Knowledge Contracts, Version 2: A Typed Substrate for Inter-Agent Knowledge Transfer, with Its Algebraic Laws Proved or Refuted

Relation to Version 1

Version 1 specified a conceptual architecture — Meaning Management as the lifecycle layer of task-specific semantic commitments, with the Resolver inside that layer and binding and authorization as separate subsequent boundaries — and preregistered an empirical program it explicitly had not run. Version 2 keeps that decomposition: its eight-step resolver ends at emit-or-refuse, binding remains a later boundary (its capability-envelope gate is specified and not yet implemented, and is named as such), and no semantic fit ever supplies authorization. What changed: the unit of the algebra is now the typed assertion rather than the document-level commitment; the five-stage v1 resolver is historicized as the v1 store’s mechanism (§8.1, with its operational record corrected in §8.11); and the laws are proved or refuted on the implemented carrier rather than assumed. One term is a false friend across versions: v1’s «Quarantine» is the holding state of newly ingested knowledge in Expansion; v2’s «quarantine» is the conflict mechanism that gives the minimal conflicting assertion set the verdict K while the rest of the context stays usable.

Version 1 closed with seven declared open research questions. A reader arriving from it deserves the walk, question by question, against this version as published:

1. Authority (AuthorityCut/PolicyCut, grants, delegation, revocation, segregation without hidden IAM inside the contract) — advanced, not closed: authority non-importation is enforced (I14, §5), a derogation is in force only through the authority journal and an in-record authority field is never a self-contained claim (§9.1), and the learning path cannot acquire authority (§9.1); delegation and revocation remain unmodeled, and the bind-time gate is a named NOT-YET (§5, I16).
2. Evidence (which checks suffice per type × risk) — advanced, open: confidence is a basis record (§3.3) and evidence currentness is adopted (§2.9), but the type×risk matrix does not exist and the evidence algebra is specified, not implemented (§4.10).
3. Receipt (canonicalizing identity, uncertainty, Search-Incomplete, privacy) — structurally answered: receipts are digest-identified canonical bytes (§3.5), unknowns are content, with genuinely-unknown attestations that ran live (§8.5), refusal is a first-class typed outcome (§6.1), and digest manifests pin content without shipping it (§10).
4. Falsification (what to preregister) — answered in action: the evaluation’s corpus rule and the parallel run’s success criteria were committed before any measurement existed (§8.4, §8.5), and the refutations were published as the headline; a formal preregistration registry it is not, and the text does not blur that difference.
5. Governance independence (what prevents producer self-approval) — closed in mechanism form: authority comes only from the journal, a promotion that would weaken a higher prohibition requires that prohibition’s own authority — unacquirable through the learning path — and non-derogable assertions refuse every justification (§9.1, implemented with proven-red refusals).
6. CapabilityType promotion (when does first-class status become justified) — closed as a criterion: a proposed kind must demonstrate a refusal surface not reachable via existing claims plus a pinned validator (§9.2’s minted roster-governance invariant), and any level placement of a learned meaning is authority-bounded and refutable (§9.1). An earlier revision of this page attributed the closure to the learning loop alone; §9.2’s criterion is the load-bearing half, and this sentence is the correction.
7. Composition/disclosure (cross-contract conflicts without disclosing secrets) — advanced: composition is implemented as a validated whole, with re-validation mandated by Theorem 1 and a cache key covering every input (§9.1); the disclosure half — digest manifests, reduction as data minimization (§6.3, §10) — stops short of privacy-preserving cross-contract checking, which remains open.

Abstract

Systems of cooperating LLM agents exchange state as prose. Prose handoffs lose deontic force, invert relation directions, invite readers to fill gaps with defaults, and leave a knowledge store’s internal wholeness uncheckable. We present a knowledge substrate in which the unit of exchange is a context — a finite set of typed, scoped assertions under a snapshot pin — carried on immutable, digest-pinned, append-only revisions, with every algebraic law of the transfer operations proved or refuted on this carrier rather than assumed. The substrate is implemented and mutation-tested — a refusal catalog of 27 codes at the 2026-08-30 evidence pin, each proven red and growing since only through that same door (§8.10); sixteen invariants enforced at honestly labeled tiers; the reduction ladder R0–R3 with exactness certificates — and exercised on real work: a live store grown from 14 to 134 revisions at the §8.10 recount — organic dogfooding for the first stretch, then a bulk corpus lift (14→63, §8.8) and requirements work this paper does not describe (63→134, §8.10), named as what each stretch was rather than folded under one word (an adversarial review, 2026-09-09, found “dogfooding” over-general for growth this paper’s own §8.8/§8.10 attribute to two other causes) — an admission gate 4-for-4 on real tasks, two write races decided by the append-only law, and two contour defects the run itself surfaced — a truncating renderer and an ungoverned executor over-claim. The work refutes three of this line’s own claims — two facets of the token-economy claim and one store-debt figure, the last felled by the parallel run rather than the evaluation — and narrows the delta claim; the refutations are the headline result. On a stage-snapshot-dominated corpus — session-to-session handoffs, where the pilot’s largest reductions (43.1%, 36.4%) lived, are excluded from the systematic sample and untested here — automated spec-only encoding inflates tokens 7.6% across 18 samples, while a structured-summary baseline under the same instruction reaches 14.8% losslessly on the same sources: reduction tracks the encoder, not the format, on this frame. Hand encoding lands within 0.1 percentage points of the pilot’s 38% on a 4-sample subset where the automated arm reduces only 2.2% — a single-point match against a pilot whose own per-artifact spread is about 12 points, stated as what it is rather than as reproduction. Recall of load-bearing source units — not fidelity in the full sense; this measure counts survival of what the source stated and cannot see a fabricated addition (§1.1’s second failure class), a limit an adversarial review found unstated (2026-09-09) — measured jointly: automated packets preserve 99.3% of 437 semantic units, but the hand encoding behind the 38% preserved only 82.7% — the token win and the completeness rule trade against each other, and token-matched compression across formats remains unmeasured. The delta claim narrows to within-task chains (4/4 counter-pairs); at near-lossless encoding, 144 blind downstream grades hit a 47/48 ceiling in every arm alike — no test with that little variance has the power to distinguish packet from honest prose, and none is claimed to. What the typed carrier exhibits, uncompared (an adversarial review, 2026-09-09, found “demonstrably earns” overstated — §8.7 item 4): machine-checkable recall of load-bearing source units after the fact — an observed MUST→SHOULD drift caught by the evaluation’s unit audit, checkable because modality is a field, and not a fidelity claim in the sense that would also catch a fabricated addition — admission gating, digest-decided concurrency, and projection focus. The co-evolution objection — that the corpus and its enforcing checks were built together — has two measured limits. A sensitivity replay, run in the store’s own append-only order, finds pre-enforcement source content for 10 of the 15 discriminable refusal codes; for the other 5 the objection stands, tested and unrefuted. A separate check-removal experiment finds three codes whose suppression admits a revision that subsequently crashes the unchanged Markdown renderer, with no pre-enforcement source witness for those three. This establishes necessity for that operation on those inputs, not independence of the corpus or failure of downstream LLM work. For the algebraic laws of §4 and the invariants of §5 the objection is untested — none of Theorem 1, Proposition 5, I4 or I5 is among the 26 codes the earlier 86-code sensitivity replay reached (§8.7 item 9); membership in the current replay’s 31 witnessed codes was not re-checked. What the design is not compared against is named to the same standard rather than conceded in a phrase: retrieval-augmented handoff, standard graph serializations under shape validation, and token-matched baselines are unmeasured, each carrying the result that would falsify the design. The method itself is adapted rather than invented — specification mutation and vacuity detection, credited in §2.10, where the analogy to weak-versus-strong mutation is withdrawn as wrong. A measurement instrument fabricated a number twice; only recomputation-from-source in CI held.

What this paper is for, stated so it can be quoted against us: it reports what a typed, digest-pinned substrate for inter-agent knowledge transfer exhibits, uncompared — and the measured answer is refusal, not economy.

---

1. Introduction

1.1 The problem

When one software agent hands work to another today, it writes a summary. The summary is prose: a stochastic paraphrase of the sender’s state, consumed by a reader that reconstructs meaning statistically. Three failure classes recur, and none of them is detectable by inspecting the message that exhibits it:

1. Modality loss. “Secret rotation is never automated” becomes “avoid risky operations.” A prohibition has been weakened into advice, and the receiving agent, working from the summary alone, can now do the forbidden thing in good faith. Nothing in the summary marks the loss.
2. Inferred meaning. A summary reports that 48 of 48 recovery tests passed; the reader infers that backups are verified — although the source document explicitly listed backup verification as not claimed. The prose invited an inference the source forbade.
3. Direction inversion. “Component X requires Y” and “Y requires X” land in the same embedding neighborhood; retrieval pipelines that reconstruct relations from retrieved text can invert a dependency edge with no error raised.

These are not exotic corner cases, but their evidential status differs and should be stated — and this run’s own measurements sharpened it. The two constructed examples remain constructed: the prohibition (“never automated”) and the explicit not-claimed list are quoted from real handoff records, the lossy summaries built over them. But the first failure class has since been observed in the wild — a real MUST→SHOULD downgrade produced by an automated freehand encoding into this paper’s own packet format (§8.4) — while an instructed prose baseline preserved every deontic unit at the mild compression it chose. Modality loss is therefore a property of unchecked re-encoding, not of prose per se; what prose lacks is not the ability to carry a MUST but the field that lets a checker verify it survived. The second class narrows the same way: unfenced summaries permit forbidden inference, but disciplined prose did not reproduce the failure across 144 downstream grades (§8.4) — and the one observed conflation of “asserted not done” with “not claimed” happened inside the typed format, committed by one of its own co-designers (§8.4). The third class rests on a research-phase code read: the ecosystem’s retrieval path returns text chunks with no typed edges, so nothing downstream of it can distinguish an edge from its reverse — verified at that phase’s commit and not re-verified during this implementation cycle. All three share a root cause: prose carries no typed commitments, so there is nothing for a checker to check. The same root cause operates at the level of the knowledge store: when an organization’s operating knowledge — roles, procedures, constraints, policies — lives as documents, nothing can verify that the store is internally whole (every reference resolves, every derived claim carries its justification, no conflict is silently dropped), and nothing can verify that the subset given to an agent for a task is sufficient for that task.

This matters now because multi-agent LLM systems are moving from demos to operations. Context windows are budgets; handoffs happen thousands of times a day; and the cost of a silently weakened MUST-NOT is no longer a wrong answer in a chat but an action taken in production.

1.2 The claim and the contributions

This paper’s claim is deliberately narrower than “a semantic algebra.” We claim, and support at stated strength:

A typed, digest-pinned, append-only knowledge substrate with mechanically checkable semantic invariants — implemented, with every refusal code mutation-proven — a rung-declared projection resolver run on real tasks, and a four-measure evaluation of the inter-agent transport format plus a four-task parallel run in which three of this line’s own earlier empirical claims fall — with the algebraic laws of the transfer operations proved or refuted on this carrier rather than assumed.

What “mutation-proven” claims, and what it does not. A refusal harness establishes that a named violation can be detected. It does not by itself establish that removing the check breaks a downstream task. The check-removal experiment (§8.7 item 9) separately establishes that existential result for four refusal codes on the real Markdown projection operation. The catalog-wide assertion previously made here is withdrawn. Neither experiment estimates the proportion of production tasks needing a code; probe counts are counts of executed cases, not a sample of independent workloads.

The contributions, ordered by evidential strength:

1. A law table for knowledge transfer operations, with every law proved or refuted — and now instantiated (§4). The load-bearing negative result: constraint application does not distribute over context merge — merging two individually valid contexts can produce an invalid one (Theorem 1) — from which re-validation after every merge follows as a soundness requirement, not a convention. The load-bearing positive result: merge is a join-semilattice operation (Proposition 1), which makes at-least-once delivery safe and arrival order semantically inert. Four of the six algebraic structures now have running, law-tested instances; the two that do not are labeled (§4.8). A published claim that such content forms a non-commutative semiring does not transfer to this carrier (§4.9); we locate the disagreement precisely rather than merely rejecting it.
2. Sixteen integrity invariants with checkable predicates, classified by enforcement strength — enforced or honestly tier-labeled in a running implementation (§5): schema-unexpressible (the invalid state has no serialization) > authoring-time checker > projection-time checker > runtime-only. I9’s optimality obligation is corrected from schema-only to projection-time verification in this revision; the residual NOT-YET sub-tier (I6’s transfer cross-check) is named in the table rather than smoothed over — I16’s bind-time gate, listed as a second NOT-YET sub-tier in earlier drafts of this section, is enforced (§5); an adversarial review (2026-09-09) found that update had not propagated here, violating this paper’s own single-definition discipline (I10). The classification states which guarantees an implementation can make static and which claims of static enforcement would be overclaiming.
3. An honesty mechanism for context minimization, on a problem already known to be NP-complete (§6): the dependency-free provider-cover subproblem is Set Cover under a structure-preserving renaming (Observation 1; the hardness is Karp’s). Every projection declares a reduction rung. R3 computes minimum provider cardinality within a bounded candidate set and emits a replayable search receipt. That is a scoped minimality claim, not proof of a minimum delivered context (§6.3). Rungs were declared on every live projection this cycle.
4. Two stores as existence evidence for the substrate discipline (§8.1–8.2): the v1 production store — 324 immutable revisions of 210 logical identifiers, now a mechanically frozen, read-only archive under a CI-enforced, mutation-proven byte manifest — and the live v2 store it feeds through a digest-verifying lift: 14 revisions of 11 logical identifiers grown by real dogfooding at the evidence pin (growth since is §8.10’s record), validated by a refusal catalog — 27 typed codes at that pin — each proven red against a live scenario by an executed harness, with an admission gate (knowledge admission, not authorization of the agent’s effects) run live on four real tasks (4/4 correct verdicts), two genuine concurrent-authoring races decided by the append-only law — and two contour defects the same run surfaced against us: a truncating renderer and an ungoverned executor over-claim (§8.5).
5. A four-measure evaluation of the transport format, with negative headline results (§8.3–8.4): the v0 pilot (n = 6, designer-encoded, 37.9%) is kept as the pilot; the new evaluation (18 systematic samples, four arms, 437 typed semantic units, 144 blind downstream grades, a 4-pair delta chain) refutes the token claim on both its facets — as an achieved reduction (automated spec-only encoding inflates tokens) and as a format property (a structured-summary baseline compresses losslessly where the packet inflates) — measures the recall cost the pilot could not see (the hand arm’s 82.7% behind its 38%), narrows the delta claim to within-task chains, and finds packet and honest prose downstream-indistinguishable. What survives, measured rather than asserted, is machine-checkable recall of load-bearing source units after the fact (§8.4) — recall, not fidelity: the measure counts survival of what the source stated and does not see a fabricated addition (§1.1’s second failure class) — admission gating (§8.5), digest-decided concurrency (§8.5), and projection focus (§8.5).
6. A methodological finding on measurement integrity, now with a recurrence (§8.6): the same CI gate fabricated a number twice — once by hand-restating the store’s root list (22 present revisions reported permanently lost), and, after that correction, once more by deriving identities instead of reading them (28 phantom debts in a count of 42). The episode motivates one of the sixteen invariants (single-definition-and-import), whose lint then found five more silent restatements the first postmortem missed. Curated numbers rot even after being corrected once; only recomputation from the declared source, in CI, held.

Where this work meets the two practitioner records reviewed in §2.8 and §2.9, its addition is the part neither supplies: an enforcement layer — a resolver that refuses, refusal codes each proven red by mutation, a determinism fixture run in CI — so that a borrowed distinction becomes something that can refuse.

Where it meets the methodological literature it adapts (§2.10), the claim is narrower, and stating it narrowly is the point. The mutation is not ours, nor the vacuity notion, nor the inference from a surviving mutant to an incomplete specification; the verdict lattice is Belnap’s (§2.5), and neither four-valued merge nor the conflict-versus-ignorance distinction is presented here as new. Four things are ours. The retention criterion: a law stays in a shipped specification only while it has a named production witness, and when the witness fails to appear the removal and its census are published as the result — a governance loop rather than a testing technique, and one we have not found published as an operating rule. Non-laundering enforced at a boundary: known conflict is never collapsed into mere ignorance at any projection of a content-addressed store, each such refusal carrying a typed code and a mutation witness — engineering with teeth rather than a logical novelty. The idle / unexercised / incapable distinction, claimed at the size of a paragraph and not a result (§9). And the append-only corpus, replayable in its own order, which makes the source-entry question measurable while leaving corpus independence unestablished (§8.7).

1.3 What is implemented versus what is measured

The work has four layers with different evidential status. Unless a later date is given, implementation-status statements refer to the evaluation close on 2026-08-30, commit 41c480a; they are historical observations, not a census of the 2026-09-12 implementation. The later I16 census (§5) and check-removal experiment (§8.7) identify their own pins. This date separation also applies to the implementation gaps discussed in §9.

• v1 (frozen archive): the original storage substrate — typed revisions, digests, append-only succession, 16 refusal codes, a five-stage resolver — ran in production and is now a closed, read-only archive, frozen mechanically: a SHA-256 manifest over its 346 files (324 revisions plus 22 gap records) is enforced in CI by a mutation-proven check (4/4 red paths). Claims about v1 are historical, verified against its code at the pinned commit (§8.1); its content enters v2 only through a digest-verifying read-only door and a deliberate lift that never imports authority.
• v0 (the pilot): the transport format’s first token measurements come from a research phase that re-encoded six real handoffs by hand (§8.3). The algebra’s proofs and refutations were produced in this phase and are carrier-relative mathematics; they do not depend on any implementation.
• v2 (implemented and exercised): the full semantic layer — the assertion-level meaning object, modality and scope as schema fields, the verdict lattice, the sixteen invariants as gates, the eight-step resolver with its reduction ladder, the packet form with deltas — is implemented and was exercised on real work during this cycle (§8.2, §8.5). Claims about it are backed by executed tests and gates at the pinned commit: 27 refusal codes proven red, invariant coverage labeled tier by tier, an admission gate (knowledge admission, not authorization of the agent’s effects) run live on four tasks. Where a v2 mechanism is still specification-only, it is named as such at the point of claim — the evidence polynomials’ real input, precedence as a stored meaning object, one sub-tier each of I6 and I16 (§5, §7) — per the same no-silent-narrowing rule the store imposes on its content. The cost layer itself left that list on 2026-09-15: its authoring path runs and 14 measured records are in the store, but at a scale that demonstrates rather than measures (§7).
• measured (the evaluation): the four measures — token reduction with baselines, unit-based semantic fidelity, downstream task success, delta economics — were measured jointly on a systematic 18-sample corpus with four encoding arms (§8.4), and the contract contour ran in parallel against the incumbent orchestration framework on four real tasks under pre-committed cutover criteria (§8.5). Three of this line’s own earlier claims did not survive this cycle — two facets of the token claim fell to the evaluation, the store-debt figure to the parallel run — and the paper reports the refutations as headline results, not caveats.
• not measured (authority over an agent’s effects): digest-pinned in this paper means byte integrity of an immutable revision, not the authority to act under it. A cross-repository review on 2026-10-06 found, by source review of the agent runtime’s repository (ARAS) at 62149ea (the installed binary 08533b39… is tied to that source only by its owner’s report), that the agent runtime consuming these contracts checks digest equality only: the admitted type carries no task, subject, issuer, signature or binding generation, so in source a contract issued for one task is admissible for another, and an executor-authored document would be admissible wherever the executor can set the pointer — which a proposed, unmerged route (Muneral PR #210, open draft) would let any executor do. The attack path was reasoned, not executed. A draft consumer boundary (ARAS repository PR #252, not merged) is designed, by source review only, to refuse every run until an authentic task-run authority exists; its issuer-independence check was extended after review finding A-1 to anchor the acting subject. Contract-bound effect authorization on a live agent, and revocation — a property this paper does not otherwise address — are therefore not measured; nothing in §8 should be read as evidence for them.

1.4 What v2 adds over v1 — and which absences are now closed

Since the archived system supplies the historical existence evidence, the reader deserves one crisp statement of what is genuinely new in the implemented layer. The v1 store validates artifacts: whole revisions with boolean checks. It has no representation for deontic modality (prohibitions live in English prose, with one narrow exception in structured policy rules), no scope field, no validity windows outside policies, no verdict values beyond pass/fail, no conflict records, no delta transport, and no cost model — each of these is a verified absence, not an assumption (§8.1). Every one of those absences is now a closed, implemented v2 target, the cost model included — its authoring path, its recorded weights and its competence distance all run, and what it lacks is measurement at scale rather than code (§7): modality is a schema field whose preservation check runs as a set comparison (§5, I5); scope is a closed vocabulary with declared intersection rules; verdicts are Belnap’s FOUR on the wire; conflict records are digest-pinned first-class objects; deltas apply with base-digest refusal. The cost model is the one target still mostly open — closure-size cost exists, and the cost layer of §7 is implemented but not measured at scale (§7). The v2 layer makes assertions — typed, scoped, modality-bearing statements inside revisions — addressable and checkable, which is precisely what turned the three failure classes of §1.1 from post-incident discoveries into machine-refusable states — two of the three no longer design intent but demonstrated, red-proven refusals: modality weakening refuses under I5 (the one MUST→SHOULD drift observed in the wild this cycle was caught by the evaluation’s unit audit — which audits fieldless prose the same way; the field is what makes such drift machine-checkable after the fact, and I5’s mechanical refusal itself, red-proven on synthetic scenarios, has not yet fired on real content, §8.4); unjustified inference refuses under I2’s missing-justification code; and edge reversal is representable, not blocked, by I6’s S-tier alone — an adversarial review (2026-09-09) found the original “is blocked” claim here overstated. The closed relation enum with distinct inverse members blocks free-text relations and retyping; it does not by itself stop B uses A from being asserted when the registry holds A uses B, because the reversed form is itself a well-typed enum member, not a malformed one. Catching that requires I6’s P-tier transfer cross-check against the registry, which §5 already names as NOT-YET, owed at the packet-consumer seam — the third failure class of §1.1 is representable and detectable in principle, not yet machine-refusable, and is not counted among the demonstrated refusals above. The algebra of §4 is the mathematics of that assertion layer; the proofs stand independent of implementation, and the laws bind the implementation that now exists as they will bind any future one.

1.5 Organization

§2 situates the work. §3 defines the substrate. §4 develops the algebra and its law table, including the non-transfer analysis of the semiring claim. §5 states the sixteen invariants with their implementation status. §6 gives the resolver, the hardness result, and the reduction ladder as implemented. §7 gives the cost geometry, implemented and not measured at scale. §8 is the evaluation: the frozen v1 archive, the implemented v2 layer, the historical pilot, the four-measure evaluation with its two refutations, the parallel-run and dogfooding evidence, the measurement-error episode, and threats to validity. §9 discusses limitations and future work. Two dated addenda postdate the rest of the draft and are marked as such where they stand: §8.8 (a second round — the corpus lift and the full-store re-run) and §9.1 (three architectural gaps found after the evaluation round). §10 states what reproduction requires.

2. Related work

2.1 Semantic communication

The semantic-communication literature asks why systems transmit bits when they could transmit meaning (Lan et al., 2021), and has developed knowledge-graph-based transmission in which entities, relations, and reasoning rules travel instead of text (Liang et al., 2022). The closest measured point to our pilot is Salehi et al. (2025): knowledge-graph-based compression of open text achieving roughly 30% volume reduction at 84% embedding-measured semantic similarity. An earlier draft of this paper read our pilot’s 37.9% as corroborating that magnitude; our own evaluation has since withdrawn the reading — the pilot number turned out to measure encoder skill, not the format (§8.4), so it cannot corroborate any format’s compression magnitude, and we draw no comparison in either direction (the fidelity criteria also differ fundamentally: theirs is embedding similarity; ours is unit completeness, §8.4). Our contribution to this line is not the compression figure but the transfer laws: none of these works states which algebraic properties the merge of two received knowledge fragments must satisfy, or what a receiver may infer from absence.

Agent communication languages already distinguish what a message says from the act of sending it. KQML (Finin et al., 1994, p. 96) separates content, message, and communication layers; its message layer supplies performatives while content can remain in the sender’s representation language. FIPA-ACL’s communicative-act library (FIPA, 2002, §§3.8, 5.3) specifies acts such as inform by feasibility preconditions and rational effects concerning agents’ beliefs and intentions. A knowledge contract instead specifies the retained content and the evidence a receiver can check: assertion identity, scope, modality, and snapshot-relative closure. It could be carried as content in an agent communication language. It neither replaces a conversation protocol nor establishes a sender’s sincerity by checking a digest; typed inter-agent messages themselves are not our novelty.

2.2 Concept-level modeling and semantic uncertainty

Large Concept Models (Barrault et al., 2024) show that autoregressive modeling over sentence-level embeddings is feasible at scale; their “concept” is an embedding, explicitly weaker than a typed assertion, and carries no deontic or provenance structure. Peyrard et al. (2024) frame multi-agent computation as exchange of “semantic tokens” between semantic processors — a conceptual precedent for our packets that specifies no wire format and no algebra. Liu et al. (2023) show meaning represented as distributions over continuations naturally expresses asymmetric relations; we take this as independent evidence that asymmetry is intrinsic to meaning representation (§7), discovered on a different carrier. Semantic entropy (Kuhn et al., 2023; Farquhar et al., 2024) measures uncertainty over meaning equivalence classes rather than token sequences and detects confabulation; it is diagnostic machinery on the model side, complementary to our structural machinery on the message side: semantic entropy estimates whether a claim is confabulated, our invariants make classes of confabulation unserializable in transfer.

2.3 Token economy in multi-agent systems

AgentPrune (Zhang et al., 2024) and AgentDropout (Wang et al., 2025) reduce inter-agent token cost by pruning which messages flow or which agents speak; ACON (Kang et al., 2025) compresses agent history in natural-language space. All three are orthogonal to this work, which changes what a message is. To our knowledge — and to the knowledge of a verification pass over this neighborhood performed in August 2026 — no published work combines typed, algebraically characterized message structure with a measured multi-agent token reduction; we state this as an observed gap in our search, not as a proof of novelty.

2.4 Knowledge graphs and provenance

The substrate’s assertions are typed directed triples in the RDF tradition; its provenance fields follow the shape standardized by W3C PROV-O (2013). Two database-theory results are load-bearing rather than decorative: provenance semirings (Green et al., 2007) give the algebra by which our evidence annotations compose (alternatives as $+$, joint requirements as $\cdot$), and why-provenance (Buneman et al., 2001) defines the query “which evidence supports this assertion?” that the contract makes a first-class operation (§4.10). Description-logic open-world/closed-world semantics (Baader et al., 2007) is why the substrate requires closed-world readings to be declared per list rather than assumed globally (§3.4).

Three omissions an adversarial review named (2026-09-09), added here rather than left silent. Merge $\oplus$’s operational consequences (§4.2) are, at the assertion-set level, the join operation of a state-based CRDT (Shapiro, Preguiça, Baquero & Zawirski, SSS 2011) — that line of work already characterizes when convergent replicated state exists and why join must be commutative, associative, and idempotent; Proposition 1 is this paper’s own re-derivation on its own carrier, not stated as prior when it read as new (§1.2). Content addressing over a fixed canonicalization, which §8.7’s baseline comparison treats as a design commitment this substrate carries and an off-the-shelf RDF stack does not, is closer to already standard than that comparison allows: RDF Dataset Canonicalization (RDFC-1.0, W3C Recommendation, 2024, successor to URDNA2015) is exactly a fixed, standardized canonicalization for RDF graphs, and Trusty URIs (Kuhn & Dumontier, 2014) together with nanopublications (Groth, Gibson & Velterop, 2010) already give fingerprint-verifiable, assertion-level provenance binding in standard RDF — revisited at the strength this changes the comparison in §8.7.

