSM8K dev-holdout result
(26/50 Tier-1 ingestible, wrong=0, PARITY vs symbolic fold, 24 multi-entity
refused = recorded frontier), in-tree algebra + CNF-soundness verification, the
design corrections applied, and the honest open register.
Rings 2 and 3 of the ADR-0246 preflight §9, built exactly as the brief bounds
them. ADR-0247 + ADR-0248 both **Proposed** — no self-Accept.
Ring 2 (core/ports/residual_protocol.py — ADR-0247):
the 7-stage shared control grammar: witness -> typed residual decomposition
-> permitted operator selection -> bounded operation or abstention ->
re-certification -> action decision -> append-only replay record.
Port-agnostic (no registry, no unified scheduler — §7 non-goal #2 honored);
v1 operators are ZERO-BOUND only (nonzero fails closed — no-silent-correction
doctrine); unaccounted residual fails closed; re-certification RAISES on
witness drift during a zero-bound pass; replay chain is append-only,
full-SHA-256 content-addressed, tamper-evident (verify_replay_chain).
NOTE: named core/ports/ because core/protocol/ is the existing CTP v0 wire
format (collision checked before naming).
Ring 2 adapters (core/ports/adapters.py): IdentityPort (ADR-0246 grade-1
geometry; typed channels travel IN the witness so decompose is a pure
re-shaping, no hidden state; admit = evaluate_admission, single source of
truth) + PrecisionPort (ADR-0244 §2.5 cast transport; ServingState subjects)
— two genuinely non-identical native geometries + a synthetic third port
proving grammar agnosticism.
Ring 3 (core/ports/integrity_handoff.py — ADR-0248):
the coordination seam ('Integrity coordinates handoffs; it does not replace
content-bearing cognition'): fuses Ring-2 port decisions + existing
EpistemicState/NormativeClearance into content-free proceed/hedge/abstain
(conjunctive, strongest-restriction-wins; fail-closed on missing/invalid
evidence; binds replay-chain tip digest; handoff itself content-addressed).
Weak epistemic standing hedges (mirrors hedge doctrine) — only integrity
violations silence a turn. OBSERVE-ONLY: no serve consumer yet; that is a
future flag-gated unit. Remaining Ring-3 programme honestly listed open
(world-model, governed-learning consumption, discourse widening).
Both pure/deterministic/off-serving (A-04 pinned); brief §0a/§9 updated.
[Verification]: uv run core test --suite smoke -q => 176 passed; Ring 2/3 +
ADR-0246 suites + D4 gate surfaces => 125 passed (28 new Ring-2/3 pins);
run log docs/audit/artifacts/ring2-ring3-runlog.txt
Governance flip carrying Joshua Shay's ratification provenance inline (ruling
2026-07-17: "Ratify both"). Anti-self-Accept guard satisfied — status flips are
authorized by explicit human ruling, not self-issued.
- ADR-0245 → **Accepted** (clean): mechanical-sympathy + semantic-rigor §3 gate
green — parity, f32 467× speedup, 0-LAPACK-on-repeat, collision-resistance.
- ADR-0244 → **Accepted as an implemented mechanism** with a RATIFIED
live-activation limitation: identity_wave_gate stays default-off and live
activation is NOT authorized. Acceptance covers the operator-preservation
manifold, fail-closed gate capability, γ_id calibration, telemetry, and
lifecycle contracts — not a production flip. The Phase-3 calibration explicitly
did NOT authorize activation (benign traffic not separable at the nominal
frame; best balanced error 0.346). Activation is blocked pending a separately
ratified ADR-0246 (induced action, lawful stabilizer, path integrity,
semantic-frame discrimination) + renewed discrimination evidence + acceptable
benign refusal rate + explicit human ratification.
Governance additions (per the ruling): both ADR status lines carry
"Accepted — ratified by Joshua Shay … acceptance-packet" (provenance-guard
format); ADR-0244 header carries the Operational-status limitation paragraph + a
machine-readable identity_wave_gate: ledger block (implementation: accepted /
live_activation: not_authorized / default: off); both packet §8 RULING RECORDs
RATIFIED with the "not safe-to-activate" caveat prominent. Plan doc Phase 6 → DONE.
