Knowledge Contracts, Version 2: A Typed Substrate for Inter-Agent Knowledge Transfer, with Its Algebraic Laws Proved or Refuted

Relation to Version 1

Version 1 specified a conceptual architecture — Meaning Management as the lifecycle layer of task-specific semantic commitments, with the Resolver inside that layer and binding and authorization as separate subsequent boundaries — and preregistered an empirical program it explicitly had not run. Version 2 keeps that decomposition: its eight-step resolver ends at emit-or-refuse, binding remains a later boundary (its capability-envelope gate is specified and not yet implemented, and is named as such), and no semantic fit ever supplies authorization. What changed: the unit of the algebra is now the typed assertion rather than the document-level commitment; the five-stage v1 resolver is historicized as the v1 store’s mechanism (§8.1, with its operational record corrected in §8.11); and the laws are proved or refuted on the implemented carrier rather than assumed. One term is a false friend across versions: v1’s «Quarantine» is the holding state of newly ingested knowledge in Expansion; v2’s «quarantine» is the conflict mechanism that gives the minimal conflicting assertion set the verdict K while the rest of the context stays usable.

Version 1 closed with seven declared open research questions. A reader arriving from it deserves the walk, question by question, against this version as published:

1. Authority (AuthorityCut/PolicyCut, grants, delegation, revocation, segregation without hidden IAM inside the contract) — advanced, not closed: authority non-importation is enforced (I14, §5), a derogation is in force only through the authority journal and an in-record authority field is never a self-contained claim (§9.1), and the learning path cannot acquire authority (§9.1); delegation and revocation remain unmodeled, and the bind-time gate is a named NOT-YET (§5, I16).
2. Evidence (which checks suffice per type × risk) — advanced, open: confidence is a basis record (§3.3) and evidence currentness is adopted (§2.9), but the type×risk matrix does not exist and the evidence algebra is specified, not implemented (§4.10).
3. Receipt (canonicalizing identity, uncertainty, Search-Incomplete, privacy) — structurally answered: receipts are digest-identified canonical bytes (§3.5), unknowns are content, with genuinely-unknown attestations that ran live (§8.5), refusal is a first-class typed outcome (§6.1), and digest manifests pin content without shipping it (§10).
4. Falsification (what to preregister) — answered in action: the evaluation’s corpus rule and the parallel run’s success criteria were committed before any measurement existed (§8.4, §8.5), and the refutations were published as the headline; a formal preregistration registry it is not, and the text does not blur that difference.
5. Governance independence (what prevents producer self-approval) — closed in mechanism form: authority comes only from the journal, a promotion that would weaken a higher prohibition requires that prohibition’s own authority — unacquirable through the learning path — and non-derogable assertions refuse every justification (§9.1, implemented with proven-red refusals).
6. CapabilityType promotion (when does first-class status become justified) — closed as a criterion: a proposed kind must demonstrate a refusal surface not reachable via existing claims plus a pinned validator (§9.2’s minted roster-governance invariant), and any level placement of a learned meaning is authority-bounded and refutable (§9.1). An earlier revision of this page attributed the closure to the learning loop alone; §9.2’s criterion is the load-bearing half, and this sentence is the correction.
7. Composition/disclosure (cross-contract conflicts without disclosing secrets) — advanced: composition is implemented as a validated whole, with re-validation mandated by Theorem 1 and a cache key covering every input (§9.1); the disclosure half — digest manifests, reduction as data minimization (§6.3, §10) — stops short of privacy-preserving cross-contract checking, which remains open.

Abstract

Systems of cooperating LLM agents exchange state as prose. Prose handoffs lose deontic force, invert relation directions, invite readers to fill gaps with defaults, and leave a knowledge store’s internal wholeness uncheckable. We present a knowledge substrate in which the unit of exchange is a context — a finite set of typed, scoped assertions under a snapshot pin — carried on immutable, digest-pinned, append-only revisions, with every algebraic law of the transfer operations proved or refuted on this carrier rather than assumed. The substrate is implemented and mutation-tested — a refusal catalog of 27 codes at the 2026-08-30 evidence pin, each proven red (the catalog and the store have kept growing since, only through the same proven-red door; §8.10), sixteen invariants enforced at honestly labeled tiers, the reduction ladder R0–R3 with exactness certificates — and exercised on real work: a live store grown to 14 revisions by dogfooding (63 after the post-draft corpus lift, §8.8; 134 at the §8.10 recount), an admission gate 4-for-4 on real tasks, two write races decided by the append-only law, and two contour defects the run itself surfaced — a truncating renderer and an ungoverned executor over-claim. The work refutes three of this line’s own claims — two facets of the token-economy claim and one store-debt figure, the last felled by the parallel run rather than the evaluation — and narrows the delta claim; the refutations are the headline result. Token economy is not a format property: in the one encoder pair measured, the reduction tracked the encoder — its skill and its tolerated loss. Hand encoding replicates the pilot’s 38% on a 4-sample overlap; automated spec-only encoding inflates tokens 7.6%; a structured-summary baseline reaches 14.8% losslessly. Fidelity, measured jointly: automated packets preserve 99.3% of 437 semantic units, but the hand encoding behind the 38% preserved only 82.7% — the token win and the completeness rule trade against each other, and token-matched compression across formats remains unmeasured. The delta claim narrows to within-task chains (4/4 counter-pairs); 144 blind downstream grades cannot distinguish packet from honest prose. What the typed carrier demonstrably earns: machine-checkable fidelity after the fact — an observed MUST→SHOULD drift caught by the evaluation’s unit audit, checkable because modality is a field — admission gating, digest-decided concurrency, and projection focus. A measurement instrument fabricated a number twice; only recomputation-from-source in CI held.

---

1. Introduction

1.1 The problem

When one software agent hands work to another today, it writes a summary. The summary is prose: a stochastic paraphrase of the sender’s state, consumed by a reader that reconstructs meaning statistically. Three failure classes recur, and none of them is detectable by inspecting the message that exhibits it:

1. Modality loss. “Secret rotation is never automated” becomes “avoid risky operations.” A prohibition has been weakened into advice, and the receiving agent, working from the summary alone, can now do the forbidden thing in good faith. Nothing in the summary marks the loss.
2. Inferred meaning. A summary reports that 48 of 48 recovery tests passed; the reader infers that backups are verified — although the source document explicitly listed backup verification as not claimed. The prose invited an inference the source forbade.
3. Direction inversion. “Component X requires Y” and “Y requires X” land in the same embedding neighborhood; retrieval pipelines that reconstruct relations from retrieved text can invert a dependency edge with no error raised.

These are not exotic corner cases, but their evidential status differs and should be stated — and this run’s own measurements sharpened it. The two constructed examples remain constructed: the prohibition (“never automated”) and the explicit not-claimed list are quoted from real handoff records, the lossy summaries built over them. But the first failure class has since been observed in the wild — a real MUST→SHOULD downgrade produced by an automated freehand encoding into this paper’s own packet format (§8.4) — while an instructed prose baseline preserved every deontic unit at the mild compression it chose. Modality loss is therefore a property of unchecked re-encoding, not of prose per se; what prose lacks is not the ability to carry a MUST but the field that lets a checker verify it survived. The second class narrows the same way: unfenced summaries permit forbidden inference, but disciplined prose did not reproduce the failure across 144 downstream grades (§8.4) — and the one observed conflation of “asserted not done” with “not claimed” happened inside the typed format, committed by one of its own co-designers (§8.4). The third class rests on a research-phase code read: the ecosystem’s retrieval path returns text chunks with no typed edges, so nothing downstream of it can distinguish an edge from its reverse — verified at that phase’s commit and not re-verified during this implementation cycle. All three share a root cause: prose carries no typed commitments, so there is nothing for a checker to check. The same root cause operates at the level of the knowledge store: when an organization’s operating knowledge — roles, procedures, constraints, policies — lives as documents, nothing can verify that the store is internally whole (every reference resolves, every derived claim carries its justification, no conflict is silently dropped), and nothing can verify that the subset given to an agent for a task is sufficient for that task.

This matters now because multi-agent LLM systems are moving from demos to operations. Context windows are budgets; handoffs happen thousands of times a day; and the cost of a silently weakened MUST-NOT is no longer a wrong answer in a chat but an action taken in production.

1.2 The claim and the contributions

This paper’s claim is deliberately narrower than “a semantic algebra.” We claim, and support at stated strength:

A typed, digest-pinned, append-only knowledge substrate with mechanically checkable semantic invariants — implemented, with every refusal code mutation-proven — a rung-declared projection resolver run on real tasks, and a four-measure evaluation of the inter-agent transport format plus a four-task parallel run in which three of this line’s own earlier empirical claims fall — with the algebraic laws of the transfer operations proved or refuted on this carrier rather than assumed.

The contributions, ordered by evidential strength:

1. A law table for knowledge transfer operations, with every law proved or refuted — and now instantiated (§4). The load-bearing negative result: constraint application does not distribute over context merge — merging two individually valid contexts can produce an invalid one (Theorem 1) — from which re-validation after every merge follows as a soundness requirement, not a convention. The load-bearing positive result: merge is a join-semilattice operation (Proposition 1), which makes at-least-once delivery safe and arrival order semantically inert. Four of the six algebraic structures now have running, law-tested instances; the two that do not are labeled (§4.8). A published claim that such content forms a non-commutative semiring does not transfer to this carrier (§4.9); we locate the disagreement precisely rather than merely rejecting it.
2. Sixteen integrity invariants with checkable predicates, classified by enforcement strength — enforced or honestly tier-labeled in a running implementation (§5): schema-unexpressible (the invalid state has no serialization) > authoring-time checker > projection-time checker > runtime-only. No classification was demoted by implementation; the two residual NOT-YET sub-tiers are named in the table rather than smoothed over. The classification states which guarantees an implementation can make static and which claims of static enforcement would be overclaiming.
3. A complexity result and an honesty mechanism for context minimization (§6): the minimal sufficient projection problem is NP-complete (Theorem 2); the substrate therefore bans the word “minimal” from its artifacts and requires every projection to carry a declared reduction rung. The full ladder R0–R3 is implemented — including budget-gated exact minimization that emits an exhaustion certificate into the receipt — and rungs were declared on every live projection this cycle.
4. Two stores as existence evidence for the substrate discipline (§8.1–8.2): the v1 production store — 324 immutable revisions of 210 logical identifiers, now a mechanically frozen, read-only archive under a CI-enforced, mutation-proven byte manifest — and the live v2 store it feeds through a digest-verifying lift: 14 revisions of 11 logical identifiers grown by real dogfooding at the evidence pin (growth since is §8.10’s record), validated by a refusal catalog — 27 typed codes at that pin — each proven red against a live scenario by an executed harness, with an admission gate run live on four real tasks (4/4 correct verdicts), two genuine concurrent-authoring races decided by the append-only law — and two contour defects the same run surfaced against us: a truncating renderer and an ungoverned executor over-claim (§8.5).
5. A four-measure evaluation of the transport format, with negative headline results (§8.3–8.4): the v0 pilot (n = 6, designer-encoded, 37.9%) is kept as the pilot; the new evaluation (18 systematic samples, four arms, 437 typed semantic units, 144 blind downstream grades, a 4-pair delta chain) refutes the token claim on both its facets — as an achieved reduction (automated spec-only encoding inflates tokens) and as a format property (a structured-summary baseline compresses losslessly where the packet inflates) — measures the fidelity cost the pilot could not see (the hand arm’s 82.7% behind its 38%), narrows the delta claim to within-task chains, and finds packet and honest prose downstream-indistinguishable. What survives, measured rather than asserted, is machine-checkable fidelity after the fact (§8.4), admission gating (§8.5), digest-decided concurrency (§8.5), and projection focus (§8.5).
6. A methodological finding on measurement integrity, now with a recurrence (§8.6): the same CI gate fabricated a number twice — once by hand-restating the store’s root list (22 present revisions reported permanently lost), and, after that correction, once more by deriving identities instead of reading them (28 phantom debts in a count of 42). The episode motivates one of the sixteen invariants (single-definition-and-import), whose lint then found five more silent restatements the first postmortem missed. Curated numbers rot even after being corrected once; only recomputation from the declared source, in CI, held.

1.3 What is implemented versus what is measured

This must be said in the introduction, not a footnote. The work exists in four layers with different evidential status:

• v1 (frozen archive): the original storage substrate — typed revisions, digests, append-only succession, 16 refusal codes, a five-stage resolver — ran in production and is now a closed, read-only archive, frozen mechanically: a SHA-256 manifest over its 346 files (324 revisions plus 22 gap records) is enforced in CI by a mutation-proven check (4/4 red paths). Claims about v1 are historical, verified against its code at the pinned commit (§8.1); its content enters v2 only through a digest-verifying read-only door and a deliberate lift that never imports authority.
• v0 (the pilot): the transport format’s first token measurements come from a research phase that re-encoded six real handoffs by hand (§8.3). The algebra’s proofs and refutations were produced in this phase and are carrier-relative mathematics; they do not depend on any implementation.
• v2 (implemented and exercised): the full semantic layer — the assertion-level meaning object, modality and scope as schema fields, the verdict lattice, the sixteen invariants as gates, the eight-step resolver with its reduction ladder, the packet form with deltas — is implemented and was exercised on real work during this cycle (§8.2, §8.5). Claims about it are backed by executed tests and gates at the pinned commit: 27 refusal codes proven red, invariant coverage labeled tier by tier, an admission gate run live on four tasks. Where a v2 mechanism is still specification-only, it is named as such at the point of claim — the cost layer beyond closure-size, the evidence polynomials, precedence as a stored meaning object, one sub-tier each of I6 and I16 (§5, §7) — per the same no-silent-narrowing rule the store imposes on its content.
• measured (the evaluation): the four measures — token reduction with baselines, unit-based semantic fidelity, downstream task success, delta economics — were measured jointly on a systematic 18-sample corpus with four encoding arms (§8.4), and the contract contour ran in parallel against the incumbent orchestration framework on four real tasks under pre-committed cutover criteria (§8.5). Three of this line’s own earlier claims did not survive this cycle — two facets of the token claim fell to the evaluation, the store-debt figure to the parallel run — and the paper reports the refutations as headline results, not caveats.

1.4 What v2 adds over v1 — and which absences are now closed

Since the archived system supplies the historical existence evidence, the reader deserves one crisp statement of what is genuinely new in the implemented layer. The v1 store validates artifacts: whole revisions with boolean checks. It has no representation for deontic modality (prohibitions live in English prose, with one narrow exception in structured policy rules), no scope field, no validity windows outside policies, no verdict values beyond pass/fail, no conflict records, no delta transport, and no cost model — each of these is a verified absence, not an assumption (§8.1). Every one of those absences except the last is now a closed, implemented v2 target: modality is a schema field whose preservation check runs as a set comparison (§5, I5); scope is a closed vocabulary with declared intersection rules; verdicts are Belnap’s FOUR on the wire; conflict records are digest-pinned first-class objects; deltas apply with base-digest refusal. The cost model is the one target still mostly open — closure-size cost exists, the cost layer of §7 does not (§7). The v2 layer makes assertions — typed, scoped, modality-bearing statements inside revisions — addressable and checkable, which is precisely what turned the three failure classes of §1.1 from post-incident discoveries into machine-refusable states — no longer design intent but demonstrated, one red-proven refusal per class: modality weakening refuses under I5 (the one MUST→SHOULD drift observed in the wild this cycle was caught by the evaluation’s unit audit — which audits fieldless prose the same way; the field is what makes such drift machine-checkable after the fact, and I5’s mechanical refusal itself, red-proven on synthetic scenarios, has not yet fired on real content, §8.4); unjustified inference refuses under I2’s missing-justification code; edge reversal is blocked by the closed relation enum with distinct inverse members under I6, whose remaining transfer cross-check at the packet-consumer seam is a named NOT-YET tier (§5). The algebra of §4 is the mathematics of that assertion layer; the proofs stand independent of implementation, and the laws bind the implementation that now exists as they will bind any future one.

1.5 Organization

§2 situates the work. §3 defines the substrate. §4 develops the algebra and its law table, including the non-transfer analysis of the semiring claim. §5 states the sixteen invariants with their implementation status. §6 gives the resolver, the hardness result, and the reduction ladder as implemented. §7 gives the cost geometry, which remains unimplemented mathematics. §8 is the evaluation: the frozen v1 archive, the implemented v2 layer, the historical pilot, the four-measure evaluation with its two refutations, the parallel-run and dogfooding evidence, the measurement-error episode, and threats to validity. §9 discusses limitations and future work. Two dated addenda postdate the rest of the draft and are marked as such where they stand: §8.8 (a second round — the corpus lift and the full-store re-run) and §9.1 (three architectural gaps found after the evaluation round). §10 states what reproduction requires.

2. Related work

2.1 Semantic communication

The semantic-communication literature asks why systems transmit bits when they could transmit meaning (Lan et al., 2021), and has developed knowledge-graph-based transmission in which entities, relations, and reasoning rules travel instead of text (Liang et al., 2022). The closest measured point to our pilot is Salehi et al. (2025): knowledge-graph-based compression of open text achieving roughly 30% volume reduction at 84% embedding-measured semantic similarity. An earlier draft of this paper read our pilot’s 37.9% as corroborating that magnitude; our own evaluation has since withdrawn the reading — the pilot number turned out to measure encoder skill, not the format (§8.4), so it cannot corroborate any format’s compression magnitude, and we draw no comparison in either direction (the fidelity criteria also differ fundamentally: theirs is embedding similarity; ours is unit completeness, §8.4). Our contribution to this line is not the compression figure but the transfer laws: none of these works states which algebraic properties the merge of two received knowledge fragments must satisfy, or what a receiver may infer from absence.

2.2 Concept-level modeling and semantic uncertainty

Large Concept Models (Barrault et al., 2024) show that autoregressive modeling over sentence-level embeddings is feasible at scale; their “concept” is an embedding, explicitly weaker than a typed assertion, and carries no deontic or provenance structure. Peyrard et al. (2024) frame multi-agent computation as exchange of “semantic tokens” between semantic processors — a conceptual precedent for our packets that specifies no wire format and no algebra. Liu et al. (2023) show meaning represented as distributions over continuations naturally expresses asymmetric relations; we take this as independent evidence that asymmetry is intrinsic to meaning representation (§7), discovered on a different carrier. Semantic entropy (Kuhn et al., 2023; Farquhar et al., 2024) measures uncertainty over meaning equivalence classes rather than token sequences and detects confabulation; it is diagnostic machinery on the model side, complementary to our structural machinery on the message side: semantic entropy estimates whether a claim is confabulated, our invariants make classes of confabulation unserializable in transfer.