2.5 Many-valued logic, paraconsistency, truth maintenance

The verdict lattice is Belnap’s four-valued logic (Belnap, 1977): $\{\top, \bot, U, K\}$ with distinct truth and knowledge orders; Kleene’s strong three-valued logic (Kleene, 1938) is recovered at the specified ternary boundary projection, where the conflict value collapses to unknown (§4.7). The paraconsistent tradition (Priest, 1979) supplies the design’s response to contradiction: one conflict must not explode the knowledge base — ex contradictione quodlibet is precisely what a multi-agent store must refuse to import, so conflicts quarantine rather than poison (§4.5). Truth-maintenance systems supply the justification discipline: every derived assertion carries rule, premises, and snapshot, which is Doyle’s JTMS (Doyle, 1979) as schema; the assumption-based variant is de Kleer’s ATMS (de Kleer, 1986). (We note the attribution explicitly because an early internal draft of this work had them reversed; the correction predates every document in this line.) Non-monotonic consequence under precedence-with-exceptions is Reiter’s default logic territory (Reiter, 1980); closed-world defaults trace to Reiter (1978) and minimal-model reasoning to circumscription (McCarthy, 1980).

Two boundaries on the Belnap debt, stated because this is the most crowded ground the paper stands on. First, the four values and their two orders are his, and so is the distinction this substrate leans on hardest: his Both is our K and his Neither is our U, in his own 1977 lattice. Neither four-valued merge nor the K-versus-U separation is presented here as new, and his motivating case is this one nearly verbatim — “a sophisticated question-answering machine capable of making inferences from its data base should employ a certain four-valued logic”, so that “minor inconsistencies in its data should not be allowed to lead (as in classical logic) to irrelevant conclusions.” What this work adds is enforcement at a boundary: known conflict is never laundered into mere ignorance at any projection of a content-addressed store, and each such refusal carries a typed code with a mutation witness (§4.7, §5). Second, a contemporary neighbor reaches the same lattice from the other side. Allen, Chhikara, Ferguson, Ilievski & Groth (2025) integrate an LLM directly into the interpretation function of a paraconsistent logic’s formal semantics, with a proof-of-concept tableau reasoner that detects 92 gluts over 228 asserted and 712 inferred statements while remaining satisfiable, so that “contradictions are localized rather than causing logical explosion”. Their object is the interpretation function; ours is the projection boundary. The lattice is shared, the work is independent of ours, and we cite it as a contemporary rather than as an influence.

Belief revision and evidence aggregation solve different problems from retaining an immutable record. Alchourrón, Gärdenfors & Makinson (1985, §§1–2) characterize contraction of a consequence-closed theory by intersecting selected maximal subsets that cease to imply the removed sentence. Their revision construction seeks consistency after adding new information. Our store retains conflicting assertions and changes which ones are active through pinned suppression records (§4.6); we establish no AGM representation theorem for that process. An append-only history could implement an AGM belief state, but append-only storage alone does not make its active-state update AGM revision.

Dempster’s (1967, §1, equations 1.1–1.7) contribution to the Dempster–Shafer tradition maps a probability space into sets of possible outcomes and computes numerical lower and upper probabilities. Our FOUR values distinguish reported support, opposition, ignorance, and conflict; they carry no probability mass. The confidence basis record (§3.3) and symbolic evidence expressions (§4.10) therefore do not implement that calculus. Treating $K$ as a numeric conflict mass, or merging evidence counts as though they were independent probability assignments, would require additional assumptions and a new representation.

Dung (1995, Definitions 2, 6, 7, 20) defines arguments through a directed attack relation, admissible sets through defense against attacks, and the grounded extension as a least fixed point. Our $\#$ is symmetric incompatibility on typed assertions, followed by declared authority precedence and quarantine. For example, in an attack chain $a\to b\to c$ with no other attacks, Dung’s grounded extension contains $a$ and $c$; symmetric clash detection alone supplies no corresponding reinstatement of $c$. We neither compute Dung extensions nor claim that FOUR is a replacement for argumentation semantics.

Horty & Bench-Capon (2012, §§4–6) derive preferences between reasons from decided cases and use them to constrain later decisions under defeasible rules. Our precedence orders authority classes supplied to a resolution; it does not learn the strength of reasons from precedents. LegalRuleML 1.0 (OASIS, 2021, §§4.2.1–4.3) already represents overrides, rule strength, deontic operators, sources, jurisdiction, authority, and time. Those distinctions are not innovations of this substrate. Our claim concerns their narrower operational use in digest-pinned transfer, with explicit suppression receipts and admission checks. We do not implement LegalRuleML’s violation/reparation machinery, and a comparative encoding in that standard has not been measured.

2.6 Asymmetric distance

Quasi-metrics — distance without the symmetry axiom — are ninety-five-year-old public mathematics (Wilson, 1931). The substrate’s cost geometry is an extended quasi-metric over a directed weighted graph (§7); the continuous, direction-dependent generalization (Finsler geometry; Bao, Chern & Shen, 2000) is deliberately deferred with an explicit trigger condition rather than adopted as decoration. “Geometry of meaning” as a research program long predates current usage (Gärdenfors, 2014; Widdows, 2004).

2.7 Complexity

The hardness of minimal sufficient projection reduces from Set Cover (Karp, 1972); the greedy bound that fixes our ladder’s middle rung is Chvátal (1979) and Johnson (1974). An independent 2025 preprint (Jeong et al., 2025) also argues for compiling natural language into typed logical forms with deontic operators under the phrase “algebra of meaning”; it shares the program’s direction and none of this paper’s specific machinery.

2.8 Compilence

Compilence, Inc. describes itself, in its published materials, as building a deterministic semantic compiler for regulated environments: authoritative text compiled to a typed obligation graph (“Semantic AST”), queries answered by deterministic traversal with ternary verdicts and typed refusal diagnostics. Their published record comprises two public web pages (Technology Overview; Investors — copies saved 2026-08-29) and five Zenodo deposits (Chudinov, 2026a–e), of which two are open (DOIs 10.5281/zenodo.18944351, CC-BY-NC-ND-4.0, and 10.5281/zenodo.19337904, CC-BY-4.0) and three are embargoed with public abstracts (10.5281/zenodo.19261510, 10.5281/zenodo.19319709, 10.5281/zenodo.19367887). None of this record is peer-reviewed (a DOI is not review); we cite it as what it is.

That description of the record is complete as of 2026-08-29 and incomplete as of 2026-09-15, and the difference matters enough to state rather than to quietly repair. Compilence has announced a book series — the Semantic Science Series, whose announced volumes include Algebra of Meaning, Geometry of Meaning, Theory of Meaning, Programming of Meaning and Compiling the Meanings — positioning an algebra and a geometry of meaning as the mathematical foundation of their system. We record the announcement and decline to compare. The volumes are unpublished as of this writing, the live site returns HTTP 403 to our environment, and what we hold is a title listing. Comparing algebras requires the axioms, the carrier and the operator signatures; none of the three is available for the announced volumes, and a comparison drawn from titles would be a comparison of names. The analysis in §4.9 is therefore explicitly scoped to the published record enumerated above — it says nothing about the announced volumes, and the standing disclaimer there (“we make no claim about Compilence’s unpublished axiom system”) extends to them by construction. Should the volumes appear, this section is where the comparison becomes possible and where it will be made. The phrase itself carries no priority for either party: “geometry of meaning” and “algebra of meaning” as research programs predate both of us (§2.6, §2.7), so convergent naming is evidence of a shared lineage rather than of contact.

What this paper takes from that record is evidence and a disagreement, not constructs. Their benchmark — up to 15× fewer specification tokens per query at 97–100% accuracy on 246 questions over a 500-page specification, via a governed navigation index versus an unguided agentic baseline (Chudinov, 2026a; vendor-reported and self-published, not independently verified) — measures a different quantity from our pilot: navigation overhead eliminated on the input side, versus handoff restatement compressed on the output side. The two numbers must not be placed in one table. Our evaluation separates the two axes: output-side compression is refuted as a format property (§8.4). Input-side projection reduced tool calls to 3–24 against 6–53 for free orientation and reduced tokens on three of four tasks in the small-store run (§8.5). That result did not survive corpus growth unchanged: the full-store replay of the frontmatter-lint task increased executor tokens from 38.5k to 50.9k, approximately +32%, as coarse-scoped governance expanded its context (§8.8). These are task- and store-relative observations, not a general input-side economy result; the token figures remain inherited from the recorded executor runs rather than regenerated by the provenance gate. Compilence’s figure itself remains vendor-reported and unverified. Their published algebraic claim — that normative and factual content forms a non-commutative semiring — receives a full carrier-relative analysis in §4.9. Several design convergences reached independently on both sides (typed refusal over invention; frozen snapshots with recompile-not- retrain; validity windows on norms; “embeddings rank relevance, structure decides authority”) were documented by us with dates on both sides, in an internal evidence register available for audit — whose dated entries have not been re-audited this cycle (§10); convergence with independent provenance is evidence against derivation in either direction.

A scholarly-honesty note on boundaries: Compilence states that five components — the E.L.I.A. language, the ARC compiler, their semantic-AST construction method, their enforcement model, and their dual-layer SPO architecture — are covered by filed provisional patent applications. This work specifies none of those components and builds on none of their non-public material; every construct here traces to public mathematics (§2.4–2.7), to the authors’ own previously shipped system (§8.1), or is labeled as this line of work’s own reconstruction. Because provisional applications are unpublished, no outside party can enumerate their claims; a freedom-to-operate review by counsel would precede any commercialization, and this paper’s provenance discipline is the input such a review needs, not a substitute for it.

2.9 First Principles Framework (FPF)

FPF (Levenchuk, n.d.) is a single-author pattern language for making engineering and epistemic work explicit and checkable: a GitHub repository with no license file, no release or version tag, and no peer review, self-described as a “normative kernel” in “eternal alpha”. We cite it for its ideas, as what it is — the same register as the Compilence record (§2.8). Its own stated ancestry is standardized or reviewed work (DDD bounded contexts, ISO 42010, W3C PROV, zero-trust authorisation), and where such an ancestor exists it is cited first. One of its distinctions refuses on this substrate’s working path: capability envelopes — an ability claim without bounded conditions and measurable thresholds is unfalsifiable and refused (§5), confirmed by a mutational audit in which deleting the rule admits a named real envelope-less record with no code at all. A second is borrowed and runs everywhere without refusing: the four-layer classification (laws / admissibility / deontics / evidence) derives a layer for every assertion in the projection, while the declared-tag lints built on it were withdrawn in 2026 as unexercised and the cross-layer lints that remain are ours (I16, §5). A third is shipped with nothing to bind — the separation of a semantic correspondence (Bridge) from the bounded right to rely on it, of which the store holds zero instances. Four distinctions once recorded here as debts are not: replaying the store’s append-only order by ancestry places the required scope field, the Ambiguous refusal, validity_interval, and authority-only-via- authority-events 178 to 187 commits before FPF entered, so they are convergences with a pre-existing witness, not adoptions. What this work adds to the exchange is stated in §1.2; the license boundary and the provenance audit are in §10.

2.10 Specification mutation, vacuity, and removal as a result

For unproved engineered checks, this work proposes a retention rule: deleting a check should break a named production task. Proved algebraic laws are retained on their proofs; the implementation’s exercise is a separate question, as detailed below. The proposal adapts specification mutation (Budd & Gopal, 1985) and vacuity detection (Kupferman & Vardi, 2003), with production tasks as the killing set. The mutation is not ours, and satisfaction of the proposed rule remains a measurement obligation.

Specification mutation is named, and forty years old. Budd & Gopal (1985) measured test-case effectiveness against a specification “in a manner analogous to mutation analysis of programs”, motivated by the gap this substrate also lives in: most generation methods of the day “deal only with the program source and ignore specifications”. The line was carried into model checking by Ammann, Black & Majurski (1998), its operators cataloged by Black, Okun & Yesha (2000), and it continues (Cordy, Lazreg, Legay & Schobbens, 2023). The red-proof harnesses of §5 and §8 are an instance of it, not an invention of ours.

The nearest formal ancestor mutates proofs. Çelik, Palmskog, Parovic, Gallego Arias & Gligoric (2019) mutate Coq definitions and re-run proof checking; a live mutant — one whose proofs still pass — “may indicate specification incompleteness”, across twelve Coq libraries (tool paper: Jain et al., 2020). That inference, from a surviving mutant to an under-specified subject, is the one our harnesses make about refusal codes. What differs is the killing set: theirs a proof corpus, ours a set of executable rejection probes. Only the separate check-removal experiment (§8.7 item 9) follows admission into a named downstream task; it must not be conflated with the rejection harnesses.

The “pointwise” mutant used throughout this paper already has a name: vacuity. A property is vacuously satisfied when replacing one subformula occurrence does not change the outcome; Kupferman & Vardi ask whether all subformulas affect a specification’s truth value in the system, with Beer, Ben-David, Eisner & Rodeh (2001) the industrial line. Deleting one point of a law while the rest stands — the mutant this paper distinguishes from full deletion in every harness report — is subformula replacement renamed, and that literature owns it.

The analogy this work might have reached for is the wrong one, and is withdrawn here rather than left available. Pointwise-versus-full is not weak-versus-strong mutation. Weak mutation (Howden, 1982) concerns where the effect is observed — after the mutated statement rather than at program output — not the extent of the mutation. A wrong lineage is worse than none. The right neighbors are vacuity, above, and the higher-order and subsuming mutant literature descending from the coupling-effect hypothesis (DeMillo, Lipton & Sayward, 1978; Offutt, 1992).

What is ours is narrow: not the mutation, not the vacuity notion, and not the inference from a live mutant to an incomplete specification, but the retention criterion that keeps a law only while it has a named production witness. Catalogue-wide satisfaction of that criterion is not demonstrated by the current experiment, and NOT_MEASURED is not a reason to delete a check. The I16 withdrawal additionally established that its guarded field had no producing or consuming path. That criterion, the precedent for publishing a removal as its result, and the three-way distinction it forced are taken up in §9.

The criterion’s stated scope, made explicit (an adversarial review, 2026-09-09, found it applied inconsistently without this statement). Three of I16’s declared-tag clauses were removed under this criterion as unexercised (§5). By the same standard, Theorem 1’s re-validation in the implementation is exercised only on a synthetic conformance fixture (§4.4: “the instance is synthetic... ‘observed on real store content’ is a claim nobody can make yet”), the conflict pass enforcing I4 has never fired on real content (§6.1), and the K→U boundary projection is likewise untested on real content. These are not removed, and the asymmetry is a real policy choice, stated here rather than left implicit: a proved law (Theorem 1, Corollary 1, Proposition 5) is retained on its proof, independent of production exercise, because the retention criterion governs when a law belongs in an implemented, enforced substrate at all — I16’s clauses were never proved, only engineered — while whether the implementation of an already-proved law has been exercised on real content is a second, separate question, answered honestly and negatively for these three wherever this paper states it. The criterion removes unproved, unexercised rules; it does not, by itself, retire proved ones for want of a production witness to their implementation — but every place this paper claims a proved law’s implementation as demonstrated on real content without that witness is a claim this paper has not earned, and the honest word for each of these three is “unexercised,” used with the same weight I16’s table uses it.

3. The substrate

A framing rule for §§3–7, extending §1.3: the definitional present tense (“is required,” “refuses,” “is refused”) describes the specification, and for most of what follows the specification now has a running, mutation-tested instance — the v2 implementation of §8.2, whose enforcement status is stated invariant by invariant in §5. Where a mechanism is still specification-only, that is said at the point of claim (the cost layer’s measurement scale, §7; the evidence polynomials’ real input, §4.10; the named sub-tiers in §5), not inferred from tense.

3.1 Carrier definitions

Definition 1 (assertion). An assertion $a$ is one typed, directed, scoped statement: $$a = (\mathit{subject}, \mathit{rel}, \mathit{object},\ \sigma,\ m,\ E,\ v)$$ where $\mathit{rel}$ is drawn from a closed relation vocabulary or a claim form declared by the revision’s kind-profile — the closed, fail-closed schema stating which assertion forms a payload of that kind may carry (§5, I13) — $\sigma$ is a scope record from a closed scope vocabulary (§3.4), $m \in \{\mathrm{MUST}, \mathrm{MUST\text{-}NOT}, \mathrm{MAY}, \mathrm{SHOULD}\} \cup \{\varepsilon\}$ is an optional deontic modality (von Wright, 1951), $E$ is an evidence annotation (a provenance polynomial, §4.10), and $v \in \{\top, \bot, U, K\}$ is an optional verdict (absent $\Rightarrow U$).

Definition 2 (context). A context $\Gamma = (A, s)$ is a finite set of assertions $A$ together with exactly one snapshot pin $s$ — a cryptographic digest identifying the state of the store against which $\Gamma$’s references resolve. A knowledge contract, a resolver output, and an inter-agent packet are all contexts.

Definition 3 (meaning object / revision). A meaning object is the stored, versioned envelope that carries assertions. It is two-level:

MeaningObject (revision envelope)     — unit of storage, digest,
 │                                       succession, authority
 └─ payload
     └─ assertions[]                  — unit of the algebra, each
                                         addressable by a stable key

Figure 1. The two-level carrier. The revision is immutable and digest-pinned; change is a successor revision. An assertion is addressed externally as the pair (content digest, assertion key), which no later renaming can re-mean.

A revision carries an identity triple (logical identifier; revision identifier id@rN; content digest = SHA-256 over canonical payload bytes), a nullable-but-required predecessor reference (null means first revision — a declared value, not an absent one), digest-pinned dependencies, provenance, an authority class, and a source-trust class. Canonical bytes are sorted-key, compact-separator, ASCII, integers only — floats are refused because cross-platform float rendering is not byte-deterministic, and a digest that cannot be recomputed identically everywhere is not an identity. (Digest recomputation was exercised heavily this cycle — every archive pin verified, one round-trip digest-exact — but on a single host; the cross-platform recomputation test the rule exists for is still owed.) The store is append-only: a second record under an existing revision identifier is retrospective mutation and is refused.

3.2 Missing is not inferred

The single rule doing the most work in the substrate is a rule about absence. Every field in the envelope and the assertion is classified as REQUIRED or OPTIONAL, and:

• REQUIRED + missing = typed refusal. An envelope without a schema version is unreadable, not “assumed latest.”
• OPTIONAL + missing = $U$ (unknown), and $U$ is content: it is representable, transportable, and mergeable. A missing validity window means temporal applicability is unknown — never “always valid.” A missing confidence record means no confidence claim — never certainty. An implementation that renders a missing value as a default has manufactured meaning; this is the transfer-level generalization of a rule the v1 store already enforced for costs (“unknown is not zero”). A named open point, found by an adversarial review (2026-09-09): storing $U$ correctly is not the same as using it correctly at a boolean choice point. The resolver’s σ-filter (§6.1 step 1) drops revisions out of scope or validity — a revision with an unknown validity window must either be kept (treated as currently applicable) or dropped (treated as not), and either choice resolves $U$ to a default at the filter, even though the stored field never does. No rule for that resolution is stated here or in §6.1, and $U$’s place in a three-state join for this specific decision is not in §4.7’s verdict table, which is a different join over a different set of values. This is named as unresolved, not repaired.
• Declared emptiness is a third state. A null predecessor, an explicitly empty dependency list, an open-ended validity (until: null) are positive claims, distinct from absence, and the schema distinguishes all three states everywhere it is profiled to look — a narrowing implementation taught us: auxiliary revision bodies are unprofiled, and there the validator has almost no refusal surface, so the distinction is enforced everywhere profiled, not everywhere conceivable (§5, I13).

3.3 Confidence without floats

Confidence is a basis record, not a number: {basis: measured | declared | derived, evidence: [...], sample_count}. The rationale is normative, not aesthetic: (a) canonical bytes forbid floats, and a probability field would be the store’s first float; (b) a subjective probability with no stated method is fiction with decimals; (c) the v1 store’s working precedent is basis-tagging with receipts — its operational ledger already flags every cost figure as estimated or measured (§7, §8.1). If graded confidence is ever needed, the documented extension seam is integer rationals with a declared measurement protocol. A negative observation worth one sentence: a full implementation cycle of real use — gap lifts, the evaluation, the parallel run — never pressured that seam open; confidence stayed a basis record throughout. Two gaps in the field itself, found by an adversarial review (2026-09-09). basis: measured with sample_count carries no numerator: “measured, 300 of 300” and “measured, 0 of 300” serialize identically, so the record does not distinguish a fully confirmed sample from a fully disconfirmed one of the same size — a real limit of a non-graduated field, not an oversight this section otherwise claims to close. And no merge law is stated for two agents’ basis records over overlapping evidence: two sample_count: 3 claims over possibly-overlapping witnesses do not have a defined sum, so $\oplus$ over confidence records specifically is unspecified where it is not simply absent on one side. Renaming the field evidence_basis and stating a merge rule (or stating non-gradation explicitly, if that is the intended design) is future work, not attempted here.

3.4 Scope, and why it is required

Conflict ($\#$) and precedence ($\succ$) act in overlapping scope; if scope is prose, overlap is undecidable and conflict detection is silently disabled. The scope value is therefore a record from a closed, versioned vocabulary (ecosystem / repository / host / environment / namespace / task / epic / actor) with declared pairwise intersection rules, and the envelope’s scope field is REQUIRED with no default: “applies everywhere” must be a statement ({ecosystem}), not the absence of one. Scope also carries sense locality (adopted from FPF with attribution, §2.9): the same name in two scopes is two meanings until an explicit, evidenced, digest-pinned Bridge claims otherwise — cross-scope identity is never inferred from name equality (invariant I15, §5). List-valued claim fields additionally carry a declared closure marker (complete | open), making the closed-world reading per-list and falsifiable rather than global and assumed. In implementation the closed vocabulary survived real use with one recorded overflow: a two-repository portability case did not fit the declared axes and was encoded fail-closed rather than by improvising a value — the survival story of a closed vocabulary is its governed-extension path, not the absence of pressure on it.

3.5 The knowledge contract

Definition 4 (knowledge contract). For a pinned store snapshot $G_s$ and a task $T$ (goal, typed inputs/outputs, required capability types, bounds, scope $\sigma$), a knowledge contract is the pair $$KC(T) = \mathrm{Resolve}(G_s, T) = (\Gamma_T,\ R_T)$$ produced by the resolver of §6: the context $\Gamma_T$ — the assertion set projected from the pinned graph for the task, under $G_s$’s pin, with per-assertion verdicts, evidence, and justifications as in Definition 1 — together with a receipt envelope $R_T$ carrying the conflict records, refusals, and the declared reduction rung (§6.3), the whole frozen and digest-identified.

Two properties distinguish this from a curated reading list. First, projection granularity is the assertion: a task touching one prohibition out of a forty-line policy carries that assertion (with its revision as authority anchor), not the whole document. Second, governance attaches by scope intersection, not curation: every MUST/MUST-NOT assertion in the pinned graph whose scope intersects $\sigma$ is attached by the resolver — “forgot to select the relevant constraint” stops being a possible authoring error and becomes a checkable resolver defect. This ran live with no curation step — an existing governance constraint rode into two real task projections by intersection alone (§8.5) — and the live run also found the mechanism’s boundary: attachment governs only encoded constraints; nothing governed an executor’s secondary claims about data it had not read, so over-claim discipline must ride in the projection itself, not be assumed from governance attachment (§8.5).

4. The algebra

4.1 Operations

The substrate recognizes six operations, on three distinct carriers. The distinction of the first two is load-bearing: a single conflated “compose” operator is what makes informal algebraic claims about such systems unprovable (§4.9).

Op	Signature	Reading
$\oplus$ merge	$\mathbb{G} \times \mathbb{G} \rightharpoonup \mathbb{G}$	combine what two contexts jointly assert
$\triangleright_\rho$ attach	$\mathbb{M} \times \rho \times \mathbb{M} \rightharpoonup \mathbb{M}$	build a composite via an explicit typed relation $\rho$
$\otimes$ constrain	$\mathbb{G} \times \mathcal{C} \to$ verdict-annotated $\mathbb{G}$	apply constraints, yielding per-action verdicts
$\Rightarrow$ derive	$\subseteq \mathbb{G} \times$ assertions	closure under pinned derivation rules
$\#$ conflict	$\subseteq$ assertions$^2$	symmetric incompatibility ($\#$, to keep the relation distinct from the verdict $\bot$)
$\succ$ precedence	strict partial order on authority classes	resolves conflicts; never total

Table 1. The operation roster. ($\mathbb{G}$: contexts; $\mathbb{M}$: meaning objects; $\mathcal{C}$: constraint sets.)

4.2 Merge

Proposition 1 (merge is a join-semilattice). Fix a snapshot $s$. On contexts pinned to $s$, define $\Gamma_1 \oplus \Gamma_2 = (A_1 \cup A_2, s)$. Then $\oplus$ is associative, commutative, and idempotent, with identity $(\varnothing, s)$; i.e., contexts over $s$ form a join-semilattice with least element $(\varnothing, s)$ under $\oplus$, ordered by $\Gamma_1 \sqsubseteq \Gamma_2 \iff \Gamma_1 \oplus \Gamma_2 = \Gamma_2$ (“knows no more than”).

Proof. Immediate from the corresponding properties of set union; conflict detection (§4.5) is a function of the resulting set, not of merge order, so annotating detected conflicts does not disturb any law. $\blacksquare$

The proposition is stated at a fixed pin deliberately. Across pins, merge is defined only when the pins are equal or ancestor-related, and an ancestor-related merge is equal-pin merge after an explicit lift: the ancestor-pinned context is first re-resolved at the descendant snapshot, and a lift under which any reference resolves differently refuses rather than merging — so the algebraic laws are only ever exercised at one pin, and the proposition covers every defined case.

Operational consequences an implementation must honor, stated at the scope Proposition 1 actually proves — the assertion set $(A, s)$ of Definition 2, not the transmitted packet: arrival order of the underlying assertion set is semantically inert (re-delivery of the same assertions is a no-op, so at-least-once transport of assertions is safe), and a merge in which the last writer wins on overlapping assertions is defective, not a design choice. Merge across unrelated snapshots refuses with a typed refusal: that is exactly where “same words, different meanings” enters a system, and the substrate makes it unrepresentable rather than inadvisable. There are no inverses: nothing removes an assertion by merging; retraction is a separate journaled act. Implementation status: the semilattice laws are enforced as tests and the unequal-pin refusal is proven red (MERGE_SNAPSHOT_MISMATCH); the ancestor-lift protocol is implemented but was not exercised on a real divergent resolution this cycle — demonstrated refusal, implemented-but-unexercised lift.

What this does not cover, found by an adversarial review (2026-09-09). The packet actually carried on the wire (§8.3) is not the pair $(A, s)$: it also carries conflict records, delta lines, evidence pointers, and refusals (§8.3), and its suppression entries are never deleted (§4.6) once surfaced. Proposition 1 proves the assertion set’s arrival-order inertness; it says nothing about this accompanying record trail, and the record trail’s own construction (§4.6, step 5 of §6.1) is a single pass over whatever governance set has accumulated at the time it runs — run twice, on two different accumulations of the same underlying assertions, it can surface a conflict record on one path that a single pass over the union would never have created, and “never deleted” then carries that record forward. Concretely: pin $s$, $\Gamma_1 = \{x:\top@A_1\}$, $\Gamma_2 = \{x:\bot@A_1\}$, $\Gamma_3 = \{x:\bot@A_2\}$, $A_2 \succ A_1$. Marking $\Gamma_1 \oplus \Gamma_2$ first finds two incomparable same-authority assertions on $x$ and surfaces a conflict record $R_{12}$; marking again after $\oplus\,\Gamma_3$ finds $A_2$ wins outright and adds a suppression entry, but $R_{12}$ survives (“never deleted”) — the receiving packet carries $\{R_{12}, S\}$. Marking $\Gamma_1 \oplus \Gamma_2 \oplus \Gamma_3$ in one pass sees only the outright win and produces $\{S\}$. The assertion sets and the final verdict agree (Proposition 1, Proposition 5); the record trail a consumer reading conflict records would see does not. This paper does not prove the record trail is arrival-order independent, and the counterexample above shows it is not, in general, without a marking discipline stated to be a single canonical pass over the full accumulated context rather than a per-arrival accumulation — which is not yet specified. “Arrival order is semantically inert” therefore holds for the assertion set an implementation ends up with, not for the conflict-record trail a consumer reads alongside it; a consumer that branches on the presence of a specific conflict record, rather than on the final verdict, is reading a value this paper has not shown to be order-independent.

4.3 Attachment

Attachment $\triangleright_\rho$ — building a composite by applying one meaning to another in a typed role (“deploy to production”) — is a family of partial operations indexed by the closed relation vocabulary, with domain/range typing making ill-typed attachments refusals.

