core/docs/adr/ADR-0264-negative-curriculum-and-premise-scope.md

ADR-0264 — Negative curriculum, premise scope, and what a curriculum band can earn

• Status: Accepted — ratified by Joshua Shay 2026-07-26. All nine rules (R1–R9) are implemented and merged to main @ 803703fc. This ADR changes no flag and no default; it fixed a schema shape and a compilation rule, and it recorded a blocking finding about ADR-0262 §5.1. §4.1 is self-superseded by this ADR's own R5 — see the note there before citing it.
• Date: 2026-07-25 · Ratified: 2026-07-26
• Implemented by: R5–R7 #120 · R9 #117 · R1–R4/R8 #125. Enforcement pins: tests/test_curriculum_polarity.py (R1–R4, R8), tests/test_volume_honesty.py (R9), tests/test_curriculum_serve.py (R6/R7), tests/test_curriculum_practice.py (R9 at the producer).
• Arc: curriculum-license-loop Phase A (docs/plans/curriculum-license-loop-2026-07-25.md §4)
• Governs: the polarity field of teaching/domain_chains/*.jsonl, teaching/curriculum_premises.py (CurriculumChain.sentence, compile_premises, load_curriculum admission), chat/curriculum_surface.py::decide_curriculum_question, evals/curriculum_serve/oracle.py, and teaching/ratification.py::validate_admissible.
• Amends: ADR-0262 §5.1 (its conclusion, not its decision) and §6's premise-set-scaling scope-out. Builds on ADR-0261 §5.1 (refuse, don't drop) and ADR-0260 (the verb-predicate band that decides these arguments).

1. Context

The plan of record asked Phase A one question: how does an explicitly-taught negative coexist with the open-world reading, where an absent edge must stay UNKNOWN and never become "no"? Answering it required reading the compilation path end to end, and that read produced three facts that were not known when the plan was written. Two of them change what the arc must do next.

Everything below was verified by running the real path in-tree, not by reading docstrings. Reproduction is in §6.

Fact 1 — the row field polarity is silently ignored, and a negative row serves a confident wrong "Yes." load_curriculum reads review_status, domain, subject, object, the two *_pack_id fields and connective. Nothing else. CurriculumChain.sentence is unconditionally f"{subject} {connective} {obj}". So a row added today with "polarity": "negative" compiles to the affirmative sentence, and the question it was authored to refute comes back entailed:

+1 negative row (acceleration requires charge, polarity=negative)
  Does acceleration require charge?  ->  verdict='entailed'

The user-visible surface for that verdict is "Yes — my physics curriculum teaches that acceleration requires charge, directly, among the 10 modal relations it states." The curriculum said the opposite.

This is not caught by any gate. evals/curriculum_serve/oracle.py is independent in code but reads the same rows, and it ignores polarity for the same reason. Gold and the serving path agree on the wrong answer, so the lane stays green and wrong=0 holds. This is the exact failure class Phase A exists to prevent, and it is now demonstrated rather than hypothesised.

Fact 2 — operator_family is not the band axis; the connective is. The plan of record and the division-of-work both state that bands key on (domain, operator_family) and warn against a modal_negative family. The warning points at a real hazard but names the wrong field. load_curriculum never reads the row's operator_family; CONNECTIVE_FAMILY[connective] is the sole family authority, deliberately and as documented in teaching/curriculum_premises.py. Two rows in the corpus already declare a family their connective contradicts (physics-causal-008 and one systems_software row, both requires/causal) and are correctly read as modal. physics · modal therefore holds 9 chains, not 8 — which is where the plan's n=9 came from.

The hazard restated correctly: the connective fixes both the band and the propositional atom. A negative expressed as a new connective (precludes, does_not_require) mints a different atom from the positive question it was meant to refute, so the ROBDD returns UNKNOWN instead of REFUTED — silently, at every such row.