2.3 Token economy in multi-agent systems

AgentPrune (Zhang et al., 2024) and AgentDropout (Wang et al., 2025) reduce inter-agent token cost by pruning which messages flow or which agents speak; ACON (Kang et al., 2025) compresses agent history in natural-language space. All three are orthogonal to this work, which changes what a message is. To our knowledge — and to the knowledge of a verification pass over this neighborhood performed in August 2026 — no published work combines typed, algebraically characterized message structure with a measured multi-agent token reduction; we state this as an observed gap in our search, not as a proof of novelty.

2.4 Knowledge graphs and provenance

The substrate’s assertions are typed directed triples in the RDF tradition; its provenance fields follow the shape standardized by W3C PROV-O (2013). Two database-theory results are load-bearing rather than decorative: provenance semirings (Green et al., 2007) give the algebra by which our evidence annotations compose (alternatives as $+$, joint requirements as $\cdot$), and why-provenance (Buneman et al., 2001) defines the query “which evidence supports this assertion?” that the contract makes a first-class operation (§4.10). Description-logic open-world/closed-world semantics (Baader et al., 2007) is why the substrate requires closed-world readings to be declared per list rather than assumed globally (§3.4).

2.5 Many-valued logic, paraconsistency, truth maintenance

The verdict lattice is Belnap’s four-valued logic (Belnap, 1977): $\{\top, \bot, U, K\}$ with distinct truth and knowledge orders; Kleene’s strong three-valued logic (Kleene, 1938) is recovered at the specified ternary boundary projection, where the conflict value collapses to unknown (§4.7). The paraconsistent tradition (Priest, 1979) supplies the design’s response to contradiction: one conflict must not explode the knowledge base — ex contradictione quodlibet is precisely what a multi-agent store must refuse to import, so conflicts quarantine rather than poison (§4.5). Truth-maintenance systems supply the justification discipline: every derived assertion carries rule, premises, and snapshot, which is Doyle’s JTMS (Doyle, 1979) as schema; the assumption-based variant is de Kleer’s ATMS (de Kleer, 1986). (We note the attribution explicitly because an early internal draft of this work had them reversed; the correction predates every document in this line.) Non-monotonic consequence under precedence-with-exceptions is Reiter’s default logic territory (Reiter, 1980); closed-world defaults trace to Reiter (1978) and minimal-model reasoning to circumscription (McCarthy, 1980).

2.6 Asymmetric distance

Quasi-metrics — distance without the symmetry axiom — are ninety-five-year-old public mathematics (Wilson, 1931). The substrate’s cost geometry is an extended quasi-metric over a directed weighted graph (§7); the continuous, direction-dependent generalization (Finsler geometry; Bao, Chern & Shen, 2000) is deliberately deferred with an explicit trigger condition rather than adopted as decoration. “Geometry of meaning” as a research program long predates current usage (Gärdenfors, 2014; Widdows, 2004).

2.7 Complexity

The hardness of minimal sufficient projection reduces from Set Cover (Karp, 1972); the greedy bound that fixes our ladder’s middle rung is Chvátal (1979) and Johnson (1974). An independent 2025 preprint (Jeong et al., 2025) also argues for compiling natural language into typed logical forms with deontic operators under the phrase “algebra of meaning”; it shares the program’s direction and none of this paper’s specific machinery.

2.8 Compilence

Compilence, Inc. describes itself, in its published materials, as building a deterministic semantic compiler for regulated environments: authoritative text compiled to a typed obligation graph (“Semantic AST”), queries answered by deterministic traversal with ternary verdicts and typed refusal diagnostics. Their published record comprises two public web pages (Technology Overview; Investors — copies saved 2026-08-29) and five Zenodo deposits (Chudinov, 2026a–e), of which two are open (DOIs 10.5281/zenodo.18944351, CC-BY-NC-ND-4.0, and 10.5281/zenodo.19337904, CC-BY-4.0) and three are embargoed with public abstracts (10.5281/zenodo.19261510, 10.5281/zenodo.19319709, 10.5281/zenodo.19367887). None of this record is peer-reviewed (a DOI is not review); we cite it as what it is.

What this paper takes from that record is evidence and a disagreement, not constructs. Their benchmark — up to 15× fewer specification tokens per query at 97–100% accuracy on 246 questions over a 500-page specification, via a governed navigation index versus an unguided agentic baseline (Chudinov, 2026a; vendor-reported and self-published, not independently verified) — measures a different quantity from our pilot: navigation overhead eliminated on the input side, versus handoff restatement compressed on the output side. The two numbers must not be placed in one table; read together they triangulate one thesis from opposite ends — structure beats prose where content is already structured, and nothing compresses novelty. Our own evaluation now separates the two axes on a single substrate: output-side compression is refuted as a format property (§8.4), while input-side projection cut the executing agent’s tool calls to 3–24 against 6–53 for free orientation and its tokens on three of four tasks (§8.5) — the input-side gain is real here, as an existence-level result on four tasks (§8.7), not a rate, even where the output-side one is not. Compilence’s figure itself remains vendor-reported and unverified. Their published algebraic claim — that normative and factual content forms a non-commutative semiring — receives a full carrier-relative analysis in §4.9. Several design convergences reached independently on both sides (typed refusal over invention; frozen snapshots with recompile-not- retrain; validity windows on norms; “embeddings rank relevance, structure decides authority”) were documented by us with dates on both sides, in an internal evidence register available for audit — whose dated entries have not been re-audited this cycle (§10); convergence with independent provenance is evidence against derivation in either direction.

A scholarly-honesty note on boundaries: Compilence states that five components — the E.L.I.A. language, the ARC compiler, their semantic-AST construction method, their enforcement model, and their dual-layer SPO architecture — are covered by filed provisional patent applications. This work specifies none of those components and builds on none of their non-public material; every construct here traces to public mathematics (§2.4–2.7), to the authors’ own previously shipped system (§8.1), or is labeled as this line of work’s own reconstruction. Because provisional applications are unpublished, no outside party can enumerate their claims; a freedom-to-operate review by counsel would precede any commercialization, and this paper’s provenance discipline is the input such a review needs, not a substitute for it.

2.9 First Principles Framework (FPF)

FPF (Levenchuk, n.d.) is a normative pattern language — by its own description a “normative kernel” in “eternal alpha” — for making complex engineering and epistemic work explicit and checkable. Six of its distinctions are adopted into the v2 specification as ideas, with attribution: sense locality (a term’s meaning is local to a bounded context; cross-context identity is never inferred from name equality), the separation of a semantic correspondence (Bridge) from the bounded right to rely on it (a use-claim with declared tolerated loss) and from authorization to act (which no semantic fit ever supplies), evidence currentness (assurance is time- and use-indexed and spoils), capability envelopes (an ability claim without bounded conditions and measurable thresholds is unfalsifiable), set-valued resolution outcomes under partial orders (shortlist/abstain instead of forced scalar winners), and a four-layer classification of contract content (laws / admissibility / deontics / evidence) enforced here as deterministic cross-layer lints. What is refused, and why it is stated here: the FPF repository carries no license, so default copyright applies; ideas are adopted with attribution, but verbatim specification text, wholesale structure, and renamed FPF entities are not used — a statement of authoring practice, not of an executed audit: the provenance audit against the FPF repository is owed (§10). What this work adds to that exchange is the part FPF by design does not have: an executable enforcement layer — a resolver that refuses (implemented, run on real tasks, §8.5), refusal codes with mutation tests (27 of 27 proven red, §8.2), a determinism discipline whose conformance fixture — double-run digest comparison — now runs green in CI, and the cross-layer lints themselves, implemented with their refusal code proven red (§5, I16; the FPF attribution is carried in the code). FPF supplies distinctions; this substrate is a place where distinctions can refuse something.

3. The substrate

A framing rule for §§3–7, extending §1.3: the definitional present tense (“is required,” “refuses,” “is refused”) describes the specification, and for most of what follows the specification now has a running, mutation-tested instance — the v2 implementation of §8.2, whose enforcement status is stated invariant by invariant in §5. Where a mechanism is still specification-only, that is said at the point of claim (the cost layer, §7; the evidence polynomials, §4.10; the named sub-tiers in §5), not inferred from tense.

3.1 Carrier definitions

Definition 1 (assertion). An assertion $a$ is one typed, directed, scoped statement: $$a = (\mathit{subject}, \mathit{rel}, \mathit{object},\ \sigma,\ m,\ E,\ v)$$ where $\mathit{rel}$ is drawn from a closed relation vocabulary or a claim form declared by the revision’s kind-profile — the closed, fail-closed schema stating which assertion forms a payload of that kind may carry (§5, I13) — $\sigma$ is a scope record from a closed scope vocabulary (§3.4), $m \in \{\mathrm{MUST}, \mathrm{MUST\text{-}NOT}, \mathrm{MAY}, \mathrm{SHOULD}\} \cup \{\varepsilon\}$ is an optional deontic modality (von Wright, 1951), $E$ is an evidence annotation (a provenance polynomial, §4.10), and $v \in \{\top, \bot, U, K\}$ is an optional verdict (absent $\Rightarrow U$).

Definition 2 (context). A context $\Gamma = (A, s)$ is a finite set of assertions $A$ together with exactly one snapshot pin $s$ — a cryptographic digest identifying the state of the store against which $\Gamma$’s references resolve. A knowledge contract, a resolver output, and an inter-agent packet are all contexts.

Definition 3 (meaning object / revision). A meaning object is the stored, versioned envelope that carries assertions. It is two-level:

MeaningObject (revision envelope)     — unit of storage, digest,
 │                                       succession, authority
 └─ payload
     └─ assertions[]                  — unit of the algebra, each
                                         addressable by a stable key

Figure 1. The two-level carrier. The revision is immutable and digest-pinned; change is a successor revision. An assertion is addressed externally as the pair (content digest, assertion key), which no later renaming can re-mean.

A revision carries an identity triple (logical identifier; revision identifier id@rN; content digest = SHA-256 over canonical payload bytes), a nullable-but-required predecessor reference (null means first revision — a declared value, not an absent one), digest-pinned dependencies, provenance, an authority class, and a source-trust class. Canonical bytes are sorted-key, compact-separator, ASCII, integers only — floats are refused because cross-platform float rendering is not byte-deterministic, and a digest that cannot be recomputed identically everywhere is not an identity. (Digest recomputation was exercised heavily this cycle — every archive pin verified, one round-trip digest-exact — but on a single host; the cross-platform recomputation test the rule exists for is still owed.) The store is append-only: a second record under an existing revision identifier is retrospective mutation and is refused.

3.2 Missing is not inferred

The single rule doing the most work in the substrate is a rule about absence. Every field in the envelope and the assertion is classified as REQUIRED or OPTIONAL, and:

• REQUIRED + missing = typed refusal. An envelope without a schema version is unreadable, not “assumed latest.”
• OPTIONAL + missing = $U$ (unknown), and $U$ is content: it is representable, transportable, and mergeable. A missing validity window means temporal applicability is unknown — never “always valid.” A missing confidence record means no confidence claim — never certainty. An implementation that renders a missing value as a default has manufactured meaning; this is the transfer-level generalization of a rule the v1 store already enforced for costs (“unknown is not zero”).
• Declared emptiness is a third state. A null predecessor, an explicitly empty dependency list, an open-ended validity (until: null) are positive claims, distinct from absence, and the schema distinguishes all three states everywhere it is profiled to look — a narrowing implementation taught us: auxiliary revision bodies are unprofiled, and there the validator has almost no refusal surface, so the distinction is enforced everywhere profiled, not everywhere conceivable (§5, I13).

3.3 Confidence without floats

Confidence is a basis record, not a number: {basis: measured | declared | derived, evidence: [...], sample_count}. The rationale is normative, not aesthetic: (a) canonical bytes forbid floats, and a probability field would be the store’s first float; (b) a subjective probability with no stated method is fiction with decimals; (c) the v1 store’s working precedent is basis-tagging with receipts — its operational ledger already flags every cost figure as estimated or measured (§7, §8.1). If graded confidence is ever needed, the documented extension seam is integer rationals with a declared measurement protocol. A negative observation worth one sentence: a full implementation cycle of real use — gap lifts, the evaluation, the parallel run — never pressured that seam open; confidence stayed a basis record throughout.

3.4 Scope, and why it is required

Conflict ($\#$) and precedence ($\succ$) act in overlapping scope; if scope is prose, overlap is undecidable and conflict detection is silently disabled. The scope value is therefore a record from a closed, versioned vocabulary (ecosystem / repository / host / environment / namespace / task / epic / actor) with declared pairwise intersection rules, and the envelope’s scope field is REQUIRED with no default: “applies everywhere” must be a statement ({ecosystem}), not the absence of one. Scope also carries sense locality (adopted from FPF with attribution, §2.9): the same name in two scopes is two meanings until an explicit, evidenced, digest-pinned Bridge claims otherwise — cross-scope identity is never inferred from name equality (invariant I15, §5). List-valued claim fields additionally carry a declared closure marker (complete | open), making the closed-world reading per-list and falsifiable rather than global and assumed. In implementation the closed vocabulary survived real use with one recorded overflow: a two-repository portability case did not fit the declared axes and was encoded fail-closed rather than by improvising a value — the survival story of a closed vocabulary is its governed-extension path, not the absence of pressure on it.

3.5 The knowledge contract

Definition 4 (knowledge contract). For a pinned store snapshot $G_s$ and a task $T$ (goal, typed inputs/outputs, required capability types, bounds, scope $\sigma$), a knowledge contract is the pair $$KC(T) = \mathrm{Resolve}(G_s, T) = (\Gamma_T,\ R_T)$$ produced by the resolver of §6: the context $\Gamma_T$ — the assertion set projected from the pinned graph for the task, under $G_s$’s pin, with per-assertion verdicts, evidence, and justifications as in Definition 1 — together with a receipt envelope $R_T$ carrying the conflict records, refusals, and the declared reduction rung (§6.3), the whole frozen and digest-identified.

Two properties distinguish this from a curated reading list. First, projection granularity is the assertion: a task touching one prohibition out of a forty-line policy carries that assertion (with its revision as authority anchor), not the whole document. Second, governance attaches by scope intersection, not curation: every MUST/MUST-NOT assertion in the pinned graph whose scope intersects $\sigma$ is attached by the resolver — “forgot to select the relevant constraint” stops being a possible authoring error and becomes a checkable resolver defect. This ran live with no curation step — an existing governance constraint rode into two real task projections by intersection alone (§8.5) — and the live run also found the mechanism’s boundary: attachment governs only encoded constraints; nothing governed an executor’s secondary claims about data it had not read, so over-claim discipline must ride in the projection itself, not be assumed from governance attachment (§8.5).

4. The algebra

4.1 Operations

The substrate recognizes six operations, on three distinct carriers. The distinction of the first two is load-bearing: a single conflated “compose” operator is what makes informal algebraic claims about such systems unprovable (§4.9).

Op	Signature	Reading
$\oplus$ merge	$\mathbb{G} \times \mathbb{G} \rightharpoonup \mathbb{G}$	combine what two contexts jointly assert
$\triangleright_\rho$ attach	$\mathbb{M} \times \rho \times \mathbb{M} \rightharpoonup \mathbb{M}$	build a composite via an explicit typed relation $\rho$
$\otimes$ constrain	$\mathbb{G} \times \mathcal{C} \to$ verdict-annotated $\mathbb{G}$	apply constraints, yielding per-action verdicts
$\Rightarrow$ derive	$\subseteq \mathbb{G} \times$ assertions	closure under pinned derivation rules
$\#$ conflict	$\subseteq$ assertions$^2$	symmetric incompatibility ($\#$, to keep the relation distinct from the verdict $\bot$)
$\succ$ precedence	strict partial order on authority classes	resolves conflicts; never total

Table 1. The operation roster. ($\mathbb{G}$: contexts; $\mathbb{M}$: meaning objects; $\mathcal{C}$: constraint sets.)

4.2 Merge

Proposition 1 (merge is a join-semilattice). Fix a snapshot $s$. On contexts pinned to $s$, define $\Gamma_1 \oplus \Gamma_2 = (A_1 \cup A_2, s)$. Then $\oplus$ is associative, commutative, and idempotent, with identity $(\varnothing, s)$; i.e., contexts over $s$ form a join-semilattice with least element $(\varnothing, s)$ under $\oplus$, ordered by $\Gamma_1 \sqsubseteq \Gamma_2 \iff \Gamma_1 \oplus \Gamma_2 = \Gamma_2$ (“knows no more than”).

Proof. Immediate from the corresponding properties of set union; conflict detection (§4.5) is a function of the resulting set, not of merge order, so annotating detected conflicts does not disturb any law. $\blacksquare$

The proposition is stated at a fixed pin deliberately. Across pins, merge is defined only when the pins are equal or ancestor-related, and an ancestor-related merge is equal-pin merge after an explicit lift: the ancestor-pinned context is first re-resolved at the descendant snapshot, and a lift under which any reference resolves differently refuses rather than merging — so the algebraic laws are only ever exercised at one pin, and the proposition covers every defined case.

Operational consequences an implementation must honor: arrival order of packets is semantically inert; re-delivery is a no-op, so at-least-once transport is safe; and a merge in which the last writer wins on overlapping assertions is defective, not a design choice. Merge across unrelated snapshots refuses with a typed refusal: that is exactly where “same words, different meanings” enters a system, and the substrate makes it unrepresentable rather than inadvisable. There are no inverses: nothing removes an assertion by merging; retraction is a separate journaled act. Implementation status: the semilattice laws are enforced as tests and the unequal-pin refusal is proven red (MERGE_SNAPSHOT_MISMATCH); the ancestor-lift protocol is implemented but was not exercised on a real divergent resolution this cycle — demonstrated refusal, implemented-but-unexercised lift.

4.3 Attachment

Attachment $\triangleright_\rho$ — building a composite by applying one meaning to another in a typed role (“deploy to production”) — is a family of partial operations indexed by the closed relation vocabulary, with domain/range typing making ill-typed attachments refusals.

Proposition 2. $\triangleright_\rho$ is non-commutative by construction ($A \triangleright_{\mathrm{uses}} B \neq B \triangleright_{\mathrm{uses}} A$: the reverse edge is false, not merely absent), and associativity is not well-posed across distinct relation indices $\rho, \rho'$ (the two bracketings have different types). Where both sides are defined — composition of typed graph paths — composition is associative with empty paths as identities: typed relations form a small category of graph paths.

The direction of every relation is meaning. This is where the non-commutativity that genuinely exists in meaning lives — a point that becomes load-bearing in §4.9. The typing discipline has a live example: during the first archive lifts, a real source relation (refines) fell outside the closed nine-relation enum and was refused rather than silently coerced — encoded as the weaker related, with the loss of refinement direction recorded, because a tenth relation is a governed enum change, not a unilateral mid-lift decision (§8.5).

4.4 Constraint application, and the central negative law

Constrain $\otimes$ applies a constraint set to a context and yields per-action verdicts. Pure constraints act by intersection on admissible states and are order-free; overrides and exceptions must be expressed only through declared precedence $\succ$, never through application order — an implementation that folds constraints left-to-right and lets the later one win has made message timing semantically load-bearing.