Proposition 2. $\triangleright_\rho$ is non-commutative by construction ($A \triangleright_{\mathrm{uses}} B \neq B \triangleright_{\mathrm{uses}} A$: the reverse edge is false, not merely absent), and associativity is not well-posed across distinct relation indices $\rho, \rho'$ (the two bracketings have different types). Where both sides are defined — composition of typed graph paths — composition is associative with empty paths as identities: typed relations form a small category of graph paths.

The direction of every relation is meaning. This is where the non-commutativity that genuinely exists in meaning lives — a point that becomes load-bearing in §4.9. The typing discipline has a live example: during the first archive lifts, a real source relation (refines) fell outside the closed nine-relation enum and was refused rather than silently coerced — encoded as the weaker related, with the loss of refinement direction recorded, because a tenth relation is a governed enum change, not a unilateral mid-lift decision (§8.5).

4.4 Constraint application, and the central negative law

Constrain $\otimes$ applies a constraint set to a context and yields per-action verdicts. Pure constraints act by intersection on admissible states and are order-free; overrides and exceptions must be expressed only through declared precedence $\succ$, never through application order — an implementation that folds constraints left-to-right and lets the later one win has made message timing semantically load-bearing.

Call a constraint pointwise if its satisfaction is a function of each single assertion in isolation, and global otherwise (cardinality constraints, mutual exclusion, resource budgets, declared-exclusion pairs). For a context $\Gamma$ and constraint set $C$, write $\mathrm{verdict}(\Gamma, C) = \top$ if $\Gamma$ satisfies every constraint in $C$ and $\bot$ otherwise — the context-level admissibility verdict, the coarsest projection of $\otimes$’s per-action output and the one an orchestrator acts on.

Theorem 1 (verdicts are not compositional). Let $V = \{\top, \bot, U, K\}$. For every at-most-$k$ cardinality constraint with $k \geq 1$, and every at-least-$k$ cardinality constraint with $k \geq 2$ — call this set $c$ — no function $f : V \times V \to V$ satisfies, for all snapshot-compatible contexts $\Gamma_1, \Gamma_2$: $$\mathrm{verdict}(\Gamma_1 \oplus \Gamma_2, \{c\}) \;=\; f\big(\mathrm{verdict}(\Gamma_1, \{c\}),\ \mathrm{verdict}(\Gamma_2, \{c\})\big).$$ In slogan form: merging two individually valid contexts can yield an invalid one, so $\otimes$ does not distribute over $\oplus$ — for these constraints, not for every cardinality constraint: at-most-$0$ and at-least-$0$ are constant, and at-least-$1$ composes by disjunction (see the Remark). An adversarial review (2026-09-09) found the original “any cardinality constraint” quantifier false against the theorem’s own Remark; this restatement is the fix, not a weakening chosen for convenience.

Proof. Take $c$ = “at most one assertion in the context satisfies predicate $P$” (the $k=1$ at-most instance; the operational instance in the source ecosystem’s workflow rules is “at most one agent lane may touch production state concurrently”). Let $a_1, a_2$ be distinct assertions satisfying $P$ and $b$ an assertion not satisfying $P$. With $\Gamma_1 = \{a_1\}$, $\Gamma_2 = \{a_2\}$: both part-verdicts are $\top$, and $\mathrm{verdict}(\Gamma_1 \oplus \Gamma_2, \{c\}) = \bot$. With $\Gamma_1' = \{a_1\}$, $\Gamma_2' = \{b\}$: both part-verdicts are again $\top$, and $\mathrm{verdict}(\Gamma_1' \oplus \Gamma_2', \{c\}) = \top$. Any candidate $f$ must map $(\top, \top)$ to both $\bot$ and $\top$; no such function exists. $\blacksquare$

The same shape generalizes to every at-most-$k$, $k \geq 1$ (take $k$ assertions satisfying $P$ against $k{+}1$), and to every at-least-$k$, $k \geq 2$ (take two disjoint $(k{-}1)$-satisfying sets, each individually $\bot$, whose union satisfies at $2(k{-}1) \geq k$; against one $(k{-}1)$-satisfying set unioned with a non-satisfying assertion, still $\bot$ — the two unions force $f(\bot,\bot)$ to be both $\top$ and $\bot$). At-least-$1$ is excluded from this family on purpose: it composes by $f = \vee$, which is exactly the Remark’s example.

Remark. The same two-pair construction goes through for mutual exclusion, resource budgets, and declared-exclusion pairs: each admits one pair of individually satisfying contexts whose union violates and another whose union satisfies. Not every global constraint is non-compositional — “the context is nonempty” ($P = \top$, at-least-$1$) composes by $f = \vee$, and “no assertion satisfies $P$” (at-most-$0$) composes by $f = \wedge$ — the theorem’s restated quantifier already excludes both; the force of the theorem is that the constraints it does cover are ubiquitous, and that compositionality is therefore a property to be proved per constraint, never assumed of a constraint class.

Corollary 1 (re-validation is a law). A sound implementation must re-validate after every merge, or statically prove that every in-scope constraint is compositional (pointwise constraints are; a global constraint needs its own proof). An orchestrator that lets each sub-agent validate its own output and then merges “all-green” results has, with any non-compositional constraint in scope — cardinality, exclusion, budget — an unsound pipeline: the exact class of failure where two individually approved production changes collide.

The phenomenon is standard in constraint satisfaction; the contribution is its statement as a wire-protocol law with an attached counterexample, in a setting where the tempting unsound shortcut (per-part validation with verdict recombination) is the natural engineering default. Notably, the v1 system already contained the pairwise instance as an implementation detail: its exclusion-conflict check iterates over the selected set, refusing to compute that verdict per-candidate (§8.1). The theorem elevates the behavior to a law of the contract, and the v2 implementation adopts both halves: constraint application is whole-context (re-validation after merge is the implemented rule, and the resolver re-validates after REDUCE, §6.1), precedence enters only as a declared strict partial order that refuses totalization, and Theorem 1’s counterexample is encoded as a conformance fixture — two individually-⊤ contexts whose merge is ⊥, demonstrated in the test suite. One honesty note attaches to that fixture and is kept verbatim from the observation log: the instance is synthetic. No archive revision carries a non-empty exclusion list (verified by recount), so v1’s own exclusion-conflict refusal has never fired on real content either; the law is proved and implemented, but “observed on real store content” is a claim nobody can make yet.

4.5 Conflict

Conflict $\#$ is symmetric and irreflexive, generated by modal clash on one action and overlapping scope, declared exclusions, and value clash on single-valued fields. (The relation is written $\#$ to keep it distinct from the verdict $\bot$.)

Proposition 3 (conflict is not transitive). There exist $a, b, c$ with $a \mathrel{\#} b$, $b \mathrel{\#} c$, and $\neg(a \mathrel{\#} c)$. Proof. Let $a$ = “replication is synchronous,” $b$ = “replication is asynchronous-only,” $c$ = “recovery-point objective < 5 s.” Then $a \mathrel{\#} b$ (a topology cannot be both, a modal/value clash the implemented relation recognizes directly), and $b \mathrel{\#} c$ (asynchronous-only excludes the objective — a domain inference an adversarial review, 2026-09-09, found is not itself one of $\#$’s three implemented generators: modal clash, declared exclusion, or single-valued-field value clash; making $b \mathrel{\#} c$ hold in the implementation requires it to be registered as a declared exclusion pair, which this proof does not state), but $a$ and $c$ are compatible (synchronous replication satisfies it). The mathematical claim — non-transitivity of some symmetric irreflexive relation with these three generators — is established regardless; whether this specific $b \mathrel{\#} c$ is a witness the running system would itself produce is not, and is named here rather than assumed. $\blacksquare$ Remark. Relabeling the same witnesses (take $b, c$ = the two compatible assertions) shows the complementary configuration $a \mathrel{\#} b$, $\neg(b \mathrel{\#} c)$, $a \mathrel{\#} c$ as well: incompatibility of pairs is a property of pairs, and neither closure nor anti-closure under chaining holds.

Code that clusters “conflict components” transitively will quarantine innocent assertions. On detection, conflicts quarantine rather than poison: the minimal conflicting assertion set receives verdict $K$ and a mandatory, digest-pinned conflict record; the rest of the merged context stays usable. The paraconsistent rationale (§2.5) has an operational face: a fleet-wide halt because two agents disagree about one fact is a denial of service on the pipeline. Whole-context poison remains a sound over-approximation (it refuses strictly more) and is a permitted interim implementation; what is forbidden at every phase is silent dropping or auto-resolution. The implemented conflict pass is the conforming instance of Proposition 3’s warning: pairwise detection with digest-pinned conflict records, no transitive clustering, and an unciteable $K$ proven unserializable (INVALID_CONFLICT_UNCITED, red). No real-store conflict has yet exercised the pass in anger, so how well minimal conflicting sets compute in practice remains an open observation, stated as one.

4.6 Derivation and precedence

Derivation $\Rightarrow$ is closure under pinned rules (dependency closure, typed-relation traversal, governance attachment). It is reflexive and transitive, but not antisymmetric (two distinct revisions can be mutually derivable — a projection and its source assert the same content — so $\Rightarrow$ is a preorder, and “deduplicating” one direction loses the projection link). The preorder argument is mathematics; no mutual-derivability case arose in real content this cycle, so the dedup-loses-the-link consequence remains argued, not exercised.

The substrate’s conflict-resolution rule (used again in the precedence discussion below): if $a \mathrel{\#} b$ in overlapping scope and $\mathrm{auth}(a) \succ \mathrm{auth}(b)$, then $b$ — and every derivation resting on $b$ — is suppressed in that scope, recorded as a suppression entry, never deleted. Write $\Gamma \vdash x$ for “$x$ is in the surviving (post-suppression) derivation closure of $\Gamma$.”

Proposition 4 (non-monotonicity under precedence). With pure monotone rules, $\Gamma \subseteq \Gamma'$ implies that $\Gamma \vdash x$ entails $\Gamma' \vdash x$. Under the suppression rule, monotonicity fails: there exist $\Gamma \subseteq \Gamma'$ and $x$ with $\Gamma \vdash x$ but $\Gamma' \nvdash x$. Proof. Let $p$ be an authored assertion and $r$ a pinned derivation rule with $\{p\} \vdash x$, where $x$ carries the deriving authority class $A_1$. Let $q$ be an authored assertion with $q \mathrel{\#} x$ in $x$’s full scope and $\mathrm{auth}(q) = A_2 \succ A_1$. For $\Gamma = \{p\}$: $\Gamma \vdash x$. For $\Gamma' = \{p, q\}$: the closure derives $x$, the conflict pass finds $q \mathrel{\#} x$ with $A_2 \succ A_1$, and the suppression rule removes $x$ from the surviving closure, so $\Gamma' \nvdash x$. $\blacksquare$ Remark. This is prioritized defeasible reasoning: defaults in Reiter’s (1980) sense, with the priority mechanism in the tradition of prioritized default logic (Brewka, 1994); the proposition is proved here directly against the substrate’s own suppression semantics.

Consequence, adopted as schema and now enforced: every derived assertion carries its justification — rule identifier, premise identifiers, snapshot digest (the JTMS discipline; Doyle, 1979) — and a context containing a derived assertion without its justification is invalid (invariant I2; the derived-without-justification state is unserializable and its refusal proven red, and the lift path refuses to infer judgment fields rather than defaulting them). A derivation is valid only relative to its pinned snapshot; snapshot pinning is not hygiene but what makes derivation cacheable at all under defeasibility — though the cacheability consequence itself stays argued: no cache-invalidation-on-pin-change test is yet recorded. Proposition 4’s suppression semantics are likewise instantiated, with tests, in the implemented conflict pass.

Precedence $\succ$ is a strict partial order on authority classes and must not be totalized. When two conflicting assertions carry incomparable authority, the correct output is verdict $K$ plus a surfaced record requiring an authority decision. Inventing a tie-break (file order, timestamp) is a defect; a tie-break is itself a meaning object — declared, versioned, and cited in the resolution record. The implementation enforces the order semantics — precedence is applied only as a declared strict partial order, refusal to totalize is tested (an irrelevant declared pair does not order the real parties) — but precedence is today a declared call input, not yet the stored, versioned meaning object the previous sentence demands; that half is carried as a named honest gap, exactly as the observation log records it.

4.7 Verdicts

The verdict set is Belnap’s FOUR $\{\top, \bot, U, K\}$ with two orders — the truth order and the knowledge order ($U \le_k \top, \bot \le_k K$):

        K   (told both: conflict)
       / \
      ⊤   ⊥        knowledge order  (↑ = knowing more)
       \ /
        U   (told nothing)

Figure 2. The knowledge order of the verdict lattice.

Proposition 5 (verdict merge). Per-assertion verdict merging is join in the knowledge order: $U \vee_k v = v$; $\top \vee_k \bot = K$; $K \vee_k v = K$; $v \vee_k v = v$. $(\{\top,\bot,U,K\}, \vee_k, U)$ is a bounded join-semilattice, so verdict merging is commutative, associative, and idempotent, and inherits every $\oplus$ law of Proposition 1. Proof: the knowledge order is a lattice order on FOUR (Belnap, 1977); join exists and has the stated table by inspection of the Hasse diagram. $\blacksquare$

This single line is the formal content of “two agents disagree ⇒ the disagreement is computed and surfaced, never averaged, never last-writer-won.” $U \vee_k v = v$ is exactly “learning something replaces not knowing.” Two disciplines make FOUR safe in engineering practice (they answer a real objection — a consumer branching if verdict == T mishandles $K$ silently): verdicts are a closed enum with exhaustive match required, and the only exported “proceed” predicate is $\mathrm{actionable}(v) \iff v = \top$ — a consumer reading only actionable sees a fail-closed boolean projection and cannot mishandle $K$, which is simply not actionable. (Kleene’s three-valued logic proper appears at the ternary boundary projection below, where $K \mapsto U$ collapses FOUR to $\{\top, \bot, U\}$.) Crucially, verdicts are not truth-functional over context composition (Theorem 1); the bilattice governs merging opinions about one assertion, never deriving a composite’s verdict from part verdicts.

For interoperation with ternary-verdict systems, the layer includes a lossy-but-honest boundary projection (implemented): $K$ exits as $U$ plus a mandatory digest-pinned conflict-record pointer, and a boundary $U$ carrying neither a conflict pointer nor a genuinely-unknown attestation is invalid — known conflict is never laundered into mere ignorance. The whole discipline ran live this cycle: the lattice and knowledge-join are implemented per Proposition 5, and the proceed-only-on-$\top$ predicate governed four real task admissions — 4/4 correct, zero false $\top$, with two honest $U$ verdicts that triggered research loops instead of proceeding, each carrying a genuinely-unknown attestation naming the missing artifact (§8.5). Ignorance was attested, not laundered; that sentence is now a demonstration, not a design intent.

4.8 What the structure is — and is not

The meaning layer is six interlocking structures, each individually standard: (S1) contexts under merge form a join-semilattice with least element; (S2) typed relations form a small category of graph paths; (S3) verdicts form the Belnap bilattice (the two orders are Belnap’s, 1977; the bilattice terminology is Ginsberg’s, 1988); (S4) constraints form an antitone operator family resolved by a strict partial order, non-monotone once defaults enter; (S5) path costs form a tropical (min-plus) semiring over a directed graph (§7); (S6) evidence composes as provenance-semiring annotations (§4.10). Naming the standard structures is deliberate: each name imports known theorems and known implementations, and the honest inventory replaces a single exotic algebra that would have to be built and debugged from scratch. Implementation splits the inventory four to two: S1–S4 have running, law-tested instances (snapshot-gated semilattice merge, the typed-relation enum with inverse pairs, the Belnap lattice with knowledge-join and boundary projection, the whole-context constraint family with declared precedence); S5 and S6 — the tropical cost semiring and the provenance evidence semiring — remain specified only, and every later mention of them carries that label (§4.10, §7).

4.9 A carrier-relative non-transfer result

Compilence’s published materials state: “Normative and factual content forms a non-commutative semiring” (Technology Overview, Ch. 07; operator-saved copy, 2026-08-29), with four operator examples published and “full axiom systems … in the monograph” (Technology Overview, ibid.; the monograph unpublished as of this writing). Since a semiring requires a commutative additive monoid, a multiplicative monoid on the same carrier, two-sided distributivity, and an annihilating zero (Golan, 1999), the claim is checkable against any concrete carrier. This is a remark on operator attribution, not a theorem (an adversarial review, 2026-09-09, found the original “fails in two structural, proved ways” framing overstated: point 1 below is a type-level observation, not a proof, and point 2 is Theorem 1 cited under a second name, not an independent structural failure). On this paper’s carrier:

1. There is no second monoid on the carrier. Constrain $\otimes$ has signature $\mathbb{G} \times \mathcal{C} \to$ verdicts, not $\mathbb{G} \times \mathbb{G} \to \mathbb{G}$; the two operations do not share a carrier — a type-level absence, checkable by reading the signatures in Table 1, not a result requiring proof. Because $\otimes$ has no matching carrier, “does $\otimes$ distribute over $\oplus$” is not a well-typed question for this algebra in the semiring sense — there is no second $\mathbb{G} \times \mathbb{G} \to \mathbb{G}$ operation for distributivity to hold or fail of.
2. The closest available analog is non-compositional (Theorem 1) — restated here, not a second, independent failure: Theorem 1 already shows $\otimes$’s verdict does not distribute over $\oplus$ in the compositionality sense that theorem defines, which is the only sense in which this point adds anything past point 1.

A third point is diagnostic rather than a further failure, and it survives independently of the two above: merge $\oplus$ — the only knowledge-combination operation on contexts — is commutative here (Proposition 1). By itself that cannot defeat a claim about their additive operation; what it supports is the attribution diagnosis below — their sole published additive example is not, on this carrier’s operator inventory, knowledge combination at all.

The scope of this result is stated precisely, and we ask that it not be read as broader than it is: we make no claim about Compilence’s unpublished axiom system. We show that on our carrier, the semiring laws as published do not hold, and that their sole published motivating example is naturally read, on this carrier’s operator inventory, as typed attachment rather than merge — narrowing any real disagreement to which operation carries non-commutativity, a question their published materials do not settle. Their published additive example — “delegation under scope is not symmetric with scope under delegation” (Technology Overview, Ch. 07; operator-saved copy, 2026-08-29) — describes role-indexed composition of concepts into derived concepts, which on this carrier is the operation named $\triangleright_\rho$, non-commutative in this paper’s own law table (Proposition 2). The apparent head-on collision therefore dissolves into an operator-attribution question: what their published examples exhibit as the additive operation is what this algebra splits off as attachment; the knowledge-combination operation this algebra calls merge does not appear among their published examples at all. Both accounts agree that meaning carries real non-commutativity; the carrier-relative theorem is that it does not live in knowledge combination. Similarly, their published annihilator (“once poison enters a derivation, conclusions built on it are structurally blocked” — Technology Overview, Ch. 05; operator-saved copy, 2026-08-29) reads as blocking the derivation cone — compatible with this paper’s quarantine semantics, not a whole-context poison; an earlier internal reading of ours construed it more broadly, and we record the correction.

One thing has changed since this analysis was first written: the carrier is no longer only specified. The operations the two counterpoints and the diagnosis rest on now run — merge is implemented commutative and snapshot-gated, no second monoid appeared in implementation, and the distributivity failure is an executed conformance fixture — so the non-transfer result holds of an implemented algebra, not a paper one.

Why this section exists at all: our prediction is that code written against the semiring picture will implement exactly the two unsound shortcuts the laws forbid — order-sensitive merge, and per-part validation with verdict recombination — both silent-drift defects. The prediction is falsifiable (build a semiring-style prototype, run it against this law table’s conformance suite) and untested: no such prototype was run, and the interpretive half stays untestable while the counterparty’s axioms are unpublished. Semirings do appear legitimately in exactly two subsystems (costs, S5; evidence, S6), and only there — both, today, specified rather than implemented. The methodological point generalizes beyond this one claim: when comparing knowledge algebras, operator attribution — which operation a law is claimed of — is as load-bearing as the law itself, and a law table over a concrete carrier is the instrument that localizes such disagreements instead of letting them remain rhetorical.

4.10 Evidence algebra

Each assertion’s evidence field composes as a provenance polynomial over evidence variables — alternatives as $+$, joint requirements as $\cdot$ (Green et al., 2007). Two queries are thereby defined operations rather than features to be invented: $\mathrm{why}(a)$ returns the polynomial (which pins, receipts, and checks support $a$; the empty polynomial is itself the honest answer for an unsupported assertion), and $\mathrm{evidence\text{-}reduce}(a)$ returns a reduced supporting set labeled with its reduction rung exactly as contracts are; any exact optimality claim must state its objective and search scope (§6.3). The evidence algebra is specified, not implemented: nothing in this paper’s evidence exercises why or evidence-reduce, and it is carried as a named NOT-YET item, not implied to run.

4.11 Where the algebra itself breaks

Stated against ourselves, as design obligations rather than fine print: (1) extraction is the weakest link — and this is now a measured finding, not a fear. The fidelity evaluation (§8.4) put numbers on it: encoding is where the losses concentrate — the hand arm altered or lost 17.3% of semantic units, identifiers weakest, and even a co-designer of the format fell into its own vocabulary trap; the automated arm’s three alterations include a real MUST→SHOULD drift. A fact that never became an assertion is invisible to every operator; the escape rule therefore requires any unencodable fact to land as guarded free text or an explicit unknown rather than be dropped, and the layer must never be lossier than the prose it replaces. The escape rule’s companion — the declared-residue assertion — is what kept a real legacy lift honest this cycle: the parts that did not decompose were pinned as residue rather than dropped (§8.5). (2) Skipped re-validation under load voids Theorem 1’s soundness — which is why the corresponding invariants are gates, not guidelines. (3) Omitted justifications make derivations uncacheable; the token saving is spent back with interest. (4) Prose scopes silently disable conflict detection (§3.4).

5. The invariants

Each invariant has a formal statement and a mechanically checkable predicate — an invariant nobody can check is not an invariant — and each is classified by when it is checkable and how strongly:

• S — schema-unexpressible: the invalid state has no serialization;
• A — authoring-time checker: refused at store write / CI;
• P — projection-time checker: refused at contract/packet emission;
• R — resolution/runtime: detectable only when applied or acted on.

An implementation may strengthen, never weaken, a classification — and the classification has now met an implementation. The v2 layer (§8.2) enforces or honestly tier-labels all sixteen. I9’s correction below moves its exact optimality obligation from S to P: syntax cannot prove exhaustion. The invariants predicted to be irreducibly runtime-bound shipped as predicted (I3’s enforcing test is a double-run digest comparison; I7’s is an apply fixture — no static enforcement was found for either), and the S-tier claims are no longer assertions about a schema on paper: each unserializable-violation claim is demonstrated by a mutation-proven refusal in the executed 27/27 coverage run (unqualified reduction-rung labels, unpinned assertion references, out-of-profile assertions, unbridged cross-scope identity among them). Two residual NOT-YET sub-tiers at the original pin were I6 and I16; the later I16 bind-time implementation is marked below. The sixteen, compactly (I1–I9 govern any conforming store and transfer; I10–I16 arise from the versioned-store setting and from a recorded design-synthesis review that folded the FPF distinctions of §2.9 into the specification — the §2.8 record contributed evidence and the disagreement of §4.9, not constructs), each with its implementation status inline:

I1 — Provenance closure (A/P). Every reference in a context resolves inside its snapshot pin, and every resolved revision’s recomputed canonical digest equals its recorded one. Predicate: closure walk plus digest recomputation, offline against the pinned store. Status: enforced — the walk runs over the live store plus archive pins.

I2 — Justification presence, not justification validity (S-part/P/R-audit) — renamed from “no inferred meaning,” which overstated it (an adversarial review, 2026-09-09, traced this to §8.5’s own “wrong at birth” instance below). No transfer raises the knowledge state of an assertion without a derivation record; missing ≠ default; absence of scope ≠ universal scope. The schema-expressible core: a derived assertion requires justification (discriminated union — origin: authored | derived, the derived branch unserializable without the JTMS triple). Projection part: $\mathrm{assertions}(\Gamma_{out}) \subseteq \mathrm{assertions}(\Gamma_{in}) \cup \mathrm{justified}(\Gamma_{out})$. What this does not check: whether the cited rule actually fires on the cited premises, or whether the premises are themselves correct. A fabricated but well-formed triple (rule id, premises, snapshot digest) serializes and passes; nobody re-executes the rule. “No inferred meaning” at the S-tier means “no unjustified inference” — a materially weaker guarantee than the name suggests, and §8.5 records a live instance of exactly this gap: a wave-1 authored claim passed every gate while incomplete against its own payload, because I2 verifies transfer, not birth, and a schema-valid justification is not a check that the justification is right. The honest tail: inference smuggled inside a value string is undecidable mechanically and is covered by sampled audits. Status: enforced at the S-tier (refusal proven red) — justification presence only; the lift path refuses to infer judgment fields; the audit tail stays procedural, as specified; re-execution of the cited rule (justification-validity, at P/R) is a named NOT-YET, not attempted anywhere in this paper.

I3 — Snapshot determinism (A-store/R-function). Resolution and projection are pure functions of (snapshot digest, input): same pin + same input ⇒ byte-identical output; later snapshots never rewrite earlier resolutions. The function half is irreducibly runtime — provable only by running twice and comparing digests; a schema cannot express “this function has no hidden clock.” Status: enforced by exactly that fixture, now executed — a double-run digest test in CI; the implementation keeps no clock anywhere (the lift takes its timestamp from the caller).

I4 — Conflict surfacing (S-record/P-detection). No context may contain $a \mathrel{\#} b$ in overlapping scope without either a suppression record (precedence used, winner, scope) or a $K$-verdict conflict record — a first-class, digest-pinned, never-truncated object; additionally a $K$ verdict must cite its conflicting assertions by digest-pinned reference (an unciteable $K$ is unserializable — also the anti-flooding guard). Pairwise detection over the emitted context; decidable because scope is a closed vocabulary. Status: enforced — pairwise pass, digest-pinned conflict records, the K-cite rule proven red, suppression from a declared strict partial order that refuses totalization, and resolved conflict records riding in the contract.

I5 — Modality preservation (P). For task scope $\sigma$: every MUST/MUST-NOT assertion in the pinned graph whose scope intersects $\sigma$ appears in the contract with modality unweakened (MUST-NOT → SHOULD-NOT is a violation). In v1 this invariant was unmechanizable because modality lived in prose; with modality and scope as fields it becomes a set comparison — the single clearest example of what the assertion layer buys. Status: enforced exactly as predicted — attachment by scope intersection plus a post-REDUCE set comparison. The payoff has an in-the-wild demonstration with an honest division of credit: the evaluation’s unit audit caught a real MUST→SHOULD drift produced by freehand encoding (§8.4) — a human judge reading the unit, not the mechanical check, which audits fieldless prose by the same procedure and would have caught the same drift there too (§8.4); “the field is what makes such drift machine-checkable” describes I5’s own refusal path, which has not yet fired on real content, not the detection that actually happened here. I5’s own mechanical refusal, red-proven on synthetic scenarios, has not yet fired on real content.

Four gaps in I5, found by an adversarial review (2026-09-09), stated rather than left implicit.

(a) The violation example is unserializable. Definition 1’s modality set is $\{\mathrm{MUST}, \mathrm{MUST\text{-}NOT}, \mathrm{MAY}, \mathrm{SHOULD}\} \cup \{\varepsilon\}$ — SHOULD-NOT is not a member. “MUST-NOT → SHOULD-NOT is a violation” cannot be constructed as a typed assertion in this substrate, so I5’s own named example is untestable on its own carrier. Nor is a general weakening order defined: whether MUST → MAY or MUST → MUST-NOT count as weakenings, collisions, or neither is not stated anywhere I5 or Definition 1 reaches.

(b) Derogation is a legal path around the set comparison. §9.1 records a real derogation composing a universe-level prohibition as “derogated-and-visible” for the granted project: the modality field is unchanged (still MUST-NOT, so I5’s set comparison is satisfied), but the deontic force for that project is gone by the derogation’s own design. I5 checks the field, not the force after derogation; a legitimate MUST-NOT → effectively-MAY transition is invisible to it by construction, not by a bug the mechanism failed to catch.