Fact 3 — the premise cap makes ADR-0262 §5.1's own prescribed remedy destroy the capability it was meant to build. compile_premises emits every chain in the family as a premise sentence, and read_verb_argument refuses beyond MAX_PREMISE_SENTENCES = 16. Measured end to end:

physics modal chains = 9   (cap = 16)
 +7 rows -> 16 premises: taught positive = 'entailed'   negative pair = 'entailed'
 +8 rows -> 17 premises: taught positive = 'declined'   negative pair = 'declined'
                          reason='compiled_premises_unreadable'

At row 17 the band stops answering anything — including conservation requires symmetry, which works today. ADR-0262 §5.1 prescribes authoring ≈219 relations per subject × family to reach a balanced band. ADR-0262 §6 scopes premise-set scaling out, on the reasoning that "no current family exceeds 9" and the fix can wait until one does. Those two sections are in contradiction: §5.1's remedy triggers §6's deferred fix at row 17 and then collapses the band for the remaining 202 rows. The scope-out silently blocks the plan it shares an ADR with.

2. Decision

R1 — Polarity is a row-level polarity field. Values "affirmative" and "negative"; absent means affirmative, so all 88 existing rows are unchanged and no migration is required.

It is not an intent value. intent already carries an orthogonal teaching-intent axis with five values in use (cause/verification/procedure/comparison/correction); overloading it would conflate two independent axes in one column and make each unreadable from the other. It is not a new operator_family value and not a new connective — see R3.

R2 — A negative row compiles to the sentential-not form.

affirmative:  f"{subject} {connective} {obj}"
negative:     f"it is not the case that {subject} {connective} {obj}"

The ("it","is","not","the","case","that") prefix is an existing shape in generate/proof_chain/english.py and member.py, already read by the verb band. It is chosen over "{subject} does not {connective} {obj}" for one reason: the does not shape wants the base form of the verb (require, not requires), which would require a de-inflection table — a new inverse of _VERB_IRREGULAR_3SG — to be invented and maintained. The band happens to read "does not requires" too, but that is ungrammatical English written into a reasoning trace, and depending on it would be depending on an accident.

Verified: all three shapes reach REFUTED with correct atom identity (premises ('a0','a1','~(a2)') against query 'a2').

R3 — A negative row MUST reuse the affirmative connective. Atom identity is (subject, normalized-verb, object). REFUTED is (⋀P) → ¬Q being a tautology, which requires the negated premise and the query to be the same atom. A new connective mints a new atom and yields UNKNOWN. validate_admissible must reject a negative row whose connective is absent from CONNECTIVE_FAMILY.

R4 — Contradiction is rejected at ratification, not discovered at serve time. A negative row for a (domain, subject, connective, object) that already holds an affirmative row — or the reverse — is inadmissible. teaching/ratification.py::validate_admissible rejects it. Without this guard the compiled premise set is inconsistent, evaluate_entailment_with_trace returns REFUSED/INCONSISTENT_PREMISES, and the surface says "The curriculum I have for that is inconsistent" — an honest answer to a problem that should never have been ratified. Fail at authoring, where a human is present.

R5 — Premise compilation is query-scoped, and the scope must be a superset of the query-atom rows. The soundness condition is exact:

For a corpus of atomic rows, every compiled premise mints one independent propositional atom. A scope that contains every row whose atom is the query's atom decides the query identically to the full family, because no other atom appears in the query formula and independent atoms cannot constrain it.

Two consequences worth stating separately, because ADR-0262 §6 conflates them:

• Sound (narrowing cannot invent an entailment) is the weaker property §6 argues for. It is true but insufficient — a narrowing can be sound while silently losing true entailments, which is coverage loss in exactly the class of case the license counts, and is the shape ADR-0261 §5.1 was written about.
• Verdict-identical is the property R5 requires, and it holds only for a scope that is a superset of the query-atom rows.

The default scope is term incidence: rows whose subject or object is one of the query's two terms. This is bounded by vocabulary degree rather than corpus size, keeps real neighbouring premises in the argument, and is a superset of the query-atom rows. If term incidence would still exceed the band's cap, narrow to the query-atom rows — never an arbitrary truncation. The reader is never asked to refuse for size.

Precision fix, 2026-07-26. "Verdict-identical" is exact for every scope the full family could be read at, and that is where the 8,520-question / zero- mismatch evidence in §6 was gathered. It is not exact for the over-cap branch: there the full family exceeds MAX_PREMISE_SENTENCES, so full-family compilation would refuse compiled_premises_unreadable and answer nothing. Narrowing there is verdict-improving, not identical — which is the entire point of the unblock. The precise claim is therefore: identical wherever the full family was readable, improving where it was not. Read literally, the unqualified phrasing would lead a reader to expect a 17-chain family to keep declining, which is backwards.