Call a constraint pointwise if its satisfaction is a function of each single assertion in isolation, and global otherwise (cardinality constraints, mutual exclusion, resource budgets, declared-exclusion pairs). For a context $\Gamma$ and constraint set $C$, write $\mathrm{verdict}(\Gamma, C) = \top$ if $\Gamma$ satisfies every constraint in $C$ and $\bot$ otherwise — the context-level admissibility verdict, the coarsest projection of $\otimes$’s per-action output and the one an orchestrator acts on.

Theorem 1 (verdicts are not compositional). Let $V = \{\top, \bot, U, K\}$. There exist global constraints $c$ — any cardinality constraint among them — for which no function $f : V \times V \to V$ satisfies, for all snapshot-compatible contexts $\Gamma_1, \Gamma_2$: $$\mathrm{verdict}(\Gamma_1 \oplus \Gamma_2, \{c\}) \;=\; f\big(\mathrm{verdict}(\Gamma_1, \{c\}),\ \mathrm{verdict}(\Gamma_2, \{c\})\big).$$ In slogan form: merging two individually valid contexts can yield an invalid one, so $\otimes$ does not distribute over $\oplus$.

Proof. Take $c$ = “at most one assertion in the context satisfies predicate $P$” (a cardinality constraint; the operational instance in the source ecosystem’s workflow rules is “at most one agent lane may touch production state concurrently”). Let $a_1, a_2$ be distinct assertions satisfying $P$ and $b$ an assertion not satisfying $P$. With $\Gamma_1 = \{a_1\}$, $\Gamma_2 = \{a_2\}$: both part-verdicts are $\top$, and $\mathrm{verdict}(\Gamma_1 \oplus \Gamma_2, \{c\}) = \bot$. With $\Gamma_1' = \{a_1\}$, $\Gamma_2' = \{b\}$: both part-verdicts are again $\top$, and $\mathrm{verdict}(\Gamma_1' \oplus \Gamma_2', \{c\}) = \top$. Any candidate $f$ must map $(\top, \top)$ to both $\bot$ and $\top$; no such function exists. $\blacksquare$

Remark. The same two-pair construction goes through for mutual exclusion, resource budgets, and declared-exclusion pairs: each admits one pair of individually satisfying contexts whose union violates and another whose union satisfies. Not every global constraint is non-compositional (“the context is nonempty” composes); the theorem’s force is that the ubiquitous ones are not, and that compositionality is therefore a property to be proved per constraint, never assumed of a constraint class.

Corollary 1 (re-validation is a law). A sound implementation must re-validate after every merge, or statically prove that every in-scope constraint is compositional (pointwise constraints are; a global constraint needs its own proof). An orchestrator that lets each sub-agent validate its own output and then merges “all-green” results has, with any non-compositional constraint in scope — cardinality, exclusion, budget — an unsound pipeline: the exact class of failure where two individually approved production changes collide.

The phenomenon is standard in constraint satisfaction; the contribution is its statement as a wire-protocol law with an attached counterexample, in a setting where the tempting unsound shortcut (per-part validation with verdict recombination) is the natural engineering default. Notably, the v1 system already contained the pairwise instance as an implementation detail: its exclusion-conflict check iterates over the selected set, refusing to compute that verdict per-candidate (§8.1). The theorem elevates the behavior to a law of the contract, and the v2 implementation adopts both halves: constraint application is whole-context (re-validation after merge is the implemented rule, and the resolver re-validates after REDUCE, §6.1), precedence enters only as a declared strict partial order that refuses totalization, and Theorem 1’s counterexample is encoded as a conformance fixture — two individually-⊤ contexts whose merge is ⊥, demonstrated in the test suite. One honesty note attaches to that fixture and is kept verbatim from the observation log: the instance is synthetic. No archive revision carries a non-empty exclusion list (verified by recount), so v1’s own exclusion-conflict refusal has never fired on real content either; the law is proved and implemented, but “observed on real store content” is a claim nobody can make yet.

4.5 Conflict

Conflict $\#$ is symmetric and irreflexive, generated by modal clash on one action and overlapping scope, declared exclusions, and value clash on single-valued fields. (The relation is written $\#$ to keep it distinct from the verdict $\bot$.)

Proposition 3 (conflict is not transitive). There exist $a, b, c$ with $a \mathrel{\#} b$, $b \mathrel{\#} c$, and $\neg(a \mathrel{\#} c)$. Proof. Let $a$ = “replication is synchronous,” $b$ = “replication is asynchronous-only,” $c$ = “recovery-point objective < 5 s.” Then $a \mathrel{\#} b$ (a topology cannot be both), and $b \mathrel{\#} c$ (asynchronous-only excludes the objective), but $a$ and $c$ are compatible (synchronous replication satisfies it). $\blacksquare$ Remark. Relabeling the same witnesses (take $b, c$ = the two compatible assertions) shows the complementary configuration $a \mathrel{\#} b$, $\neg(b \mathrel{\#} c)$, $a \mathrel{\#} c$ as well: incompatibility of pairs is a property of pairs, and neither closure nor anti-closure under chaining holds.

Code that clusters “conflict components” transitively will quarantine innocent assertions. On detection, conflicts quarantine rather than poison: the minimal conflicting assertion set receives verdict $K$ and a mandatory, digest-pinned conflict record; the rest of the merged context stays usable. The paraconsistent rationale (§2.5) has an operational face: a fleet-wide halt because two agents disagree about one fact is a denial of service on the pipeline. Whole-context poison remains a sound over-approximation (it refuses strictly more) and is a permitted interim implementation; what is forbidden at every phase is silent dropping or auto-resolution. The implemented conflict pass is the conforming instance of Proposition 3’s warning: pairwise detection with digest-pinned conflict records, no transitive clustering, and an unciteable $K$ proven unserializable (INVALID_CONFLICT_UNCITED, red). No real-store conflict has yet exercised the pass in anger, so how well minimal conflicting sets compute in practice remains an open observation, stated as one.

4.6 Derivation and precedence

Derivation $\Rightarrow$ is closure under pinned rules (dependency closure, typed-relation traversal, governance attachment). It is reflexive and transitive, but not antisymmetric (two distinct revisions can be mutually derivable — a projection and its source assert the same content — so $\Rightarrow$ is a preorder, and “deduplicating” one direction loses the projection link). The preorder argument is mathematics; no mutual-derivability case arose in real content this cycle, so the dedup-loses-the-link consequence remains argued, not exercised.

The substrate’s conflict-resolution rule (used again in the precedence discussion below): if $a \mathrel{\#} b$ in overlapping scope and $\mathrm{auth}(a) \succ \mathrm{auth}(b)$, then $b$ — and every derivation resting on $b$ — is suppressed in that scope, recorded as a suppression entry, never deleted. Write $\Gamma \vdash x$ for “$x$ is in the surviving (post-suppression) derivation closure of $\Gamma$.”

Proposition 4 (non-monotonicity under precedence). With pure monotone rules, $\Gamma \subseteq \Gamma'$ implies that $\Gamma \vdash x$ entails $\Gamma' \vdash x$. Under the suppression rule, monotonicity fails: there exist $\Gamma \subseteq \Gamma'$ and $x$ with $\Gamma \vdash x$ but $\Gamma' \nvdash x$. Proof. Let $p$ be an authored assertion and $r$ a pinned derivation rule with $\{p\} \vdash x$, where $x$ carries the deriving authority class $A_1$. Let $q$ be an authored assertion with $q \mathrel{\#} x$ in $x$’s full scope and $\mathrm{auth}(q) = A_2 \succ A_1$. For $\Gamma = \{p\}$: $\Gamma \vdash x$. For $\Gamma' = \{p, q\}$: the closure derives $x$, the conflict pass finds $q \mathrel{\#} x$ with $A_2 \succ A_1$, and the suppression rule removes $x$ from the surviving closure, so $\Gamma' \nvdash x$. $\blacksquare$ Remark. This is prioritized defeasible reasoning: defaults in Reiter’s (1980) sense, with the priority mechanism in the tradition of prioritized default logic (Brewka, 1994); the proposition is proved here directly against the substrate’s own suppression semantics.

Consequence, adopted as schema and now enforced: every derived assertion carries its justification — rule identifier, premise identifiers, snapshot digest (the JTMS discipline; Doyle, 1979) — and a context containing a derived assertion without its justification is invalid (invariant I2; the derived-without-justification state is unserializable and its refusal proven red, and the lift path refuses to infer judgment fields rather than defaulting them). A derivation is valid only relative to its pinned snapshot; snapshot pinning is not hygiene but what makes derivation cacheable at all under defeasibility — though the cacheability consequence itself stays argued: no cache-invalidation-on-pin-change test is yet recorded. Proposition 4’s suppression semantics are likewise instantiated, with tests, in the implemented conflict pass.

Precedence $\succ$ is a strict partial order on authority classes and must not be totalized. When two conflicting assertions carry incomparable authority, the correct output is verdict $K$ plus a surfaced record requiring an authority decision. Inventing a tie-break (file order, timestamp) is a defect; a tie-break is itself a meaning object — declared, versioned, and cited in the resolution record. The implementation enforces the order semantics — precedence is applied only as a declared strict partial order, refusal to totalize is tested (an irrelevant declared pair does not order the real parties) — but precedence is today a declared call input, not yet the stored, versioned meaning object the previous sentence demands; that half is carried as a named honest gap, exactly as the observation log records it.

4.7 Verdicts

The verdict set is Belnap’s FOUR $\{\top, \bot, U, K\}$ with two orders — the truth order and the knowledge order ($U \le_k \top, \bot \le_k K$):

        K   (told both: conflict)
       / \
      ⊤   ⊥        knowledge order  (↑ = knowing more)
       \ /
        U   (told nothing)

Figure 2. The knowledge order of the verdict lattice.

Proposition 5 (verdict merge). Per-assertion verdict merging is join in the knowledge order: $U \vee_k v = v$; $\top \vee_k \bot = K$; $K \vee_k v = K$; $v \vee_k v = v$. $(\{\top,\bot,U,K\}, \vee_k, U)$ is a bounded join-semilattice, so verdict merging is commutative, associative, and idempotent, and inherits every $\oplus$ law of Proposition 1. Proof: the knowledge order is a lattice order on FOUR (Belnap, 1977); join exists and has the stated table by inspection of the Hasse diagram. $\blacksquare$

This single line is the formal content of “two agents disagree ⇒ the disagreement is computed and surfaced, never averaged, never last-writer-won.” $U \vee_k v = v$ is exactly “learning something replaces not knowing.” Two disciplines make FOUR safe in engineering practice (they answer a real objection — a consumer branching if verdict == T mishandles $K$ silently): verdicts are a closed enum with exhaustive match required, and the only exported “proceed” predicate is $\mathrm{actionable}(v) \iff v = \top$ — a consumer reading only actionable sees a fail-closed boolean projection and cannot mishandle $K$, which is simply not actionable. (Kleene’s three-valued logic proper appears at the ternary boundary projection below, where $K \mapsto U$ collapses FOUR to $\{\top, \bot, U\}$.) Crucially, verdicts are not truth-functional over context composition (Theorem 1); the bilattice governs merging opinions about one assertion, never deriving a composite’s verdict from part verdicts.

For interoperation with ternary-verdict systems, the layer includes a lossy-but-honest boundary projection (implemented): $K$ exits as $U$ plus a mandatory digest-pinned conflict-record pointer, and a boundary $U$ carrying neither a conflict pointer nor a genuinely-unknown attestation is invalid — known conflict is never laundered into mere ignorance. The whole discipline ran live this cycle: the lattice and knowledge-join are implemented per Proposition 5, and the proceed-only-on-$\top$ predicate governed four real task admissions — 4/4 correct, zero false $\top$, with two honest $U$ verdicts that triggered research loops instead of proceeding, each carrying a genuinely-unknown attestation naming the missing artifact (§8.5). Ignorance was attested, not laundered; that sentence is now a demonstration, not a design intent.

4.8 What the structure is — and is not

The meaning layer is six interlocking structures, each individually standard: (S1) contexts under merge form a join-semilattice with least element; (S2) typed relations form a small category of graph paths; (S3) verdicts form the Belnap bilattice (the two orders are Belnap’s, 1977; the bilattice terminology is Ginsberg’s, 1988); (S4) constraints form an antitone operator family resolved by a strict partial order, non-monotone once defaults enter; (S5) path costs form a tropical (min-plus) semiring over a directed graph (§7); (S6) evidence composes as provenance-semiring annotations (§4.10). Naming the standard structures is deliberate: each name imports known theorems and known implementations, and the honest inventory replaces a single exotic algebra that would have to be built and debugged from scratch. Implementation splits the inventory four to two: S1–S4 have running, law-tested instances (snapshot-gated semilattice merge, the typed-relation enum with inverse pairs, the Belnap lattice with knowledge-join and boundary projection, the whole-context constraint family with declared precedence); S5 and S6 — the tropical cost semiring and the provenance evidence semiring — remain specified only, and every later mention of them carries that label (§4.10, §7).

4.9 A carrier-relative non-transfer result

Compilence’s published materials state: “Normative and factual content forms a non-commutative semiring” (Technology Overview, Ch. 07; operator-saved copy, 2026-08-29), with four operator examples published and “full axiom systems … in the monograph” (Technology Overview, ibid.; the monograph unpublished as of this writing). Since a semiring requires a commutative additive monoid, a multiplicative monoid on the same carrier, two-sided distributivity, and an annihilating zero (Golan, 1999), the claim is checkable against any concrete carrier. On this paper’s carrier it fails in two structural, proved ways:

1. There is no second monoid on the carrier. Constrain $\otimes$ has signature $\mathbb{G} \times \mathcal{C} \to$ verdicts, not $\mathbb{G} \times \mathbb{G} \to \mathbb{G}$; the two operations do not share a carrier — a type-level absence.
2. Distributivity fails for the closest available analog (Theorem 1).

A third point is diagnostic rather than a further failure, and it survives independently of the two above: merge $\oplus$ — the only knowledge-combination operation on contexts — is commutative here (Proposition 1). By itself that cannot defeat a claim about their additive operation; what it supports is the attribution diagnosis below — their sole published additive example is not, on this carrier’s operator inventory, knowledge combination at all.

The scope of this result is stated precisely, and we ask that it not be read as broader than it is: we make no claim about Compilence’s unpublished axiom system. We show that on our carrier, the semiring laws as published do not hold, and that their sole published motivating example is naturally read, on this carrier’s operator inventory, as typed attachment rather than merge — narrowing any real disagreement to which operation carries non-commutativity, a question their published materials do not settle. Their published additive example — “delegation under scope is not symmetric with scope under delegation” (Technology Overview, Ch. 07; operator-saved copy, 2026-08-29) — describes role-indexed composition of concepts into derived concepts, which on this carrier is the operation named $\triangleright_\rho$, non-commutative in this paper’s own law table (Proposition 2). The apparent head-on collision therefore dissolves into an operator-attribution question: what their published examples exhibit as the additive operation is what this algebra splits off as attachment; the knowledge-combination operation this algebra calls merge does not appear among their published examples at all. Both accounts agree that meaning carries real non-commutativity; the carrier-relative theorem is that it does not live in knowledge combination. Similarly, their published annihilator (“once poison enters a derivation, conclusions built on it are structurally blocked” — Technology Overview, Ch. 05; operator-saved copy, 2026-08-29) reads as blocking the derivation cone — compatible with this paper’s quarantine semantics, not a whole-context poison; an earlier internal reading of ours construed it more broadly, and we record the correction.

One thing has changed since this analysis was first written: the carrier is no longer only specified. The operations the two counterpoints and the diagnosis rest on now run — merge is implemented commutative and snapshot-gated, no second monoid appeared in implementation, and the distributivity failure is an executed conformance fixture — so the non-transfer result holds of an implemented algebra, not a paper one.

Why this section exists at all: our prediction is that code written against the semiring picture will implement exactly the two unsound shortcuts the laws forbid — order-sensitive merge, and per-part validation with verdict recombination — both silent-drift defects. The prediction is falsifiable (build a semiring-style prototype, run it against this law table’s conformance suite) and untested: no such prototype was run, and the interpretive half stays untestable while the counterparty’s axioms are unpublished. Semirings do appear legitimately in exactly two subsystems (costs, S5; evidence, S6), and only there — both, today, specified rather than implemented. The methodological point generalizes beyond this one claim: when comparing knowledge algebras, operator attribution — which operation a law is claimed of — is as load-bearing as the law itself, and a law table over a concrete carrier is the instrument that localizes such disagreements instead of letting them remain rhetorical.

4.10 Evidence algebra

Each assertion’s evidence field composes as a provenance polynomial over evidence variables — alternatives as $+$, joint requirements as $\cdot$ (Green et al., 2007). Two queries are thereby defined operations rather than features to be invented: $\mathrm{why}(a)$ returns the polynomial (which pins, receipts, and checks support $a$; the empty polynomial is itself the honest answer for an unsupported assertion), and $\mathrm{evidence\text{-}reduce}(a)$ returns a reduced supporting set labeled with its reduction rung exactly as contracts are — the word “minimal” is banned here for the same reason as in §6.3. The evidence algebra is specified, not implemented: nothing in this paper’s evidence exercises why or evidence-reduce, and it is carried as a named NOT-YET item, not implied to run.

4.11 Where the algebra itself breaks

Stated against ourselves, as design obligations rather than fine print: (1) extraction is the weakest link — and this is now a measured finding, not a fear. The fidelity evaluation (§8.4) put numbers on it: encoding is where the losses concentrate — the hand arm altered or lost 17.3% of semantic units, identifiers weakest, and even a co-designer of the format fell into its own vocabulary trap; the automated arm’s three alterations include a real MUST→SHOULD drift. A fact that never became an assertion is invisible to every operator; the escape rule therefore requires any unencodable fact to land as guarded free text or an explicit unknown rather than be dropped, and the layer must never be lossier than the prose it replaces. The escape rule’s companion — the declared-residue assertion — is what kept a real legacy lift honest this cycle: the parts that did not decompose were pinned as residue rather than dropped (§8.5). (2) Skipped re-validation under load voids Theorem 1’s soundness — which is why the corresponding invariants are gates, not guidelines. (3) Omitted justifications make derivations uncacheable; the token saving is spent back with interest. (4) Prose scopes silently disable conflict detection (§3.4).

5. The invariants

Each invariant has a formal statement and a mechanically checkable predicate — an invariant nobody can check is not an invariant — and each is classified by when it is checkable and how strongly:

• S — schema-unexpressible: the invalid state has no serialization;
• A — authoring-time checker: refused at store write / CI;
• P — projection-time checker: refused at contract/packet emission;
• R — resolution/runtime: detectable only when applied or acted on.