(c) Suppression and I5 disagree about what “appears” means. §4.6 suppresses a lower-authority assertion outright: $b$ is “recorded as a suppression entry, never deleted,” but is removed from the surviving derivation closure $\Gamma \vdash x$ is defined over. If $b$ is a MUST-NOT suppressed by a higher-authority MAY in overlapping scope, I5 demands $b$ “appear... unweakened” while §4.6 demands it not appear in the surviving closure at all. Which mechanism’s output the delivered contract honors is not stated.

(d) None of (a)–(c) is exercised by any test in this paper; they are named as open gaps in I5, not repaired here.

I6 — Direction preservation (S-enum/P-check). Transport never reverses, symmetrizes, or retypes an edge: the relation vocabulary is a closed enum with distinct inverse members, free-text relations are unserializable, and every relation assertion in a transfer is verified against the pinned graph — a cited edge that exists reversed in the registry fails loudly. Status: the S-tier half is enforced (closed enum, inverse pairs, refusal proven red); the P-tier transfer cross-check against the registry is NOT YET — owed at the packet-consumer seam, and named here rather than implied.

I7 — Delta soundness (S-base/R-application). $\mathrm{digest}(\mathrm{apply}(\Delta, \mathrm{fetch}(\Delta.\mathrm{base}))) = \Delta.\mathrm{after}$; refuse on missing base, never “closest version” — content addressing in the Merkle tradition (Merkle, 1979) applied to contexts. A delta without a digest-pinned base is unserializable; the application equality is a property of an act, not of bytes at rest. Status: enforced — base-digest refusal in delta application, with the apply fixture as the runtime-tier test, as predicted.

I8 — Append-only monotonicity (A). Existing revisions are immutable; change is a successor revision; no in-place edit, deletion, or digest reuse. Transfer extension: a packet asserting revision $X$ with a digest differing from the registry’s $X$ is equivocation, refused. Status: enforced at store and write path — and exercised by two genuine concurrent-authoring races, both decided by design: each losing writer refused and never mutated; the capability-map race recovered by staged succession, while in the role-developer race the losing candidate was discarded in favor of the standing revision (§8.5).

I9 — Scoped optimality claims (S/P). Every contract declares its reduction rung. R0–R2 make no exact optimality claim. R3 may claim the minimum number of selected capability providers for its pinned candidate set and declared requirements, only after bounded exhaustive search completes; above the bound it refuses. This is a minimality claim, even though the schema rejects the literal rung minimal. An exhaustion receipt containing optimum_size is functionally such a claim, so the earlier prohibition on all minimality claims was false. The corrected invariant prohibits an unsupported or unscoped claim (§6.3).

Status: rung validation is schema-level; the exact-rung obligation is projection-time. The emitted receipt records candidates, the selected subset, its cardinality, and a subsets-examined counter. The counter alone is not a proof of exhaustion; verification requires replay against the pinned inputs. Small constructed instances exercise that replay. Exact optimality of the final dependency- and governance-expanded projection, token count, and executor cost is neither established by this receipt nor claimed.

I10 — Single definition and import (A/S-where-possible). Every definition the system owns — kind roster, relation enum, domain/range table, scope vocabulary, verdict enum, refusal-code catalog, store root set, rung enum — exists exactly once as a versioned object, and every consumer imports it by pin. A component that restates one is invalid as a component, whatever its output. This invariant was purchased with a real incident (§8.6). Honest limit: a determined restatement inside opaque code is detectable only by divergence; the lint narrows the window, it cannot close it. Status: enforced — and the lint earned its keep on first contact: its first run over the live repository found five pre-existing restatements of the same defect class that the incident’s postmortem had missed, silent because none had yet diverged (recorded as explicit, stale-protected debt, not amnestied). The divergence-only residual window is now evidenced, not asserted; and the incident’s fix demonstrably did NOT close the class — the lint did.

I11 — Pinned assertion references (S/A). A cross-revision assertion citation without a content-digest pin is refused. The digest freezes payload bytes, so (digest, key) is unambiguous forever; resolution against “latest” is the equivocation attack that needs no attacker. Status: enforced, refusal proven red; the companion succession rule — assertion keys may not silently drift across a succession — is likewise red-proven and was exercised by the store’s first real succession.

I12 — Form parity (A/P). Every rendered projection (a page, a generated document) carries its source pin and regenerates byte-identically from its source revision; a projection without a source is not an artifact. The v1 system’s public-content gate is the precedent, and its true violation set is counted in §8.6 — after two instrument corrections. Status: enforced for the v2 store (deterministic projection with source pin, byte-compared, red on missing, orphan, or drift); the invariant also caught a real defect in its own renderer this cycle — a truncating projection, lossier than its revision, violating the invariant in spirit — found by the parallel run, fixed, and re-verified (§8.5).

I13 — Profile closure (S). An assertion outside its revision’s kind-profile is refused, not ignored: an unprofiled assertion is an unscanned authority-smuggling channel. Fail-closed schema interpretation is inherited: the validator raises on any schema keyword it does not implement, so a schema cannot promise more than enforcement delivers. Status: enforced fail-closed for every managed kind — with a recorded narrowing the implementation taught us. Profiles exist for managed kinds; auxiliary revision bodies are unprofiled, and there the validator has almost no refusal surface. “Zero refusals” is strong evidence only where profiles exist; the closure claim holds everywhere profiled, not everywhere conceivable.

I14 — Authority non-importation (P/R). No approval event from an archived store establishes current authorization for a successor-store object; old approvals are evidence toward the archived object’s historical validity only. Batch migrations whose issuances share one approval reference without a digest-pinned batch-approval policy are flagged (the anti-laundering gate). Status: enforced — authority events must target a live-store revision, and every archive lift this cycle entered carrying no authority.

I15 — Cross-scope identity is a claim, never an inference (S/A core; R staleness). Name equality across scopes never implies identity; identity or substitutability across scopes is an explicit, evidenced, digest-pinned Bridge plus a bounded use-claim with declared tolerated loss and mandatory currentness (the Bridge/use-claim separation adopted from FPF with attribution, §2.9) — and even then authorizes nothing (the authorization separation extends to semantic edges). The resolver refuses unbridged cross-scope resolution — an executable rule, now executed. Residual runtime tier: bridge staleness (endpoint supersession flips reliance to $K$ until re-affirmed; refusal proven red). Status: enforced, and exercised negatively under real pressure: a gap record named an artifact by a tal- alias whose content lives under a different declared identifier. Minting the alias twin would have created exactly the equivocation surface this invariant kills; the twin was refused — a Bridge needs two digest-pinned endpoints and the alias side has none — and the gap closes at the requirer’s lift instead. “A name-only requirement is not an identity” held when it cost something.

I16 — Layer-flow integrity (A/P). Every projected assertion has a layer value in {laws, admissibility, deontics, evidence} (the four-layer classification adopted from FPF with attribution, §2.9) — derived by default from existing fields, explicitly tagged only where derivation is ambiguous — with deterministic cross-layer lints: an evidence-layer assertion never satisfies a deontic obligation (a log is not a proof; an evidence carrier cannot create a permission); deontics are never derived from laws alone; admissibility gates before deontic evaluation. Recorded honesty: if these lints never meaningfully fail in practice, the discipline is to be removed rather than kept as theater. Status: the census fired on 2026-09-03 and the promised removal was made in part. Censusing the lints CLAUSE BY CLAUSE rather than by their shared finding code changed the answer, and that is the reportable result: the code covered five distinct laws, not one. Three of them — unknown layer value, declared-versus-derived disagreement, and deontic force on a declared evidence carrier — were REMOVED. All three were capable (a constructed violation made each fire, checked before removal) and all three had population zero: of 1544 assertions across 163 revisions none carried an explicit layer tag at the 2026-09-03 census (commit cbebf3a1eefc14c17306f0a4abc8d1992785c628), because the substrate writes none and reads none; the derivation ignores the tag on every path. They policed an affordance that was specified and never wired up. Two clauses were KEPT, and neither was idle. A modality on a carrier whose profile forbids one is charter enforcement (CH4): 46 live assertions fell within its checking population at that same census — a lint real content passes is being obeyed, not ignored. A deontic conclusion derived from descriptive premises alone was built days earlier to close a cataloged gap and has a red proof of its own; its clock had not run. The explicit tag is gone from the vocabulary with its lints, so the laws-versus-admissibility residue is now openly unsettleable, recorded as a divergence rather than dropped. The admissibility-gates-before-deontics rule is no longer NOT YET: it is enforced at bind time as the capability-envelope gate, which never read a layer tag and was unaffected — its refusal is still proven red after the removal. The honest label is “removed because unexercised”, which is neither “removed because idle” (a law real content meets) nor “removed because incapable” (dead code that could not fire); conflating the three is how a lint that was never reachable gets retired with the same sentence as one that works.

Invariant	S	A	P	R	Weakest necessary tier	v2 status
I1 provenance closure		✔	✔		P	enforced
I2 no inferred meaning	◐		✔	audit	P (core; value-string audit tail R)	enforced (S-tier core; audit tail procedural)
I3 snapshot determinism		◐		✔	R	enforced (double-run digest test)
I4 conflict surfacing	◐		✔		P	enforced
I5 modality preservation			✔		P	enforced (post-REDUCE set comparison)
I6 direction preservation	◐		✔		P	S-tier enforced; transfer cross-check NOT YET
I7 delta soundness	◐			✔	R	enforced (base-digest refusal + apply fixture)
I8 append-only		✔	◐		A (core; transfer extension P)	enforced; exercised by two real races
I9 scoped optimality claims	◐		✔		P	rung validated; provider-cardinality claim replayed on small constructed instances (§6.3)
I10 single definition	◐	✔		divergence	A (core; divergence residual R)	enforced (lint + debt registry)
I11 pinned assertion refs	✔	✔			S	enforced
I12 form parity	◐	✔	✔		A	enforced for the v2 store
I13 profile closure	✔	✔			S	enforced where profiled (see status note)
I14 authority non-import			✔	✔	P	enforced
I15 cross-scope identity	✔	✔		staleness	S (core; staleness R)	enforced (unbridged refusal + staleness)
I16 layer-flow integrity		✔	✔	— (tag removed)	A (core; bind-time gate R)	partly withdrawn 2026-09-03 — 3 declared-tag clauses removed unexercised, 2 kept (one with population 46 at the pinned census); bind-time gate enforced

Table 2. Enforcement-strength classification (◐ = partial coverage at that tier), with the implementation’s per-invariant status. The “weakest necessary tier” column follows one rule: it names the weakest tier at which the invariant’s CORE obligation is fully discharged — partial (◐) coverage discharges nothing, and residual obligations weaker than that tier are parenthesized rather than promoted. The rule is a judgment about the invariant’s substance, not a count of marks: a ✔ records where a check runs, the column records where one is unavoidable (I1 needs the emission-time walk because contracts are emitted per task; I12’s rendered projections are committed artifacts, so the CI byte-comparison discharges it at A). The status column condenses the implementation’s own coverage table, verified against its executed test and gate suite at the pinned commit (§8.2); I9’s classification is corrected here from S to P because an exhaustion claim is not established by its serialization.

The table is honest in both directions. Three invariants reach the strongest class — the schema refuses to express the violation. Two (I3, I7) are irreducibly runtime-bound: determinism and delta application are properties of acts, and an implementation claiming to have made them schema-static would be overclaiming — this table exists to prevent that claim as much as to enable the strong ones. One further honesty item is owed: the classification also creates a new single point of semantic failure — the normative vocabularies themselves (scope, domain/range, profiles). A wrong row silently mis-governs every contract projected after it; the mitigation is the same discipline the tables impose on everything else (they are versioned objects, changed by succession, with mutation tests per row class), and the residual cost when it happens anyway is wrong contracts with perfect audit trails — loud in review, invisible at emission. This failure class is no longer hypothetical: it occurred organically during implementation, when the kind roster was silently trimmed relative to the specification — a wrong vocabulary row in the strict sense — and the first piece of real content needing a trimmed kind exposed it within the hour. The deliberate injected-wrong-row experiment was not run; the organic instance substitutes, and it also argues for the interleaved implement-then-use-immediately method that caught it, where a fixture suite built from the same wrong assumption never would have (§8.5).

6. The resolver

6.1 The eight steps — specified, implemented, and run

$\mathrm{Resolve}(G_s, T)$ is specified in eight steps, all implemented, and run end-to-end on real tasks this cycle (§8.5) — with two honest asterisks on “exercised”: the conflict pass of step 5 has never fired on real content (no live conflict has yet arisen; its detection and refusal paths are red-proven on synthetic scenarios only), and REDUCE’s R2/R3 rungs have not run in anger (§6.2):

1. σ-filter: drop revisions out of scope/validity (linear);
2. seed: match $T$’s requirements to providers (index lookup);
3. closure: bounded deterministic closure from seeds over pinned dependencies and typed relations (polynomial; the v1 system’s bounded-BFS with typed non-answers is the model);
4. governance attach: every MUST/MUST-NOT with scope ∩ σ ≠ ∅ (I5 — completeness, not minimality);
5. conflict pass: pairwise $\#$ over the closure; resolve by $\succ$ or surface $K$ (I4);
6. REDUCE: the minimization step (§6.2–6.3). A gap named by an adversarial review (2026-09-09) and checked against the implementation, not assumed: step 5’s $K$-records cite their conflicting assertions by digest (I4); if REDUCE could drop one cited party, the surviving $K$-record would either dangle (an unciteable $K$, which I4 calls unserializable) or be dropped with it, silently resolving what I4 required surfaced. The implementation’s REDUCE keeps every governance-attached assertion (step 4’s MUST/MUST-NOT set) unconditionally — only capability-providing candidates are pruned — so a conflict between two governance assertions cannot be affected this way. Conflict’s generators are broader than governance, though (§4.5: modal clash, declared exclusions, and value clash on single-valued fields), and a value-clash or declared-exclusion conflict between two ordinary capability-providing assertions is not shown to be protected the same way. This paper does not resolve that case: whether REDUCE can remove one side of a non-governance conflict pair, and if so what becomes of the referencing $K$-record, is untested and unstated, not verified safe;
7. verdict pass: $\otimes$ over the reduced set — after REDUCE. Theorem 1 is about addition: no function of two contexts’ part-verdicts determines their merge’s verdict. Removal is a different, separately checkable fact: a global constraint’s verdict is not monotone under deletion either — dropping the one assertion that satisfied “at least one covers $P$” flips that constraint from $\top$ to $\bot$ — so a verdict pass taken before REDUCE would certify a set REDUCE has not yet finished changing, and an implementation that reorders steps 6 and 7 verifies the wrong object (an adversarial review, 2026-09-09, found the original citation of “Theorem 1 again” here miscited: Theorem 1 is a fact about $\oplus$ removal is not);
8. emit or refuse: the contract with receipt (sufficiency certificate, reduction rung, retained rejections), or a typed structural refusal. Refusal is a first-class outcome: the agent does not launch.

Running the resolver on real work surfaced a rule the specification did not contain, reported here as an implementation-discovered rule rather than retrofitted as if it had always been specified. The closure walk of step 3 followed a lifted revision’s digest-pinned derived-from edge into the frozen archive and refused it as Missing — and no specification part said what Resolve does at the archive boundary. The resolution, faithful to the layer’s own rule that archive content is citable by digest but archive identifiers never surface as live nodes: archive-resolvable pins are closure leaves — digest-verified, recorded in the receipt, never traversed, never projected; only a nowhere-resolvable reference is Missing; and a cited digest that disagrees with the archive is an equivocation refusal, not a fetch of “closest version.” Implemented and tested. An executable specification is the instrument that finds its own underspecifications; this was the third such finding of the cycle (the other two are in §6.3 and §8.5).

6.1a Selective disclosure, and why the structure is a DAG

The eight steps describe what Resolve computes. What they do not name is the discipline that decides how far anything is expanded, and it deserves a name because this architecture was built on it before it was written down. Stated as the principle its author formulates it, as a design commitment rather than a theorem:

A task is not unfolded fractally in every direction. Each branch is disclosed only as deep as is necessary for the leaf to be something one simple agent on a simple model can execute reliably. Every disclosed level is assessed; what is still too hard is disclosed further, what is simple enough stops and may go to execution. Different branches of one task may therefore have entirely different depths — one step in one, five in another, and in a third the discovery that the knowledge needed to go further does not exist. That discovery starts a second process: a provisional fill so the work is not halted, and a separate research task whose result becomes a validated knowledge artifact. Solving tasks grows the knowledge base.

The principle operates at two levels, in different states of implementation. Both are stated here; neither is inferred from the other.

Level one — disclosure of the knowledge contract (implemented, measured). From a pinned store of 165 revisions, a contract carries 24 to 31 (median 26, over the 18 admissions with a closure manifest). The naive reading of that number — that the walk selected 26 of 165 — is wrong, and the measurement says so plainly. Of those, exactly 22 are governance revisions in every one of the 18 contracts, attached by step 4 through scope intersection rather than reached by the walk; the task-specific remainder is 2 to 9, median 4. So selective disclosure is real as a rule and nearly inert as a magnitude: the graph the roots reach is shallow because no live provider declares dependencies at all (§8.8), and the size of a contract is dominated by completeness, not by reach. The typed stops below are correct claims about a walk that, today, rarely has anything to stop.

That correction is worth stating rather than quietly fixing, because the flattering version of this section was written first: a mechanism whose rule is sound can still be doing almost none of the work, and a paper that names the rule without measuring its magnitude has not established anything about it.

The rule itself: from a space that could be expanded enormously, expand only what the task’s declared roots actually reach, verify every stop, and record what was not disclosed and why. The contrast that clarifies it is recursive decomposition, in which every node is expanded by a uniform rule until a budget runs out. Under that discipline the answer to “why is this branch not deeper?” is the budget ended, and the answer to “why is this one deeper?” is the budget had not. Under this one, every stop is typed, and a typed stop is a claim that can be wrong and checked.

The carrier is a directed acyclic graph — not a tree, and not a self-similar decomposition, and two lines of the implementation are what make that true rather than approximately true. The first is if rid in closure: continue: a revision reachable by two paths is disclosed once. A tree would have no need for the line; a fractal decomposition would re-expand the repeated node on every branch it appears in, and the disclosed set would count it twice. The second is that the walk follows edges of different kinds — dependencies, and the typed uses / derived-from relations — and types them as it traverses, so an ill-typed attachment refuses the whole task rather than pruning a branch. Neither a tree nor a fractal does that: in both, the shape of the expansion is a property of the expander, whereas here it is a property of the graph being expanded.

Disclosure stops for exactly three typed reasons, and each one records itself:

1. Archive leaf. A digest-pinned reference resolving in the read-only archive is verified, receipted, and then neither traversed nor projected. It is a stop that asserts something — this exists and is exactly these bytes — while disclosing nothing.
2. Already in the closure. The revision is present; it is not re-expanded. This is the line that makes the structure a DAG.
3. Unbridged cross-scope. A revision outside the task’s σ without a claimed Bridge does not silently drop out of the disclosed set: it refuses the task under I15. A boundary the walk cannot cross is a refusal, never a quiet omission.

A fourth stop exists and is deliberately not one of the three, because it is not a rule but a bound. DEFAULT_BOUNDS caps depth and node count; hitting the cap yields Search-Incomplete with the receipt line “closure bound hit: don’t-know, not not-needed”. The distinction is the whole point of typing the stops. An exhausted budget is a fact about the search, and reporting it as a fact about the requirement — “this was all that was needed” — is precisely how a bounded search launders its own limit into an answer. The layer’s rule is the blunt one: do not shrink the task to fit the bound.

Level two — decomposition of the task by competence (architectural intention, not implemented in this layer). Nothing in Resolve, the admission gate or the loop assesses a task’s difficulty or splits it. The task block has no parent, no children and no complexity field; the 44 recorded admissions are flat, and the deepest closure walk across all of them reaches depth 1. The stopping criterion the principle names — simple enough for one simple agent on a simple model — is therefore stated here as a requirement and not as a result. The substrate does contain the natural candidate for the estimator it would need: competence distance (§7), the recorded-cost distance from an executor’s profile to what a leaf requires, which is built and unmeasured at scale. A branch would stop when that distance falls under a declared threshold and be disclosed further when it does not — declared, like a reduction rung, and never the word “enough.” None of this is exercised, and this paper claims no result for it.

The second process — a knowledge gap as a first-class outcome (implemented at the gate; the research-task half unfinished). When disclosure cannot proceed because the knowledge does not exist, the gate does not guess. A $U$ verdict names what is missing as an actionable authoring spec, typed by kind of gap: a capability with no provider, a scope node with no charter, an unresolvable reference, a bound hit, a structural refusal. On the record two kinds have fired on real tasks — six capability-without-provider refusals across four tasks, and one charter-absent on the single product-scoped task (§8.7 item 6a). Three of those loops closed: the missing capability was researched, authored as a store revision, validated, and the task re-admitted $\top$ against the moved snapshot. One of the three took three consecutive refusals to close, which is the shape the principle predicts — a branch whose depth is discovered, not declared in advance. Two gaps remain open, and their openness is on the record rather than resolved by a default.

The half that is specified and not wired is the one that would make the loop self-sustaining rather than operator-driven: a provisional extension recorded beside the pinned artifact so the current work is not halted, paired with an independent review intent naming its reviewer capability and its evidence. That code exists and postdates every run in this evaluation — zero of the 73 journal entries carry it — and the dispatch of such an intent as a separate research work item is specified and deliberately not executed. Stating this as implemented would be exactly the error §7 made about the cost layer.

On the name. “Selective disclosure” is a term of art in verifiable credentials, where a holder reveals a subset of signed claims for privacy; the mechanism here is not that one — the selector is the resolver, the criterion is task sufficiency rather than minimal exposure, and verifiability rests on digest pins rather than signatures. The nearest established prior for level two is as-needed decomposition, which recursively decomposes a sub-task only when an executor fails at it, adapting depth to task complexity and executor capability. The difference is the trigger: that line of work splits after an execution failure, whereas this principle splits on a predicted insufficiency before dispatch, which places it between as-needed decomposition and complexity-based model routing. Lazy hierarchical refinement in acting-and-planning shares the per-branch depth and the anytime shape but stops on a rollout budget — the contrast this section draws. Iterative deepening and progressive widening are budget-driven for the same reason. On the knowledge side, adaptive-retrieval work decides when to fetch and gap-as-task retrieval keeps unresolved gaps as objects, but neither authors a validated artifact back into the store. No single established term covers the chain assess → disclose selectively → detect the gap → fill provisionally and research fully → execute → promote, so we keep selective disclosure for level one with the disambiguation above, and name level two competence-bounded decomposition.

What this section does not claim is selectivity at the level of the individual assertion. §3.5 states that projection granularity is the assertion, and that is true of the format; it is not yet true of the observed behaviour, and the measured gap is stated in §8.8. Nor does it claim any result for level two.

6.2 Hardness

Definition 5 (Minimal Sufficient Projection, decision version). Given: a pinned graph $G_s$ whose artifacts each carry a set of provided capability tokens; a task $T$ with required token set $U$; an integer $k$. Question: is there a selection of at most $k$ artifacts whose provided sets jointly cover $U$?

Observation 1 (Theorem 2 in earlier drafts). Minimal Sufficient Projection is NP-complete. Named an observation rather than a theorem here — an adversarial review (2026-09-09) found the reduction below is the identity on structure, not an independent hardness argument, and “a complexity result” among this paper’s contributions overstated what citing Set Cover under a new name earns.

Proof. Membership: a selection is a polynomial-size certificate; verifying coverage is a union and comparison. Hardness: reduce from Set Cover (Karp, 1972). Given a Set Cover instance (universe $\mathcal{U}$, family $\mathcal{S} = \{S_1, \dots, S_n\}$, bound $k$), construct one artifact per $S_i$ providing exactly the tokens $S_i$, and a task requiring $U = \mathcal{U}$. A selection of $\le k$ artifacts covering $U$ exists iff a set cover of size $\le k$ exists; the mapping is polynomial — the substrate’s Minimal Sufficient Projection is Set Cover with artifacts standing in for sets, not a distinct problem that happens to reduce from it. $\blacksquare$

The reduction uses only machinery the substrate already has (provides token lists — machinery that is now real, not schematic: this cycle’s first real succession declared a provides token to close an admission gap, and the implemented REDUCE runs cover-based over exactly these tokens), so the hardness is not an artifact of generality: any implementation with overlapping providers faces it. An honesty note from recomputation, re-run for this revision: an earlier research document in this line claimed the production graph already exhibits overlapping providers; it does not, and still does not. At its frozen pin the v1 store declares 22 distinct capability tokens, each provided by exactly one logical identifier; the live v2 store, recounted for this rewrite, adds 6 declared tokens — again each provided by exactly one identifier. Exact minimization is trivial today, and R2/R3 remain unexercised in anger, exactly as predicted. The hardness claim is about the problem class, and it bites exactly when alternative providers accumulate — the graph’s stated growth direction — which is why the ladder below exists before it is needed rather than after. With dependency closure added, the problem only hardens (it generalizes toward directed/group Steiner problems, for which known polynomial algorithms achieve only polylogarithmic approximation factors — cited as literature context, not proved here).

6.3 The tractable ladder, and the ban on “minimal”

Rung	Procedure	Cost	Minimality forfeited
R0	closure-only	poly	nothing removed: sufficient, possibly grossly redundant
R1	closure + dominated-alternative pruning under the pinned tie-break	poly	keeps ties; sound because the tie-break is pinned
R2	greedy set cover over alternatives	poly	within $\ln n + 1$ of optimum, $n = |U|$ the required token set (Chvátal, 1979; Johnson, 1974, and independently Lovász, 1975) — and no polynomial algorithm does asymptotically better unless P = NP (Dinur & Steurer, 2014, after Feige, 1998)
R3	enumerate provider subsets under the declared exact(k) bound	exponential in candidate providers; refuses above k, with no wall-clock cutoff	minimum provider cardinality within the candidate set; no minimum final-context or token-cost guarantee

Table 3. The reduction ladder. The resolver takes its exact bound from exact(k); it does not impose a default of 20. The separate evidence reducer’s default budget is 20, which an earlier draft mistakenly attributed to this resolver. The R2 approximation ratio is for unweighted provider cover; it is not a bound on the cost of the expanded context. Here $n$ is the number of required tokens, not the number of artifacts.

For R3, let $P$ be the pinned candidate providers, $U$ the declared required tokens, and $C(p)$ the tokens provided by $p$. The objective actually computed is $$\min_{Q\subseteq P}|Q|\quad\text{subject to}\quad \bigcup_{p\in Q}C(p)\supseteq U.$$ If $|P|\le k$, enumeration considers every subset, skipping a coverage test only when the subset is at least as large as the best cover already found. No strictly smaller cover is skipped, so the returned cardinality is optimal for this objective. The receipt is a compact execution record, not an independently checkable proof merely because its counter says $2^{|P|}$; a verifier must reconstruct the candidates and coverage from the snapshot and repeat the search.

This claim does not extend to the delivered context. An executed counterexample has a provider of both required tokens with three dependencies, and two other providers supplying one token each without dependencies. R3 chooses one provider and emits four revisions; choosing the two other providers emits two revisions. Thus provider minimality and projection minimality differ even before token costs enter. This counterexample and the bounded-search refusal are regression tests; no production demand for R3 is inferred from them.

All four rungs are implemented, including R3’s bounded enumeration. Implementing the ladder surfaced a defect in the specification itself: the I9 rung enum serialized three rungs while the resolver document defined four — R1, dominated-alternative pruning, had no legal serialization, so an implementation following the schema part alone could never declare the rung the resolver part told it to implement. The enum was extended as a governed correction, and the episode is kept as evidence for a claim prose review cannot earn: an executable specification catches inconsistencies that years of careful reading missed. (A second, smaller instance from the same session: the first R1 test asserted a provider tie where the pinned order actually gives strict dominance — the implementation was right and the implementer’s “sound pruning” intuition was wrong, which is precisely why the pinned-order definition, not intuition, decides.)

Invariant I9 therefore requires a rung and an explicit objective for any optimality claim. Rejecting the literal minimal prevents an unqualified rung label; it cannot establish optimality or prohibit the equivalent claim made by optimum_size. Sufficiency remains relative to declared requirements. Every projection in the live parallel run carried its rung (§8.5); that observation does not verify R3 optimality in production.