R6 — An empty scope is UNKNOWN; only an empty family is a refusal. Today compile_premises returning nothing means "this family has no ratified chains" and correctly refuses empty_curriculum. Under R5 it will much more often mean "no ratified chain mentions this query", which is UNKNOWN — the open-world reading. These two must be distinguished at the call site, or 8,463 of the 8,520 questions measured in §6 flip from unknown to declined.

R7 — premise_count continues to report family size. It is user-visible ("It states 9 modal relations, and none of them decides this one"). Under R5 the compiled scope is usually 0 or 1, and reporting that number would understate the curriculum to the user. Report family size in the surface; carry the compiled-scope size as a separate field for the lane and the audit ledger, and disclose the narrowing there. This also keeps ADR-0262 §7's existing assertions stable.

R8 — The oracle learns polarity independently. evals/curriculum_serve/oracle.py reads polarity with its own default rule and its own restated vocabulary, sharing no helper with teaching/curriculum_premises.py. Its code-level independence is the entire evidentiary value of the lane; a shared polarity helper would make the two agree by construction, which is what Fact 1 shows is indistinguishable from being right. Additionally: negative edges are excluded from the BFS adjacency. A negative edge is not a traversable path, and including it would inflate the reachability depths the lane asserts against.

R9 — Committed volume must be DISTINCT evidence, and a band that cannot reach the threshold must say so before anyone authors for it.

conservative_floor is a one-sided Wilson lower bound, and Wilson assumes independent trials. CORE's pipeline is deterministic, so replaying an identical case is not a second trial — it is the same trial with a guaranteed outcome. A ledger's committed count is therefore an upper bound on its evidence, and the defensible figure is its distinct-decision count. A producer must commit at most one case per distinct decision, where the decision key for this path is the query atom (domain, subject, connective, object) — spelling variants of one question are one case, because R2/R3 normalize them to one atom.

Additionally the producer reports, per band, the maximum honest committed volume (§4.2) and the maximum entailed share the ratified corpus can support, and a band whose ceiling is below the licensing threshold is reported structurally unable to earn SERVE rather than left for authoring effort to discover.

Amended 2026-07-25, Phase B. This rule was written as a precaution for a producer that does not exist yet. Measuring the producers that do exist found it already violated: 21 of the 25 ratified deduction_serve bands do not clear θ_SERVE=0.99 on distinct evidence, three of them inflating 28 distinct cases into 720 committed, under a flag ratified ON. The estimation producer (ADR-0175) is clean at 660 distinct per class, so this is a regression from an established standard rather than an architectural gap. Measured, pinned in both directions by tests/test_volume_honesty.py, and not repaired — the ledger is SHA-sealed and ratified, so re-sealing it is Shay's decision. Full audit: docs/research/distinct-evidence-audit-2026-07-25.md.

Outcome mix is deliberately excluded from the pin. ClassTally has no verdict axis, so mix can only be enforced at the producer; the deduction producer already balances 240/240/240 by construction; and whether each verdict class needs its own 657 is an open ruling that would retroactively fail all 25 bands (smallest per-band verdict-class count is 120). Recorded for Shay with numbers, not decided.

3. Why this is sound

R5 is the only rule that changes an existing answer, so it is the only one that needs evidence rather than argument. Both candidate scopes were compared against full-family compilation over every routable question in all four served domains (philosophy_theology sampled to its first 40 lemmas to stay tractable):

questions compared           : 8520
term-incidence mismatches    : 0
query-atom mismatches        : 0     (over non-empty scopes)
query-atom EMPTY scopes      : 8463  <- R6 governs these
max premises, full-family    : 9
max premises, term-incidence : 8

Zero verdict changes. The physics lane's entailed 14 / unknown 12 / declined 6 gold is preserved exactly: taught edges keep a non-empty query-atom scope and stay entailed; untaught pairs get an empty scope and stay unknown under R6; pre-band refusals are untouched.

R1–R4 and R8 add a verdict (REFUTED) that the decision path already maps and already has a surface template for. They do not change any existing answer, because absent polarity means affirmative.

4. Findings

4.1 No curriculum band can earn a SERVE license under the current architecture

SELF-SUPERSEDED by this ADR's own R5, discharged 2026-07-26. The heading is no longer true of the running system. Read the finding below as a statement about the pre-R5 architecture; it was accurate then and it is why R5 exists.