An implementation may strengthen, never weaken, a classification — and the classification has now met an implementation. The v2 layer (§8.2) enforces or honestly tier-labels all sixteen; no classification was demoted, the invariants predicted to be irreducibly runtime-bound shipped exactly as predicted (I3’s enforcing test is a double-run digest comparison; I7’s is an apply fixture — no static enforcement was found for either), and the S-tier claims are no longer assertions about a schema on paper: each unserializable-violation claim is demonstrated by a mutation-proven refusal in the executed 27/27 coverage run (minimality claims, unpinned assertion references, out-of-profile assertions, unbridged cross-scope identity among them). Two residual NOT-YET sub-tiers are named in place below (I6, I16) rather than smoothed over. The sixteen, compactly (I1–I9 govern any conforming store and transfer; I10–I16 arise from the versioned-store setting and from a recorded design-synthesis review that folded the FPF distinctions of §2.9 into the specification — the §2.8 record contributed evidence and the disagreement of §4.9, not constructs), each with its implementation status inline:

I1 — Provenance closure (A/P). Every reference in a context resolves inside its snapshot pin, and every resolved revision’s recomputed canonical digest equals its recorded one. Predicate: closure walk plus digest recomputation, offline against the pinned store. Status: enforced — the walk runs over the live store plus archive pins.

I2 — No inferred meaning (S-part/P/R-audit). No transfer raises the knowledge state of an assertion without a derivation record; missing ≠ default; absence of scope ≠ universal scope. The schema-expressible core: a derived assertion requires justification (discriminated union — origin: authored | derived, the derived branch unserializable without the JTMS triple). Projection part: $\mathrm{assertions}(\Gamma_{out}) \subseteq \mathrm{assertions}(\Gamma_{in}) \cup \mathrm{justified}(\Gamma_{out})$. The honest tail: inference smuggled inside a value string is undecidable mechanically and is covered by sampled audits. Status: enforced at the S-tier (refusal proven red); the lift path refuses to infer judgment fields; the audit tail stays procedural, as specified.

I3 — Snapshot determinism (A-store/R-function). Resolution and projection are pure functions of (snapshot digest, input): same pin + same input ⇒ byte-identical output; later snapshots never rewrite earlier resolutions. The function half is irreducibly runtime — provable only by running twice and comparing digests; a schema cannot express “this function has no hidden clock.” Status: enforced by exactly that fixture, now executed — a double-run digest test in CI; the implementation keeps no clock anywhere (the lift takes its timestamp from the caller).

I4 — Conflict surfacing (S-record/P-detection). No context may contain $a \mathrel{\#} b$ in overlapping scope without either a suppression record (precedence used, winner, scope) or a $K$-verdict conflict record — a first-class, digest-pinned, never-truncated object; additionally a $K$ verdict must cite its conflicting assertions by digest-pinned reference (an unciteable $K$ is unserializable — also the anti-flooding guard). Pairwise detection over the emitted context; decidable because scope is a closed vocabulary. Status: enforced — pairwise pass, digest-pinned conflict records, the K-cite rule proven red, suppression from a declared strict partial order that refuses totalization, and resolved conflict records riding in the contract.

I5 — Modality preservation (P). For task scope $\sigma$: every MUST/MUST-NOT assertion in the pinned graph whose scope intersects $\sigma$ appears in the contract with modality unweakened (MUST-NOT → SHOULD-NOT is a violation). In v1 this invariant was unmechanizable because modality lived in prose; with modality and scope as fields it becomes a set comparison — the single clearest example of what the assertion layer buys. Status: enforced exactly as predicted — attachment by scope intersection plus a post-REDUCE set comparison. The payoff has an in-the-wild demonstration with an honest division of credit: the evaluation’s unit audit caught a real MUST→SHOULD drift produced by freehand encoding (§8.4) — the precise defect this check exists to refuse; the field is what makes such drift machine-checkable after the fact. I5’s own mechanical refusal, red-proven on synthetic scenarios, has not yet fired on real content.

I6 — Direction preservation (S-enum/P-check). Transport never reverses, symmetrizes, or retypes an edge: the relation vocabulary is a closed enum with distinct inverse members, free-text relations are unserializable, and every relation assertion in a transfer is verified against the pinned graph — a cited edge that exists reversed in the registry fails loudly. Status: the S-tier half is enforced (closed enum, inverse pairs, refusal proven red); the P-tier transfer cross-check against the registry is NOT YET — owed at the packet-consumer seam, and named here rather than implied.

I7 — Delta soundness (S-base/R-application). $\mathrm{digest}(\mathrm{apply}(\Delta, \mathrm{fetch}(\Delta.\mathrm{base}))) = \Delta.\mathrm{after}$; refuse on missing base, never “closest version” — content addressing in the Merkle tradition (Merkle, 1979) applied to contexts. A delta without a digest-pinned base is unserializable; the application equality is a property of an act, not of bytes at rest. Status: enforced — base-digest refusal in delta application, with the apply fixture as the runtime-tier test, as predicted.

I8 — Append-only monotonicity (A). Existing revisions are immutable; change is a successor revision; no in-place edit, deletion, or digest reuse. Transfer extension: a packet asserting revision $X$ with a digest differing from the registry’s $X$ is equivocation, refused. Status: enforced at store and write path — and exercised by two genuine concurrent-authoring races, both decided by design: each losing writer refused and never mutated; the capability-map race recovered by staged succession, while in the role-developer race the losing candidate was discarded in favor of the standing revision (§8.5).

I9 — Minimality honesty (S). No artifact may claim minimality; contracts claim sufficiency at a declared reduction rung, and there is no serialization of “minimal” (§6.3). The model case of the strongest class: the schema refuses to express the violation, at zero runtime cost. Status: enforced and demonstrated — the minimality-claim refusal is mutation-proven, the rung field is required, exact-rung reductions emit an exhaustion certificate into the receipt, and every live projection this cycle carried its declared rung (§8.5).

I10 — Single definition and import (A/S-where-possible). Every definition the system owns — kind roster, relation enum, domain/range table, scope vocabulary, verdict enum, refusal-code catalog, store root set, rung enum — exists exactly once as a versioned object, and every consumer imports it by pin. A component that restates one is invalid as a component, whatever its output. This invariant was purchased with a real incident (§8.6). Honest limit: a determined restatement inside opaque code is detectable only by divergence; the lint narrows the window, it cannot close it. Status: enforced — and the lint earned its keep on first contact: its first run over the live repository found five pre-existing restatements of the same defect class that the incident’s postmortem had missed, silent because none had yet diverged (recorded as explicit, stale-protected debt, not amnestied). The divergence-only residual window is now evidenced, not asserted; and the incident’s fix demonstrably did NOT close the class — the lint did.

I11 — Pinned assertion references (S/A). A cross-revision assertion citation without a content-digest pin is refused. The digest freezes payload bytes, so (digest, key) is unambiguous forever; resolution against “latest” is the equivocation attack that needs no attacker. Status: enforced, refusal proven red; the companion succession rule — assertion keys may not silently drift across a succession — is likewise red-proven and was exercised by the store’s first real succession.

I12 — Form parity (A/P). Every rendered projection (a page, a generated document) carries its source pin and regenerates byte-identically from its source revision; a projection without a source is not an artifact. The v1 system’s public-content gate is the precedent, and its true violation set is counted in §8.6 — after two instrument corrections. Status: enforced for the v2 store (deterministic projection with source pin, byte-compared, red on missing, orphan, or drift); the invariant also caught a real defect in its own renderer this cycle — a truncating projection, lossier than its revision, violating the invariant in spirit — found by the parallel run, fixed, and re-verified (§8.5).

I13 — Profile closure (S). An assertion outside its revision’s kind-profile is refused, not ignored: an unprofiled assertion is an unscanned authority-smuggling channel. Fail-closed schema interpretation is inherited: the validator raises on any schema keyword it does not implement, so a schema cannot promise more than enforcement delivers. Status: enforced fail-closed for every managed kind — with a recorded narrowing the implementation taught us. Profiles exist for managed kinds; auxiliary revision bodies are unprofiled, and there the validator has almost no refusal surface. “Zero refusals” is strong evidence only where profiles exist; the closure claim holds everywhere profiled, not everywhere conceivable.

I14 — Authority non-importation (P/R). No approval event from an archived store establishes current authorization for a successor-store object; old approvals are evidence toward the archived object’s historical validity only. Batch migrations whose issuances share one approval reference without a digest-pinned batch-approval policy are flagged (the anti-laundering gate). Status: enforced — authority events must target a live-store revision, and every archive lift this cycle entered carrying no authority.

I15 — Cross-scope identity is a claim, never an inference (S/A core; R staleness). Name equality across scopes never implies identity; identity or substitutability across scopes is an explicit, evidenced, digest-pinned Bridge plus a bounded use-claim with declared tolerated loss and mandatory currentness (the Bridge/use-claim separation adopted from FPF with attribution, §2.9) — and even then authorizes nothing (the authorization separation extends to semantic edges). The resolver refuses unbridged cross-scope resolution — an executable rule, now executed. Residual runtime tier: bridge staleness (endpoint supersession flips reliance to $K$ until re-affirmed; refusal proven red). Status: enforced, and exercised negatively under real pressure: a gap record named an artifact by a tal- alias whose content lives under a different declared identifier. Minting the alias twin would have created exactly the equivocation surface this invariant kills; the twin was refused — a Bridge needs two digest-pinned endpoints and the alias side has none — and the gap closes at the requirer’s lift instead. “A name-only requirement is not an identity” held when it cost something.

I16 — Layer-flow integrity (A/P). Every projected assertion has a layer value in {laws, admissibility, deontics, evidence} (the four-layer classification adopted from FPF with attribution, §2.9) — derived by default from existing fields, explicitly tagged only where derivation is ambiguous — with deterministic cross-layer lints: an evidence-layer assertion never satisfies a deontic obligation (a log is not a proof; an evidence carrier cannot create a permission); deontics are never derived from laws alone; admissibility gates before deontic evaluation. Recorded honesty: if these lints never meaningfully fail in practice, the discipline is to be removed rather than kept as theater. Status: enforced at the A-tier — layer values derived by default, declared-versus-derived disagreement an error, deontic force on an evidence carrier refused, with the refusal proven red. The admissibility-gates-before-deontics resolution rule is NOT YET: it needs capability-envelope evaluation at bind time, which has no consumer yet. And the keep-or-remove decision the recorded-honesty clause promises cannot be made yet — the lints have not run over enough real content to adjudicate it.

Invariant	S	A	P	R	Weakest necessary tier	v2 status
I1 provenance closure		✔	✔		P	enforced
I2 no inferred meaning	◐		✔	audit	P (core; value-string audit tail R)	enforced (S-tier core; audit tail procedural)
I3 snapshot determinism		◐		✔	R	enforced (double-run digest test)
I4 conflict surfacing	◐		✔		P	enforced
I5 modality preservation			✔		P	enforced (post-REDUCE set comparison)
I6 direction preservation	◐		✔		P	S-tier enforced; transfer cross-check NOT YET
I7 delta soundness	◐			✔	R	enforced (base-digest refusal + apply fixture)
I8 append-only		✔	◐		A (core; transfer extension P)	enforced; exercised by two real races
I9 minimality honesty	✔		◐		S	enforced; certificate emission tested (R3 unexercised in anger, §6.2)
I10 single definition	◐	✔		divergence	A (core; divergence residual R)	enforced (lint + debt registry)
I11 pinned assertion refs	✔	✔			S	enforced
I12 form parity	◐	✔	✔		A	enforced for the v2 store
I13 profile closure	✔	✔			S	enforced where profiled (see status note)
I14 authority non-import			✔	✔	P	enforced
I15 cross-scope identity	✔	✔		staleness	S (core; staleness R)	enforced (unbridged refusal + staleness)
I16 layer-flow integrity		✔	✔	tag-shopping	A (core; bind-time gate R)	A-tier enforced; bind-time gate NOT YET

Table 2. Enforcement-strength classification (◐ = partial coverage at that tier), with the implementation’s per-invariant status. The “weakest necessary tier” column follows one rule: it names the weakest tier at which the invariant’s CORE obligation is fully discharged — partial (◐) coverage discharges nothing, and residual obligations weaker than that tier are parenthesized rather than promoted. The rule is a judgment about the invariant’s substance, not a count of marks: a ✔ records where a check runs, the column records where one is unavoidable (I1 needs the emission-time walk because contracts are emitted per task; I12’s rendered projections are committed artifacts, so the CI byte-comparison discharges it at A). The status column condenses the implementation’s own coverage table, verified against its executed test and gate suite at the pinned commit (§8.2); no row’s classification was demoted by implementation.

The table is honest in both directions. Four invariants reach the strongest class — the schema refuses to express the violation. Two (I3, I7) are irreducibly runtime-bound: determinism and delta application are properties of acts, and an implementation claiming to have made them schema-static would be overclaiming — this table exists to prevent that claim as much as to enable the strong ones. One further honesty item is owed: the classification also creates a new single point of semantic failure — the normative vocabularies themselves (scope, domain/range, profiles). A wrong row silently mis-governs every contract projected after it; the mitigation is the same discipline the tables impose on everything else (they are versioned objects, changed by succession, with mutation tests per row class), and the residual cost when it happens anyway is wrong contracts with perfect audit trails — loud in review, invisible at emission. This failure class is no longer hypothetical: it occurred organically during implementation, when the kind roster was silently trimmed relative to the specification — a wrong vocabulary row in the strict sense — and the first piece of real content needing a trimmed kind exposed it within the hour. The deliberate injected-wrong-row experiment was not run; the organic instance substitutes, and it also argues for the interleaved implement-then-use-immediately method that caught it, where a fixture suite built from the same wrong assumption never would have (§8.5).

6. The resolver

6.1 The eight steps — specified, implemented, and run

$\mathrm{Resolve}(G_s, T)$ is specified in eight steps, all implemented, and run end-to-end on real tasks this cycle (§8.5) — with two honest asterisks on “exercised”: the conflict pass of step 5 has never fired on real content (no live conflict has yet arisen; its detection and refusal paths are red-proven on synthetic scenarios only), and REDUCE’s R2/R3 rungs have not run in anger (§6.2):

1. σ-filter: drop revisions out of scope/validity (linear);
2. seed: match $T$’s requirements to providers (index lookup);
3. closure: bounded deterministic closure from seeds over pinned dependencies and typed relations (polynomial; the v1 system’s bounded-BFS with typed non-answers is the model);
4. governance attach: every MUST/MUST-NOT with scope ∩ σ ≠ ∅ (I5 — completeness, not minimality);
5. conflict pass: pairwise $\#$ over the closure; resolve by $\succ$ or surface $K$ (I4);
6. REDUCE: the minimization step (§6.2–6.3);
7. verdict pass: $\otimes$ over the reduced set — after REDUCE, because removing a provider can break a constraint satisfied by accident before (Theorem 1 again; an implementation that reorders steps 6 and 7 has reintroduced the unsound merge);
8. emit or refuse: the contract with receipt (sufficiency certificate, reduction rung, retained rejections), or a typed structural refusal. Refusal is a first-class outcome: the agent does not launch.

Running the resolver on real work surfaced a rule the specification did not contain, reported here as an implementation-discovered rule rather than retrofitted as if it had always been specified. The closure walk of step 3 followed a lifted revision’s digest-pinned derived-from edge into the frozen archive and refused it as Missing — and no specification part said what Resolve does at the archive boundary. The resolution, faithful to the layer’s own rule that archive content is citable by digest but archive identifiers never surface as live nodes: archive-resolvable pins are closure leaves — digest-verified, recorded in the receipt, never traversed, never projected; only a nowhere-resolvable reference is Missing; and a cited digest that disagrees with the archive is an equivocation refusal, not a fetch of “closest version.” Implemented and tested. An executable specification is the instrument that finds its own underspecifications; this was the third such finding of the cycle (the other two are in §6.3 and §8.5).

6.2 Hardness

Definition 5 (Minimal Sufficient Projection, decision version). Given: a pinned graph $G_s$ whose artifacts each carry a set of provided capability tokens; a task $T$ with required token set $U$; an integer $k$. Question: is there a selection of at most $k$ artifacts whose provided sets jointly cover $U$?

Theorem 2. Minimal Sufficient Projection is NP-complete.

Proof. Membership: a selection is a polynomial-size certificate; verifying coverage is a union and comparison. Hardness: reduce from Set Cover (Karp, 1972). Given a Set Cover instance (universe $\mathcal{U}$, family $\mathcal{S} = \{S_1, \dots, S_n\}$, bound $k$), construct one artifact per $S_i$ providing exactly the tokens $S_i$, and a task requiring $U = \mathcal{U}$. A selection of $\le k$ artifacts covering $U$ exists iff a set cover of size $\le k$ exists; the mapping is polynomial. $\blacksquare$

The reduction uses only machinery the substrate already has (provides token lists — machinery that is now real, not schematic: this cycle’s first real succession declared a provides token to close an admission gap, and the implemented REDUCE runs cover-based over exactly these tokens), so the hardness is not an artifact of generality: any implementation with overlapping providers faces it. An honesty note from recomputation, re-run for this revision: an earlier research document in this line claimed the production graph already exhibits overlapping providers; it does not, and still does not. At its frozen pin the v1 store declares 22 distinct capability tokens, each provided by exactly one logical identifier; the live v2 store, recounted for this rewrite, adds 6 declared tokens — again each provided by exactly one identifier. Exact minimization is trivial today, and R2/R3 remain unexercised in anger, exactly as predicted. The hardness claim is about the problem class, and it bites exactly when alternative providers accumulate — the graph’s stated growth direction — which is why the ladder below exists before it is needed rather than after. With dependency closure added, the problem only hardens (it generalizes toward directed/group Steiner problems, for which known polynomial algorithms achieve only polylogarithmic approximation factors — cited as literature context, not proved here).

6.3 The tractable ladder, and the ban on “minimal”

Rung	Procedure	Cost	Minimality forfeited
R0	closure-only	poly	nothing removed: sufficient, possibly grossly redundant
R1	closure + dominated-alternative pruning under the pinned tie-break	poly	keeps ties; sound because the tie-break is pinned
R2	greedy set cover over alternatives	poly	within $\ln n + 1$ of optimum (Chvátal, 1979; Johnson, 1974) — and no polynomial algorithm does asymptotically better unless P = NP (Dinur & Steurer, 2014, after Feige, 1998)
R3	exact minimization, bounded (≤ ~20 choice points, via SAT/ILP)	exponential in choice points, budget-gated	none below the bound; refuses above it — never silently degrades

Table 3. The reduction ladder.

All four rungs are implemented, including R3’s budget-gated exact minimization, which refuses above its bound and emits an exhaustion certificate into the contract receipt when it completes. Implementing the ladder surfaced a defect in the specification itself: the I9 rung enum serialized three rungs while the resolver document defined four — R1, dominated-alternative pruning, had no legal serialization, so an implementation following the schema part alone could never declare the rung the resolver part told it to implement. The enum was extended as a governed correction, and the episode is kept as evidence for a claim prose review cannot earn: an executable specification catches inconsistencies that years of careful reading missed. (A second, smaller instance from the same session: the first R1 test asserted a provider tie where the pinned order actually gives strict dominance — the implementation was right and the implementer’s “sound pruning” intuition was wrong, which is precisely why the pinned-order definition, not intuition, decides.)