Why REDUCE matters at all: over-large contexts cost tokens (the direct bill), attention (irrelevant constraints dilute compliance with relevant ones), and exposure (needless material widens the secrecy surface — reduction is also a data-minimization requirement, not just an economy). And the one cost REDUCE cannot touch is now measured rather than argued: governance attached by scope intersection is protected from reduction by I5’s completeness rule by design, and the post-draft full-store re-run put a bill on that protection — coarse-scoped governance grew one task’s rendered context 8.9× at +32% executor cost (§8.8).

Sufficiency has its own honest limit: $K \models T$ is checkable only against declared requirements. A fact that exists as prose but not as an assertion is invisible to any resolver — a principle this cycle confirmed live: every projection insufficiency the parallel run recorded traced to a fact nobody had asserted (a payload path, an undeclared authoring rule), never to a resolver defect (§8.5). The size of the ungraphed-content debt is itself a cautionary tale about instruments: the figure this paper’s draft carried, 42 of 125 published artifacts, was two-thirds instrument fiction — the corrected gate counts 14 genuinely ungraphed artifacts, the other 28 being phantoms manufactured by the gate deriving identities instead of reading them (§8.6). Closing the real 14 is a correctness precondition for the resolver’s guarantee to mean anything, not hygiene.

7. Geometry and cost

Definition 6. Let $G = (M, E, w)$ with $M$ the meaning objects, $E$ the typed directed edges carrying recorded costs, and $w : E \to \mathbb{Z}_{\ge 0}$ the cost. Define $d(x, y) = \inf\{\sum_i w(e_i)\}$ over directed paths $x \to y$ within $E$, with $d(x, y) = \infty$ if no such path exists. (An edge without a cost record is outside $E$: a query whose only routes cross it returns reachability separately and cost unknown — see below.)

Proposition 6. $d$ satisfies $d(x,x) = 0$ and the triangle inequality $d(x,z) \le d(x,y) + d(y,z)$, with no symmetry requirement: $d$ is an extended quasi-pseudometric — a quasi-metric in Wilson’s (1931) sense exactly when the separation axiom holds, which is not required here. Proof: the zero path, and path concatenation — the min-plus (tropical) closure. With nonnegative integer weights on a finite graph, the infimum is attained by a simple path (cycles cannot decrease cost), so $d$ is computable by standard shortest-path algorithms. $\blacksquare$

Two implementation rules follow from honesty rather than mathematics: raw edge weights need not satisfy the triangle inequality (only the closure does — never read a stored weight as “the distance”), and $d(x,y) = d(y,x) = 0$ with $x \ne y$ is permitted (“same meaning, different address”; quotienting by that relation is what restores Wilson’s separation axiom when one is needed).

The asymmetry is the point, and it is grounded in the ecosystem’s operational record rather than stipulated: acquiring a missing skill costs training and verification effort while the reverse traversal costs nothing (held skills are not un-learned), so “distance from junior profile to senior profile ≫ the reverse” falls out of edge direction with no extra machinery; in one recorded incident, entering a bad state was one credential issuance while the recorded exit path was a five-step recovery; in another, a wrongly merged change cost multiple recorded revert-and-reland cycles while merging costs one CI run.

Three provenance rules govern weights. Measured weights derive from the operational ledger (the production system records per-task wall time, token counts, and cost with an estimated/measured basis flag across 126 per-task ledger files); repeated samples give a distribution whose declared statistic is recorded with sample references. Declared weights are permitted where no sample exists and remain distinguishable from measured forever. Forbidden: deriving weights from embedding cosine distances — embeddings are symmetric by construction (checked during the research phase against the ecosystem’s retrieval fusion, whose ranking carries no directional term; the check is pinned to that phase, was not re-run this cycle, and no lint yet enforces the rule), and laundering a symmetric similarity into an “asymmetric cost” manufactures the asymmetry the layer exists to preserve. Weights never gate correctness — only constraints gate; a wrong cost mis-prioritizes, it cannot mis-permit — a design rule, not a demonstrated property: no code path exists yet on which to test it. An edge with no cost record has unknown cost ($U$), never $1$ and never $0$; $\infty$ is reserved for declared unreachability under a complete-closure scope.

A continuous, direction-dependent geometry (Finsler; Bao, Chern & Shen, 2000) would add geodesics through points that are not graph nodes, curvature, and direction-dependent infinitesimal cost — none of which is defined until meanings live in a continuous space. On a discrete carrier of 324 archived and 14 live revisions, every question actually asked is a shortest-path question, and the quasi-metric answers it. The deferral has an explicit trigger (a continuous embedding with meaningful interpolation), not a date; building the apparatus now would be decorative mathematics.

A status statement this section owes more than any other, and one that this revision had to correct against its own repository. Until 2026-09-15 this paragraph read that “no cost-record authoring exists” and that “no running code exercises” Proposition 6. Both had stopped being true, and the paper was the last place to find out: kc2_cost.py is 496 lines with author_cost_record and measure_edges on its authoring path, the resolver reads recorded weights through kc2_cost.edge_cost while ranking live candidates, distance() is covered by kc2/tests/test_cost_distance.py including an asymmetry case on real records, and the live store holds 14 CostRecord revisions mined from the operational ledger — 581 of its 641 rows carry the wall-time and token fields a weight can be taken from. A claim of absence is as falsifiable as a claim of presence, and this one was false against a store the paper itself pins.

What remains true is narrower and is the reason the section still owes a status statement. Every authored record is basis: measured; nothing in the tooling mints a declared weight, because a declared weight is a human’s opinion with provenance and a tool must not forge one. Competence distance (this section) is built, and this sentence is the second correction of the same kind in one paragraph: kc2_cost.distance computes $d$ over the min-plus closure of recorded-cost edges, an edge without a record is outside the costed graph and yields $U$ rather than zero, and test_real_competence_asymmetry exercises the asymmetry case stated above on real store content — $d(\text{editor} \to \text{factcheck})$ measured over a recorded requirement edge while the reverse traversal is $U$ and unreachable, so the acquisition asymmetry falls out of edge direction with no extra machinery. The test runs; it is not skipped for want of the live pair.

So the layer’s honest limit is scale, not existence: 14 records over five weighed uses edges is a demonstration that the path runs end to end, not an at-scale measurement of the directional geometry, and the incident-grounded asymmetry examples above remain motivation for that reason and no other. The verdict on this section moves from not implemented to implemented and not measured at scale — the third verdict, which is neither of the other two, and which this paper is required to state rather than round to whichever neighbor is more convenient.

One consumer of this geometry has now been tested against a retrieval baseline, and the result is negative. A preregistered offline intervention (program experiment EXP-A2-S15-SCIENCE-CLOSURE-20261006, registered at d5146537 before execution; exploratory; frozen historical 165-record store; no live retrieval measured) reranked or expanded a frozen hybrid-retrieval top-10 along recorded edges, with topology-ordered and cost-ordered arms. All four arms scored 31/33 recall@5 — exactly the frozen baseline (0.9394) — so the improvement verdict is FAIL. Edges were used on 3 of 33 questions by expansion and on none by reranking, and each graph-using seed had a single eligible outgoing neighbor, so cost ordering and topology ordering could not differ: a cost-specific effect is not measured, not refuted. The next falsifier — a separately registered fixture with competing graph paths that keeps the topology and edge-removal controls — is not yet registered.

8. Evaluation

The evaluation makes five kinds of claims with five different strengths: historical existence evidence from the v1 store, now a frozen archive (§8.1); implementation evidence from the executed v2 layer and its live store (§8.2); the v0 pilot, kept as the pilot (§8.3); the measured evaluation — four measures, jointly, refuting this line’s token claim on both its facets and narrowing its delta claim (§8.4); and the dogfooding and parallel-run record (§8.5), whose premise-check felled the third refuted claim — the store-debt figure — via the instrument recount of §8.6. The measurement-error episode (§8.6) and threats to validity (§8.7) close the section as it was written. Two subsections postdate all of them: §8.8 is a dated addendum from a second round — the corpus lift and the full-store re-run — and §8.9, dated a day later, records the correction of §8.8’s own enumeration frame; both are appended after this draft’s evaluation closed, not woven into the sections whose claims they extend or contradict.

8.1 Historical existence evidence: the v1 store, now a frozen archive

All claims in this subsection were verified by reading the production repository and re-executing its own loaders at commit 63f66b2 (2026-08-29) — never by quoting its documentation. Since that verification the store has been closed: v1 is a read-only archive, frozen mechanically — a SHA-256 manifest over its 346 files (324 revisions plus 22 gap records), enforced in CI by a freeze check that is itself mutation-proven (4/4 red paths). The freeze is the standing recount: every count below is re-runnable byte-identically at the pin. What was not re-executed this cycle is labeled as such.

The store holds 324 immutable revisions of 210 logical identifiers across three roots (55 + 147 + 122), of seven managed kinds (172 Skill, 51 Role, 43 Blueprint, 20 Constraint, 17 SuccessCriterion, 16 Policy, 5 CapabilityDescription), each with the identity triple of §3.1 and digest-verified at load. Its census file additionally records 324 dependency edges (coincidentally equal to the revision count; both recomputed independently at the pin), 293 resolved relation edges, and 57 unresolved declared-relation edges — recorded visibly, never dropped. The census was not re-executed this cycle; the byte-freeze makes it re-runnable identically at the pin. And one fact the census numbers do not capture, learned during the v2 lift work: v1’s by-name relations were never mechanically checked at all — the archive’s only mechanical frontmatter gate verifies no relations whatsoever (verified in its code, §8.5) — so “recorded visibly” is a property of the census file, not evidence that any declared relation resolves.

The v1 validator enforces 16 typed refusal codes (unpinned references, digest mismatches, unclosed dependencies, exclusion conflicts, retrospective mutation, replay equivocation, authority smuggled through content, evidence self-attestation, among others), under a red–green doctrine: no refusal code exists without a test that can go red. That harness was read and inventoried for the original draft but not re-executed — and it has not been re-executed since: the archive is frozen and is never validated under v2. The live successor catalog is v2’s 27 codes, and that harness was executed for this revision (§8.2). The five-stage v1 resolver (Propose → Verify → Select → Assemble+Issue → Bind), with its three never-merged identities and its documented “never ‘pick the first one’” rule, is likewise history: it ran one real end-to-end resolution to the Bound state (Correction, 2026-08-31 — an undercount; the store’s own record says twenty, see §8.11), was not exercised with fresh resolutions this cycle, and is superseded by the v2 eight-step resolver, where all fresh resolution work ran — four end-to-end admission → projection → execution runs (§8.5) replacing the v1-era n = 1 as the substrate’s existence-in-motion evidence.

Equally load-bearing are the verified absences. The v1 store has no deontic modality field (prohibitions live in prose bodies, with the one exception of structured policy rules carrying allow/deny/require_approval effects — an existing mechanism the v2 modality field generalizes), no scope field, no verdict values beyond boolean checks, no conflict records, no delta transport, and no cost model (a budget field exists on resolver intents and is read by no stage). The theorems of §4 are about the layer these absences delimit, and every absence is now a closed, implemented v2 target (§1.4) — the cost model as of 2026-09-15, at demonstration scale and without measurement at scale (§7). The store’s own hygiene gate — after two instrument corrections (§8.6) — reports 14 of 125 published document artifacts genuinely lacking a backing graph revision (8 competencies, 2 skills, 2 policies, 2 constraints, counted by declared identifier from the canonical roots; one of the 14 was re-authored into the v2 store this cycle), carried as known debt rather than reconciled away.

What this evidence does and does not establish: it establishes that the substrate discipline — append-only digest-pinned storage, fail-closed typed refusal, mutation-tested gates, deterministic resolution — ran at organizational scale with real content, survived contact with its own operational errors (§8.6), and hands its content to a successor only through digest-verifying doors. Claims about the assertion layer rest on §8.2 onward, not on this archive.

8.2 Implementation evidence: the v2 layer and its live store

The v2 layer described in §§3–6 is implemented in one visible boundary directory of the same repository, and every implementation claim in this subsection is backed by an executed test or gate at commit 41c480a (2026-08-30), the pin for this implementation census. The components: a single-definition module (I10) that every other component imports — kind roster, profiles, scope vocabulary with intersection rules, verdict/modality/rung enums, the refusal-code catalog, the one v2 store root; a revision store with canonical-digest verification at load and duplicate/retro-mutation refusal at the door; the validator, whose every refusal is a catalog code; the eight-step resolver with typed refusals and declared rungs; the packet module (canonical JSON plus a deterministic line projection, round-trip enforced, deltas with base-digest refusal); and the archive lift, the only door through which v1 content enters, judgment fields refused rather than inferred. The CI gates — archive freeze, single-definition lint, refusal coverage, the suite — are each mutation-proven before they run.

The refusal-code catalog holds 27 typed codes, each proven red against a live scenario by an executed coverage harness — the counter fails on a missing scenario, so the 27/27 figure cannot silently rot — re-executed during this revision’s claims audit (2026-08-30). Per §5’s status column, all sixteen invariants are enforced or honestly tier-labeled, with the one named NOT-YET sub-tier (I6’s transfer cross-check; I16’s bind-time gate is enforced as the capability-envelope check, wired into the resolver and tested — an earlier “two named NOT-YET” count here had not caught up with that, found by an adversarial review, 2026-09-09); the reduction ladder runs R0–R3 including exact-with-certificate (§6.3).

The live store, recounted from disk for this rewrite: 14 revisions of 11 logical identifiers — every one produced by real work, none seeded as fixture content. The partition, stated so it sums: three scripts as CapabilityDescription with mandatory envelopes (3 revisions); the template as Blueprint across three revisions — first lift, then the staged succession that closed the template↔script mutual reference, then the provides-token succession that closed a live admission gap (3); one constraint (1) and one research-evidence revision (1); the capability map as Blueprint across two revisions, the second being the succession forced by a genuine authoring race on that artifact (§8.5) (2); three real archive lifts — the structured skill (which also closed the eighth registered gap target at its declared identifier), the role-developer artifact, and a legacy-prose constraint lift, honest only via a declared-residue assertion, that closed the run’s other admission gap (§8.5) (3); and an authoring-capability revision minted in the same two-level research loop as the template’s third revision (1). That is 3 + 3 + 1 + 1 + 2 + 3 + 1 = 14 revisions, and the eight registered exists-outside-the-graph gap targets are all among them — seven under their own logical identifiers, the eighth resolved at its declared identifier by the skill lift. (These counts are the store at this section’s pin. A post-draft second round later grew it to 63 revisions through a bulk corpus lift; that growth and its consequences are reported separately, dated, in §8.8 — not folded into the counts here.) Two observations from that growth belong in the record. First, the authoring cost concentrates in the first artifact of each shape: the second gap-lift wave hit zero validator refusals and credited the first wave’s worked example — a learning curve, not a constant tax. Second, the validator earned its keep at write time, refusing three real malformed assertion keys during the first decomposition — authoring errors caught before review rather than after.

8.3 The transport pilot (historical)

The pilot is kept in this paper as exactly what it was, because its numbers stand while their reading has fallen: the measurements below are real, and §8.4 shows they measured the encoder, not the format.

The measured question: what does re-encoding a real agent-to-agent handoff from prose into the typed packet form do to its token count, holding semantic content fixed by construction?

• Corpus. Six real handoff artifacts from the ecosystem’s live agent-orchestration workflow store — a separate store from §8.1’s graph, holding 56 sessions and 116 snapshots at measurement time per the committed measurement record (the snapshot half was independently corroborated when §8.4’s evaluation drew its own corpus from the same directory and found 116 files; the session half still rests on the committed record alone) — chosen to span the artifact classes: two session handoffs, three stage snapshots (parent-orchestrator, blocked-task, and production-push variants), one archive. Originals copied verbatim into the measurement directory.
• Re-encoding. Each artifact was hand-encoded into the packet projection — a terse line grammar with typed assertion lines, state records, justified derivations, deontic lines, explicit not-claimed/unknown fences, conflict records, delta lines, evidence pointers, and refusals — by the research session that designed the format, under a completeness rule: every load-bearing semantic unit preserved (verdicts, modalities, digests, conflict records, lessons; full hashes kept where the prose had full hashes), with narrative connective tissue the only permitted loss. Lessons and other novel content are carried as guarded free text: the format refuses to compress what exists in no registry.
• Counting. tiktoken, both o200k_base and cl100k_base vocabularies. The receiving models’ tokenizer is proprietary; two independent BPE vocabularies are reported so the ratio is not an artifact of one vocabulary (they agree within 0.3 percentage points throughout). The harness, file pairs, prose originals, and packet re-encodings are committed alongside the research documents in the (private) research repository; reproduction is two commands for anyone with access, and §10 states what stands between the corpus and public release.

Fidelity was controlled by construction, not by similarity scoring: each packet is auditable line-against-source, and the design position remains that the correct fidelity metric for this format is validator-checkable unit completeness, not embedding similarity — a summary at 84% semantic similarity that lost one MUST-NOT would pass an embedding check and fail invariant I5. But the pilot enforced that position only by the encoder’s own discipline, with no independent check — and when the independent check was finally run (§8.4), construction-verified hand encoding turned out to be the least faithful arm measured. The position survives; the pilot’s claim to have satisfied it does not.

The pilot’s results, verbatim:

Handoff	Prose bytes	Packet bytes	Prose tokens	Packet tokens	Reduction
stage snapshot 1	2330	1454	614	482	21.5%
stage snapshot 2 (blocked)	2683	1685	708	571	19.4%
stage snapshot 3	4248	1769	1311	636	51.5%
task archive	2648	1559	786	556	29.3%
session handoff 1	10700	5775	2976	1692	43.1%
session handoff 2	9315	5215	2623	1667	36.4%
Total			9018	5604	37.9%

Table 4. Standalone packet results, o200k_base (the cl100k_base total is 38.1%; per-artifact agreement within 0.3 pp).

	Prose (full restatement)	Delta packet	Reduction
tokens (o200k_base)	2623	1116	57.5%

Table 5. The one delta-regime pair (n = 1): session handoff 2 re-encoded against its real predecessor with standing context carried by pinned reference, paying only for change.

Reading the pilot, as re-anchored by the evaluation: the aggregate effect was a 37.9% token-weighted reduction (1 − 5604/9018, so larger artifacts weigh more; the unweighted mean of the six per-artifact reductions is 33.5%; per-artifact range 19.4–51.5%; two tokenizer vocabularies agree within 0.3 pp) — of designer-encoded packets, which the later unit audit found only 82.7% faithful (§8.4). The per-artifact spread remains the pilot’s honest finding, now confirmed at one end and untested at the other: artifacts whose authors had already invented ad-hoc semi-structured discipline sit near an identifier floor (19.4–21.5% here; the evaluation’s 18 fresh identifier-dense samples reproduced the floor, with baseline ceilings of 11.9%/14.8% showing how little narrative tissue exists to remove), while the narrative-heavy 51.5% end was not retested. “The format’s contribution is checkability, not tokens” — the pilot’s reading of its own floor cases — is, after §8.4, this paper’s supported position for the whole corpus class. The delta regime’s 57.5% on the pilot’s single clean pair was reported as n = 1 and stays n = 1; the evaluation’s four-pair extension narrows it sharply (§8.4). An earlier draft placed an external calibration point beside the 37.9% (Salehi et al., 2025); that reading is withdrawn — a number that measures encoder skill corroborates no format magnitude (§2.1).

8.4 The evaluation: four measures, jointly

The evaluation upgrades the pilot to a protocol another party could re-run, committed before any encoding existed: a systematic corpus (every 8th stage snapshot by sorted filename from the 116-file live handoff store, no substitutions — whatever the rule yields is the corpus, including near-floor short samples — plus three real handoffs this cycle’s own run produced: a consilium facts sheet and two authoring-wave final reports; 18 samples, content digests committed in a manifest, the corpus itself not shipped per §10); four arms — an automated packet encoder (a fresh-context strong model given only the encoder specification and the completeness rule, not a format designer), compressed-prose and structured-summary baselines under the same preserve-every-load-bearing-unit instruction, and a hand arm (a format co-designer, on a 4-sample overlap subset, to measure the hand-versus-automated gap directly); and the four measures reported jointly — no axis traded silently against another. All arms are the same model family as the format’s designers; the fresh-context, spec-only setup removes design-session memory, not family style (§8.7).

Token reduction on this frame: automated spec-only encoding does not reduce, a structured-summary baseline does better without the format. An adversarial review (2026-09-09) found “the format-property claim is refuted” overstated against the sampling frame actually measured: the systematic corpus is stage snapshots plus three same-cycle reports, not session-to-session handoffs — where the pilot’s two largest reductions (43.1%, 36.4%) and its whole delta regime lived, and which are untested here, not refuted. On 18 samples (source total 15,201 tokens, o200k_base; cl100k_base agrees within noise): the automated packet arm inflated tokens — 16,360 total, −7.6%, larger than its source on 12 of 18 samples (worst −25.5%) — while the same model’s compressed-prose baseline reduced 11.9% and its structured-summary baseline 14.8%, both at 100% measured recall. On the only fair hand-versus-automated comparison (the same 4-sample subset — a subset on which the automated arm’s own reduction, +2.2%, is far from its −7.6% across all 18, so this subset is not representative of the automated arm either, by the paper’s own numbers): hand 38.0%, automated packet 2.2%, prose 18.0%, structured summary 22.9%. The hand arm’s 38.0% lands within 0.1 percentage points of the pilot’s 37.9% — stated as what a single observation against a pilot with roughly 12 points of per-artifact spread is worth (not independently reproduced, not statistically distinguished from coincidence) — so the pilot measurement was not wrong; it measured designer-encoded packets on stage-snapshot-style artifacts, and on this frame, the reduction tracked the encoder — its skill, and, as the recall measure below prices, its tolerated loss — rather than the format. The structured-summary baseline beating the automated packet on tokens, at equal-or-better fidelity, on the same sources, is the uncomfortable result and is reported as such. Three causes are separable in the per-sample data: the corpus is already compressed (telegraphic, identifier-dense; the baselines’ own ceilings show the floor); the completeness rule costs tokens when enforced by an encoder that cannot judge load-bearingness cheaply — the automated encoders routed everything questionable into typed lines, including derived and conflict lines the prose only implied (the assertion-inflation gradient of §9, observed in the wild); and BPE tokenization punishes the line DSL’s kebab-case compound values.

Recall of load-bearing source units — the tradeoff the pilot could not see, measured for the first time. Named recall rather than fidelity here and everywhere in this paper an adversarial review (2026-09-09) found the two conflated: what follows is extraction-side — every judgment starts from a source unit and asks whether it survived — and by construction cannot see the complementary failure, an addition the source never licensed (§1.1’s second failure class, “the prose invited an inference the source forbade”). A packet that preserves all 437 source units and also adds a fabricated derived: X because R(p1,p2) for a rule R that never actually fired would score 100% on this measure; nothing below checks a typed line against its claimed source, only a source unit against its typed line. A precision pass — every typed line traced to a source span or marked NO-SOURCE — is the missing experiment; it is not run here and this paper does not claim it is. Judges extracted 437 load-bearing units from the sources, typed fact / deontic / negative-claim / unknown / identifier; an independent judging pass marked each unit preserved / altered / lost per arm, seeing one arm at a time and never the source. The automated packet preserved 99.3% (434 preserved, 3 altered, 0 lost) — the three alterations being an encoder hedge, a hyphen-mangled regex literal, and one real MUST→SHOULD modality downgrade: I5’s canonical drift, observed in the wild, produced by freehand encoding and caught by this audit’s unit-by-unit judging — which audits fieldless prose the same way; the field is what makes such drift machine-checkable after the fact, and I5’s mechanical refusal, red-proven on synthetic scenarios, has not yet fired on real content. Both baselines preserved 100% — a genuine property of the mild compression they chose, consistent with how little they compressed; whether prose is inherently more faithful is the token-matched experiment’s question. The hand arm — whose reduction is numerically close to the pilot’s 38%, a coincidence of rate rather than a reproduction of the pilot — preserved 82.7% (86 preserved, 17 altered, 1 lost of its 104 units): identifiers weakest (7 of 21 altered — paths and filenames collapsed to categories), one deontic force-downgrade via a misplaced uncertainty marker, and one explicit “asserted not done” conflated with a NOT-CLAIMED fence — a DSL vocabulary trap sprung on the format’s own co-designer. The token win and the completeness rule pull against each other, and the pilot’s 37.9% carried this fidelity cost unmeasured. The honest comparison the table supports is therefore not “packets are less faithful than prose” but: at near-lossless compression every format preserves everything and the packet pays more tokens; at aggressive compression the packet’s losses become measurable — and nobody measured the baselines at equal aggression. Token-matched compression across formats is the missing experiment, stated as future work, not assumed in either direction. An inter-rater check exists where the pilot had none: a second independent judge re-judged the packet arm’s two densest samples (114 units) blind to the first judge’s verdicts — 113/114 identical (99.1%). Reported without a chance-correction, which an adversarial review (2026-09-09) found the number needs: at the packet arm’s own ~99% preserved rate, two judges who each simply marked everything preserved would agree at close to the same base rate without either one reading anything, so raw percent agreement overstates reliability here specifically. The check was not re-run on the hand arm — the one with 17% altered units, where disagreement is actually informative and base-rate agreement would be low — so reproducibility is shown on the easy arm, not the hand arm on which the measured recall loss is largest. Reporting Cohen’s $\kappa$ and duplicating judgment on the hand arm are future work, not attempted here.

Downstream task success — the pilot’s most important silence, closed, with a null result at a ceiling with no power to find anything else (an adversarial review, 2026-09-09, found this qualifier owed at the finding, not left three paragraphs downstream). Six samples (every 3rd of the sorted corpus), eight questions each authored from the source before any encoding existed (≥2 deontic, ≥1 negative-claim, ≥1 open-unknown, ≥1 precise-identifier, the rest factual; identifier questions are graded within the factual tally), one artifact per receiving agent (full source / automated packet / prose baseline), blind grading against ground truth: 144 grades, and the three arms are indistinguishable — 47 correct, 1 partial, 0 incorrect each, the one partial being the same question in all three arms. Per category, every arm scored 15/15 deontic, 7/7 negative-claim, 5/6 unknown, 20/20 factual. A packet handoff does not degrade a receiving agent’s correctness — and neither does honest prose: disciplined prose reproduced none of §1.1’s failure classes on this question set. Two qualifiers cut opposite ways: the encodings were near-lossless, so this is a ceiling effect — the experiment separates formats only at aggressive compression, exactly where the hand arm’s fidelity losses live; and the questions were authored from single sources, so they cannot exercise the format’s designed multi-context advantages (machine-checkable merge, conflict surfacing, digest-pinned dereference), which no single-handoff QA can see.

The delta regime — narrowed, structurally. The pilot’s 57.5% (n = 1) was extended to a chain of five consecutive real session handoffs of one working day, encoded full and as deltas against each predecessor: all four pairs came out longer than full re-encoding (85–95% genuinely new content per hop, plus lines spent retiring the dead threads). The narrowing is structural, not an encoding failure: the pilot’s one pair was two handoffs of the same task, where standing context dominates and pinned references replace restatement; the session chain interleaved four workstreams, so each successor dropped its predecessor’s entire subject matter. The corrected claim, stated exactly: the delta regime pays on within-task handoff chains (confirmed there at 57.5%, still n = 1) and costs tokens on interleaved multi-stream days (4/4 counter-pairs); delta bases must be scoped to a logical identifier, never to wall-clock succession. The measurement also produced the paper’s only direct quantification of the novelty bound (§8.3): 85–95% of each successor hop was content no re-encoding could compress, upgrading “nothing compresses novelty” from an argued reading to a measured one.

Jointly, the four measures say: on this corpus class the typed format buys no tokens and loses nothing downstream; what it exhibits, uncompared, is checkability — the drift, the conflation, and the hedges above are findings only because typed units could be audited one by one. Every per-sample figure regenerates from the committed harness and manifest (§10); no sample was dropped after the draw, and encoder failures are results, per the protocol’s honesty rules.

8.5 The dogfooding and parallel-run evidence

(Re-scoped 2026-08-31, in the light of the second round: the run below was performed on a near-empty store — the 14 revisions of §8.2 — and is, since that round, this paper’s PILOT for the contract contour. A post-draft re-run of the identical four tasks against the 63-revision corpus store confirmed its admission correctness — 4/4 again, superseding this run as the correctness evidence — and contradicted its context picture: projections for the same tasks grew from 2–4 revisions to 12–13. §8.8 reports that re-run; nothing below has been rewritten in its light.)