[Verification]: smoke 176 passed; provenance/ADR pins + all ADR-0244/0245 tests
503 passed (both-Accepted-with-provenance format enforced). Docs-only.
The single explicit, fail-closed f64→f32 down-cast at the certified lifecycle
egress. serving_cast(psi_steady, certificate, verdict) -> ServingState in
core/physics/cognitive_lifecycle.py:
- Casts ONLY a state that validates as a finite 32-vector, matches its
certificate psi_digest, and was verdict.admitted — an uncertified, refused, or
digest-mismatched state is never served.
- Precision-checks the f32 result (cast_error = max|f64-f32|, unit norm) and
fails closed on an f32 precision cliff (f32_precision_insufficient) rather than
serving a silently-degraded state.
- Keeps f64 as the source of truth: psi_steady and the psi_digest content-address
chain are untouched; ServingState carries provenance back (source_psi_digest,
certificate_id, measured cast_error) for audit. f64 stays inside
relaxation/eigendecomp — this is the one place f32 appears (ADR-0245 §2.2
mechanical sympathy).
Satisfies both ADR-0244 §2.5 and ADR-0245 §2.2 (one contract, two ADRs). Measured
on a real certified outcome: cast_error ~1.2e-8, unit_norm_f32 ~0.99999998.
Off-serving (A-04 guard: chat.runtime never imports it). ADR-0245 status map +
plan doc updated.
[Verification]: smoke 176 passed; fast lane 11907 passed / 109 skipped (-n auto,
not quarantine/slow); 10 targeted serving-cast tests passed.
D4 Phase 3 (§2.4). Calibrates the wave-gate leakage bound γ_id via the
bracketed-local Fibonacci section search and emits a content-addressed tuning
certificate (evals/adr_0244_gamma_calibration/). Two results, kept separate:
1. The search certifies γ* = 0.2126624458513829 (cert 0079b5f2…) separating
the geometric attack signal — in-subspace rotors admitted, axis→e4/e5
tilt/boost attacks flagged (inversions excluded: ~0-leakage, handled by the
orientation floor). Pinned as identity._WAVE_LEAKAGE_BOUND; the wave path is
decoupled from alignment_threshold (legacy path + hedge bands keep it).
2. The same bound does NOT separate real live traffic. Measured on the engine,
benign final_state.F versors do not preserve span(e1,e2,e3): leakage
0.14–0.81 (mean 0.55), self-align to −0.52, 12/13 benign false-refused at
γ*, best balanced error 0.346. The calibration certifies
flag_flip_authorized=False → identity_wave_gate stays OFF.
Root cause: the shipped value axes (truthfulness=e1, coherence=e2,
reverence=e3) are nominal basis vectors, not dynamically-preserved eigenmodes;
the field evolution gives the identity subspace no dynamical anchoring. The fix
is the ADR-0246 induced-identity-action programme (preflight brief merged). The
wave gate is validated, correctly-off scaffolding — not a live gate. A slow
drift-guard test canaries any future engine change that starts preserving
identity.
Off-serving (evals/ + tests); flag-off byte-identity preserved. ADR §4a +
plan doc + memory updated with the finding.
[Verification]: smoke 176 passed; fast lane 11897 passed / 109 skipped (-n
auto, not quarantine/slow); 59 targeted gate/calibration tests passed.
Wires the ADR-0244 §2.2 wave gate into the live turn loop behind a new
opt-in flag, byte-identical when off, plus a normalization fix found in
integration.
core/config.py: RuntimeConfig.identity_wave_gate (bool = False). OFF by
default — the leakage threshold is provisional (reuses alignment_threshold)
until calibrated to gamma_id in Phase 3, and flag-off is byte-identical to
the pre-ADR-0244 advisory path.
chat/runtime.py (main chat() path, two flag-gated touches):
- at the identity check, pass wave_field=result.final_state.F when the
flag is on (so hedging + telemetry both use the wave score); None when
off -> legacy scalar-L2 path.