§4.1's reasoning rests on "the premise cap holds a family to ≤16 chains". R5 removed that: compilation is query-scoped, so a family of any size answers. With the cap gone, four bands would earn SERVE the moment a ledger is sealed — physics·causal, systems_software·causal, and philosophy_theology·{modal,contrast} — measured in docs/research/curriculum-practice-producer-2026-07-26.md §1.

But the conclusion "the binding constraint is not curriculum volume" survives, for a different and stronger reason. Reliability is commitment precision and a correct UNKNOWN is a commitment, so a band clears θ_SERVE on non-commitments alone: conservative_floor(660,660) = 0.990046. The licensable evidence is 99.0–99.98% non-entailed, and max entailed volume in any band is 9. So §4.1's "≥97.6% non-entailed" arithmetic was directionally right and its cause was wrong — it is not the premise cap that makes a curriculum license dishonest, it is the absence of a mix rule. That also means the plan's Phase-1 exit criterion ("a real, still-unearned ledger") is unreachable: a committed ledger is necessarily an earning one.

The binding constraint is now the outcome-mix ruling (§5, recorded as open and still open). chat/data/curriculum_serve_ledger.json is deliberately absent and core proposal-queue reseal refuses to grant a license without --allow-new-licenses, so nothing is licensed while that ruling is unmade.

This follows from two facts already in the repository, and it does not depend on any rule in §2.

• A taught edge makes exactly one question come back entailed, so the entailed cases available to a band equal the number of ratified chains in its family.
• The premise cap holds a family to ≤16 chains — beyond that the band answers nothing at all (Fact 3).

So a band has at most 16 entailed cases available, against a licensing threshold of n ≥ 657 committed. Reaching 657 therefore requires a ledger that is at least 1 − 16/657 = 97.6% non-entailed. ADR-0262 §5.1 already rules that unacceptable. Its ⅓-entailed target caps committed volume at 3 × 16 = 48, and any mix floor above 2.44% blocks a license outright.

The conclusion inverts §5.1's: the binding constraint is not curriculum volume, and not "a curriculum-authoring and ratification task — Shay's call, not an engineering one." Authoring is blocked by an engineering prerequisite. R5 is that prerequisite: query-scoped compilation removes the 16-chain ceiling, at which point §5.1's ≈219-relation prescription becomes achievable and its arithmetic becomes correct again.

4.2 Seven of eleven bands cannot reach the threshold even with unlimited authoring

CORRECTED 2026-07-26, after Phase C measured this against the wired code. The original heading said eight of eleven and the table below understated every ceiling. Both errors have one cause: I sized bands from per-term exclusivity (a lemma taught by only one subject), while resolve_domain's actual predicate is per-pair — a question routes iff exactly one served subject holds both terms. A lemma taught in two subjects can still appear in a pair only one of them holds both halves of, so per-term exclusivity is a strictly tighter bound.

band	stated below	measured	change
curriculum_systems_software_causal	630	720	impossible → reachable
curriculum_philosophy_theology_modal	44,104	45,300	—
curriculum_philosophy_theology_contrast	22,052	22,650	—
curriculum_mathematics_logic_modal	420	480	—
curriculum_mathematics_logic_{sequence,contrast,evidential}	210	240	—
curriculum_systems_software_modal	420	480	—
curriculum_systems_software_sequence	210	240	—
curriculum_physics_{causal,modal}	720 / 480	720 / 480	—

So four bands can reach 657, not three, and seven cannot, not eight. Every conclusion that depends on this survives: physics · modal at 480 is still impossible at any authoring volume, and philosophy_theology · modal is still the defensible target by two orders of magnitude. The numbers are now pinned as measured values in tests/test_curriculum_practice.py::BAND_ATOM_SPACE, so this class of error cannot recur silently. See docs/research/curriculum-practice-producer-2026-07-26.md §2.

The original text is preserved below unedited.