The substrate was not only measured; it was used — the observation log’s method was to implement one element, exercise it on real work immediately, and record what held and what broke, negative findings first. Separately, the contract contour ran head-to-head against the incumbent free-orientation contour on four real, pre-declared tasks, with the success criteria committed before any measurement existed (the committed criteria file predates the measurements in history — evidence of ordering, auditable at the pin). The record:

The admission gate: 4/4, including the refusals. Each task was admitted through the ternary gate: two $\top$ verdicts (both with an existing governance constraint riding into the projection by scope intersection, with no curation step — invariant I5 as attachment, live) and two honest $U$ verdicts, each naming the missing artifact as an actionable authoring spec. Zero false $\top$: no task admitted $\top$ ever hit a missing artifact mid-task. The refusal path was proven live twice: two $U$ verdicts, each driving a research loop that closed to a $\top$ re-admission; between them the loops authored three artifacts — a provides-token succession, an authoring-capability revision (those two in one loop that ran two levels deep), and a real legacy archive lift. One prediction had to be corrected before the run: the author mis-remembered the store; the store, asked, was right.

Outcome parity, and the two findings that dent it honestly. All four tasks reached headline outcome parity with the free contour. The dents: (1) a projection truncation defect — the deterministic renderer cut an assertion value at 200 characters, mid-sentence, and the executor recovered only by reading the payload source; a projection lossier than its revision violates I12 in spirit. The parallel run caught what the test suite had not; renderer fixed, projections regenerated, parity re-verified green. (2) a secondary over-claim no gate governed: one contract-contour executor inflated a gate’s “OK + count” output into “every row exists” when ground truth was 111 exists + 4 create; the free contour, which read the rows, got it right at 1.6× the token cost. The root cause is recorded, not excused: a projection-only context reduces tokens and reduces the executor’s ability to self-correct beyond the projected claims — the unknown-is-not-zero constraint governed the primary figures, but nothing governed claims about unread data. Over-claim discipline must ride in the projection.

Tokens and focus. The contract contour was cheaper on three of four tasks (by 5%, 38%, and 11%) and costlier on the authoring task (+21% — where, per the committed parallel-run record (results-parallel-run.md, at the v2 evidence pin), the race and the two-level research loop added overhead); aggregate 235.9k versus 256.9k tokens (−8.2%), with the per-task spread as the real story. The projection’s larger, more consistent effect was focus: contract-contour executors used 3–24 tool calls against 6–53, and never wandered. Projections carried 2–4 revisions (3.7–9.4 KB) per task, each with its declared reduction rung. Recurring insufficiencies had exactly one shape — a fact nobody had asserted, most often a payload path — fixable at authoring time and now a recorded authoring pattern.

The two races, and what they say about determinism. The cycle produced two genuine concurrent-authoring collisions, on different artifacts, and the contract’s own rules decided both. In the gap-lift waves, two parallel authoring agents raced on the capability-map artifact: the second hit the first’s just-authored revision, was refused by append-only immutability (I8), never mutated, and recovered via staged succession — a second revision upgrading a byte-pinned provenance string to a digest-pinned object. In the parallel run, two authors raced on the role-developer artifact: the loser was likewise refused by I8 and never mutated, and its candidate was discarded in favor of the standing revision — no succession — after reporting four recorded judgment divergences from that revision on identical inputs: decomposition is not deterministic across same-model authors. The layer’s determinism lives where it is enforced — parity-tested compilation and double-run digests — not in authoring, and the paper claims it nowhere else.

Wrong at birth, observed. A wave-1 authored capability claim passed every gate while being incomplete against its own payload (the payload also enforced a rule the claim omitted), and steered a projection until the free contour’s wider source read exposed it. The invariants verify transfer, not birth (§9’s standing residual risk, now with a live instance): wrong content authored at encoding time is protected wrong content thereafter. The same run also demonstrated the remedy’s direction — both independent executors of a third task falsified the task’s own premise against the store, which is what exposed the instrument defect of §8.6.

What a human still had to decide. Capability enumeration per task (the gate is only as good as the declared requirements); kind/scope/modality judgment inside every authoring act; the race reconciliation; which research-loop artifact to author first. This is the I2 judgment tail, reported as the operator-facing honesty line, and none of it is automatable by the present gate.

8.6 The measurement-error episode, and its recurrence

During this work, the production repository’s own gates produced false measurements twice — the second time in the same file, after the first had been found and fixed. The episode is reported in full because it has become the paper’s strongest methodological thread: curated numbers rot, corrected curated numbers rot again, and the only discipline that held was recomputation from the declared source, in CI.

Two CI gates were written to check store integrity and document-to-graph parity. Each hand-restated the store’s root list instead of importing the canonical definition; one omitted a root holding 55 revisions and invented a root the store does not load. The integrity gate reported 56 dangling dependency edges (a fabricated figure, unrelated to §8.1’s real count of 57 unresolved declared-relation edges — a different edge class, correctly recorded), 22 revisions missing (“content lost forever,” recorded in a 22-line debt registry); the parity gate reported 60 published artifacts as ungraphed. Every “missing” revision was present the whole time; 18 of the “ungraphed” artifacts had revisions in the unread root. Both figures were fiction produced by the instrument.

The first error was caught by the substrate itself: an authoring pass that tried to mint the “missing” revisions collided with the existing ones — the append-only store refused the duplicate identifiers. The correction was structural, not procedural: the root list imported from its single definition, the false debt registry deleted, the corrected gates documenting the incident in their own docstrings — and the corrected parity count, 42 genuinely ungraphed of 125, entered this paper’s first draft as a settled figure.

It was not settled. Two-thirds of it was fiction — from the same gate, by a second error of the same class. During the parallel run (§8.5), an executor found a task’s premise false: an artifact the debt registry listed as ungraphed had two revisions in the graph. Root cause, verified in the gate’s code: the corrected form-parity-check derived every expected identifier as a fixed prefix plus the filename, ignoring the declared identifier in each artifact’s own frontmatter — 28 of the 42 “ungraphed” artifacts had their content graphed under their declared identifiers the whole time. True declared-identifier debt: 14 (8 competencies, 2 skills, 2 policies, 2 constraints — the figure used in §8.1 and §6.3). Same file, same defect class, second instance: an instrument restating (this time, deriving) an identity it should have read. The gate now reads identifiers from frontmatter and raises a tool error on absence; the debt registry was pruned with the correction recorded in place; the gate’s mutation harness was updated and re-proven; and errata were added to the specification parts that had carried the 42.

The generalization is invariant I10 — definitions exist once and are imported by pin, because a hand-copied definition is a measurement error waiting for a divergence — and the episode’s recurrence sharpens it: a corrected curated number is still a curated number. The I10 lint’s first run made the same point at scale, finding five more silent restatements of the store’s identity lists in v1-era analysis code that the first postmortem had missed (§5, I10). And the pattern reached beyond gates into this line’s own research prose: in preparing this paper and its revision, every carried count was recomputed from its declared source, and four discrepancies were found in our own prior documents, corrected here rather than repeated — a ledger file count written as 136 where the repository holds 126 at the relevant commits; a claim of overlapping capability providers where the recount finds none (§6.2); a mission brief’s “7 registered gaps” where the register holds 8; and a gap record’s “~23 requirers” where a live parse of the referenced table counts 115 rows. Every curated summary number this cycle touched was wrong until recomputed. The numbers are incidental; the defect class — restating instead of recomputing — is the one I10 exists to kill, and it appeared in our own instruments, our own analysis code, and our own research documents while we were writing about it.

We report the episode for two reasons. Methodologically, it is a worked example of mutation-proving gates: a gate whose failure mode has never been exercised is not evidence — the first save came from a write-path collision, the second from a live run whose executor checked the premise against the store instead of trusting the task text. Honestly, it calibrates how much to trust any hand-maintained number, including the ones in this paper: which is why every number here is recomputed or cited to the committed artifact that recomputes it.

8.7 Threats to validity

The pilot’s threat list is re-stated with what the evaluation did to each threat; new threats the evaluation itself introduces are added.

1. Hand-encoding by the format’s designers — no longer a threat but the explanation: the risk the pilot named (“incentive gradient toward favorable compression,” “no inter-rater check”) is exactly what the evaluation measured, and the pilot understated it — an independent encoder did not narrow the reduction, it flipped its sign (38.0% vs 2.2% on the same subset, inflation on the full corpus). Unit judging now carries an inter-rater check (113/114); encoding agreement across independent encoders remains unmeasured beyond the one hand/automated pair.

2. Selection — remediated: the evaluation corpus is a systematic every-8th draw with no substitutions, n = 18, committed before encoding. The pilot’s six remain a curated sample and are labeled historical.

3. No downstream measurement — closed, with a null result and two stated qualifiers: ceiling effect at near-lossless compression, and single-source questions that cannot exercise multi-context advantages (§8.4).

4. No baseline comparison — half closed, the other half named rather than waved at. Closed: compressed-prose and structured-summary baselines ran under the same completeness instruction, including the uncomfortable result (the structured baseline beat the packet on tokens at 100% fidelity). What remains is not “no baseline” but four named comparisons. (a) Retrieval-augmented handoff (Lewis et al., 2020): the receiver queries the sender’s corpus on demand rather than being handed a packet — whether transfer is needed at all, and the alternative most deployed systems use. (b) A standard graph serialization with off-the-shelf validation: the same typed content as RDF or JSON-LD (W3C, 2020) under SHACL shapes (W3C, 2017) — whether the contract layer adds anything a standard stack does not. (c) An on-demand tool surface over the sender’s store: access rather than transfer. (d) Token-matched baselines: equal compression aggression across formats.

   Settled by construction, and therefore not performance questions. A verdict-free format cannot lose a conflict in transit because it never carried one: there is no K to launder, so the non-laundering guarantee has nothing to be compared against. A top-k retriever always returns something, so a typed refusal for absence has no counterpart. And a research-phase code read already recorded that the ecosystem’s retrieval path returns text chunks with no typed edges, so nothing downstream can distinguish an edge from its reverse (§1.1, §7) — pinned to that phase, not re-verified this cycle, which bounds it as evidence. The converse is the honest half, and it is stated at the strength the specifications support rather than at the strength that would flatter us. RDF and JSON-LD can carry a digest as a literal, and SHACL Core can require that it be present and well-formed; a four-valued vocabulary is only more predicates. What SHACL Core cannot do is check that a pin is true — the specification defines no hash function, and the words hash and digest do not occur in it. SHACL-SPARQL can reach further, since SPARQL 1.1 supplies SHA256 (§17.4.6); but verifying a pin means hashing the referent’s canonical bytes, which needs the content in the graph and a fixed canonicalization. This is closer to off-the-shelf than the previous sentence claimed, corrected by an adversarial review (2026-09-09) rather than left standing: RDF Dataset Canonicalization (RDFC-1.0, W3C Recommendation, 2024, successor to URDNA2015) is exactly that fixed canonicalization, standardized, not this substrate’s own design commitment — and Trusty URIs (Kuhn & Dumontier, 2014) with nanopublications (Groth, Gibson & Velterop, 2010) already compose fingerprint-verifiable, assertion-level provenance on top of standard RDF, closer to a working alternative than “not off-the-shelf” allows. That distinction is not hypothetical here: this work shipped presence-without-verification in its own I11, where a false pin validated, entered the store and resolved silently until a store-native audit caught it. A shape check that a pin exists is not a check that it is true, and we learned that on our own carrier. So a stack that adds RDFC-1.0 canonicalization, Trusty-URI-style digests, and nanopublication-style assertion binding has re-derived a large part of this contract in standard syntax, closer to the substrate’s own machinery than this paper first credited — and the open question narrows to what the remaining discipline (the algebra of §4, the invariants of §5) costs to author and check beyond that stack, on which this paper still has no measurement.

   A further gap an adversarial review (2026-09-09) named directly. §8.1 and §9 credit this carrier with four things “demonstrably earning” their claim: machine-checkable recall, admission gating, digest-decided concurrency, and projection focus. None of the four has been run against any of the comparisons above. Worse, two of the four — admission gating and digest-decided concurrency — are, on this evaluation’s own record, properties of the store the carrier is admitted into, not shown to require this transport format specifically; if retrieval-augmented handoff or a standard graph store under SHACL validation supplied the same store-side admission and concurrency discipline, those two claims would survive as store properties and evaporate as transport-format claims. This paper does not run that comparison, and so the honest verb for all four is “exhibits, uncompared,” not “demonstrably earns” — corrected throughout §Abstract and §9 to match.

   The comparisons we would win are worth least. An axis where the alternative cannot represent the property is a benchmark designed to be won, and none is run here. The axis where a win would have meant something is tokens — refuted by us (§8.4), which removes the one comparison this work had an incentive to stage.

   What would settle each, and what would falsify us. For (a): one task set run twice, retrieval against packet, on tasks requiring a merge or a surfaced conflict, which single-source questions cannot exercise (§8.4); cost, that task set plus an out-of-family judge (threat 7). Falsifier: if retrieval matches the packet on conflict- surfacing and absence-honesty at equal or lower cost, the premise that these properties must be carried rather than queried fails. For (b): express one real contract in RDF or JSON-LD with digest literals and a four-valued vocabulary, validate with SHACL, compare authoring cost and checkability; cost, the vocabulary is real engineering. Falsifier: if a standard stack — RDF or JSON-LD under SHACL, with SPARQL constraints where Core cannot reach — enforces these invariants including the content-verifying ones at comparable authoring cost, the contribution shrinks to the invariant set and the carrier is a re-implementation. (c) shares (a)’s experiment and (a)’s falsifier: it is the same arm with a typed retriever in place of a text-chunk one, and it is named separately because a reviewer will, not because it earns a separate falsification condition. For (d): re-run the protocol at equal token budgets; cost, low — corpus, encoders and judges exist. Falsifier: if prose at matched tokens preserves load-bearing units as well as the packet, the fidelity claim that survived §8.4 falls with it.

   And what we cannot know without running it. Whether a retrieval-augmented receiver, given a good index over the same store, performs the handoff task as well as a carried contract — we cannot know without running it, and no argument here substitutes for that experiment. The design rests on a claim about what must be carried, supported by construction and by the invariant set, not by any comparison against the alternative most deployed systems use.

5. Tokenizer proxy — carries forward unchanged: two open BPE vocabularies, not the receiving models’ proprietary tokenizer; cross-vocabulary agreement bounds but does not eliminate the concern.

6. Single ecosystem — carries forward: every sample, in pilot and evaluation, comes from one organization’s workflow conventions. 6a. The corpus is self-referential, and this is a sharper limit than item 6. Of the 44 admissions in the live journals, 43 declare scope {ecosystem: true} — they are tasks about building, measuring and governing this substrate. Exactly one declares a product scope ({project: "angry-bt"}), and it was admitted U with kind_of_gap: charter-absent and has not been re-admitted since. So the claim “exercised on real work” is true and the work is real, but it is work of one kind: the system has demonstrated that it admits tasks about itself, and has one recorded attempt — refused for a stated, correct reason — at admitting a task about something else. A reader entitled to ask whether the discipline survives contact with domain work will not find that answer here, and the honest form of this limit is to say so rather than to let 44 admissions imply a variety the scopes do not contain.

7. Same model family throughout — the encoders, baselines, judges, and receiving agents are all the same model family as the format’s designers. Fresh-context and spec-only setups remove design-session memory, not family style; a same-family judge may miss losses a different family would catch. This is the evaluation’s deepest residual threat and is not mitigable from inside one family.

8. The parallel run is n = 4 with the orchestrator as adjudicator — criteria were pre-committed and per-task results are itemized, but four tasks support existence claims (the gate can refuse honestly; the loop can close), not rates. No statistical inference is attempted anywhere in this paper, and none should be read into any mean.

9. Validator refusal codes: sensitivity, check removal, and admission order. Co-evolution of a corpus and its checks can make evidence circular: tasks may have been authored to require the checks that admit them. We distinguish two experiments. The earlier experiment asks whether perturbing committed content raises a code and whether that content predates the code. The second, run on 2026-09-12, uses the stronger witness definition: removing one rejecting check admits a revision whose named downstream task then fails.

   This is not a test of the algebraic laws. None of Theorem 1, Proposition 5, I4 or I5 — the load-bearing negative results of §4 and §5 — is among the 26 codes the earlier 86-code sensitivity replay reached (membership in the current replay’s 31 witnessed codes was not re-checked); the catalog it replays is the validator’s refusal codes, not the law table. For the algebraic laws the co-evolution objection remains untested by this paper, stated plainly rather than folded into the codes result.

   Check-removal experiment. The named task is production of a revision’s human-readable Markdown projection by the existing renderer. It is a real substrate operation, not execution of the procedure described inside a Skill or an external LLM’s work task. We freeze the store and implementation at c329c7c339d06339e947c1fef48e2a2ced6a26ec. Each original revision must render successfully. We then generate the same structural perturbations used by the sensitivity experiment: missing or mistyped envelope fields and edits to fields in the first three assertions, with and without recomputing the payload digest.

   Each candidate is assessed in a counterfactual in-memory snapshot. If another blocking code remains, removing the selected code has not admitted it. Otherwise the real revision writer is run twice in a fresh temporary directory: first with its normal validator, then with only the selected code’s rejection suppressed. This is removal of that code’s admission decision; the remaining checks still execute. A witness requires normal rejection, an actual write after suppression, and an exception from the unmodified renderer reading those written bytes after suppression has ended. A validator exception is not a downstream-task failure. Temporary first writes do not demonstrate that an existing committed revision could be overwritten: append-only protection was not removed.

   Earlier experiment — the sensitivity replay.

   The result, published in the direction it fell. Of 93 enforced refusal codes, 31 are witnessed on real store content and 62 are not witnessed by this method at all (counted and named, folded into neither answer). Of those 31, 10 have at least one witness that entered before the code, and 21 have none.

   These figures moved from the 86 / 26 / 60 this section first published, and the direction is worth stating: the level preflight (require_scope, require_store_levels and the record-level checks beside them) added 7 enforced codes, of which 5 are witnessed and 2 are not. Nothing left the catalog. Two codes that had been witnessed stopped being so when that preflight first landed — INVALID_SCOPE on 141 revisions and INVALID_VERSION_OR_SCHEMA on 40 — because the new refusal arrived earlier and displaced the more precise one; both were restored before these numbers were taken, and the restoration is the reason the counts add rather than trade. A law that is still enforced but no longer observable is how a law quietly becomes decoration, and this replay is what caught it.

   The ratio that carries information is the smaller one, and it is stated instead of the flattering one. The first store content and the validator entered in the same commit, so a code introduced there cannot have a pre-existing witness whatever its quality: 16 of the 31 are undecidable by construction. Among the 15 the test can discriminate, 10 are evidenced on content that predates them — LEVEL_ABSENT (165 of its 165 witnesses), LEVEL_MALFORMED (165 of 165), INVALID_ATTACHMENT_TYPE (40 of its 46), INVALID_EQUIVOCAL_PIN (30 of 30), INVALID_COST_RECORD (17 of 17), PROJECT_SCOPE_REQUIRED (6 of 6), DEROGATION_TARGET_INVALID (2 of 2), LEVEL_IDENTITY_ABSENT (1 of 1), LEVEL_TARGET_MISMATCH (1 of 1) and RESTRUCTURE_UNAUTHORIZED (1 of its 7) — and 5 are not: CHARTER_UNANCHORED, RESTRUCTURE_UNRECORDED, LEVEL_UNREGISTERED, LEVEL_AMBIGUOUS_SPECIFICITY and DEROGATION_SELF_GRANTED. For those five the objection stands — tested, and unrefuted.

   These four figures also moved, and this time the movement runs in the direction that flatters the design — 6/25 became 10/21, and 6 of 11 discriminable became 10 of 15 — which is precisely why it is stated rather than absorbed. The whole gain is one group: the level preamble (LEVEL_ABSENT, LEVEL_MALFORMED, LEVEL_IDENTITY_ABSENT and LEVEL_TARGET_MISMATCH), enforced at a position later than all 165 revisions it can raise on, so every one of its witnesses necessarily predates it. A law that arrives after all the content it governs scores perfectly on this test because it arrived last, and that is a fact about the ordering, not evidence that the law was discovered from the data. The five laws that carry the objection did not change, and the objection is unaffected by the improvement: a ratio cannot be argued up by adding laws whose favourable score is guaranteed by their commit date. The currency rule of §8.10 is what caught the drift; the figures above were re-measured on 2026-09-15 and are bound to a live replay by kc2/tests/test_law_order.py, which fails when the prose and the instrument disagree — as it did, for these four, before this edit.

   RESTRUCTURE_UNAUTHORIZED moved out of that list, and how it moved is the point rather than the gain. Its one pre-existing witness is arcanada-authority-level-map@r1 under drop:schema_version, and that witness was unreachable for as long as the authority map’s reader refused a wrong schema_version by raising: the replay counts an exception as a crash, not a witness, so the perturbation produced nothing to observe. The refusal was correct and the record was still rejected; only the observation was lost. Returning an empty map there — leaving the schema verdict to the validator that owns it — restored it. One code left the standing-objection list because an instrument was repaired, not because the evidence changed.

   Second experiment — check removal (2026-09-12).

   Across 165 clean rendering controls, there were 10582 candidate revisions, of which 10303 reached a validation verdict and 279 raised during validation (not measured for admission). Removing one code admitted 4424 candidates; 900 then failed the rendering task. The code-level result is 3 witnessed, 6 with no rendering failure observed, and 84 not measured for downstream failure out of the same 93-code catalog. The three witnesses are INVALID_STRUCTURE, INVALID_ASSERTION_KEY, and INSUFFICIENT_STRUCTURE. Examples are a missing envelope kind, a missing assertion key, and a missing relation: after admission each reaches a corresponding field access in the renderer and raises. All clean controls pass. Successful rendering is only absence of an exception; semantic accuracy is not measured by this oracle. In particular, malformed modality, schema, or digest can still yield text, so passing this task does not establish safety.

   The six codes with admitted candidates but no observed rendering failure are INVALID_DIGEST_MISMATCH, INVALID_ID_FORMAT, INVALID_KIND, INVALID_MODALITY, INVALID_SUCCESSION_SHAPE, and INVALID_VERSION_OR_SCHEMA. The 84 unmeasured codes are partitioned explicitly: two, BRIDGE_STALE_RELIANCE and CHARTER_STALE_ANCHOR, are nonblocking markers at this gate, so they cannot satisfy the rejection-to-admission premise by construction; 22 have candidates but no isolated writer admission; 60 have no rejecting candidate in this probe frame. This last group includes operation-specific checks on merge, transfer, runtime journals, and promotion, for which revision writing and rendering are not the relevant operations. The reproducibility supplement lists every code, its disposition, and the reason. Absence from the probe frame is a measurement limit, not evidence that a code is unnecessary or impossible to witness.

   The older sensitivity result, retained as a different measurement. The history replay orders by first-parent ancestry position rather than timestamps and dates a code at its enforcement’s entry, not its catalog entry. Here only, a sensitivity witness means that perturbing a source revision raises the code. Of 86 enforced refusal codes, 26 are witnessed on real store content and 60 are not witnessed by that method. Of those 26, 5 have at least one witness that entered before the code, and 21 have none. Because the first validator and store content entered together, 15 of the 26 are undecidable by construction. Among the 11 the test can discriminate, 5 are evidenced on content that predates them: INVALID_ATTACHMENT_TYPE, INVALID_EQUIVOCAL_PIN, INVALID_COST_RECORD, PROJECT_SCOPE_REQUIRED, and DEROGATION_TARGET_INVALID. The other six are CHARTER_UNANCHORED, RESTRUCTURE_UNAUTHORIZED, RESTRUCTURE_UNRECORDED, LEVEL_UNREGISTERED, LEVEL_AMBIGUOUS_SPECIFICITY, and DEROGATION_SELF_GRANTED. These figures describe sensitivity and ancestry, not task failures. In particular, the cost-record sensitivity probes start from revisions of other kinds; that result cannot establish a cost task failure. Excluding that code leaves four sensitivity cases, not three check-removal witnesses.

   What the stronger experiment settles. None of its three witnessed codes has a failing source revision that predates its enforcement: all three entered with the first store. Thus 0 check-removal codes have a pre-enforcement source witness in this run. The earlier 5-of-11 ratio supplies no admission-order independence for the new task-failure result. Even a pre-existing source would establish only source-entry order: the corrupted candidate and the experiment were constructed later, and the check’s designers could already have read the source. Independent corpus authorship and downstream LLM task success remain unmeasured. The broader assertion that every code has a real task that fails without it is withdrawn; the measured claim is three codes on this rendering task and this probe frame.

   The fourth witness was lost to a later change, and that is the result rather than an accident of bookkeeping. At the original pin (dade260d) the experiment witnessed four codes, INVALID_SCOPE among them. Re-running it at this branch’s own pin returns three: INVALID_SCOPE is now NOT_MEASURED — “no isolated writer admission; co-refusals, writer guard or admission exception remain”. The cause is #333, which replaced a silent scope default in kc2_admission.py with D.require_scope(...). The enforcement moved EARLIER, so the code can no longer be isolated by masking one diagnostic — the candidate is refused before the masked check is reached. The law did not weaken; it stopped being separately observable by this probe, and the count is reported at what the probe can now see rather than carried forward from a pin the tree has left. Unmeasured outcomes rose 76 -> 84 for the same reason.

8.8 Added after this draft’s evaluation round: the corpus lift and the full-store re-run (2026-08-31)

This subsection postdates the original evaluation. The evaluation and parallel run closed at the v2 evidence pin (41c480a, 2026-08-30); what follows happened in a second round — the post-draft requirements of §9.1 implemented, then a bulk lift of the incumbent framework’s knowledge corpus, then a re-run of §8.5’s four tasks against the store that lift produced. It is appended rather than folded in, so that no earlier section’s claims silently inherit evidence that did not exist when they were written; where a result below contradicts one above, the contradiction is stated here. Later revisions of the manuscript refer back to this dated result; they do not change its measurement pin.

The corpus: 41 items lifted by reading, zero refusals, two drift findings. Forty-one knowledge items of the incumbent orchestration framework were lifted into the store by five parallel authoring waves under one written protocol — every item’s full source read, and the frozen v1 archive consulted before memory. The store, 14 revisions at §8.2’s pin and 20 at the start of the lift, grew to 63 (kc2/OBSERVATIONS.md, OBS-013; the store recount from disk agrees). Thirty-nine of the 41 items had revisions in the frozen archive to lift against, and sixteen of the lifted items’ structured payloads were proven round-trip digest-exact — decomposed into assertions and recomposed to the archived payload’s exact bytes (counted from the ledger’s per-row notes). The reading discipline caught two real drift findings the lift would otherwise have laundered: one item’s live source has drifted from its archived body (declared in the residue, assertions following the live source, both digests pinned), and another’s live body has grown roughly eleven sections past its archived revision — recorded as succession debt for a deliberate later revision rather than silently folded in, because folding it in would have broken the loss detector. Across all 41 items the validator issued zero refusals — §8.2’s learning-curve observation at full scale, with its honest reading stated in place of the flattering one: on a mature protocol with worked examples in the store, the validator’s value shifts from catching errors to making the clean result provable. Zero refusals on a first wave would have been evidence of a toothless gate; zero refusals across five waves, from a gate whose refusals are mutation-proven red, is evidence about the protocol — evidence bounded the same way §8.5’s own “wrong at birth” finding bounds it, named here rather than left implicit (an adversarial review, 2026-09-09): a validator proven able to fire is not shown able to catch every class of error, and §8.5 records one class — content incomplete against its own payload — that a real claim carried through every gate with zero refusals. Zero refusals here is consistent with a genuinely clean lift and with the same blind spot recurring unexercised; this section does not distinguish the two, and neither claim is made stronger than the other by the count alone. The lift was also the first real exercise of §9.1’s placement judgment: all 41 items placed at universe level, each with a recorded one-sentence rationale; one recorded as intended for space level, blocked on the operator registration §9.1 names; zero project-level placements.

