Completes the ADR-0206 §5 math-serving deferral in its own careful PR. The GSM8K
wrong=0 serving gate, select_self_verified, now takes a ReachPolicy. This changes
NO serving behavior today — it is the safe, byte-identical, sanctioned first edit to
the most wrong=0-critical line, with a live-wiring test, so a future VERIFIED
widening has a precise, proven integration point.
Why it can't actually widen yet (the tension scoping surfaced): GSM8K wrong=0 is
ABSOLUTE (zero wrong, ever); a reliability license is STATISTICAL (a 0.99 Wilson
floor); math answers aren't disclosed like the cognition path (E). So widening the
math serve on a statistical license would eventually serve a SILENT wrong. ADR-0206
§4 foresaw this: VERIFIED is "the only state that will license widening past gold,"
and it is reserved pending a canonical-comparison pass (the soundness≠correctness
gap) that is unbuilt.
Design (safe by construction):
- select_self_verified(..., policy=STRICT_POLICY). STRICT (the default every one of
the 5 callers passes) is the prior logic verbatim — unique answer → Resolution;
zero-verify or disagreement → refuse. Byte-identical: the pinned serving-lane SHAs
(demo_composition 3a3d09f3, fabrication 01e1b6b7, math_teaching_corpus eaf160d1)
are unchanged; Resolution is unchanged; no import cycle.
- A wider reach resolves a disagreement ONLY via _canonically_verified — the VERIFIED
gate — whose body returns None (capability unbuilt). So the widening is
STRUCTURALLY inert: a disagreement refuses regardless of policy. wrong=0 holds by
construction, not caller discipline. A statistical reliability license is NOT
consulted by the math path (the cognition/math asymmetry is deliberate: cognition
discloses, math is absolute).
- test_seam_is_live_wiring injects the gate to prove the consumer fires under a wider
reach — and STRICT still refuses even then.
Verified: smoke (90), invariants (56), governance + selfverify + ms2 (354 incl. the
new seam tests), GSM8K serving regression byte-identical (the one red,
test_serving_unchanged_by_search expecting stale 6/44, fails identically on clean
main — a pre-existing stale artifact, not this change). Three-lens adversarial review
(byte-identity/seal, structural wrong=0 inertness, no-overclaim): all held.
The real unlock — a VERIFIED canonical-comparison producer — is scoped in
docs/analysis/VERIFIED-canonical-comparison-scoping-2026-06-06.md (recommended:
back-substitution / constraint-satisfaction on a checkable problem class). Still
deferred: SITUATE (stakes), the live FEED-BACK loop, reach_level JSONL emission.
c5f0c90738