Volume is bounded by taught vocabulary, not by corpus size, because a question must have both terms in exactly one served subject's vocabulary to route at all (ambiguous_reading otherwise). Measured routable question spaces:

domain	|V|	exclusive lemmas	routable ordered pairs
physics	16	16	240
mathematics_logic	16	15	210
systems_software	16	15	210
philosophy_theology	151	149	22,052

max_honest_n = routable_pairs × |connectives(family)|, one committed case per distinct question:

band	chains	max honest n	vs 657
curriculum_physics_causal	7	720	reachable
curriculum_physics_modal	9	480	impossible
curriculum_mathematics_logic_modal	4	420	impossible
curriculum_mathematics_logic_contrast	8	210	impossible
curriculum_mathematics_logic_evidential	8	210	impossible
curriculum_mathematics_logic_sequence	4	210	impossible
curriculum_systems_software_causal	7	630	impossible
curriculum_systems_software_modal	6	420	impossible
curriculum_systems_software_sequence	3	210	impossible
curriculum_philosophy_theology_contrast	8	22,052	reachable
curriculum_philosophy_theology_modal	8	44,104	reachable

The plan of record's first content target is one of the impossible ones. physics · modal was chosen for having the most chains (9, "closest of eleven bands"). Chain count is not the constraint; vocabulary is. Its ceiling is 480 — below the threshold with every possible question counted, and that ceiling cannot be raised by authoring chains, only by growing en_physics_v1.

physics · causal is nominally reachable at 720 but would need 657 of its 720 questions — 91% of the entire space — leaving no held-out room at all.

The defensible first target is philosophy_theology · modal: 44,104 honest ceiling (67× the threshold), 8 chains already ratified, and the same 8-chain starting point as the physics band. This reverses a decision in the plan of record, on a measurement.

4.3 The two unbuilt segments are still unbuilt, and are still not the blocker

Phases C and D stand as written — evals/curriculum_serve/practice/ and the reseal verb do not exist, and chat/data/curriculum_serve_ledger.json has no writer. That finding survives. What changes is its priority: building the producer before R5 lands would produce a correct instrument reporting that every band is at its ceiling.

5. What this ADR does not decide

• The bound in R9. The specific de-duplication tuple and mix floor are Phase B's deliverable. R9 fixes only that a bound must exist and be reported.
• Raising MAX_PREMISE_SENTENCES. Rejected as an approach, not deferred: it is a shared honesty cap that the 25 deduction bands also decide under, raising it would move hash-pinned lanes, and a 219-premise argument is not honest at any cap. R5 makes the cap irrelevant to curriculum instead.
• Composition across curriculum edges. Still scoped out per ADR-0262 §3.3. R8's exclusion of negative edges from BFS is a reachability-reporting rule, not a licence to chain.
• Negated questions. The grammar stays Does <term> <relation> <term>?, three tokens. Polarity lives in the curriculum, never in the question. "Does X not require Y?" is four tokens and refuses typed, as it does today.
• Growing en_physics_v1. §4.2 says physics bands need vocabulary, not chains. Whether to grow the pack is a separate ratified decision.
• Any flag. curriculum_serving_enabled stays False.

6. Verification

All four probes are in docs/research/curriculum-premise-scope-2026-07-25.md, each runnable against a clean tree; the corpus-mutating one restores the file and asserts byte-identity.

1. Negation reaches REFUTED — three shapes, atom identity checked.
2. Cap collapse — real negative rows appended to physics_chains_v1.jsonl; band answers at 16 premises, declines at 17, including the previously-working taught positive. Also demonstrates Fact 1: at +1 row the negative pair answers entailed.
3. Scope equivalence — 8,520 routable questions, 0 mismatches for both candidate scopes, 8,463 empty query-atom scopes.
4. Band ceilings — the §4.2 table, derived from CONNECTIVE_FAMILY and the loaded vocabularies rather than restated.

No production code changed in this ADR; §2's rules are implemented by Phase C against Phase B's tests.

7. Consequences for the plan of record

1. New phase, before content: implement R5–R7. Nothing else in the arc can earn anything until the 16-chain ceiling is gone. Loud failure mode (the lane pins every physics verdict), so it is a Sonnet unit once the assertion set here is fixed — which it now is.
2. Phase F retargets to philosophy_theology · modal per §4.2, and its volume target is recomputed against that band's ceiling.
3. Phase B additionally specifies R9's ceiling report, so no future arc spends authoring effort on a structurally impossible band.
4. ADR-0262 §5.1's conclusion is amended by §4.1 — the constraint is engineering-then-content, not content alone. §5.1's criterion is upheld and promoted to a measured precondition.