The correspondence ledger: 120 items, four verdict classes, a gate that cannot restate. The incumbent framework’s full surface is accounted for in a correspondence ledger (kc2/exit/correspondence-ledger.tsv): 120 rows, one per surface item — 43 lifted / 57 covered-by-mechanism (the item’s job is done by a substrate mechanism rather than by a lifted artifact) / 18 dropped (each with its recorded rationale) / 2 pending, both pending rows mechanism-blocked and named rather than silently open. The correspondence is not always one-to-one — the 1:N shape was needed twice on the lift’s first day (one item decomposing into a skill plus a constraint), confirming a warning recorded at design time — so rows count surface items, not lifted revisions. The builder enumerates the surface from disk and joins the live store — never a hand-maintained roster — and the gate that checks the ledger likewise reads disk and store and is itself mutation-proven red on five paths, because this line has twice been burned by an instrument restating what it should have read (§8.6); the class counts above regenerate from the rows.

Stage B: the verdicts hold and the projection degrades — the completeness-cost prediction confirmed with numbers. §8.5’s four tasks were re-run against the 63-revision store (kc2/exit/results-stage-b.md). Admission correctness held completely: 4/4 verdicts correct, no false admissions at scale, admit time flat at ~4–5 ms. The executor’s context did not hold: projections for the identical tasks grew from the pilot’s 2–4 revisions to 12–13 revisions (107–118 assertions); one task’s rendered projection grew 3.7 KB → 33 KB (8.9× — 33/3.7; an adversarial review, 2026-09-09, found the earlier “8.8×” did not match the two rounded figures either side of it), its executor’s cost 38.5k → 50.9k tokens (+32%), and the executor’s own relevance inventory found roughly 80% of the attached governance dead weight for the task — 2 of 12 projected revisions did real work. The cause is structural, and §3.5’s own mechanism names it: governance attaches by scope intersection, {ecosystem} intersects every task scope, and the corpus added many governance revisions whose declared scope is {ecosystem} while their actual applicability lives in their values (“boundary-touching tasks,” “publishing workflows”) — and REDUCE may not remove them, because I5 protects attached governance from reduction by design. The claims inventory paired that prediction with exactly this test (“measure contract-size cost of completeness”), and the claims walk carried the completeness/token-economy tension as an at-risk prediction; the bill has now arrived, with numbers. Completeness-by-intersection stands confirmed as a correctness mechanism and stands measured as a token liability at corpus scale.

That one task’s 2-of-12 is not an outlier, and the store-wide figure is the one that belongs in the paper rather than in an evaluation file. Across 63 probes, 1432 of 1495 projected revisions — 95.8% — arrive by scope intersection rather than because the task asked for them; closure contributed zero, because no provider in the live store declares dependencies. Re-measured on 2026-09-15 against a store that had meanwhile grown from 135 to 165 revisions, the share is unchanged at 95.8% (1480 of 1545): it is a structural property, not a sampling artifact of one store size.

This is the measured counterweight to §6.1a and it is stated here rather than folded into it. Selectivity of disclosure is real: a task is disclosed 24–31 revisions out of 165, and the walk stops for typed reasons. Selectivity of selection, within what is disclosed, is almost absent: of roughly 24 revisions in a typical contract, about one is task-specific. The mechanism responsible is the one §3.5 specifies and I5 protects, so the number is not a defect report — it is the price of completeness-by-intersection, quoted. It does mean that §3.5’s “projection granularity is the assertion” describes a capability of the format and not the observed behaviour of the resolver: selection today is per-revision, not per-assertion, and the paper should not be read as claiming otherwise. The recorded remedy direction is an authoring discipline plus vocabulary growth — constraints scoped as finely as their own applicability conditions, and task-class scope axes the closed vocabulary does not yet have — and it is explicitly not implemented in this cycle: silently weakening attach-by-intersection would trade away I5, and that trade is the operator’s to weigh with this paper in hand.

What survives of §8.5’s context picture. The fat-projection executor stayed at 5 tool uses and reached the correct outcome — with the honesty discipline, if anything, stronger: it carried the lifted capability’s earned limitations into its report unprompted — but at the token cost above. Focus survived; minimality did not.

Composition at scale. The three project compositions on the full store carry 392–425 assertions (241–258 KB) each — the same coarse-scope effect, wholesale. Compose stays cheap (29–41 ms), and the cache’s rebuild-versus-hit ratio (~12×) now measurably matters where at pilot scale it did not; the one real derogation of §9.1 still resolves correctly at scale — exactly one derogated entry, only in the granted project. One recount for §6.2’s ledger: the 63-revision store declares 49 capability tokens, still each provided by exactly one logical identifier — the hardness case remains vacuous at corpus scale, and R2/R3 remain unexercised in anger.

The second round’s threat profile is §8.7’s, unimproved: the same four tasks (n = 4, existence claims, not rates), the same model family throughout, and the dead-weight inventory is the executor’s own accounting, not an independent audit.

8.9 The third instrument correction: the surface itself (2026-08-31)

This subsection postdates §8.8 by a day and corrects that subsection’s own measurement frame; under this section’s stated rule, §8.8’s text stands unchanged as the record of what was claimed when, and the contradiction is stated here.

§8.8 reported the correspondence ledger as 120 rows accounting for the incumbent framework’s “full surface,” built by a tool that “enumerates the surface from disk and joins the live store — never a hand-maintained roster.” The enumeration did read from disk — from three hand-chosen directories. The framework’s real surface, derived rather than chosen, is 1257 files; the three directories the builder walked hold 237 of them (Correction, 2026-08-31 — the recount says 187; see §8.12) (kc2/tools/build_ledger.py, docstring; row count recomputed from kc2/exit/correspondence-ledger.tsv). Every “corpus complete” claim in §8.8 was honest arithmetic over a denominator that was never the real one. The operator caught it; the instrument did not.

This is the third instance of the defect class §8.6 reports, and each instance wore a new dress: the first gates restated the store’s root list; the corrected parity gate derived identifiers it should have read; the ledger builder walked hand-chosen roots while its own description said “from disk.” All three enumerated honestly within a frame that was itself restated — which sharpens §8.6’s generalization by one clause. Recomputation from the declared source is not enough when the frame — the root set, the identifier authority, the denominator — is itself a hand-stated input: recomputation must include the frame, and the red path for the case nobody enumerated must be installed and proven, never assumed. The corrected builder and gate derive the framework root from the framework’s own structure (the parent of the commands symlink target — nothing in either tool names the root’s path), state exactly one exclusion (.git, VCS internals) with its justification, and the gate is mutation-proven to go red on a file in a directory nobody thought to enumerate — that case now draws the same MISSING_LEDGER_ROW refusal as any other (scripts/bin/kc2-ledger-check.py; kc2/OBSERVATIONS.md OBS-015, six mutation paths proven, the un-enumerated-directory case among them).

The honest numbers, recomputed from the corrected ledger: 1257 rows, one per file — 43 lifted / 142 covered-by-mechanism / 924 dropped / 148 pending. Every drop is a decision with a contents-grounded reason recorded in its row, never an omission; every pending row is visible — pending is the only default state, and none is silent. §8.8’s 43/57/18/2 stands above as what the minority frame could see.

Two findings from the classification itself, and one open problem, carried honestly. A contents-based audit of the drops re-opened 4 of the 17 audited — most consequentially, the dropped visual maps’ entity-relationship diagrams turn out to encode relational knowledge the store does not hold: the role→skill bipartite structure and the panel-membership vocabulary exist nowhere in it, and are flagged for lift as relations, not pictures. And the audit surfaced a genuine limitation of the substrate, recorded as an open problem rather than smoothed over: near-duplicate accumulation in an append-only store. I8 refuses only exact-digest duplicates and I4 only contradictions, so redundant-but-consistent content accumulates silently, and nothing in the invariant regime names it. Whether the remedy is semantic deduplication or an accepted loss is an undecided design question, stated as such (OBS-016).

8.10 The day after: the store keeps moving, and a recount that did not survive its own frame (2026-08-31)

This subsection postdates §8.9 by hours and follows the same rule: every earlier section stands as the record of what was claimed when, and this one states what moved. It exists because this paper’s own audit flagged exactly the class of figure it contains — a number true at its pin and already behind the store by the time a reader meets it.

At eb7c7e4 (2026-08-31, after a further day of requirement work — charters, supersession, restructuring, project identity, and the demotion half of the learning loop, none of which this paper describes): the refusal catalog holds 69 typed codes — the same coverage harness proves every one red, and its counter still fails on a missing scenario, so the growth from 27 arrived only through the proven-red door; the live store holds 134 revisions of 105 logical identifiers; the gate battery reports 40 gates passing with one standing environmental failure and the suite 399 tests; the correspondence ledger still holds 1257 rows, now 88 lifted / 190 covered-by-mechanism / 12 covered-by-revision / 967 dropped / 0 pending — §8.9’s 148 pending rows have all been dispositioned, and the classification grew a verdict class (covered-by-revision) that §8.9’s frame did not have.

One recount initially looked qualitative and was not — and the correction is this subsection’s most instructive content. Correction, same day (2026-08-31), before publication. A first version of this subsection reported six of the store’s 62 declared capability tokens as having more than one provider and declared §8.8’s vacuity finding overturned. The count was wrong by frame: it tallied providers per revision file, and in an append-only store a re-revised artifact then counts its own superseded revisions as alternative providers — testing held at r3, r4 and r5 of one logical identifier is one provider, not three. Recounted per logical identifier (both over all revisions and over latest-per-identifier), the 62 declared tokens are each provided by exactly one logical identifier: §8.8’s sentence stands, the hardness case remains vacuous at this scale, and R2/R3 remain unexercised in anger. The error is the fourth instance of the defect class §8.6 and §8.9 report, in a new dress again — an instrument enumerating honestly within a frame that was not the claim’s frame (first restated root lists, then derived identifiers, then hand-chosen directories, now a per-file denominator for a per-identifier claim) — and it was caught by the operator’s independent recount during pre-publication review, which is why it appears here as a correction rather than as published text.

The currency rule, stated once for every number above: this subsection is a dated record like its predecessors, not a maintained-forward figure. The catalog, the store, the battery, and the ledger each own their current values (kc2/src/kc2_defs.py, the store recount in kc2/tools/kc2_state.py, kc2/tools/run_gate_battery.sh, kc2/exit/correspondence-ledger.tsv); a reader who needs today’s numbers recomputes them from those sources — per I10, never from this text.

8.11 The fifth instance: a first run’s report read as a census of the class (2026-08-31)

This subsection postdates §8.10 and corrects a sentence §8.1 has carried since the first draft — found not by this line’s own instruments but by the operator’s refusal to accept a closure that had verified existence where the claim stated a count.

§8.1 says the five-stage v1 resolver “ran one real end-to-end resolution to the Bound state.” The store says otherwise, and said otherwise at this paper’s own v1 pin: counting resolutions whose committed bundles carry a populated BindingRecord — the record the Bind stage mints, and null exactly where a resolution’s own receipt says “no Binding Record requested” — yields twenty at 63f66b2, nineteen beyond the talo-0021 delivery run the sentence was written from: the operational resolutions under architecture/reports/ (the support-center integration, four launch-epoch resolutions, deploys, publications, a competency promotion, among others), each produced by the same five-stage pipeline against the same pinned 149-revision graph, per its own receipt. The sentence was inherited from the resolver’s delivery report — which honestly documents its own first run — and never recounted against the class it quantifies. That is the defect §8.6, §8.9 and §8.10 report, in its fifth dress: restated root lists, derived identifiers, hand-chosen directories, a per-file denominator — and now a report of the class’s first member read as a census of the class. The audit that first closed this question repeated the error in miniature: it verified that a Bound record exists and stopped, when the claim’s subject was the count; the operator’s second look forced the recount.

Two things the correction does not disturb. The v1 resolver remains history, superseded by the v2 eight-step resolver — all twenty Bound resolutions predate the freeze, and “was not exercised with fresh resolutions this cycle” stands. And the direction of the error is the unusual one: the n = 1 figure understated v1’s operational record — the resolver ran to Bound routinely, so the existence-in-motion evidence was stronger than the paper claimed, not weaker. A wrong number is a wrong number regardless of the direction it flatters; it is corrected, not kept for being modest. The count derives from the enumeration, never from this text: populated binding_record fields across the store’s committed *.bundle.json, at whichever pin the reader needs.

8.12 The inheritance sweep, and the gate it produced (2026-08-31)

§8.11’s fifth instance implied a question the operator then asked directly: which other figures in this paper were inherited from an upstream document rather than recomputed during the paper’s own runs? This subsection is the sweep’s record, and it postdates everything above it.

Method: for every quantitative claim about the running system or its record, ask not “is it right” but “where did this number come from, and was it recounted here against its class” — then recount it now, from the declared source, at the pin the claim names. Recounted true, listed so the next auditor extends the sweep rather than repeats it: the v1 store’s 324 revisions of 210 identifiers across 55+147+122, its census trio 324/293/57, the 346-file freeze manifest and its 22 gap records, the 16 v1 refusal codes, the 22 single-provider v1 capability tokens, 14-of-125, the v2 store’s 14 revisions of 11 identifiers with 6 declared tokens and 27 codes at the evidence pin, the 45-code catalog at the §9.1 addendum’s own commit, the 63-revision store with 49 single-provider tokens and the 120-row 43/57/18/2 ledger at the §8.8 recount’s commit, the 8-record exists-outside gap register, the capability map’s 115 rows, the 43 template rows, and §8.10’s dated figures at their pin.

One figure failed the sweep, and its provenance is the finding. §8.9 says the three hand-chosen directories “hold 237 of” the 1257-file surface. The three directories hold 187 — on the live surface, in the surface’s own tracked history at and before the day of writing (180→187 across August; no state holds 237), and as ledger rows today. The 237 was minted in the corrected builder’s own docstring — inside the very correction that fixed the third frame-class instance — and propagated from there into a specification part, a requirements response, and this paper. A correction is a claim like any other; this one carried a miscount about the frame it was correcting, and nobody recounted it because it arrived wearing a correction’s authority. The origin docstring, the specification part, and the requirements response are corrected at source, dated; §8.9’s text stands as the record, with a dated pointer. Sixth instance of the class.

The mechanism, because six instances earn one: scripts/bin/paper-figure-provenance-check.py recomputes, from its declared source at its named pin, every machine-derivable figure this paper states — the store counts through git at their pins, the Bound-resolution enumeration, the refusal-catalog counts at three commits, the ledger states, the register classes, the three-directory count itself — and fails loud on any mismatch, and on a paper sentence that no longer carries the figure its manifest row anchors to. Figures that regenerate only from committed measurement artifacts (the pilot and evaluation tables) are printed as INHERITED-LABELED with the artifact named — visibly, never counted green. The gate runs in the battery and is mutation-proven red on a tampered expectation, a vanished anchor, and a narrowed enumeration frame — because a checker of inherited counts that was never itself shown able to go red would be this class’s next instance waiting to happen.

9. Discussion, limitations, future work

What is established. A carrier and six operations with their laws settled by proof or counterexample, four of the six algebraic structures now instantiated and law-tested; a sixteen-invariant integrity regime enforced or honestly tier-labeled by a running implementation, with every code in the refusal catalog mutation-proven red (27 at the evidence pin, 69 at the §8.10 recount); a hardness result motivating declared reduction rungs and a bounded, replayable provider-cardinality optimum, without a minimum final-context claim; a frozen production archive and a live dogfooded store demonstrating the storage discipline; an admission gate that refused honestly and never falsely admitted across four real tasks; and an evaluation establishing that the format’s token economy is not a format property — in the one encoder pair measured, the reduction tracked the encoder, its skill and its tolerated loss — that its fidelity is machine-auditable at the unit level, and that a packet handoff neither helps nor harms downstream correctness on single-source questions.

What is not established, stated against ourselves. (1) Token economy as a format property, on the stage-snapshot-dominated frame this paper measured — session-to-session handoffs, where the pilot’s own largest reductions lived, are untested here (§8.4); no figure in this paper should be read as a format compression claim beyond that frame. (2) Independence of the evaluators — every encoder, baseline, judge, and receiver is the same model family as the format’s designers; nothing here is evidence about what an independent family would preserve, judge, or answer. (3) Generality — one organization’s corpus, one ecosystem’s conventions, a single-provider store on which the hardness case is vacuous today (every capability token, v1 and v2 alike, has exactly one provider; R2/R3 have never run in anger). (4) Parts of the layer itself — precedence is not yet a stored, versioned meaning object; I16’s admissibility-before-deontics gate is enforced at bind time as the capability-envelope check (§5) — an earlier “no bind-time consumer” here was stale against that update, found by an adversarial review, 2026-09-09; I6’s transfer cross-check awaits the packet-consumer seam; the evidence polynomials are unimplemented and the cost layer is implemented but unmeasured at scale, competence distance included (§7, §4.10) — a fifth stale “unimplemented” corrected 2026-09-15 against the repository’s own 14 cost records. (5) Legacy content — prose-era artifacts lift only partially: the one real legacy lift decomposed six deontic rules cleanly and carried the rest as a declared residue assertion; “fully decomposable” would have been a false claim, and most of the archive is prose-era. (6) Multi-context advantages — the properties the format was designed for (checkable merge, conflict surfacing, pinned dereference) are exactly the ones a single-handoff QA cannot see; they remain measured nowhere. (7) The algebra’s laws bind implementations of this carrier; nothing is claimed about other carriers (§4.9 practices the same restraint it asks of others) — with one stated exception: Theorem 1’s construction is portable to any transfer discipline whose merge is set-union-like and whose constraint language admits a cardinality constraint, so “validate the parts, trust the whole” is unsound well beyond this substrate. The portability is argued, not exercised: no second, independent substrate has run the construction.

Costs the design imposes on itself, now with measurements attached. The escape rule (§4.11) means the format is never lossier than prose only if encoders obey it — and extraction is now the measured weakest link: the losses concentrate at encoding (17.3% of units in the hand arm), the invariants verify transfer, not birth, and the wrong-at-birth risk has a live instance — an authored capability claim that passed every gate while incomplete against its own payload (§8.5). Authoring is not even deterministic: two same-model authors produced four divergent judgment calls on identical inputs; determinism lives in parity-tested compilation, not in authoring. The closed vocabularies that make conflict detection decidable are themselves a single point of semantic failure, with one organic wrong-row instance on record (§5). Assertion granularity invites inflation — no longer hypothetically: the automated encoders routed everything questionable into typed lines and inflated their packets past their sources (§8.4); the profile-lint-distribution mitigation remains unimplemented, so the cost is currently paid, not managed.

A removal, its precedent, and the distinction it forced. Reporting the I16 withdrawal (§5) required a three-way distinction the harnesses had been eliding: a rule may be idle — a real population meets it — unexercised — capable, but nothing has ever entered its population — or incapable, unable to fire at all. We have not found the three named together as a set and claim them at the size of a paragraph; naming their neighbors keeps the distinction deliberate rather than naive: unexercised is the vacuity case, idle a coverage-gap case, and incapable nearer unsatisfiability (§2.10).

Publishing the removal itself as a result has precedent. Vacuity detection was born as this kind of finding — Beer, Ben-David, Eisner & Rodeh (2001) built industrial tooling because trivially-passing formulas were a recurring practical problem, so the result was the discovery that a passing check was empty; Çelik et al.’s (2019) headline is live mutants exposing incomplete specifications; and Piranha (Ramanathan, Clapp, Barik & Sridharan, 2020) published the deletion itself, with cleanup diffs for 1,381 stale feature flags, 17% of all flags at Uber, 65% of them landing unchanged. The I16 census belongs in that company: three clauses withdrawn after the pinned 2026-09-03 census (§5) found zero of 1544 assertions across 163 revisions carrying the field they guarded — the full population at that pin, not a sample — with each clause first shown capable of refusing an injected real record, so that the result reads unexercised rather than incapable. Software engineering has a venue precedent for findings of this shape (Paige, Cabot & Ernst, 2017). The bar we hold the census to is that a negative result must not be an artifact of an underpowered design, which is why the denominator, the capability probe, and the unmutated control are reported beside the zero rather than after it.

What that leaves as ours is narrow, and is worth stating against the lineage in §2.10 rather than apart from it. Not the mutation; not the vacuity notion; not the inference from a live mutant to an incomplete specification. The proposed retention criterion is a governance rule: retain a check on the strength of a named production witness, or publish the census and the decision to remove it. This paper has not established that criterion catalog-wide. The new experiment witnesses three codes on one rendering task; its 84 unmeasured outcomes are not grounds for deleting checks (§8.7). Applying the proposed rule requires distinguishing a check with no relevant population from one whose relevant task has not been tested.

Future work, in order of evidential leverage. (1) Token-matched compression across formats: compress the baselines as aggressively as the hand arm and audit units at equal token budgets — the experiment that decides whether the packet’s structure earns its tokens under pressure, and the one §8.4’s fidelity table explicitly cannot decide. (2) A multi-context evaluation: tasks whose answers require merging two contexts, surfacing a conflict, or dereferencing a pin — the format’s designed advantages, measurable by no single-handoff QA. (3) An alternative-substrate arm: retrieval-augmented handoff and a standard graph serialization under shape validation, run against the packet on the same tasks — the comparison §8.7’s fourth threat names, carrying the falsification condition stated there. (4) Independent-family evaluation: encoders and judges from a different model family. (5) The named implementation gaps, in this order: precedence as a stored meaning object, I6’s transfer cross-check, then the cost layer at a scale beyond the five weighed edges its ledger mining reached — bind-time capability-envelope evaluation (I16’s gate), once named here and by an independent migration survey as the top missing piece, is implemented, wired into the resolver, and tested (§5); a fourth stale copy of “not yet” caught by an adversarial review, 2026-09-09, alongside the three in §1.2, §8.2, and this section’s item (4) above — all four traced to the same 2026-09-03 update not having propagated. (6) A synthetic, releasable handoff corpus in the shape of the internal one (§10). (7) The audits still owed before any publication: the convergence-register date audit and the FPF provenance audit (§10), and a re-run of the related-work search dated August 2026 (§2.3). (8) The deferred continuous geometry, if and only if its trigger condition (a continuous embedding with meaningful interpolation) is ever met.

9.1 Three architectural gaps found after this draft’s evaluation round (2026-08-30)

The architectural comparison in this subsection starts from the evaluation-close pin (41c480a, 2026-08-30). Later dated corrections elsewhere in the paper use their own pins (§1.3). Immediately after that close, the operator’s review of the draft identified three architectural gaps this draft did not see — none of them existed in the specification, the implementation, or any earlier section’s claims when the preceding evidence was gathered. They were recorded the same day as dated operator requirements (R-SCOPE-LEVELS, R-COMPOSITION, R-LEARNING, all 2026-08-30, in the specification’s requirements set), implemented in a follow-on cycle, and are reported here as what they are: post-draft findings, appended rather than retrofitted, so that no earlier section reads as if it had contained them.

Gap (a) — contract levels, and the specific overriding the general. Contracts exist at the level of the universe of projects, of a project space, and of the individual project — and the more specific must be able to override the more general, because the higher-level statement may be vaguer or may not fit a particular project’s character. The draft’s scope vocabulary could not represent this: the axes were a flat list, the one containment relation in the whole vocabulary was {ecosystem}-contains-everything, and below it narrowing degenerated to equality (verified in the code before the requirement was recorded, not assumed). Worse, cross-axis intersection was declared fail-closed for conflict detection — sound as far as it went — so a general and a specific assertion could collide, and nothing said which won: the system produced a ConflictRecord where an override was meant. The requirement: levels first-class and ordered by containment; specific-over-general as a structural precedence source beside §4.6’s declared order, with the priority between the two sources decided in advance rather than case-by-case; overriding visible as overridden-by with the overriding revision pinned, never deletion; and a binding/overridable distinction with teeth, so that a project cannot override a universe-level MUST-NOT by refining it — some higher-level assertions are floors, not defaults. §3.4’s recorded vocabulary overflow was this same fault line seen once; the level gap is its structural recurrence, and we widen that narrowing rather than patch it quietly.

A gap in “decided in advance,” found by an adversarial review (2026-09-09) and not yet closed here. “Decided in advance” states a policy (check authority, fall back to level) but does not by itself prove the combination is a strict partial order. Authority ($\succ$, §4.6) is itself only a partial order, and a rule that defers to level exactly where authority is silent can produce a cycle: $A \succ B$ by authority; $B, C$ and $A, C$ incomparable by authority, so level decides them; levels $B \sqsupset C \sqsupset A$. “Authority first, then level” gives $A \succ B$ (authority), $B \succ C$ (level, since authority was silent), and $C \succ A$ (level again) — a cycle in the combined order from two individually well-founded sources. This is not hypothetical against this paper’s own construction; it is not exercised against a real case here, and neither a proof that the composition is acyclic under some restriction (a lexicographic product over a complete first component, say) nor a cycle-detecting refusal is shown to exist. Stated as an open gap, not repaired.

Gap (b) — composition of the levels into one validated artifact. Attachment (Resolve step 4) collects: assertions from several scopes end up side by side in one contract. Nothing in the draft composed the levels into a single artifact per project — deterministic, digest-pinned, validated as a whole before delivery, with a justified derogation channel for a lower level’s departure from a higher prohibition (required non-empty human-authored justification; non-derogable assertions refusing every justification; the departure visible in the composed artifact), and a cache whose key covers every input to the composition, so that it can never serve a stale artifact that omits a newly added prohibition. One consequence the draft did not draw, although its own proof contains it: composition is a merge, so Theorem 1 applies directly, and whole-artifact re-validation after composition follows from the non-distributivity result this paper already proves. The corollary was there for the taking in §4.4; we state plainly that the draft did not take it — the operator’s requirement forced the question, and the paper’s own mathematics turned out to already mandate the answer.

Gap (c) — the learning loop, with authority-bounded level placement. Succession (§3.1’s id@rN) is vertical in time, not in level: an artifact improves in place, but the draft had no mechanism by which a meaning learned in one project reaches the level where it belongs — a rule discovered in one repository that in fact holds ecosystem-wide had nowhere to go, so every contract was assembled from artifacts that never improve. The requirement, stated implementation-independently because the architecture demands no more: for every candidate meaning there is a placement judgment — universe, space, or project — and that judgment must exist, be recorded (with rationale, evidence, and what generalization dropped), be bounded by authority, and be refutable (demotion and retraction are first-class, and a recorded negative result blocks re-proposal on the same evidence). Who or what performs the judgment — a human curator, a panel, or an agent — is an implementation choice, and the architecture must hold for any of them; prescribing a class of decider would date the result to a technology and confuse a policy about who may decide with a fact about what must be decided.

The generalizable safety result. The sharpest finding in the three requirements is where (b) and (c) meet, and it is not a detail of this ecosystem: a learning path that can promote derogation-derived meanings quietly repeals its own prohibitions — the project’s narrower rule “works well,” the loop generalizes it upward, and the higher-level prohibition is gone with no authority granting a repeal, no one reviewing one, and an audit trail that says “improvement.” The constraint set that closes the hole, adopted here as design law: a meaning that exists only because of a derogation is proposable, never auto-promotable; a promotion that would weaken or repeal a higher-level MUST/MUST-NOT requires the same authority as authoring that prohibition, and that authority cannot be acquired through the learning path; non-derogable assertions are non-repealable by learning. Any knowledge architecture that has both a justified-exception channel and a learning loop has this laundering path open unless it is closed by construction — and it arrives disguised as improvement.

Three mechanism findings from the follow-on implementation (recorded as they occurred; kc2/OBSERVATIONS.md, OBS-012, 2026-08-30). (1) Mutual digest-pinning between two first-class records has no fixed point: a Derogation citing its AuthorityEvent’s digest while the event pins the Derogation’s digest cannot be constructed — the third instance of this circularity class in the cycle. The lawful shape is that the journal grants: the Derogation is authored inert, and it is in force iff a live AuthorityEvent of adequate level targets it, any in-record authority field being a digest-pinned citation and never a self-contained claim — which is also what keeps the derogation channel inside I14’s authority-non-importation discipline instead of opening a cross-level hole in it. (2) Disjoint is not incomparable: the first real composition refused on a sibling project’s assertion under the specified “incomparable levels refuse” rule; sibling scopes on the same axis are in fact disjoint — decidably inapplicable, skipped — and only unknown space↔project membership is genuinely undecidable (refusing when the assertion is deontic). The level comparison ended with five outcomes, forced by real content. (3) The derogation is the departure record: an implementation that applies derogations only where a lower-level counter-assertion exists renders a pure grant invisible — the real grant had no counter-assertion and vanished from the composition. Compose must apply live derogations to governing entries directly, scope-matched, and surface the pin and justification in the composed artifact; a derogation that disappears into the composition is exactly the blind override the mechanism exists to forbid.