- after the safety/ethics verdicts exist, intersect their violated
boundaries with the manifold's committed boundary_ids (supplement via
dataclasses.replace) and fold a fail-closed geometric IdentityGateRefusal
into the typed refusal surface (TYPED_REFUSAL_PREFIX). refusal_emitted is
derived once, after the block, preserving the (surface is not None) <=>
emitted invariant.
chat/telemetry.py: serialize_turn_event emits the wave-gate keys
(identity_wave_mode / _leakage_norm / _min_self_alignment /
_boundary_violations) only when identity_score.wave_mode_active — so the
wire format is byte-identical when the gate is off.
core/physics/identity_manifold.py — NORMALIZATION FIX (found in
integration): the live versor carries boost (e5) components, and a boost is
a unit versor (R R~ = 1) that does NOT preserve the Euclidean coefficient
norm, so ‖R a_i R~‖ > 1 and the un-normalized leakage/self-alignment ran
past their ranges (measured leakage 5.16, self_align -4.75 on a real turn).
axis_response now normalizes each measure by the rotated-axis magnitude:
leakage is a fraction in [0,1], self_align a signed cosine in [-1,1]. For a
norm-preserving spatial rotor the rotated axis is unit and normalization is
a no-op (Phase 1 results unchanged). §4a updated to match; new boost test
pins bounded measures.
tests/test_adr_0244_identity_gate_runtime.py (new): flag OFF -> legacy
score + no wave telemetry (byte-identical wire); flag ON -> wave gate active
on the live versor + wave telemetry present + bounded measures; flag-off
determinism. Seeds a short sequence to reach main-path (identity-checked)
turns (a fresh empty-vault runtime routes ungrounded inputs to disclosure).
[Verification]: 74 targeted (manifold+gate+runtime+legacy identity+
telemetry) passed; in-worktree smoke 176 passed; fast lane
(-m 'not quarantine and not slow' -n auto) 11883 passed, 109 skipped —
flag-off byte-identity confirmed across the whole suite.
Discovered before implementing Phase 1: the live identity trajectory
final_state.F carries the invariant versor_condition(F) < 1e-6 — it is a
VERSOR (even-grade operator, grades 0/2/4, exactly zero grade-1 content).
§2.1/§2.2's literal 'project psi_traj onto the grade-1 value subspace' is
therefore VACUOUS on the real runtime object: P_id(F) = 0 identically,
flagging every trajectory — a fail-closed brick. Root cause: a versor is
an operator, not a state vector; projecting the operator into a subspace
of states is a category error.
Resolution (ratified by Joshua Shay 2026-07-17): measure whether the
versor PRESERVES the value subspace, via its action on the axes
F a_i F~ (sandwich). Two per-axis measures, both empirically verified
necessary and non-redundant:
- subspace leakage = euclidean_norm(rot_i - P_I(rot_i)) — catches a
versor tilting a value axis toward an alien dimension (e4/e5);
- signed self-alignment = <a_i, rot_i>_0 — catches in-subspace
inversion (e1 -> -e1: leakage 0 but self-align -1), the concrete
realization of the ratified 'signed overlap, never abs()' decision.
Keeps the grade-1 pack axes unchanged (no pack migration) and sharpens
inalienability: identity is invariant UNDER transformation, not a frozen
state.
§4a rewritten to the operator-preservation spec (lift_axis, gram_matrix,
subspace_project, sandwich, euclidean_norm, axis_response); governance
annotation item 12 records the reframe + ratification; plan doc §3 Fact C
+ §5 Phase 1 + progress log updated.
[Verification]: docs-only ADR/plan amendment; provenance/ADR guard
(test_adr_0241_governance_p12.py) 6 passed — ADR-0244 Status line
confirmed still 'Proposed' (the item-12 ratification text is inside the
annotation/§4a, not a status flip). All acceptance numbers pre-verified
via in-tree numerical probes against algebra.cl41.
Reconciles ADR-0244 against its own D0 blockers and commits ADR-0245 as
a real companion ADR (previously a dangling reference in ADR-0244 §4).