Because true minimality is intractable and a minimality claim without an exactness certificate is unfalsifiable, invariant I9 makes the rung a mandatory field of every contract and removes the word “minimal” from the output vocabulary entirely: what a contract may claim is provably sufficient at the declared rung — and the ban is enforced, not aspirational: the minimality-claim refusal is mutation-proven, and every projection emitted for the live parallel run carried its declared rung (§8.5). Why REDUCE matters at all: over-large contexts cost tokens (the direct bill), attention (irrelevant constraints dilute compliance with relevant ones), and exposure (needless material widens the secrecy surface — reduction is also a data-minimization requirement, not just an economy). And the one cost REDUCE cannot touch is now measured rather than argued: governance attached by scope intersection is protected from reduction by I5’s completeness rule by design, and the post-draft full-store re-run put a bill on that protection — coarse-scoped governance grew one task’s rendered context 8.8× at +32% executor cost (§8.8).

Sufficiency has its own honest limit: $K \models T$ is checkable only against declared requirements. A fact that exists as prose but not as an assertion is invisible to any resolver — a principle this cycle confirmed live: every projection insufficiency the parallel run recorded traced to a fact nobody had asserted (a payload path, an undeclared authoring rule), never to a resolver defect (§8.5). The size of the ungraphed-content debt is itself a cautionary tale about instruments: the figure this paper’s draft carried, 42 of 125 published artifacts, was two-thirds instrument fiction — the corrected gate counts 14 genuinely ungraphed artifacts, the other 28 being phantoms manufactured by the gate deriving identities instead of reading them (§8.6). Closing the real 14 is a correctness precondition for the resolver’s guarantee to mean anything, not hygiene.

7. Geometry and cost

Definition 6. Let $G = (M, E, w)$ with $M$ the meaning objects, $E$ the typed directed edges carrying recorded costs, and $w : E \to \mathbb{Z}_{\ge 0}$ the cost. Define $d(x, y) = \inf\{\sum_i w(e_i)\}$ over directed paths $x \to y$ within $E$, with $d(x, y) = \infty$ if no such path exists. (An edge without a cost record is outside $E$: a query whose only routes cross it returns reachability separately and cost unknown — see below.)

Proposition 6. $d$ satisfies $d(x,x) = 0$ and the triangle inequality $d(x,z) \le d(x,y) + d(y,z)$, with no symmetry requirement: $d$ is an extended quasi-pseudometric — a quasi-metric in Wilson’s (1931) sense exactly when the separation axiom holds, which is not required here. Proof: the zero path, and path concatenation — the min-plus (tropical) closure. With nonnegative integer weights on a finite graph, the infimum is attained by a simple path (cycles cannot decrease cost), so $d$ is computable by standard shortest-path algorithms. $\blacksquare$

Two implementation rules follow from honesty rather than mathematics: raw edge weights need not satisfy the triangle inequality (only the closure does — never read a stored weight as “the distance”), and $d(x,y) = d(y,x) = 0$ with $x \ne y$ is permitted (“same meaning, different address”; quotienting by that relation is what restores Wilson’s separation axiom when one is needed).

The asymmetry is the point, and it is grounded in the ecosystem’s operational record rather than stipulated: acquiring a missing skill costs training and verification effort while the reverse traversal costs nothing (held skills are not un-learned), so “distance from junior profile to senior profile ≫ the reverse” falls out of edge direction with no extra machinery; in one recorded incident, entering a bad state was one credential issuance while the recorded exit path was a five-step recovery; in another, a wrongly merged change cost multiple recorded revert-and-reland cycles while merging costs one CI run.

Three provenance rules govern weights. Measured weights derive from the operational ledger (the production system records per-task wall time, token counts, and cost with an estimated/measured basis flag across 126 per-task ledger files); repeated samples give a distribution whose declared statistic is recorded with sample references. Declared weights are permitted where no sample exists and remain distinguishable from measured forever. Forbidden: deriving weights from embedding cosine distances — embeddings are symmetric by construction (checked during the research phase against the ecosystem’s retrieval fusion, whose ranking carries no directional term; the check is pinned to that phase, was not re-run this cycle, and no lint yet enforces the rule), and laundering a symmetric similarity into an “asymmetric cost” manufactures the asymmetry the layer exists to preserve. Weights never gate correctness — only constraints gate; a wrong cost mis-prioritizes, it cannot mis-permit — a design rule, not a demonstrated property: no code path exists yet on which to test it. An edge with no cost record has unknown cost ($U$), never $1$ and never $0$; $\infty$ is reserved for declared unreachability under a complete-closure scope.

A continuous, direction-dependent geometry (Finsler; Bao, Chern & Shen, 2000) would add geodesics through points that are not graph nodes, curvature, and direction-dependent infinitesimal cost — none of which is defined until meanings live in a continuous space. On a discrete carrier of 324 archived and 14 live revisions, every question actually asked is a shortest-path question, and the quasi-metric answers it. The deferral has an explicit trigger (a continuous embedding with meaningful interpolation), not a date; building the apparatus now would be decorative mathematics.

A status statement this section owes more than any other: the cost layer is the least-built part of the substrate. Proposition 6 is proved mathematics and stands; no running code exercises it. Beyond closure-size cost in the resolver, nothing here is implemented — no cost-record authoring exists, so the operational ledger has not been mined for directional pairs and the incident-grounded asymmetry examples above remain motivation rather than at-scale measurement. This is the “cost model” absence of §1.4, the one v1 absence this cycle did not close, and it is carried per the same rule as every other gap: named, not implied away.

8. Evaluation

The evaluation makes five kinds of claims with five different strengths: historical existence evidence from the v1 store, now a frozen archive (§8.1); implementation evidence from the executed v2 layer and its live store (§8.2); the v0 pilot, kept as the pilot (§8.3); the measured evaluation — four measures, jointly, refuting this line’s token claim on both its facets and narrowing its delta claim (§8.4); and the dogfooding and parallel-run record (§8.5), whose premise-check felled the third refuted claim — the store-debt figure — via the instrument recount of §8.6. The measurement-error episode (§8.6) and threats to validity (§8.7) close the section as it was written. Two subsections postdate all of them: §8.8 is a dated addendum from a second round — the corpus lift and the full-store re-run — and §8.9, dated a day later, records the correction of §8.8’s own enumeration frame; both are appended after this draft’s evaluation closed, not woven into the sections whose claims they extend or contradict.

8.1 Historical existence evidence: the v1 store, now a frozen archive

All claims in this subsection were verified by reading the production repository and re-executing its own loaders at commit 63f66b2 (2026-08-29) — never by quoting its documentation. Since that verification the store has been closed: v1 is a read-only archive, frozen mechanically — a SHA-256 manifest over its 346 files (324 revisions plus 22 gap records), enforced in CI by a freeze check that is itself mutation-proven (4/4 red paths). The freeze is the standing recount: every count below is re-runnable byte-identically at the pin. What was not re-executed this cycle is labeled as such.

The store holds 324 immutable revisions of 210 logical identifiers across three roots (55 + 147 + 122), of seven managed kinds (172 Skill, 51 Role, 43 Blueprint, 20 Constraint, 17 SuccessCriterion, 16 Policy, 5 CapabilityDescription), each with the identity triple of §3.1 and digest-verified at load. Its census file additionally records 324 dependency edges (coincidentally equal to the revision count; both recomputed independently at the pin), 293 resolved relation edges, and 57 unresolved declared-relation edges — recorded visibly, never dropped. The census was not re-executed this cycle; the byte-freeze makes it re-runnable identically at the pin. And one fact the census numbers do not capture, learned during the v2 lift work: v1’s by-name relations were never mechanically checked at all — the archive’s only mechanical frontmatter gate verifies no relations whatsoever (verified in its code, §8.5) — so “recorded visibly” is a property of the census file, not evidence that any declared relation resolves.

The v1 validator enforces 16 typed refusal codes (unpinned references, digest mismatches, unclosed dependencies, exclusion conflicts, retrospective mutation, replay equivocation, authority smuggled through content, evidence self-attestation, among others), under a red–green doctrine: no refusal code exists without a test that can go red. That harness was read and inventoried for the original draft but not re-executed — and it has not been re-executed since: the archive is frozen and is never validated under v2. The live successor catalog is v2’s 27 codes, and that harness was executed for this revision (§8.2). The five-stage v1 resolver (Propose → Verify → Select → Assemble+Issue → Bind), with its three never-merged identities and its documented “never ‘pick the first one’” rule, is likewise history: it ran one real end-to-end resolution to the Bound state (Correction, 2026-08-31 — an undercount; the store’s own record says twenty, see §8.11), was not exercised with fresh resolutions this cycle, and is superseded by the v2 eight-step resolver, where all fresh resolution work ran — four end-to-end admission → projection → execution runs (§8.5) replacing the v1-era n = 1 as the substrate’s existence-in-motion evidence.

Equally load-bearing are the verified absences. The v1 store has no deontic modality field (prohibitions live in prose bodies, with the one exception of structured policy rules carrying allow/deny/require_approval effects — an existing mechanism the v2 modality field generalizes), no scope field, no verdict values beyond boolean checks, no conflict records, no delta transport, and no cost model (a budget field exists on resolver intents and is read by no stage). The theorems of §4 are about the layer these absences delimit, and every absence except the cost model is now a closed, implemented v2 target (§1.4). The store’s own hygiene gate — after two instrument corrections (§8.6) — reports 14 of 125 published document artifacts genuinely lacking a backing graph revision (8 competencies, 2 skills, 2 policies, 2 constraints, counted by declared identifier from the canonical roots; one of the 14 was re-authored into the v2 store this cycle), carried as known debt rather than reconciled away.

What this evidence does and does not establish: it establishes that the substrate discipline — append-only digest-pinned storage, fail-closed typed refusal, mutation-tested gates, deterministic resolution — ran at organizational scale with real content, survived contact with its own operational errors (§8.6), and hands its content to a successor only through digest-verifying doors. Claims about the assertion layer rest on §8.2 onward, not on this archive.

8.2 Implementation evidence: the v2 layer and its live store

The v2 layer described in §§3–6 is implemented in one visible boundary directory of the same repository, and every implementation claim in this paper is backed by an executed test or gate at commit 41c480a (2026-08-30), the pin for all v2 evidence in this revision. The components: a single-definition module (I10) that every other component imports — kind roster, profiles, scope vocabulary with intersection rules, verdict/modality/rung enums, the refusal-code catalog, the one v2 store root; a revision store with canonical-digest verification at load and duplicate/retro-mutation refusal at the door; the validator, whose every refusal is a catalog code; the eight-step resolver with typed refusals and declared rungs; the packet module (canonical JSON plus a deterministic line projection, round-trip enforced, deltas with base-digest refusal); and the archive lift, the only door through which v1 content enters, judgment fields refused rather than inferred. The CI gates — archive freeze, single-definition lint, refusal coverage, the suite — are each mutation-proven before they run.

The refusal-code catalog holds 27 typed codes, each proven red against a live scenario by an executed coverage harness — the counter fails on a missing scenario, so the 27/27 figure cannot silently rot — re-executed during this revision’s claims audit (2026-08-30). Per §5’s status column, all sixteen invariants are enforced or honestly tier-labeled, with the two named NOT-YET sub-tiers (I6’s transfer cross-check, I16’s bind-time gate); the reduction ladder runs R0–R3 including exact-with-certificate (§6.3).

The live store, recounted from disk for this rewrite: 14 revisions of 11 logical identifiers — every one produced by real work, none seeded as fixture content. The partition, stated so it sums: three scripts as CapabilityDescription with mandatory envelopes (3 revisions); the template as Blueprint across three revisions — first lift, then the staged succession that closed the template↔︎script mutual reference, then the provides-token succession that closed a live admission gap (3); one constraint (1) and one research-evidence revision (1); the capability map as Blueprint across two revisions, the second being the succession forced by a genuine authoring race on that artifact (§8.5) (2); three real archive lifts — the structured skill (which also closed the eighth registered gap target at its declared identifier), the role-developer artifact, and a legacy-prose constraint lift, honest only via a declared-residue assertion, that closed the run’s other admission gap (§8.5) (3); and an authoring-capability revision minted in the same two-level research loop as the template’s third revision (1). That is 3 + 3 + 1 + 1 + 2 + 3 + 1 = 14 revisions, and the eight registered exists-outside-the-graph gap targets are all among them — seven under their own logical identifiers, the eighth resolved at its declared identifier by the skill lift. (These counts are the store at this section’s pin. A post-draft second round later grew it to 63 revisions through a bulk corpus lift; that growth and its consequences are reported separately, dated, in §8.8 — not folded into the counts here.) Two observations from that growth belong in the record. First, the authoring cost concentrates in the first artifact of each shape: the second gap-lift wave hit zero validator refusals and credited the first wave’s worked example — a learning curve, not a constant tax. Second, the validator earned its keep at write time, refusing three real malformed assertion keys during the first decomposition — authoring errors caught before review rather than after.

8.3 The transport pilot (historical)

The pilot is kept in this paper as exactly what it was, because its numbers stand while their reading has fallen: the measurements below are real, and §8.4 shows they measured the encoder, not the format.

The measured question: what does re-encoding a real agent-to-agent handoff from prose into the typed packet form do to its token count, holding semantic content fixed by construction?

• Corpus. Six real handoff artifacts from the ecosystem’s live agent-orchestration workflow store — a separate store from §8.1’s graph, holding 56 sessions and 116 snapshots at measurement time per the committed measurement record (the snapshot half was independently corroborated when §8.4’s evaluation drew its own corpus from the same directory and found 116 files; the session half still rests on the committed record alone) — chosen to span the artifact classes: two session handoffs, three stage snapshots (parent-orchestrator, blocked-task, and production-push variants), one archive. Originals copied verbatim into the measurement directory.
• Re-encoding. Each artifact was hand-encoded into the packet projection — a terse line grammar with typed assertion lines, state records, justified derivations, deontic lines, explicit not-claimed/unknown fences, conflict records, delta lines, evidence pointers, and refusals — by the research session that designed the format, under a completeness rule: every load-bearing semantic unit preserved (verdicts, modalities, digests, conflict records, lessons; full hashes kept where the prose had full hashes), with narrative connective tissue the only permitted loss. Lessons and other novel content are carried as guarded free text: the format refuses to compress what exists in no registry.
• Counting. tiktoken, both o200k_base and cl100k_base vocabularies. The receiving models’ tokenizer is proprietary; two independent BPE vocabularies are reported so the ratio is not an artifact of one vocabulary (they agree within 0.3 percentage points throughout). The harness, file pairs, prose originals, and packet re-encodings are committed alongside the research documents in the (private) research repository; reproduction is two commands for anyone with access, and §10 states what stands between the corpus and public release.

Fidelity was controlled by construction, not by similarity scoring: each packet is auditable line-against-source, and the design position remains that the correct fidelity metric for this format is validator-checkable unit completeness, not embedding similarity — a summary at 84% semantic similarity that lost one MUST-NOT would pass an embedding check and fail invariant I5. But the pilot enforced that position only by the encoder’s own discipline, with no independent check — and when the independent check was finally run (§8.4), construction-verified hand encoding turned out to be the least faithful arm measured. The position survives; the pilot’s claim to have satisfied it does not.

The pilot’s results, verbatim:

Handoff	Prose bytes	Packet bytes	Prose tokens	Packet tokens	Reduction
stage snapshot 1	2330	1454	614	482	21.5%
stage snapshot 2 (blocked)	2683	1685	708	571	19.4%
stage snapshot 3	4248	1769	1311	636	51.5%
task archive	2648	1559	786	556	29.3%
session handoff 1	10700	5775	2976	1692	43.1%
session handoff 2	9315	5215	2623	1667	36.4%
Total			9018	5604	37.9%

Table 4. Standalone packet results, o200k_base (the cl100k_base total is 38.1%; per-artifact agreement within 0.3 pp).

	Prose (full restatement)	Delta packet	Reduction
tokens (o200k_base)	2623	1116	57.5%

Table 5. The one delta-regime pair (n = 1): session handoff 2 re-encoded against its real predecessor with standing context carried by pinned reference, paying only for change.

Reading the pilot, as re-anchored by the evaluation: the aggregate effect was a 37.9% token-weighted reduction (1 − 5604/9018, so larger artifacts weigh more; the unweighted mean of the six per-artifact reductions is 33.5%; per-artifact range 19.4–51.5%; two tokenizer vocabularies agree within 0.3 pp) — of designer-encoded packets, which the later unit audit found only 82.7% faithful (§8.4). The per-artifact spread remains the pilot’s honest finding, now confirmed at one end and untested at the other: artifacts whose authors had already invented ad-hoc semi-structured discipline sit near an identifier floor (19.4–21.5% here; the evaluation’s 18 fresh identifier-dense samples reproduced the floor, with baseline ceilings of 11.9%/14.8% showing how little narrative tissue exists to remove), while the narrative-heavy 51.5% end was not retested. “The format’s contribution is checkability, not tokens” — the pilot’s reading of its own floor cases — is, after §8.4, this paper’s supported position for the whole corpus class. The delta regime’s 57.5% on the pilot’s single clean pair was reported as n = 1 and stays n = 1; the evaluation’s four-pair extension narrows it sharply (§8.4). An earlier draft placed an external calibration point beside the 37.9% (Salehi et al., 2025); that reading is withdrawn — a number that measures encoder skill corroborates no format magnitude (§2.1).

8.4 The evaluation: four measures, jointly

The evaluation upgrades the pilot to a protocol another party could re-run, committed before any encoding existed: a systematic corpus (every 8th stage snapshot by sorted filename from the 116-file live handoff store, no substitutions — whatever the rule yields is the corpus, including near-floor short samples — plus three real handoffs this cycle’s own run produced: a consilium facts sheet and two authoring-wave final reports; 18 samples, content digests committed in a manifest, the corpus itself not shipped per §10); four arms — an automated packet encoder (a fresh-context strong model given only the encoder specification and the completeness rule, not a format designer), compressed-prose and structured-summary baselines under the same preserve-every-load-bearing-unit instruction, and a hand arm (a format co-designer, on a 4-sample overlap subset, to measure the hand-versus-automated gap directly); and the four measures reported jointly — no axis traded silently against another. All arms are the same model family as the format’s designers; the fresh-context, spec-only setup removes design-session memory, not family style (§8.7).