Status, in this paper’s own accounting. The three mechanisms are implemented, with 45 typed refusal codes each proven red — extending §8.2’s 27 under the same coverage discipline — the composition cache mutation-proven stale-red on five paths with the promotion path among them, and propagation tests in both directions (downward through composition, upward through promotion) with negative controls proving each can fail. One real derogation ran end to end — the one genuine operator-granted departure in the ecosystem, a written publish-unlisted grant: the universe-level prohibition composes as derogated-and-visible (pin and justification carried) for the granted project, as governing for a sibling project, and its non-derogable deployment floor stands everywhere. What is not done is named: the real-store upward round trip is blocked on two operator registrations (the space’s registry entry and its project membership; placements carry an intended_level field in the interim), and no real promotion has yet run end to end on the corpus. The corpus-scale consequences of the composition mechanism — including the projection-bloat bill — are measured in §8.8.

The design law above was itself falsified once in the implementation, and the record is kept rather than overwritten. Two expected-refusal controls — an authority event whose verified signer is the proposal’s proposer, and one whose signer is its executor — were admitted by the promotion evaluator at 840ca5fd (2 FAIL; Muneral authority node eeae58c6, finding C4-AUTH-01): the authority that must not be acquirable through the learning path could be signed from inside it. After PR #395 the same two controls, run unchanged (harness sha256 603e425f…) on merged main 57da764, now refuse (2/2); a separate discriminating probe on the same synthetic fixtures shows the refusal reason AUTHORITY_SIGNER_NOT_INDEPENDENT and acceptance of the unsubstituted fixture. The fixture’s lineages have length one, so a transitive or aliased signer — an ancestor beyond the first hop, or a principal mapped to a lineage member — is not measured, and an authentic Auth issuer, production wiring and live revocation are not measured. The two original FAIL rows stand in the evidence; the repair does not retroactively make them passes.

9.2 Shape in a typed substrate: the template question, asked and answered (2026-08-31)

Like §8.8, §8.9, and §9.1, this subsection postdates the draft’s evaluation round: the operator raised the question on 2026-08-30 as a recorded open question (OQ-1) that deliberately blocked the templates portion of the corpus lift — decide by argument before authoring, so the ontology is not settled by accident — and a recorded consilium decided it on 2026-08-31 (Consilium H, 4–0) before any of the 43 rows it governs were classified.

The question, in the operator’s words. “Is there such a notion [as templates] in the Knowledge Contract, and is that notion even needed? That is: we have a Blueprint, and that is probably enough — it will reference some template. So it is unclear to me whether we need to describe notions like templates in the paper and then in the implementation, or whether they simply enter as references inside artifacts we have already defined.” The question was not theoretical. The managed-kind roster holds seven kinds and no Template, while the incumbent framework carries 43 template files, every one of which needed a ledger row; and the Blueprint profile’s own “allowed variation” clause sits suspiciously close to what a template expresses. Three candidate answers were on the table: (A) a template is a reference — a Blueprint points at a template artifact as an opaque payload, at the cost that nothing can validate conformance to it; (B) a template is not a separate kind because it is a kind-profile — shape becomes schema, not data; (C) Template is a first-class kind with its own profile, artifacts declaring checkable conformance to it, at the cost of a new kind and the risk of re-importing the document ceremony the substrate exists to replace.

The decision method, executed rather than argued. Five steps, all run on the real corpus. (1) Sort the real 43: every template read in full and clustered by where its value lives — 11 shape-dominant, 8 knowledge-dominant, 4 runtime-state, 7 code scaffolding, 6 ceremony of already-dropped pipelines, 7 project scaffolding; residue zero. (2) The architecture’s own test, per cluster: does treating a cluster a given way let the system refuse something it should refuse — and is that refusal the substrate’s to make? (3) The Blueprint-overlap probe on real pairs: whether a Blueprint’s “allowed variation” already expresses a real template’s constraints, checked against the store’s own precedent — tal-template-artifact@r3, this line’s earlier lift, which constructively proves conformance checking at zero new kinds via profile claims plus a validated-by binding. (4) Kind-inflation cost, priced honestly: a kind is a one-way door — profile, refusal codes, red proofs, gate coverage, spec text, forever — and the roster grows easily and shrinks never. (5) The zero-residue check: whatever is chosen must classify all 43 rows with no “does not fit anywhere” remainder.

The result. In a typed knowledge substrate, “template” is not an ontological category but a bundle of separable values — shape, knowledge, executability, state, ceremony — each with a native carrier already in the substrate. Shape is schema: profile claims (elements, invariants, allowed variation) plus a digest-pinned validator bound by validated-by — exactly where the substrate owns the refusal. Knowledge lifts as Skill/Blueprint/Constraint content, and the fill-in shape around it evaporates. Executability stays a referenced payload whose conformance belongs to CI — a store refusing shellcheck-class deviations would have become a linter, a category error. State dissolves under a preemption rule applied first: under this substrate, state is the store, and the file class’s refusals migrate to store semantics. Ceremony of dropped machinery drops with the machinery. A kind names what the substrate refuses over, and templates never name a refusal the profile mechanism does not already carry — which is why candidate C fails the architecture’s own test: its promised refusal surface already ships, at zero new kinds. The managed-kind roster stays seven, and that consequence is recorded explicitly, because the roster is a closed enum with mechanical consequences everywhere.

The security corollary, and the invariant the decision minted. Declared conformance without pinned enforcement is the substrate’s principal integrity hazard, and the design refuses it structurally: a Blueprint carrying MUST-modality shape invariants must either bind a digest-pinned validator or carry an explicit recorded unvalidated waiver — absence of both is lintable and fail-closed. And the criterion itself became an invariant of roster governance: a proposed kind must demonstrate a refusal surface not reachable via existing claims plus validated-by. A recorded re-open trigger keeps the decision refutable — if a surviving shape ever needs a refusal the profile mechanism cannot carry, OQ-1 reopens with that case as evidence.

Two things the answer honestly does not carry. Element ordering is deliberately left out of the carrier: assertions remain an unordered keyed set — load-bearing for merge, diff, and succession — and ordering is stored as the one canonical opaque-payload encoding, enforced by pinned validators. The recorded Skill flip condition is the single future trigger for revisiting this: if it fires, one shared ordering facility is designed for Skill steps and Blueprint elements simultaneously — never two ad-hoc ones, and never from the weaker use case first. Instantiation semantics — what it means to fill a template and mint the resulting artifact — the substrate does not model at all; that act stays outside the carrier, stated as out of scope rather than smuggled in.

The empirical test. The criterion classified all 43 template rows with zero residue — the operator’s own fifth test, passed — and then, posed as a classifier question for every shape-carrier (“if this carrier vanished, what would the system stop being able to refuse — and is that refusal this substrate’s to make?”, state-preemption applied first), classified the full 1257-file surface of §8.9 with zero residue rows. The eight knowledge-dominant template rows served as the calibration set for borderline knowledge/shape calls, confirming a guard the consilium recorded: the criterion travels with its worked examples attached, not as a bare statement.

Per the operator’s instruction, this paper carries the question and the reasoning as the contribution, not only the outcome: “should shape be data, schema, or reference?” is a general question for any typed knowledge substrate, and the answer here — with its stated criterion, its priced costs, and its recorded re-open trigger — is offered as one worked resolution of it, not the only one.

10. Reproducibility

Reproducibility differs by artifact class, and each class is stated with what was actually re-executed for this revision and what blocks an independent party today.

Counts and enforcement claims — re-executable, and re-executed. Every v2 claim (the full refusal coverage run — 27/27 at the evidence pin, with §8.10 recording the catalog since — the invariant gates, the double-run determinism fixture, the store recount) regenerates from the committed implementation and its CI suite; the refusal harness was re-executed cleanly during this revision’s claims audit (2026-08-30). Every v1 count is fixed by the byte-freeze manifest and re-runnable identically at the pin; the v1 census and the v1 mutation harness were not re-executed this cycle, and §8.1 labels both.

Second-revision measurements (2026-09-12). The I16 census is recomputed from the store, kind profiles, and checking predicate at cbebf3a1eefc14c17306f0a4abc8d1992785c628; the two historical count claims now have active rows in the paper figure-provenance manifest. The check-removal run uses the source pin in §8.7 and is shipped as round2/refusal-task-ablation.json beside this manuscript, with input hashes, clean controls, per-code outcomes, and concrete failing examples. The accompanying round2/MEASUREMENTS.md explains the frame and lists all 86 dispositions. Reproduction from the repository root is:

python3 research/tools/refusal_task_ablation.py --check
python3 scripts/bin/paper-figure-provenance-check.py
python3 -m unittest -v kc2.tests.test_law_order kc2.tests.test_refusal_task_ablation kc2.tests.test_ladder

The first command reruns the experiment and requires whole-receipt equality; the second includes that replay as a source resolver. It does not turn the historical executor-token records into fresh measurements. New literature comparisons have edition URLs, hashes, and pinpoint reading notes in round2/SOURCES.md. Neither the experiment nor its provenance gate publishes the manuscript or verifies a deployed page; publication drift is checked separately.

The evaluation — regenerates from committed harness plus a non-shipped corpus. The protocol, the per-sample results, the measurement harness, and a manifest committing each corpus sample’s name, byte size, and SHA-256 digest are committed; the corpus itself is not (the samples are internal operational records — the standing non-release rule — so the digests pin what content the numbers were computed over without shipping it). “Anyone with repository access can re-run” therefore narrows, honestly, to “plus the corpus on the measurement host.” The v0 pilot’s two-command reproduction path stands as committed but was not re-executed verbatim this cycle.

What an independent party would need, and what blocks each item today: (1) The handoff corpora (the pilot’s six, the evaluation’s 18) are internal operational records containing hostnames, credentials context, and infrastructure detail; they cannot be released as-is. What can be released instead is a synthetic corpus in the same shape — same artifact classes, same line disciplines, same novelty-to-restatement ratios — together with the unmodified harness; constructing it is named as future work rather than claimed as done. (2) The production repository is private; the specific files, line numbers, and commit hashes cited throughout (v1 evidence at 63f66b2, v2 evidence at 41c480a) are therefore traceability anchors for an audit rather than public links; the same holds for the research repository holding the measurement corpora and harnesses and for the internal convergence/evidence register cited in §2.8. An audit bundle (the store loaders, validator, gates, census, measurement harnesses with their manifests, and the evidence register against pinned commits) could be prepared for a reviewer under agreement — and one audit is recorded as owed, not done — the convergence register’s dated entries have not been re-audited against their pinned dates this cycle — and one is now run, with its scope stated: a lexical provenance audit of the v2 specification (twelve parts and README) and this manuscript against the FPF repository — FPF-Spec.md at commit 434e17ec (sha256 8fb27a33…), 8-word shingles after Markdown-punctuation stripping and lower-casing, script research/tools/fpf-provenance-audit.py — found zero shared 8-word runs in every file except two: the specification’s synthesis register (Part 12), whose two matches are the author’s requested citation string and one marked 8-word quotation, and this manuscript’s own reference list, where the disambiguated entry for FPF reproduces the repository’s citation string (one run). That audit shows the absence of verbatim reuse outside citation strings and one marked quotation; it does not detect paraphrase or structural borrowing, which remain bounded by the specification’s authoring rules (§8.2b there) and by its register of schema identifiers shared with FPF (Part 12 §12.12: Bridge, UseClaim, tolerated_loss, correspondence_rule) — an overlap the specification once promised a naming lint would prevent; the lint was never built, the promise is retired, and the overlap is recorded. (3) The external literature register: all arXiv, DOI, and W3C references were verified as resolvable on 2026-08-29; the Compilence Zenodo records were fetched the same day (two open, three embargoed with public abstracts); the two Compilence web pages are cited from operator-saved copies dated 2026-08-29, as the live site returned HTTP 403 to this environment on that date. The three verbatim Compilence quotations in §4.9 carry their pinpoint sources inline and are verifiable word-for-word against those saved copies. One provenance-regime note: this paper deliberately carries its external-source attribution in prose (§2.8–2.9, §4.9) rather than with the specification set’s per-claim provenance-tag discipline; the tagged claim-by-claim mapping lives in the specification parts, not here, and the choice is a recorded decision, not an omission. Citations marked “standard” in the bibliography (classical textbooks and papers) were not re-fetched.

11. Conclusion

The paper’s thesis, restated at the end at exactly the strength the evidence bears: agent-to-agent knowledge transfer can be given a typed carrier whose algebraic laws are theorems rather than assumptions, whose integrity conditions are predicates rather than exhortations — several of them strong enough that the violation cannot even be serialized — and whose necessary approximations (context reduction, conflict handling, unknown values) are forced into the open by construction: declared rungs and scoped optimality claims, quarantine records instead of silent resolution, transportable unknowns instead of defaults. Both halves of that discipline now run: the storage half at modest but real scale, frozen and inherited through digest-verifying doors, and the semantic half as an implementation whose every refusal is mutation-proven and which admitted, refused, and projected real work. What the discipline earned by running is not the claim we set out to support. The evaluation it made possible refuted the transport format’s token economy as a format property and priced the completeness rule in measured recall of load-bearing source units; what survived is the checkability case — the four things the carrier exhibits, uncompared (§8.7 item 4): machine-checkable recall of load-bearing source units after the fact — not fidelity in the sense that would also see a fabricated addition (§1.1, §8.4) — (a MUST→SHOULD drift auditable unit by unit because modality is a field — the mechanical refusal itself, red-proven, has yet to fire on real content; §8.4), admission gating (no admission false, every refusal naming its missing artifact; §8.5), digest-decided concurrency (two races ended in refusal, never corruption; §8.5), and projection focus (executors that never wandered; §8.5). The most instructive moments of the whole line remain the ones where its own instruments lied and its own claims fell: twice for one gate, twice for our own headline numbers. A corrected error beats a flattered assumption; this paper has tried to be, throughout — and is now, in part, about being — the kind of document that rule produces.

---

References

Convention: items marked ⟂ are classical results cited in their standard form and not re-fetched during this work’s verification pass; all other items were verified resolvable on 2026-08-29, except the methodological-lineage entries added for §2.10 and §2.5 — Allen et al.; Ammann, Black & Majurski; Beer et al.; Black, Okun & Yesha; Budd & Gopal; Çelik et al.; Cordy et al.; DeMillo, Lipton & Sayward; Howden; Jain et al.; Kupferman & Vardi; Offutt; Paige, Cabot & Ernst; Ramanathan et al. — whose author lists, venues, pages and DOIs were verified against publisher records on 2026-09-03, the five entries that were cited in the text but missing from this list — Groth, Gibson & Velterop; Kuhn & Dumontier; Lovász; RDF Dataset Canonicalization; Shapiro et al. — checked for bibliographic metadata against publisher, W3C and DOI records on 2026-10-07 (verification record), and the three baseline-comparison entries added for §8.7 — Lewis et al.; SHACL; JSON-LD 1.1 — verified against the publisher or W3C record on 2026-09-04. The agent-language, belief-revision, evidence, argumentation, and legal-reasoning sources added in the second revision were read at the specific sections cited on 2026-09-12. Their edition URLs and downloaded byte hashes are recorded with the reproducibility material; sources whose original host was unavailable are identified by the mirror actually read.

• Alchourrón, C. E., Gärdenfors, P., Makinson, D. (1985). On the logic of theory change: Partial meet contraction and revision functions. Journal of Symbolic Logic 50(2):510–530. DOI: 10.2307/2274239. Read edition.

• Dempster, A. P. (1967). Upper and lower probabilities induced by a multivalued mapping. Annals of Mathematical Statistics 38(2):325–339. DOI: 10.1214/aoms/1177698950. Read edition.

• Dung, P. M. (1995). On the acceptability of arguments and its fundamental role in nonmonotonic reasoning, logic programming and n-person games. Artificial Intelligence 77(2):321–357. DOI: 10.1016/0004-3702(94)00041-X. Read edition.

• Finin, T., Fritzson, R., McKay, D., McEntire, R. (1994). KQML—A language and protocol for knowledge and information exchange. Knowledge-Based Systems and Agent Technologies, AAAI Technical Report WS-94-02, pp. 92–102. Read edition.

• FIPA (2002). FIPA Communicative Act Library Specification, SC00037J, Standard, 3 December 2002. Read edition, institutional mirror.

• Horty, J. F., Bench-Capon, T. J. M. (2012). A factor-based definition of precedential constraint. Artificial Intelligence and Law 20:181–214. DOI: 10.1007/s10506-012-9125-8. Read edition.

• OASIS (2021). LegalRuleML Core Specification Version 1.0, OASIS Standard, 30 August 2021. Read edition.

• Allen, B. P., Chhikara, P., Ferguson, T. M., Ilievski, F., Groth, P. (2025). Sound and complete neurosymbolic reasoning with LLM-grounded interpretations. NeSy 2025 (19th Conference on Neurosymbolic Learning and Reasoning). arXiv:2507.09751.

• Ammann, P., Black, P. E., Majurski, W. (1998). Using model checking to generate tests from specifications. ICFEM 1998, pp. 46–54. DOI: 10.1109/ICFEM.1998.730569.

• Baader, F., Calvanese, D., McGuinness, D., Nardi, D., Patel-Schneider, P. (eds.) (2007). The Description Logic Handbook, 2nd ed. Cambridge University Press. ⟂

• Bao, D., Chern, S.-S., Shen, Z. (2000). An Introduction to Riemann–Finsler Geometry. Springer GTM 200. ⟂

• Beer, I., Ben-David, S., Eisner, C., Rodeh, Y. (2001). Efficient detection of vacuity in temporal model checking. Formal Methods in System Design 18(2):141–163. DOI: 10.1023/A:1008779610539.

• Belnap, N. D. (1977). A useful four-valued logic. In J. M. Dunn & G. Epstein (eds.), Modern Uses of Multiple-Valued Logic, Episteme vol. 2, Reidel, pp. 5–37. DOI: 10.1007/978-94-010-1161-7_2.

• Black, P. E., Okun, V., Yesha, Y. (2000). Mutation operators for specifications. ASE 2000, pp. 81–88. DOI: 10.1109/ASE.2000.873653.

• Budd, T. A., Gopal, A. S. (1985). Program testing by specification mutation. Computer Languages 10(1):63–73. DOI: 10.1016/0096-0551(85)90011-6.

• Brewka, G. (1994). Adding priorities and specificity to default logic. In Logics in Artificial Intelligence (JELIA ‘94), LNAI 838, Springer. ⟂

• Buneman, P., Khanna, S., Tan, W.-C. (2001). Why and where: A characterization of data provenance. ICDT 2001. DOI: 10.1007/3-540-44503-X_20.

• Chudinov, Y. (2026a). Skill Without Training [navigation-index methodology and benchmark]. Zenodo. DOI: 10.5281/zenodo.18944351 (open, CC-BY-NC-ND-4.0).

• Chudinov, Y. (2026b). Dual-Layer SPO Architecture. Zenodo. DOI: 10.5281/zenodo.19261510 (embargoed; public abstract).

• Chudinov, Y. (2026c). Deterministic Inference Engine. Zenodo. DOI: 10.5281/zenodo.19319709 (embargoed; public abstract).

• Chudinov, Y. (2026d). Stationarity by Governance. Zenodo. DOI: 10.5281/zenodo.19367887 (embargoed; public abstract).

• Chudinov, Y. (2026e). Engineering Approximation Stack. Zenodo. DOI: 10.5281/zenodo.19337904 (open, CC-BY-4.0).

• Chvátal, V. (1979). A greedy heuristic for the set-covering problem. Mathematics of Operations Research 4(3):233–235. ⟂

• Compilence, Inc. (2026). Technology Overview; Investor Overview. compilence.com. Cited from operator-saved copies dated 2026-08-29 (live site returned HTTP 403 to this environment on that date).

• Çelik, A., Palmskog, K., Parovic, M., Gallego Arias, E. J., Gligoric, M. (2019). Mutation analysis for Coq. ASE 2019, pp. 539–551. DOI: 10.1109/ASE.2019.00057.

• Cordy, M., Lazreg, S., Legay, A., Schobbens, P.-Y. (2023). Towards strengthening formal specifications with mutation model checking. ESEC/FSE 2023, pp. 2102–2106. DOI: 10.1145/3611643.3613080.

• de Kleer, J. (1986). An assumption-based TMS. Artificial Intelligence 28(2):127–162. ⟂

• DeMillo, R. A., Lipton, R. J., Sayward, F. G. (1978). Hints on test data selection: Help for the practicing programmer. Computer 11(4):34–41. DOI: 10.1109/C-M.1978.218136.

• Dinur, I., Steurer, D. (2014). Analytical approach to parallel repetition. STOC 2014. ⟂

• Doyle, J. (1979). A truth maintenance system. Artificial Intelligence 12(3):231–272.

• Farquhar, S., Kossen, J., Kuhn, L., Gal, Y. (2024). Detecting hallucinations in large language models using semantic entropy. Nature 630:625–630.

• Feige, U. (1998). A threshold of ln n for approximating set cover. Journal of the ACM 45(4):634–652. ⟂

• Gärdenfors, P. (2014). The Geometry of Meaning: Semantics Based on Conceptual Spaces. MIT Press.

• Ginsberg, M. L. (1988). Multivalued logics: A uniform approach to reasoning in artificial intelligence. Computational Intelligence 4:265–316. ⟂

• Golan, J. S. (1999). Semirings and their Applications. Kluwer. ⟂

• Green, T. J., Karvounarakis, G., Tannen, V. (2007). Provenance semirings. PODS 2007. DOI: 10.1145/1265530.1265535.

• Groth, P., Gibson, A., Velterop, J. (2010). The anatomy of a nanopublication. Information Services & Use 30:51–56. DOI: 10.3233/ISU-2010-0613.

• Jeong, S., Kim, H., Park, J. (2025). The algebra of meaning: Why machines need Montague more than Moore’s law. arXiv:2510.06559 (preprint, not peer-reviewed).

• Johnson, D. S. (1974). Approximation algorithms for combinatorial problems. JCSS 9:256–278. ⟂

• Karp, R. M. (1972). Reducibility among combinatorial problems. In Complexity of Computer Computations, Plenum.

• Howden, W. E. (1982). Weak mutation testing and completeness of test sets. IEEE Transactions on Software Engineering SE-8(4):371–379. DOI: 10.1109/TSE.1982.235571.

• JSON-LD 1.1 (2020). A JSON-based Serialization for Linked Data. W3C Recommendation, 16 July 2020. https://www.w3.org/TR/json-ld11/

• Jain, K., Palmskog, K., Çelik, A., Gallego Arias, E. J., Gligoric, M. (2020). mCoq: Mutation analysis for Coq verification projects. ICSE 2020 Companion, pp. 89–92. DOI: 10.1145/3377812.3382156.

• Kleene, S. C. (1938). On notation for ordinal numbers. Journal of Symbolic Logic 3:150–155.

• Kuhn, L., Gal, Y., Farquhar, S. (2023). Semantic uncertainty: Linguistic invariances for uncertainty estimation in natural language generation. ICLR 2023. arXiv:2302.09664.

• Kuhn, T., Dumontier, M. (2014). Trusty URIs: Verifiable, immutable, and permanent digital artifacts for linked data. In The Semantic Web: Trends and Challenges (ESWC 2014), LNCS 8465, pp. 395–410. Springer. doi:10.1007/978-3-319-07443-6_27.

• Kupferman, O., Vardi, M. Y. (2003). Vacuity detection in temporal model checking. International Journal on Software Tools for Technology Transfer 4(2):224–233. DOI: 10.1007/s100090100062. (Conference version: CHARME 1999, LNCS 1703, pp. 82–96.)

• Lan, Q., Wen, D., Zhang, Z., et al. (2021). What is semantic communication? A view on conveying meaning in the era of machine intelligence. J. Communications and Information Networks. arXiv:2110.00196.

• Levenchuk, A. First Principles Framework (FPF). GitHub repository, https://github.com/ailev/FPF, main branch at commit 434e17ec (accessed 2026-09-01; no license file — default copyright; no release or version tag; cited for ideas with attribution per §2.9). Not to be confused with the unrelated “First Principles Framework (FPF)” of Gilda & Gilda, arXiv:2601.21116 (2026), which this paper does not cite.

• Lewis, P., Perez, E., Piktus, A., Petroni, F., et al. (2020). Retrieval-augmented generation for knowledge-intensive NLP tasks. NeurIPS 2020. arXiv:2005.11401.

• Liang, C., Xiao, D., Li, S., Shi, J., Bennis, M. (2022). Life-long learning for reasoning-based semantic communication. IEEE ICC Workshops 2022. arXiv:2202.01952.

• Liu, X., Trager, M., Achille, A., et al. (2023). Meaning representations from trajectories in autoregressive models. arXiv:2310.18348.

• Lovász, L. (1975). On the ratio of optimal integral and fractional covers. Discrete Mathematics 13(4):383–390. DOI: 10.1016/0012-365X(75)90058-8.

• McCarthy, J. (1980). Circumscription — a form of non-monotonic reasoning. Artificial Intelligence 13:27–39. ⟂

• Merkle, R. C. (1979). Secrecy, Authentication, and Public Key Systems. PhD thesis, Stanford University.

• Barrault, L., Duquenne, P.-A., Elbayad, M., et al. (Meta AI) (2024). Large Concept Models: Language modeling in a sentence representation space. arXiv:2412.08821.

• Peyrard, M., Josifoski, M., West, R. (2024). Agentic AI: The era of semantic decoding. arXiv:2403.14562 (position paper).

• Offutt, A. J. (1992). Investigations of the software testing coupling effect. ACM Transactions on Software Engineering and Methodology 1(1):5–20. DOI: 10.1145/125489.125473.

• Paige, R. F., Cabot, J., Ernst, N. A. (2017). Foreword to the special section on negative results in software engineering. Empirical Software Engineering 22(5):2453–2456. DOI: 10.1007/s10664-017-9498-0.

• Priest, G. (1979). The logic of paradox. Journal of Philosophical Logic 8(1):219–241. ⟂

• Ramanathan, M. K., Clapp, L., Barik, R., Sridharan, M. (2020). Piranha: Reducing feature flag debt at Uber. ICSE-SEIP 2020, pp. 221–230. DOI: 10.1145/3377813.3381350.

• RDF Dataset Canonicalization (RDFC-1.0) (2024). W3C Recommendation, 21 May 2024. D. Longley, G. Kellogg, D. Yamamoto (eds.). https://www.w3.org/TR/2024/REC-rdf-canon-20240521/

• Reiter, R. (1978). On closed world data bases. In Logic and Data Bases, Plenum. ⟂

• Reiter, R. (1980). A logic for default reasoning. Artificial Intelligence 13:81–132.

• SHACL (2017). Shapes Constraint Language (SHACL). W3C Recommendation, 20 July 2017. https://www.w3.org/TR/shacl/

• Salehi, S., Erol-Kantarci, M., Niyato, D. (2025). LLM-enabled data transmission in end-to-end semantic communication. arXiv:2504.07431.

• Shapiro, M., Preguiça, N., Baquero, C., Zawirski, M. (2011). Conflict-free replicated data types. In Stabilization, Safety, and Security of Distributed Systems (SSS 2011), LNCS 6976, pp. 386–400. Springer. DOI: 10.1007/978-3-642-24550-3_29.

• von Wright, G. H. (1951). Deontic logic. Mind 60(237):1–15.

• W3C (2013). PROV-O: The PROV Ontology. W3C Recommendation, 2013-04-30. https://www.w3.org/TR/prov-o/

• Wang, Z., Wang, Y., Liu, X., Ding, L., Zhang, M., Liu, J., Zhang, M. (2025). AgentDropout: Dynamic agent elimination for token-efficient and high-performance LLM-based multi-agent collaboration. arXiv:2503.18891.

• Widdows, D. (2004). Geometry and Meaning. CSLI Publications.

• Wilson, W. A. (1931). On quasi-metric spaces. American Journal of Mathematics 53(3):675–684.

• Zhang, G., Yue, Y., Li, Z., Yun, S., Wan, G., Wang, K., Cheng, D., Yu, J. X., Chen, T. (2024). Cut the crap: An economical communication pipeline for LLM-based multi-agent systems (AgentPrune). arXiv:2410.02506.

• Kang, M., Chen, W.-N., Han, D., et al. (2025). ACON: Optimizing context compression for long-horizon LLM agents. arXiv:2510.00615.