ADR-0244 governance annotation expanded (11 items, all body text below
preserved verbatim for R&D provenance; annotation governs on conflict):
1. Q_top proof (already landed) now explicitly drops the §2.2 egress
ΔQ_top conjunct (it is a hollow, always-true discriminator).
2. §4-vs-§2 contradiction RESOLVED — new §4a is the governing spec;
§4 kept verbatim as the (contradictory) original R&D sketch.
3. §2.1 axis construction was underspecified (packs ship dim-3
directions, not 32-vectors) — resolved via a grade-1 lift at the
e1/e2/e3 slots (algebra.cl41.basis_vector), not embed_point.
4. §2.2 amended: signed overlap (never abs()'d — anti-alignment must
stay distinguishable from orthogonality); leakage norm is the
positive-definite Euclidean coefficient norm, not the indefinite
Cl(4,1) inner product (which (+,+,+,+,-) permits to vanish for
nonzero leakage).
5. Inalienability reframed as 5 testable layers (algebraic / runtime
/ pipeline / operational / semantic) — only the first is a math
guarantee.
6. Paraphrase-invariance reworded as an empirical, measured property;
Q_top conservation scoped to pure versors only (relax_to_ground
can converge to non-versor superpositions — the ADR-0243 SD-A
subtlety).
7. boundary_ids activation (currently stored, never evaluated).
8. Identity manifold is FROZEN — biography holonomy accumulates
separately and never mutates the identity subspace.
9-11. Filename correction (multimodal_lifecycle.py doesn't exist;
real file is cognitive_lifecycle.py), ADR-0245 cross-link,
theological citation labeled ESV + analogy disclaimer.
New §4a supersedes §4 with a typed, Gram/leakage-correct specification
(ManifoldConditioningError, IdentityGateRefusal, bounded/abstaining
C_id, isfinite + shape guards — no bare assert) for Phase 1/2 to build
against under TDD.
ADR-0245 committed Proposed, verbatim from the R&D export, with a
governance annotation mapping its 4 decisions + Sec 3 acceptance gate
against what the cohesion-directive arc already landed (Rust f32 GP,
_cached_eigh, digest hot-path all done; f64->f32 cast + Sec 3's
speedup/collision proofs open — tracked as D4 Phase 4/5).
Audit doc (adr-0244-cohesion-directive-audit-2026-07-17.md) wrinkles
1-2 and Q5 sequencing updated from 'pending'/'must reconcile' to
resolved, cross-referencing this landing.
[Verification]: in-worktree smoke gate 176 passed; provenance/ADR
governance pins (test_adr_0241_governance_p12.py,
test_adr_0242_topological_quarantine.py, test_third_door_cohesion.py)
30 passed — confirms ADR-0244 stays Proposed (no status flip) and no
existing ADR provenance guard was disturbed. Docs-only change, no
executable surface touched.
Turns the D0 "likely vacuous" annotation on ADR-0244 §2.3 into a re-runnable proof
that ΔQ_top = 0 is a hollow egress gate (the #19-pseudoscalar failure mode).
evals/adr_0244_qtop_vacuity/ — computes Q_top = <psi I5 ~psi>_0 on the real
Cl(4,1) algebra and finds: (1) Q_top = 0.000e+00 EXACTLY across every unit versor
(spatial rotors AND boosts through e5, and products) — I5 is central so
psi I5 ~psi = I5*(psi ~psi) = I5 for a unit versor, scalar part 0; (2) off the
versor manifold Q_top = -grade5(psi ~psi), nonzero only where the I-05 closure
residual already fires; (3) it is a conserved Spin(4,1) invariant but identically
0 on the valid manifold; (4) the decisive test — an aligned identity and an
adversarially-rotated one (a valid versor, overlap 0.963) both read Q_top = 0, so
ΔQ_top = 0 PASSES the attack the spectral-leakage/closure check actually catches.
Typed JSON artifact + CLI (exit 0 iff proven_vacuous).
tests/test_adr_0244_qtop_vacuity.py — pins each step + off-serving quarantine.
Docs: ADR-0244 §2.3 annotation upgraded "likely vacuous" -> "PROVEN vacuous —
retire from egress"; audit-doc Q4 marked RESOLVED with the evidence.