Token reduction — the format-property claim is refuted. On 18 samples (source total 15,201 tokens, o200k_base; cl100k_base agrees within noise): the automated packet arm inflated tokens — 16,360 total, −7.6%, larger than its source on 12 of 18 samples (worst −25.5%) — while the same model’s compressed-prose baseline reduced 11.9% and its structured-summary baseline 14.8%, both at 100% measured fidelity. On the only fair hand-versus-automated comparison (the same 4-sample subset): hand 38.0%, automated packet 2.2%, prose 18.0%, structured summary 22.9%. The hand arm reproduced the pilot’s number almost exactly (38.0% vs 37.9%) — so the pilot measurement was not wrong; it measured designer-encoded packets, and the reduction is not a property of the format: in the one encoder pair measured, it tracked the encoder — its skill, and, as the fidelity measure below prices, its tolerated loss. The structured-summary baseline beating the automated packet on tokens, at equal-or-better fidelity, on the same sources, is the uncomfortable result and is reported as such. Three causes are separable in the per-sample data: the corpus is already compressed (telegraphic, identifier-dense; the baselines’ own ceilings show the floor); the completeness rule costs tokens when enforced by an encoder that cannot judge load-bearingness cheaply — the automated encoders routed everything questionable into typed lines, including derived and conflict lines the prose only implied (the assertion-inflation gradient of §9, observed in the wild); and BPE tokenization punishes the line DSL’s kebab-case compound values.

Semantic fidelity — the tradeoff the pilot could not see, measured for the first time. Judges extracted 437 load-bearing units from the sources, typed fact / deontic / negative-claim / unknown / identifier; an independent judging pass marked each unit preserved / altered / lost per arm, seeing one arm at a time and never the source. The automated packet preserved 99.3% (434 preserved, 3 altered, 0 lost) — the three alterations being an encoder hedge, a hyphen-mangled regex literal, and one real MUST→SHOULD modality downgrade: I5’s canonical drift, observed in the wild, produced by freehand encoding and caught by this audit’s unit-by-unit judging — which audits fieldless prose the same way; the field is what makes such drift machine-checkable after the fact, and I5’s mechanical refusal, red-proven on synthetic scenarios, has not yet fired on real content. Both baselines preserved 100% — a genuine property of the mild compression they chose, consistent with how little they compressed; whether prose is inherently more faithful is the token-matched experiment’s question. The hand arm — the one that reproduces the pilot’s 38% — preserved 82.7% (86 preserved, 17 altered, 1 lost of its 104 units): identifiers weakest (7 of 21 altered — paths and filenames collapsed to categories), one deontic force-downgrade via a misplaced uncertainty marker, and one explicit “asserted not done” conflated with a NOT-CLAIMED fence — a DSL vocabulary trap sprung on the format’s own co-designer. The token win and the completeness rule pull against each other, and the pilot’s 37.9% carried this fidelity cost unmeasured. The honest comparison the table supports is therefore not “packets are less faithful than prose” but: at near-lossless compression every format preserves everything and the packet pays more tokens; at aggressive compression the packet’s losses become measurable — and nobody measured the baselines at equal aggression. Token-matched compression across formats is the missing experiment, stated as future work, not assumed in either direction. An inter-rater check exists where the pilot had none: a second independent judge re-judged the packet arm’s two densest samples (114 units) blind to the first judge’s verdicts — 113/114 identical (99.1%), so unit judging is reproducible on this corpus.

Downstream task success — the pilot’s most important silence, closed, with a null result. Six samples (every 3rd of the sorted corpus), eight questions each authored from the source before any encoding existed (≥2 deontic, ≥1 negative-claim, ≥1 open-unknown, ≥1 precise-identifier, the rest factual; identifier questions are graded within the factual tally), one artifact per receiving agent (full source / automated packet / prose baseline), blind grading against ground truth: 144 grades, and the three arms are indistinguishable — 47 correct, 1 partial, 0 incorrect each, the one partial being the same question in all three arms. Per category, every arm scored 15/15 deontic, 7/7 negative-claim, 5/6 unknown, 20/20 factual. A packet handoff does not degrade a receiving agent’s correctness — and neither does honest prose: disciplined prose reproduced none of §1.1’s failure classes on this question set. Two qualifiers cut opposite ways: the encodings were near-lossless, so this is a ceiling effect — the experiment separates formats only at aggressive compression, exactly where the hand arm’s fidelity losses live; and the questions were authored from single sources, so they cannot exercise the format’s designed multi-context advantages (machine-checkable merge, conflict surfacing, digest-pinned dereference), which no single-handoff QA can see.

The delta regime — narrowed, structurally. The pilot’s 57.5% (n = 1) was extended to a chain of five consecutive real session handoffs of one working day, encoded full and as deltas against each predecessor: all four pairs came out longer than full re-encoding (85–95% genuinely new content per hop, plus lines spent retiring the dead threads). The narrowing is structural, not an encoding failure: the pilot’s one pair was two handoffs of the same task, where standing context dominates and pinned references replace restatement; the session chain interleaved four workstreams, so each successor dropped its predecessor’s entire subject matter. The corrected claim, stated exactly: the delta regime pays on within-task handoff chains (confirmed there at 57.5%, still n = 1) and costs tokens on interleaved multi-stream days (4/4 counter-pairs); delta bases must be scoped to a logical identifier, never to wall-clock succession. The measurement also produced the paper’s only direct quantification of the novelty bound (§8.3): 85–95% of each successor hop was content no re-encoding could compress, upgrading “nothing compresses novelty” from an argued reading to a measured one.

Jointly, the four measures say: on this corpus class the typed format buys no tokens and loses nothing downstream; what it demonstrably buys is checkability — the drift, the conflation, and the hedges above are findings only because typed units could be audited one by one. Every per-sample figure regenerates from the committed harness and manifest (§10); no sample was dropped after the draw, and encoder failures are results, per the protocol’s honesty rules.

8.5 The dogfooding and parallel-run evidence

(Re-scoped 2026-08-31, in the light of the second round: the run below was performed on a near-empty store — the 14 revisions of §8.2 — and is, since that round, this paper’s PILOT for the contract contour. A post-draft re-run of the identical four tasks against the 63-revision corpus store confirmed its admission correctness — 4/4 again, superseding this run as the correctness evidence — and contradicted its context picture: projections for the same tasks grew from 2–4 revisions to 12–13. §8.8 reports that re-run; nothing below has been rewritten in its light.)

The substrate was not only measured; it was used — the observation log’s method was to implement one element, exercise it on real work immediately, and record what held and what broke, negative findings first. Separately, the contract contour ran head-to-head against the incumbent free-orientation contour on four real, pre-declared tasks, with the success criteria committed before any measurement existed (the committed criteria file predates the measurements in history — evidence of ordering, auditable at the pin). The record:

The admission gate: 4/4, including the refusals. Each task was admitted through the ternary gate: two $\top$ verdicts (both with an existing governance constraint riding into the projection by scope intersection, with no curation step — invariant I5 as attachment, live) and two honest $U$ verdicts, each naming the missing artifact as an actionable authoring spec. Zero false $\top$: no task admitted $\top$ ever hit a missing artifact mid-task. The refusal path was proven live twice: two $U$ verdicts, each driving a research loop that closed to a $\top$ re-admission; between them the loops authored three artifacts — a provides-token succession, an authoring-capability revision (those two in one loop that ran two levels deep), and a real legacy archive lift. One prediction had to be corrected before the run: the author mis-remembered the store; the store, asked, was right.

Outcome parity, and the two findings that dent it honestly. All four tasks reached headline outcome parity with the free contour. The dents: (1) a projection truncation defect — the deterministic renderer cut an assertion value at 200 characters, mid-sentence, and the executor recovered only by reading the payload source; a projection lossier than its revision violates I12 in spirit. The parallel run caught what the test suite had not; renderer fixed, projections regenerated, parity re-verified green. (2) a secondary over-claim no gate governed: one contract-contour executor inflated a gate’s “OK + count” output into “every row exists” when ground truth was 111 exists + 4 create; the free contour, which read the rows, got it right at 1.6× the token cost. The root cause is recorded, not excused: a projection-only context reduces tokens and reduces the executor’s ability to self-correct beyond the projected claims — the unknown-is-not-zero constraint governed the primary figures, but nothing governed claims about unread data. Over-claim discipline must ride in the projection.

Tokens and focus. The contract contour was cheaper on three of four tasks (by 5%, 38%, and 11%) and costlier on the authoring task (+21% — where, per the committed parallel-run record (results-parallel-run.md, at the v2 evidence pin), the race and the two-level research loop added overhead); aggregate 235.9k versus 256.9k tokens (−8.2%), with the per-task spread as the real story. The projection’s larger, more consistent effect was focus: contract-contour executors used 3–24 tool calls against 6–53, and never wandered. Projections carried 2–4 revisions (3.7–9.4 KB) per task, each with its declared reduction rung. Recurring insufficiencies had exactly one shape — a fact nobody had asserted, most often a payload path — fixable at authoring time and now a recorded authoring pattern.

The two races, and what they say about determinism. The cycle produced two genuine concurrent-authoring collisions, on different artifacts, and the contract’s own rules decided both. In the gap-lift waves, two parallel authoring agents raced on the capability-map artifact: the second hit the first’s just-authored revision, was refused by append-only immutability (I8), never mutated, and recovered via staged succession — a second revision upgrading a byte-pinned provenance string to a digest-pinned object. In the parallel run, two authors raced on the role-developer artifact: the loser was likewise refused by I8 and never mutated, and its candidate was discarded in favor of the standing revision — no succession — after reporting four recorded judgment divergences from that revision on identical inputs: decomposition is not deterministic across same-model authors. The layer’s determinism lives where it is enforced — parity-tested compilation and double-run digests — not in authoring, and the paper claims it nowhere else.

Wrong at birth, observed. A wave-1 authored capability claim passed every gate while being incomplete against its own payload (the payload also enforced a rule the claim omitted), and steered a projection until the free contour’s wider source read exposed it. The invariants verify transfer, not birth (§9’s standing residual risk, now with a live instance): wrong content authored at encoding time is protected wrong content thereafter. The same run also demonstrated the remedy’s direction — both independent executors of a third task falsified the task’s own premise against the store, which is what exposed the instrument defect of §8.6.

What a human still had to decide. Capability enumeration per task (the gate is only as good as the declared requirements); kind/scope/modality judgment inside every authoring act; the race reconciliation; which research-loop artifact to author first. This is the I2 judgment tail, reported as the operator-facing honesty line, and none of it is automatable by the present gate.

8.6 The measurement-error episode, and its recurrence

During this work, the production repository’s own gates produced false measurements twice — the second time in the same file, after the first had been found and fixed. The episode is reported in full because it has become the paper’s strongest methodological thread: curated numbers rot, corrected curated numbers rot again, and the only discipline that held was recomputation from the declared source, in CI.

Two CI gates were written to check store integrity and document-to-graph parity. Each hand-restated the store’s root list instead of importing the canonical definition; one omitted a root holding 55 revisions and invented a root the store does not load. The integrity gate reported 56 dangling dependency edges (a fabricated figure, unrelated to §8.1’s real count of 57 unresolved declared-relation edges — a different edge class, correctly recorded), 22 revisions missing (“content lost forever,” recorded in a 22-line debt registry); the parity gate reported 60 published artifacts as ungraphed. Every “missing” revision was present the whole time; 18 of the “ungraphed” artifacts had revisions in the unread root. Both figures were fiction produced by the instrument.

The first error was caught by the substrate itself: an authoring pass that tried to mint the “missing” revisions collided with the existing ones — the append-only store refused the duplicate identifiers. The correction was structural, not procedural: the root list imported from its single definition, the false debt registry deleted, the corrected gates documenting the incident in their own docstrings — and the corrected parity count, 42 genuinely ungraphed of 125, entered this paper’s first draft as a settled figure.

It was not settled. Two-thirds of it was fiction — from the same gate, by a second error of the same class. During the parallel run (§8.5), an executor found a task’s premise false: an artifact the debt registry listed as ungraphed had two revisions in the graph. Root cause, verified in the gate’s code: the corrected form-parity-check derived every expected identifier as a fixed prefix plus the filename, ignoring the declared identifier in each artifact’s own frontmatter — 28 of the 42 “ungraphed” artifacts had their content graphed under their declared identifiers the whole time. True declared-identifier debt: 14 (8 competencies, 2 skills, 2 policies, 2 constraints — the figure used in §8.1 and §6.3). Same file, same defect class, second instance: an instrument restating (this time, deriving) an identity it should have read. The gate now reads identifiers from frontmatter and raises a tool error on absence; the debt registry was pruned with the correction recorded in place; the gate’s mutation harness was updated and re-proven; and errata were added to the specification parts that had carried the 42.

The generalization is invariant I10 — definitions exist once and are imported by pin, because a hand-copied definition is a measurement error waiting for a divergence — and the episode’s recurrence sharpens it: a corrected curated number is still a curated number. The I10 lint’s first run made the same point at scale, finding five more silent restatements of the store’s identity lists in v1-era analysis code that the first postmortem had missed (§5, I10). And the pattern reached beyond gates into this line’s own research prose: in preparing this paper and its revision, every carried count was recomputed from its declared source, and four discrepancies were found in our own prior documents, corrected here rather than repeated — a ledger file count written as 136 where the repository holds 126 at the relevant commits; a claim of overlapping capability providers where the recount finds none (§6.2); a mission brief’s “7 registered gaps” where the register holds 8; and a gap record’s “~23 requirers” where a live parse of the referenced table counts 115 rows. Every curated summary number this cycle touched was wrong until recomputed. The numbers are incidental; the defect class — restating instead of recomputing — is the one I10 exists to kill, and it appeared in our own instruments, our own analysis code, and our own research documents while we were writing about it.

We report the episode for two reasons. Methodologically, it is a worked example of mutation-proving gates: a gate whose failure mode has never been exercised is not evidence — the first save came from a write-path collision, the second from a live run whose executor checked the premise against the store instead of trusting the task text. Honestly, it calibrates how much to trust any hand-maintained number, including the ones in this paper: which is why every number here is recomputed or cited to the committed artifact that recomputes it.

8.7 Threats to validity

The pilot’s threat list is re-stated with what the evaluation did to each threat; new threats the evaluation itself introduces are added.

1. Hand-encoding by the format’s designers — no longer a threat but the explanation: the risk the pilot named (“incentive gradient toward favorable compression,” “no inter-rater check”) is exactly what the evaluation measured, and the pilot understated it — an independent encoder did not narrow the reduction, it flipped its sign (38.0% vs 2.2% on the same subset, inflation on the full corpus). Unit judging now carries an inter-rater check (113/114); encoding agreement across independent encoders remains unmeasured beyond the one hand/automated pair.
2. Selection — remediated: the evaluation corpus is a systematic every-8th draw with no substitutions, n = 18, committed before encoding. The pilot’s six remain a curated sample and are labeled historical.
3. No downstream measurement — closed, with a null result and two stated qualifiers: ceiling effect at near-lossless compression, and single-source questions that cannot exercise multi-context advantages (§8.4).
4. No baseline comparison — closed: compressed-prose and structured-summary baselines were run under the same completeness instruction, including the uncomfortable result (the structured baseline beat the packet on tokens at 100% fidelity). Token-matched baselines — equal aggression across formats — remain the missing experiment. Retrieval-augmented handoff and standard KG serializations remain unmeasured.
5. Tokenizer proxy — carries forward unchanged: two open BPE vocabularies, not the receiving models’ proprietary tokenizer; cross-vocabulary agreement bounds but does not eliminate the concern.
6. Single ecosystem — carries forward: every sample, in pilot and evaluation, comes from one organization’s workflow conventions.
7. Same model family throughout — the encoders, baselines, judges, and receiving agents are all the same model family as the format’s designers. Fresh-context and spec-only setups remove design-session memory, not family style; a same-family judge may miss losses a different family would catch. This is the evaluation’s deepest residual threat and is not mitigable from inside one family.
8. The parallel run is n = 4 with the orchestrator as adjudicator — criteria were pre-committed and per-task results are itemized, but four tasks support existence claims (the gate can refuse honestly; the loop can close), not rates. No statistical inference is attempted anywhere in this paper, and none should be read into any mean.

8.8 Added after this draft’s evaluation round: the corpus lift and the full-store re-run (2026-08-31)

This subsection postdates every result above it. The evaluation and parallel run closed at the v2 evidence pin (41c480a, 2026-08-30); what follows happened in a second round — the post-draft requirements of §9.1 implemented, then a bulk lift of the incumbent framework’s knowledge corpus, then a re-run of §8.5’s four tasks against the store that lift produced. It is appended rather than folded in, so that no earlier section’s claims silently inherit evidence that did not exist when they were written; where a result below contradicts one above, the contradiction is stated here and the earlier text stands as the record of what was claimed when.

The corpus: 41 items lifted by reading, zero refusals, two drift findings. Forty-one knowledge items of the incumbent orchestration framework were lifted into the store by five parallel authoring waves under one written protocol — every item’s full source read, and the frozen v1 archive consulted before memory. The store, 14 revisions at §8.2’s pin and 20 at the start of the lift, grew to 63 (kc2/OBSERVATIONS.md, OBS-013; the store recount from disk agrees). Thirty-nine of the 41 items had revisions in the frozen archive to lift against, and sixteen of the lifted items’ structured payloads were proven round-trip digest-exact — decomposed into assertions and recomposed to the archived payload’s exact bytes (counted from the ledger’s per-row notes). The reading discipline caught two real drift findings the lift would otherwise have laundered: one item’s live source has drifted from its archived body (declared in the residue, assertions following the live source, both digests pinned), and another’s live body has grown roughly eleven sections past its archived revision — recorded as succession debt for a deliberate later revision rather than silently folded in, because folding it in would have broken the loss detector. Across all 41 items the validator issued zero refusals — §8.2’s learning-curve observation at full scale, with its honest reading stated in place of the flattering one: on a mature protocol with worked examples in the store, the validator’s value shifts from catching errors to making the clean result provable. Zero refusals on a first wave would have been evidence of a toothless gate; zero refusals across five waves, from a gate whose refusals are mutation-proven red, is evidence about the protocol. The lift was also the first real exercise of §9.1’s placement judgment: all 41 items placed at universe level, each with a recorded one-sentence rationale; one recorded as intended for space level, blocked on the operator registration §9.1 names; zero project-level placements.

The correspondence ledger: 120 items, four verdict classes, a gate that cannot restate. The incumbent framework’s full surface is accounted for in a correspondence ledger (kc2/exit/correspondence-ledger.tsv): 120 rows, one per surface item — 43 lifted / 57 covered-by-mechanism (the item’s job is done by a substrate mechanism rather than by a lifted artifact) / 18 dropped (each with its recorded rationale) / 2 pending, both pending rows mechanism-blocked and named rather than silently open. The correspondence is not always one-to-one — the 1:N shape was needed twice on the lift’s first day (one item decomposing into a skill plus a constraint), confirming a warning recorded at design time — so rows count surface items, not lifted revisions. The builder enumerates the surface from disk and joins the live store — never a hand-maintained roster — and the gate that checks the ledger likewise reads disk and store and is itself mutation-proven red on five paths, because this line has twice been burned by an instrument restating what it should have read (§8.6); the class counts above regenerate from the rows.