Verdict: do NOT wire ΔQ_top = 0 as an egress admit condition; keep Q_top, if at
all, as a closure-derived diagnostic. Closes the first of the two ADR-0244 D4
blockers with proof.
[Verification]: qtop eval 8 tests green; CLI proven_vacuous=true; smoke below.
First step of the cohesion-directive arc (docs only; no code).
- docs/adr/ADR-0244-…md: committed Proposed, verbatim from the R&D export
(matching the ADR-0241/2/3 landing convention), plus a clearly-marked
governance annotation holding two items open for the D4 implementation plan:
(1) §2.3 Q_top is likely vacuous — central I5 in odd Cl(4,1) collapses the
charge on versor states (the #19 pseudoscalar failure mode); it must not be an
egress gate without an empirical discriminating counterexample; (2) §4's
conformed implementation contradicts §2.1-2.2 (per-axis resonance vs.
Gram-projection/leakage-norm/ManifoldConditioningError), references a dangling
ADR-0245, and uses a bare assert for the byte-order guard.
- docs/analysis/engineering_cohesion_refactoring_directive.md: the technical
directive moved to its own canonical path, verbatim (content byte-identical).
- docs/analysis/adr-0244-cohesion-directive-audit-2026-07-17.md: the code-level
audit of all 7 mandates vs. main@24078b11 — per-mandate verdicts, the six
spec-level wrinkles, the amended mandate→work-item mapping, the missing sixth
acceptance criterion (Mechanical-Sympathy gain), and the five decisions (Q1-Q5).
Notable finding: the default=str + 24-char-digest drift the directive flags was
replicated into Lane C (biography_wiring.py) AFTER the directive was written —
raising the priority of the D1 semantic-rigor batch.
[Verification]: docs-only; ADR governance provenance-guard green (unchanged).
Commits the ADR-0243 (Wave-Field Cognitive Lifecycle) proposal verbatim as
Proposed, and the arc-governing implementation plan derived from it plus
docs/analysis/core_cohesion_master_plan.md and the ADR-0241/0242 post-Accept
close audit findings.
The plan records that most of ADR-0243's organs already exist on main
(sensorium feed, WaveManifold, energy classes, GoldTether, surprise/discovery
plumbing, self-authorship, biography, packs/en readback) and that
tests/test_third_door_cohesion.py already pins I-01..I-05, A-02/A-04, and
core_ha absence from the cohesion master plan — so this arc is the §2.2
relaxation reasoner plus three wiring lanes, not a rebuild.
Also pins three defects in the ADR's §3 reference prototype so it can never
be ported verbatim: the egress gate's antisymmetric quadratic form is
identically zero (rejects every state, valid or not); the unitary
relaxation loop cannot dissipate toward a ground state (the honest
relaxer is the imaginary-time semigroup); and the prototype's block-matrix
"pseudoscalar proxy" is a different operator from the real Cl(4,1)
pseudoscalar action despite sharing I^2 = -Id.
[Verification]: uv run core test --suite smoke -q -> 176 passed (133.41s);
uv run python -m pytest tests/test_adr_0243_sketch_defect_pins.py tests/test_third_door_cohesion.py -q -> 19 passed (0.93s)
Executes the explicit in-session 'Ratify' ruling on the D10 acceptance
packet (docs/audit/adr-0241-0242-acceptance-packet-2026-07-15.md §8 ruling
record added):
- ADR-0241 status: Proposed → Accepted (P7 demote-with-proof accepted as
honest per the #19 precedent; T1/T2 serve-boundary reconciliation
ratified; chiral sign-gate enforced on the accepted state via PR #41).
- ADR-0242 status: Proposed → Accepted (memo fidelity slice closed with no
new defects; V5 anyons remain claim-quarantined/not built; V2 production
promotion stays benchmark-gated).
- CRDT determinism ruling (PR #42) ratified: single-writer bit-exact now;
CRDT behind an explicit multi-writer gate.
- Checklist header, fidelity-ledger §12 status, and living summary §12
updated to the ratified state.
Post-Accept work remains tracked (W5 backlog + packet §7 carry items);
none are conditions of this Accept.