Stage B: the verdicts hold and the projection degrades — C20’s at-risk prediction confirmed with numbers. §8.5’s four tasks were re-run against the 63-revision store (kc2/exit/results-stage-b.md). Admission correctness held completely: 4/4 verdicts correct, no false admissions at scale, admit time flat at ~4–5 ms. The executor’s context did not hold: projections for the identical tasks grew from the pilot’s 2–4 revisions to 12–13 revisions (107–118 assertions); one task’s rendered projection grew 3.7 KB → 33 KB (8.8×), its executor’s cost 38.5k → 50.9k tokens (+32%), and the executor’s own relevance inventory found roughly 80% of the attached governance dead weight for the task — 2 of 12 projected revisions did real work. The cause is structural, and §3.5’s own mechanism names it: governance attaches by scope intersection, {ecosystem} intersects every task scope, and the corpus added many governance revisions whose declared scope is {ecosystem} while their actual applicability lives in their values (“boundary-touching tasks,” “publishing workflows”) — and REDUCE may not remove them, because I5 protects attached governance from reduction by design. The claims inventory paired C20 with exactly this test (“measure contract-size cost of completeness”), and the claims walk carried the completeness/token-economy tension as an at-risk prediction; the bill has now arrived, with numbers. Completeness-by-intersection stands confirmed as a correctness mechanism and stands measured as a token liability at corpus scale. The recorded remedy direction is an authoring discipline plus vocabulary growth — constraints scoped as finely as their own applicability conditions, and task-class scope axes the closed vocabulary does not yet have — and it is explicitly not implemented in this cycle: silently weakening attach-by-intersection would trade away I5, and that trade is the operator’s to weigh with this paper in hand.

What survives of §8.5’s context picture. The fat-projection executor stayed at 5 tool uses and reached the correct outcome — with the honesty discipline, if anything, stronger: it carried the lifted capability’s earned limitations into its report unprompted — but at the token cost above. Focus survived; minimality did not.

Composition at scale. The three project compositions on the full store carry 392–425 assertions (241–258 KB) each — the same coarse-scope effect, wholesale. Compose stays cheap (29–41 ms), and the cache’s rebuild-versus-hit ratio (~12×) now measurably matters where at pilot scale it did not; the one real derogation of §9.1 still resolves correctly at scale — exactly one derogated entry, only in the granted project. One recount for §6.2’s ledger: the 63-revision store declares 49 capability tokens, still each provided by exactly one logical identifier — the hardness case remains vacuous at corpus scale, and R2/R3 remain unexercised in anger.

The second round’s threat profile is §8.7’s, unimproved: the same four tasks (n = 4, existence claims, not rates), the same model family throughout, and the dead-weight inventory is the executor’s own accounting, not an independent audit.

8.9 The third instrument correction: the surface itself (2026-08-31)

This subsection postdates §8.8 by a day and corrects that subsection’s own measurement frame; under this section’s stated rule, §8.8’s text stands unchanged as the record of what was claimed when, and the contradiction is stated here.

§8.8 reported the correspondence ledger as 120 rows accounting for the incumbent framework’s “full surface,” built by a tool that “enumerates the surface from disk and joins the live store — never a hand-maintained roster.” The enumeration did read from disk — from three hand-chosen directories. The framework’s real surface, derived rather than chosen, is 1257 files; the three directories the builder walked hold 237 of them (kc2/tools/build_ledger.py, docstring; row count recomputed from kc2/exit/correspondence-ledger.tsv). Every “corpus complete” claim in §8.8 was honest arithmetic over a denominator that was never the real one. The operator caught it; the instrument did not.

This is the third instance of the defect class §8.6 reports, and each instance wore a new dress: the first gates restated the store’s root list; the corrected parity gate derived identifiers it should have read; the ledger builder walked hand-chosen roots while its own description said “from disk.” All three enumerated honestly within a frame that was itself restated — which sharpens §8.6’s generalization by one clause. Recomputation from the declared source is not enough when the frame — the root set, the identifier authority, the denominator — is itself a hand-stated input: recomputation must include the frame, and the red path for the case nobody enumerated must be installed and proven, never assumed. The corrected builder and gate derive the framework root from the framework’s own structure (the parent of the commands symlink target — nothing in either tool names the root’s path), state exactly one exclusion (.git, VCS internals) with its justification, and the gate is mutation-proven to go red on a file in a directory nobody thought to enumerate — that case now draws the same MISSING_LEDGER_ROW refusal as any other (scripts/bin/kc2-ledger-check.py; kc2/OBSERVATIONS.md OBS-015, six mutation paths proven, the un-enumerated-directory case among them).

The honest numbers, recomputed from the corrected ledger: 1257 rows, one per file — 43 lifted / 142 covered-by-mechanism / 924 dropped / 148 pending. Every drop is a decision with a contents-grounded reason recorded in its row, never an omission; every pending row is visible — pending is the only default state, and none is silent. §8.8’s 43/57/18/2 stands above as what the minority frame could see.

Two findings from the classification itself, and one open problem, carried honestly. A contents-based audit of the drops re-opened 4 of the 17 audited — most consequentially, the dropped visual maps’ entity-relationship diagrams turn out to encode relational knowledge the store does not hold: the role→skill bipartite structure and the panel-membership vocabulary exist nowhere in it, and are flagged for lift as relations, not pictures. And the audit surfaced a genuine limitation of the substrate, recorded as an open problem rather than smoothed over: near-duplicate accumulation in an append-only store. I8 refuses only exact-digest duplicates and I4 only contradictions, so redundant-but-consistent content accumulates silently, and nothing in the invariant regime names it. Whether the remedy is semantic deduplication or an accepted loss is an undecided design question, stated as such (OBS-016).

8.10 The day after: the store keeps moving, and a recount that did not survive its own frame (2026-08-31)

This subsection postdates §8.9 by hours and follows the same rule: every earlier section stands as the record of what was claimed when, and this one states what moved. It exists because this paper’s own audit flagged exactly the class of figure it contains — a number true at its pin and already behind the store by the time a reader meets it.

At eb7c7e4 (2026-08-31, after a further day of requirement work — charters, supersession, restructuring, project identity, and the demotion half of the learning loop, none of which this paper describes): the refusal catalog holds 69 typed codes — the same coverage harness proves every one red, and its counter still fails on a missing scenario, so the growth from 27 arrived only through the proven-red door; the live store holds 134 revisions of 105 logical identifiers; the gate battery reports 40 gates passing with one standing environmental failure and the suite 399 tests; the correspondence ledger still holds 1257 rows, now 88 lifted / 190 covered-by-mechanism / 12 covered-by-revision / 967 dropped / 0 pending — §8.9’s 148 pending rows have all been dispositioned, and the classification grew a verdict class (covered-by-revision) that §8.9’s frame did not have.

One recount initially looked qualitative and was not — and the correction is this subsection’s most instructive content. Correction, same day (2026-08-31), before publication. A first version of this subsection reported six of the store’s 62 declared capability tokens as having more than one provider and declared §8.8’s vacuity finding overturned. The count was wrong by frame: it tallied providers per revision file, and in an append-only store a re-revised artifact then counts its own superseded revisions as alternative providers — testing held at r3, r4 and r5 of one logical identifier is one provider, not three. Recounted per logical identifier (both over all revisions and over latest-per-identifier), the 62 declared tokens are each provided by exactly one logical identifier: §8.8’s sentence stands, the hardness case remains vacuous at this scale, and R2/R3 remain unexercised in anger. The error is the fourth instance of the defect class §8.6 and §8.9 report, in a new dress again — an instrument enumerating honestly within a frame that was not the claim’s frame (first restated root lists, then derived identifiers, then hand-chosen directories, now a per-file denominator for a per-identifier claim) — and it was caught by the operator’s independent recount during pre-publication review, which is why it appears here as a correction rather than as published text.

The currency rule, stated once for every number above: this subsection is a dated record like its predecessors, not a maintained-forward figure. The catalog, the store, the battery, and the ledger each own their current values (kc2/src/kc2_defs.py, the store recount in kc2/tools/kc2_state.py, kc2/tools/run_gate_battery.sh, kc2/exit/correspondence-ledger.tsv); a reader who needs today’s numbers recomputes them from those sources — per I10, never from this text.

8.11 The fifth instance: a first run’s report read as a census of the class (2026-08-31)

This subsection postdates §8.10 and corrects a sentence §8.1 has carried since the first draft — found not by this line’s own instruments but by the operator’s refusal to accept a closure that had verified existence where the claim stated a count.

§8.1 says the five-stage v1 resolver “ran one real end-to-end resolution to the Bound state.” The store says otherwise, and said otherwise at this paper’s own v1 pin: counting resolutions whose committed bundles carry a populated BindingRecord — the record the Bind stage mints, and null exactly where a resolution’s own receipt says “no Binding Record requested” — yields twenty at 63f66b2, nineteen beyond the talo-0021 delivery run the sentence was written from: the operational resolutions under architecture/reports/ (the support-center integration, four launch-epoch resolutions, deploys, publications, a competency promotion, among others), each produced by the same five-stage pipeline against the same pinned 149-revision graph, per its own receipt. The sentence was inherited from the resolver’s delivery report — which honestly documents its own first run — and never recounted against the class it quantifies. That is the defect §8.6, §8.9 and §8.10 report, in its fifth dress: restated root lists, derived identifiers, hand-chosen directories, a per-file denominator — and now a report of the class’s first member read as a census of the class. The audit that first closed this question repeated the error in miniature: it verified that a Bound record exists and stopped, when the claim’s subject was the count; the operator’s second look forced the recount.

Two things the correction does not disturb. The v1 resolver remains history, superseded by the v2 eight-step resolver — all twenty Bound resolutions predate the freeze, and “was not exercised with fresh resolutions this cycle” stands. And the direction of the error is the unusual one: the n = 1 figure understated v1’s operational record — the resolver ran to Bound routinely, so the existence-in-motion evidence was stronger than the paper claimed, not weaker. A wrong number is a wrong number regardless of the direction it flatters; it is corrected, not kept for being modest. The count derives from the enumeration, never from this text: populated binding_record fields across the store’s committed *.bundle.json, at whichever pin the reader needs.

9. Discussion, limitations, future work

What is established. A carrier and six operations with their laws settled by proof or counterexample, four of the six algebraic structures now instantiated and law-tested; a sixteen-invariant integrity regime enforced or honestly tier-labeled by a running implementation, with every code in the refusal catalog mutation-proven red (27 at the evidence pin, 69 at the §8.10 recount); a hardness result that converts “minimal context” from a marketing claim into a banned word with a checkable, implemented replacement — exhaustion certificates included; a frozen production archive and a live dogfooded store demonstrating the storage discipline; an admission gate that refused honestly and never falsely admitted across four real tasks; and an evaluation establishing that the format’s token economy is not a format property — in the one encoder pair measured, the reduction tracked the encoder, its skill and its tolerated loss — that its fidelity is machine-auditable at the unit level, and that a packet handoff neither helps nor harms downstream correctness on single-source questions.

What is not established, stated against ourselves. (1) Token economy as a format property — refuted by our own evaluation, and no figure in this paper should be read as a format compression claim. (2) Independence of the evaluators — every encoder, baseline, judge, and receiver is the same model family as the format’s designers; nothing here is evidence about what an independent family would preserve, judge, or answer. (3) Generality — one organization’s corpus, one ecosystem’s conventions, a single-provider store on which the hardness case is vacuous today (every capability token, v1 and v2 alike, has exactly one provider; R2/R3 have never run in anger). (4) Parts of the layer itself — precedence is not yet a stored, versioned meaning object; I16’s admissibility-before-deontics gate has no bind-time consumer; I6’s transfer cross-check awaits the packet-consumer seam; the cost layer and the evidence polynomials are unimplemented (§7, §4.10). (5) Legacy content — prose-era artifacts lift only partially: the one real legacy lift decomposed six deontic rules cleanly and carried the rest as a declared residue assertion; “fully decomposable” would have been a false claim, and most of the archive is prose-era. (6) Multi-context advantages — the properties the format was designed for (checkable merge, conflict surfacing, pinned dereference) are exactly the ones a single-handoff QA cannot see; they remain measured nowhere. (7) The algebra’s laws bind implementations of this carrier; nothing is claimed about other carriers (§4.9 practices the same restraint it asks of others) — with one stated exception: Theorem 1’s construction is portable to any transfer discipline whose merge is set-union-like and whose constraint language admits a cardinality constraint, so “validate the parts, trust the whole” is unsound well beyond this substrate. The portability is argued, not exercised: no second, independent substrate has run the construction.

Costs the design imposes on itself, now with measurements attached. The escape rule (§4.11) means the format is never lossier than prose only if encoders obey it — and extraction is now the measured weakest link: the losses concentrate at encoding (17.3% of units in the hand arm), the invariants verify transfer, not birth, and the wrong-at-birth risk has a live instance — an authored capability claim that passed every gate while incomplete against its own payload (§8.5). Authoring is not even deterministic: two same-model authors produced four divergent judgment calls on identical inputs; determinism lives in parity-tested compilation, not in authoring. The closed vocabularies that make conflict detection decidable are themselves a single point of semantic failure, with one organic wrong-row instance on record (§5). Assertion granularity invites inflation — no longer hypothetically: the automated encoders routed everything questionable into typed lines and inflated their packets past their sources (§8.4); the profile-lint-distribution mitigation remains unimplemented, so the cost is currently paid, not managed.

Future work, in order of evidential leverage. (1) Token-matched compression across formats: compress the baselines as aggressively as the hand arm and audit units at equal token budgets — the experiment that decides whether the packet’s structure earns its tokens under pressure, and the one §8.4’s fidelity table explicitly cannot decide. (2) A multi-context evaluation: tasks whose answers require merging two contexts, surfacing a conflict, or dereferencing a pin — the format’s designed advantages, measurable by no single-handoff QA. (3) Independent-family evaluation: encoders and judges from a different model family. (4) The named implementation gaps, in this order: bind-time capability-envelope evaluation (I16’s gate — independently rediscovered as the top missing piece by the migration survey), precedence as a stored meaning object, I6’s transfer cross-check, then the cost layer with ledger-mined directional weights. (5) A synthetic, releasable handoff corpus in the shape of the internal one (§10). (6) The audits still owed before any publication: the convergence-register date audit and the FPF provenance audit (§10), and a re-run of the related-work search dated August 2026 (§2.3). (7) The deferred continuous geometry, if and only if its trigger condition (a continuous embedding with meaningful interpolation) is ever met.

9.1 Three architectural gaps found after this draft’s evaluation round (2026-08-30)

Everything above this subsection describes the architecture as it stood when the evaluation closed, at the v2 evidence pin (41c480a, 2026-08-30). Immediately after that close, the operator’s review of the draft identified three architectural gaps this draft did not see — none of them existed in the specification, the implementation, or any earlier section’s claims when the preceding evidence was gathered. They were recorded the same day as dated operator requirements (R-SCOPE-LEVELS, R-COMPOSITION, R-LEARNING, all 2026-08-30, in the specification’s requirements set), implemented in a follow-on cycle, and are reported here as what they are: post-draft findings, appended rather than retrofitted, so that no earlier section reads as if it had contained them.

Gap (a) — contract levels, and the specific overriding the general. Contracts exist at the level of the universe of projects, of a project space, and of the individual project — and the more specific must be able to override the more general, because the higher-level statement may be vaguer or may not fit a particular project’s character. The draft’s scope vocabulary could not represent this: the axes were a flat list, the one containment relation in the whole vocabulary was {ecosystem}-contains-everything, and below it narrowing degenerated to equality (verified in the code before the requirement was recorded, not assumed). Worse, cross-axis intersection was declared fail-closed for conflict detection — sound as far as it went — so a general and a specific assertion could collide, and nothing said which won: the system produced a ConflictRecord where an override was meant. The requirement: levels first-class and ordered by containment; specific-over-general as a structural precedence source beside §4.6’s declared order, with the priority between the two sources decided in advance rather than case-by-case; overriding visible as overridden-by with the overriding revision pinned, never deletion; and a binding/overridable distinction with teeth, so that a project cannot override a universe-level MUST-NOT by refining it — some higher-level assertions are floors, not defaults. §3.4’s recorded vocabulary overflow was this same fault line seen once; the level gap is its structural recurrence, and we widen that narrowing rather than patch it quietly.

Gap (b) — composition of the levels into one validated artifact. Attachment (Resolve step 4) collects: assertions from several scopes end up side by side in one contract. Nothing in the draft composed the levels into a single artifact per project — deterministic, digest-pinned, validated as a whole before delivery, with a justified derogation channel for a lower level’s departure from a higher prohibition (required non-empty human-authored justification; non-derogable assertions refusing every justification; the departure visible in the composed artifact), and a cache whose key covers every input to the composition, so that it can never serve a stale artifact that omits a newly added prohibition. One consequence the draft did not draw, although its own proof contains it: composition is a merge, so Theorem 1 applies directly, and whole-artifact re-validation after composition follows from the non-distributivity result this paper already proves. The corollary was there for the taking in §4.4; we state plainly that the draft did not take it — the operator’s requirement forced the question, and the paper’s own mathematics turned out to already mandate the answer.

Gap (c) — the learning loop, with authority-bounded level placement. Succession (§3.1’s id@rN) is vertical in time, not in level: an artifact improves in place, but the draft had no mechanism by which a meaning learned in one project reaches the level where it belongs — a rule discovered in one repository that in fact holds ecosystem-wide had nowhere to go, so every contract was assembled from artifacts that never improve. The requirement, stated implementation-independently because the architecture demands no more: for every candidate meaning there is a placement judgment — universe, space, or project — and that judgment must exist, be recorded (with rationale, evidence, and what generalization dropped), be bounded by authority, and be refutable (demotion and retraction are first-class, and a recorded negative result blocks re-proposal on the same evidence). Who or what performs the judgment — a human curator, a panel, or an agent — is an implementation choice, and the architecture must hold for any of them; prescribing a class of decider would date the result to a technology and confuse a policy about who may decide with a fact about what must be decided.

The generalizable safety result. The sharpest finding in the three requirements is where (b) and (c) meet, and it is not a detail of this ecosystem: a learning path that can promote derogation-derived meanings quietly repeals its own prohibitions — the project’s narrower rule “works well,” the loop generalizes it upward, and the higher-level prohibition is gone with no authority granting a repeal, no one reviewing one, and an audit trail that says “improvement.” The constraint set that closes the hole, adopted here as design law: a meaning that exists only because of a derogation is proposable, never auto-promotable; a promotion that would weaken or repeal a higher-level MUST/MUST-NOT requires the same authority as authoring that prohibition, and that authority cannot be acquired through the learning path; non-derogable assertions are non-repealable by learning. Any knowledge architecture that has both a justified-exception channel and a learning loop has this laundering path open unless it is closed by construction — and it arrives disguised as improvement.

Three mechanism findings from the follow-on implementation (recorded as they occurred; kc2/OBSERVATIONS.md, OBS-012, 2026-08-30). (1) Mutual digest-pinning between two first-class records has no fixed point: a Derogation citing its AuthorityEvent’s digest while the event pins the Derogation’s digest cannot be constructed — the third instance of this circularity class in the cycle. The lawful shape is that the journal grants: the Derogation is authored inert, and it is in force iff a live AuthorityEvent of adequate level targets it, any in-record authority field being a digest-pinned citation and never a self-contained claim — which is also what keeps the derogation channel inside I14’s authority-non-importation discipline instead of opening a cross-level hole in it. (2) Disjoint is not incomparable: the first real composition refused on a sibling project’s assertion under the specified “incomparable levels refuse” rule; sibling scopes on the same axis are in fact disjoint — decidably inapplicable, skipped — and only unknown space↔︎project membership is genuinely undecidable (refusing when the assertion is deontic). The level comparison ended with five outcomes, forced by real content. (3) The derogation is the departure record: an implementation that applies derogations only where a lower-level counter-assertion exists renders a pure grant invisible — the real grant had no counter-assertion and vanished from the composition. Compose must apply live derogations to governing entries directly, scope-matched, and surface the pin and justification in the composed artifact; a derogation that disappears into the composition is exactly the blind override the mechanism exists to forbid.

Status, in this paper’s own accounting. The three mechanisms are implemented, with 45 typed refusal codes each proven red — extending §8.2’s 27 under the same coverage discipline — the composition cache mutation-proven stale-red on five paths with the promotion path among them, and propagation tests in both directions (downward through composition, upward through promotion) with negative controls proving each can fail. One real derogation ran end to end — the one genuine operator-granted departure in the ecosystem, a written publish-unlisted grant: the universe-level prohibition composes as derogated-and-visible (pin and justification carried) for the granted project, as governing for a sibling project, and its non-derogable deployment floor stands everywhere. What is not done is named: the real-store upward round trip is blocked on two operator registrations (the space’s registry entry and its project membership; placements carry an intended_level field in the interim), and no real promotion has yet run end to end on the corpus. The corpus-scale consequences of the composition mechanism — including the projection-bloat bill — are measured in §8.8.

9.2 Shape in a typed substrate: the template question, asked and answered (2026-08-31)

Like §8.8, §8.9, and §9.1, this subsection postdates the draft’s evaluation round: the operator raised the question on 2026-08-30 as a recorded open question (OQ-1) that deliberately blocked the templates portion of the corpus lift — decide by argument before authoring, so the ontology is not settled by accident — and a recorded consilium decided it on 2026-08-31 (Consilium H, 4–0) before any of the 43 rows it governs were classified.

The question, in the operator’s words. “Is there such a notion [as templates] in the Knowledge Contract, and is that notion even needed? That is: we have a Blueprint, and that is probably enough — it will reference some template. So it is unclear to me whether we need to describe notions like templates in the paper and then in the implementation, or whether they simply enter as references inside artifacts we have already defined.” The question was not theoretical. The managed-kind roster holds seven kinds and no Template, while the incumbent framework carries 43 template files, every one of which needed a ledger row; and the Blueprint profile’s own “allowed variation” clause sits suspiciously close to what a template expresses. Three candidate answers were on the table: (A) a template is a reference — a Blueprint points at a template artifact as an opaque payload, at the cost that nothing can validate conformance to it; (B) a template is not a separate kind because it is a kind-profile — shape becomes schema, not data; (C) Template is a first-class kind with its own profile, artifacts declaring checkable conformance to it, at the cost of a new kind and the risk of re-importing the document ceremony the substrate exists to replace.

The decision method, executed rather than argued. Five steps, all run on the real corpus. (1) Sort the real 43: every template read in full and clustered by where its value lives — 11 shape-dominant, 8 knowledge-dominant, 4 runtime-state, 7 code scaffolding, 6 ceremony of already-dropped pipelines, 7 project scaffolding; residue zero. (2) The architecture’s own test, per cluster: does treating a cluster a given way let the system refuse something it should refuse — and is that refusal the substrate’s to make? (3) The Blueprint-overlap probe on real pairs: whether a Blueprint’s “allowed variation” already expresses a real template’s constraints, checked against the store’s own precedent — tal-template-artifact@r3, this line’s earlier lift, which constructively proves conformance checking at zero new kinds via profile claims plus a validated-by binding. (4) Kind-inflation cost, priced honestly: a kind is a one-way door — profile, refusal codes, red proofs, gate coverage, spec text, forever — and the roster grows easily and shrinks never. (5) The zero-residue check: whatever is chosen must classify all 43 rows with no “does not fit anywhere” remainder.

The result. In a typed knowledge substrate, “template” is not an ontological category but a bundle of separable values — shape, knowledge, executability, state, ceremony — each with a native carrier already in the substrate. Shape is schema: profile claims (elements, invariants, allowed variation) plus a digest-pinned validator bound by validated-by — exactly where the substrate owns the refusal. Knowledge lifts as Skill/Blueprint/Constraint content, and the fill-in shape around it evaporates. Executability stays a referenced payload whose conformance belongs to CI — a store refusing shellcheck-class deviations would have become a linter, a category error. State dissolves under a preemption rule applied first: under this substrate, state is the store, and the file class’s refusals migrate to store semantics. Ceremony of dropped machinery drops with the machinery. A kind names what the substrate refuses over, and templates never name a refusal the profile mechanism does not already carry — which is why candidate C fails the architecture’s own test: its promised refusal surface already ships, at zero new kinds. The managed-kind roster stays seven, and that consequence is recorded explicitly, because the roster is a closed enum with mechanical consequences everywhere.

The security corollary, and the invariant the decision minted. Declared conformance without pinned enforcement is the substrate’s principal integrity hazard, and the design refuses it structurally: a Blueprint carrying MUST-modality shape invariants must either bind a digest-pinned validator or carry an explicit recorded unvalidated waiver — absence of both is lintable and fail-closed. And the criterion itself became an invariant of roster governance: a proposed kind must demonstrate a refusal surface not reachable via existing claims plus validated-by. A recorded re-open trigger keeps the decision refutable — if a surviving shape ever needs a refusal the profile mechanism cannot carry, OQ-1 reopens with that case as evidence.

Two things the answer honestly does not carry. Element ordering is deliberately left out of the carrier: assertions remain an unordered keyed set — load-bearing for merge, diff, and succession — and ordering is stored as the one canonical opaque-payload encoding, enforced by pinned validators. The recorded Skill flip condition is the single future trigger for revisiting this: if it fires, one shared ordering facility is designed for Skill steps and Blueprint elements simultaneously — never two ad-hoc ones, and never from the weaker use case first. Instantiation semantics — what it means to fill a template and mint the resulting artifact — the substrate does not model at all; that act stays outside the carrier, stated as out of scope rather than smuggled in.

The empirical test. The criterion classified all 43 template rows with zero residue — the operator’s own fifth test, passed — and then, posed as a classifier question for every shape-carrier (“if this carrier vanished, what would the system stop being able to refuse — and is that refusal this substrate’s to make?”, state-preemption applied first), classified the full 1257-file surface of §8.9 with zero residue rows. The eight knowledge-dominant template rows served as the calibration set for borderline knowledge/shape calls, confirming a guard the consilium recorded: the criterion travels with its worked examples attached, not as a bare statement.

Per the operator’s instruction, this paper carries the question and the reasoning as the contribution, not only the outcome: “should shape be data, schema, or reference?” is a general question for any typed knowledge substrate, and the answer here — with its stated criterion, its priced costs, and its recorded re-open trigger — is offered as one worked resolution of it, not the only one.

10. Reproducibility

Reproducibility differs by artifact class, and each class is stated with what was actually re-executed for this revision and what blocks an independent party today.

Counts and enforcement claims — re-executable, and re-executed. Every v2 claim (the full refusal coverage run — 27/27 at the evidence pin, with §8.10 recording the catalog since — the invariant gates, the double-run determinism fixture, the store recount) regenerates from the committed implementation and its CI suite; the refusal harness was re-executed cleanly during this revision’s claims audit (2026-08-30). Every v1 count is fixed by the byte-freeze manifest and re-runnable identically at the pin; the v1 census and the v1 mutation harness were not re-executed this cycle, and §8.1 labels both.

The evaluation — regenerates from committed harness plus a non-shipped corpus. The protocol, the per-sample results, the measurement harness, and a manifest committing each corpus sample’s name, byte size, and SHA-256 digest are committed; the corpus itself is not (the samples are internal operational records — the standing non-release rule — so the digests pin what content the numbers were computed over without shipping it). “Anyone with repository access can re-run” therefore narrows, honestly, to “plus the corpus on the measurement host.” The v0 pilot’s two-command reproduction path stands as committed but was not re-executed verbatim this cycle.

What an independent party would need, and what blocks each item today: (1) The handoff corpora (the pilot’s six, the evaluation’s 18) are internal operational records containing hostnames, credentials context, and infrastructure detail; they cannot be released as-is. What can be released instead is a synthetic corpus in the same shape — same artifact classes, same line disciplines, same novelty-to-restatement ratios — together with the unmodified harness; constructing it is named as future work rather than claimed as done. (2) The production repository is private; the specific files, line numbers, and commit hashes cited throughout (v1 evidence at 63f66b2, v2 evidence at 41c480a) are therefore traceability anchors for an audit rather than public links; the same holds for the research repository holding the measurement corpora and harnesses and for the internal convergence/evidence register cited in §2.8. An audit bundle (the store loaders, validator, gates, census, measurement harnesses with their manifests, and the evidence register against pinned commits) could be prepared for a reviewer under agreement — and two audits are recorded as owed, not done: the convergence register’s dated entries have not been re-audited against their pinned dates this cycle, and no provenance audit of the v2 specification text against the FPF repository has been run (the attribution practice of §2.9 continued; the audit would verify it). (3) The external literature register: all arXiv, DOI, and W3C references were verified as resolvable on 2026-08-29; the Compilence Zenodo records were fetched the same day (two open, three embargoed with public abstracts); the two Compilence web pages are cited from operator-saved copies dated 2026-08-29, as the live site returned HTTP 403 to this environment on that date. The three verbatim Compilence quotations in §4.9 carry their pinpoint sources inline and are verifiable word-for-word against those saved copies. One provenance-regime note: this paper deliberately carries its external-source attribution in prose (§2.8–2.9, §4.9) rather than with the specification set’s per-claim provenance-tag discipline; the tagged claim-by-claim mapping lives in the specification parts, not here, and the choice is a recorded decision, not an omission. Citations marked “standard” in the bibliography (classical textbooks and papers) were not re-fetched.

11. Conclusion

The paper’s thesis, restated at the end at exactly the strength the evidence bears: agent-to-agent knowledge transfer can be given a typed carrier whose algebraic laws are theorems rather than assumptions, whose integrity conditions are predicates rather than exhortations — several of them strong enough that the violation cannot even be serialized — and whose necessary approximations (context reduction, conflict handling, unknown values) are forced into the open by construction: declared rungs instead of “minimal,” quarantine records instead of silent resolution, transportable unknowns instead of defaults. Both halves of that discipline now run: the storage half at modest but real scale, frozen and inherited through digest-verifying doors, and the semantic half as an implementation whose every refusal is mutation-proven and which admitted, refused, and projected real work. What the discipline earned by running is not the claim we set out to support. The evaluation it made possible refuted the transport format’s token economy as a format property and priced the completeness rule in measured fidelity; what survived is the checkability case — the four things the carrier demonstrably earns: machine-checkable fidelity after the fact (a MUST→SHOULD drift auditable unit by unit because modality is a field — the mechanical refusal itself, red-proven, has yet to fire on real content; §8.4), admission gating (no admission false, every refusal naming its missing artifact; §8.5), digest-decided concurrency (two races ended in refusal, never corruption; §8.5), and projection focus (executors that never wandered; §8.5). The most instructive moments of the whole line remain the ones where its own instruments lied and its own claims fell: twice for one gate, twice for our own headline numbers. A corrected error beats a flattered assumption; this paper has tried to be, throughout — and is now, in part, about being — the kind of document that rule produces.

---

References

Convention: items marked ⟂ are classical results cited in their standard form and not re-fetched during this work’s verification pass; all other items were verified resolvable on 2026-08-29.

• Baader, F., Calvanese, D., McGuinness, D., Nardi, D., Patel-Schneider, P. (eds.) (2007). The Description Logic Handbook, 2nd ed. Cambridge University Press. ⟂
• Bao, D., Chern, S.-S., Shen, Z. (2000). An Introduction to Riemann–Finsler Geometry. Springer GTM 200. ⟂
• Belnap, N. D. (1977). A useful four-valued logic. In Modern Uses of Multiple-Valued Logic, Reidel. DOI: 10.1007/978-94-010-1161-7_2.
• Brewka, G. (1994). Adding priorities and specificity to default logic. In Logics in Artificial Intelligence (JELIA ’94), LNAI 838, Springer. ⟂
• Buneman, P., Khanna, S., Tan, W.-C. (2001). Why and where: A characterization of data provenance. ICDT 2001. DOI: 10.1007/3-540-44503-X_20.
• Chudinov, Y. (2026a). Skill Without Training [navigation-index methodology and benchmark]. Zenodo. DOI: 10.5281/zenodo.18944351 (open, CC-BY-NC-ND-4.0).
• Chudinov, Y. (2026b). Dual-Layer SPO Architecture. Zenodo. DOI: 10.5281/zenodo.19261510 (embargoed; public abstract).
• Chudinov, Y. (2026c). Deterministic Inference Engine. Zenodo. DOI: 10.5281/zenodo.19319709 (embargoed; public abstract).
• Chudinov, Y. (2026d). Stationarity by Governance. Zenodo. DOI: 10.5281/zenodo.19367887 (embargoed; public abstract).
• Chudinov, Y. (2026e). Engineering Approximation Stack. Zenodo. DOI: 10.5281/zenodo.19337904 (open, CC-BY-4.0).
• Chvátal, V. (1979). A greedy heuristic for the set-covering problem. Mathematics of Operations Research 4(3):233–235. ⟂
• Compilence, Inc. (2026). Technology Overview; Investor Overview. compilence.com. Cited from operator-saved copies dated 2026-08-29 (live site returned HTTP 403 to this environment on that date).
• de Kleer, J. (1986). An assumption-based TMS. Artificial Intelligence 28(2):127–162. ⟂
• Dinur, I., Steurer, D. (2014). Analytical approach to parallel repetition. STOC 2014. ⟂
• Doyle, J. (1979). A truth maintenance system. Artificial Intelligence 12(3):231–272.
• Farquhar, S., Kossen, J., Kuhn, L., Gal, Y. (2024). Detecting hallucinations in large language models using semantic entropy. Nature 630:625–630.
• Feige, U. (1998). A threshold of ln n for approximating set cover. Journal of the ACM 45(4):634–652. ⟂
• Gärdenfors, P. (2014). The Geometry of Meaning: Semantics Based on Conceptual Spaces. MIT Press.
• Ginsberg, M. L. (1988). Multivalued logics: A uniform approach to reasoning in artificial intelligence. Computational Intelligence 4:265–316. ⟂
• Golan, J. S. (1999). Semirings and their Applications. Kluwer. ⟂
• Green, T. J., Karvounarakis, G., Tannen, V. (2007). Provenance semirings. PODS 2007. DOI: 10.1145/1265530.1265535.
• Jeong, S., Kim, H., Park, J. (2025). The algebra of meaning: Why machines need Montague more than Moore’s law. arXiv:2510.06559 (preprint, not peer-reviewed).
• Johnson, D. S. (1974). Approximation algorithms for combinatorial problems. JCSS 9:256–278. ⟂
• Karp, R. M. (1972). Reducibility among combinatorial problems. In Complexity of Computer Computations, Plenum.
• Kleene, S. C. (1938). On notation for ordinal numbers. Journal of Symbolic Logic 3:150–155.
• Kuhn, L., Gal, Y., Farquhar, S. (2023). Semantic uncertainty: Linguistic invariances for uncertainty estimation in natural language generation. ICLR 2023. arXiv:2302.09664.
• Lan, Q., Wen, D., Zhang, Z., et al. (2021). What is semantic communication? A view on conveying meaning in the era of machine intelligence. J. Communications and Information Networks. arXiv:2110.00196.
• Levenchuk, A. First Principles Framework (FPF). GitHub: https://github.com/ailev/FPF (repository; no license file — default copyright; cited for ideas with attribution per §2.9).
• Liang, C., Xiao, D., Li, S., Shi, J., Bennis, M. (2022). Life-long learning for reasoning-based semantic communication. IEEE ICC Workshops 2022. arXiv:2202.01952.
• Liu, X., Trager, M., Achille, A., et al. (2023). Meaning representations from trajectories in autoregressive models. arXiv:2310.18348.
• McCarthy, J. (1980). Circumscription — a form of non-monotonic reasoning. Artificial Intelligence 13:27–39. ⟂
• Merkle, R. C. (1979). Secrecy, Authentication, and Public Key Systems. PhD thesis, Stanford University.
• Barrault, L., Duquenne, P.-A., Elbayad, M., et al. (Meta AI) (2024). Large Concept Models: Language modeling in a sentence representation space. arXiv:2412.08821.
• Peyrard, M., Josifoski, M., West, R. (2024). Agentic AI: The era of semantic decoding. arXiv:2403.14562 (position paper).
• Priest, G. (1979). The logic of paradox. Journal of Philosophical Logic 8(1):219–241. ⟂
• Reiter, R. (1978). On closed world data bases. In Logic and Data Bases, Plenum. ⟂
• Reiter, R. (1980). A logic for default reasoning. Artificial Intelligence 13:81–132.
• Salehi, S., Erol-Kantarci, M., Niyato, D. (2025). LLM-enabled data transmission in end-to-end semantic communication. arXiv:2504.07431.
• von Wright, G. H. (1951). Deontic logic. Mind 60(237):1–15.
• W3C (2013). PROV-O: The PROV Ontology. W3C Recommendation, 2013-04-30. https://www.w3.org/TR/prov-o/
• Wang, Z., Wang, Y., Liu, X., Ding, L., Zhang, M., Liu, J., Zhang, M. (2025). AgentDropout: Dynamic agent elimination for token-efficient and high-performance LLM-based multi-agent collaboration. arXiv:2503.18891.
• Widdows, D. (2004). Geometry and Meaning. CSLI Publications.
• Wilson, W. A. (1931). On quasi-metric spaces. American Journal of Mathematics 53(3):675–684.
• Zhang, G., Yue, Y., Li, Z., Yun, S., Wan, G., Wang, K., Cheng, D., Yu, J. X., Chen, T. (2024). Cut the crap: An economical communication pipeline for LLM-based multi-agent systems (AgentPrune). arXiv:2410.02506.
• Kang, M., Chen, W.-N., Han, D., et al. (2025). ACON: Optimizing context compression for long-horizon LLM agents. arXiv:2510.00615.