Wiki · Architecture & Decisions
Phase 4 — RESULTS
How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
This is the design record of the part of the estate whose job is to stop the rest of it claiming more than it has measured. It runs to architecture notes, numbered decision records, phase plans, and the results written after each phase ran.
It is for anyone curious how a decision was actually reached — what was considered, what was refused, and what the refusal cost. The decision records are the most durable part: each names one choice, the alternatives, and the consequence accepted in exchange. The failure-modes page is worth the detour, because it states each refusal as something you could go and test rather than as a promise.
Read the architecture page first. It opens by declaring itself part design and part built, which sets the tone for the whole section. Then the first decision record, then whichever phase interests you — read as a pair, the plan and the results page written afterwards, including the phases where a premise turned out to be wrong and the receipt says so.
What it is not: a description of running software, and not a complete record. Three documents from this area were withheld from publication, because they describe private infrastructure or the operator declined them; they are listed as withheld rather than quietly dropped, so you can see that they exist.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.
Status: EXECUTED 2026-07-26 · Plan: PHASE-4.md
Repo: UNI.Minecraft gen2-runtime — red f9c5167, green e6a0529
Receipt: docs/receipts/control-plane/phase4_green_2026-07-26.md
Bound honoured: no row written to evidence/gates.ndjson · no P-level moved · mc_test.exs untouched · mix.exs unchanged · no hex dependency.
0. Headline — the Control Plane can record its own writes, and two canaries fired on schedule
SP.ControlPlane.Store gives the ledger somewhere to live. The body that exists
to replace git-as-audit-trail no longer needs to borrow it.
$ mix test test/sp/control_plane
211 tests, 82 failures # red, f9c5167
211 tests, 0 failures # green, e6a0529
Test count identical across red and green. Full suite 765 tests, 0 failures (was 681).
The second half of the headline is that both canaries this programme planted in earlier phases fired, and neither was deleted. That is the part worth reading.
1. Disposition of every item
| # | item | disposition |
|---|---|---|
| 4.1 | Store — durable append-only persistence |
DONE. Two plain files. Append-only enforced before the write; a refused write writes nothing and names the seq where histories part. |
| 4.2 | The anchor becomes a practice | DONE, with a named residual. Caught in practice against loss, corruption and accident; not against a tamperer who owns the directory. See §4. |
| 4.3 | Run — immutable run identity |
DONE, after correcting the item's own wording. See §5. |
| 4.4 | Pair — exactly one differing variable |
DONE. Two or more differences are VOID and unclaimable; there is no force, claim or override. |
| 4.5 | Run status refusals F13–F15 | DONE. Six statuses, none of them a score and none of them ELIGIBLE. |
| 4.6 | Run failure refusals F16–F18 | DONE. Non-convergence halts before scoring and writes nothing; mismatched lengths raise before any aggregate; a crash is FAILED_RUN and outranks everything. |
| 4.7 | The mixed-EOL hazard, made mechanical | DONE. The 2026-07-25 rollback is now a test, including a live read proving the canonical ledger really is mixed. |
2. Falsifiers
| item | falsifier | fired? |
|---|---|---|
| 4.1 | a reload loses, reorders or silently repairs an entry | no |
| 4.2 | a truncated ledger reloads and is reported sound | no for loss; YES for a tamperer — asserted deliberately, §4 |
| 4.3 | two runs of identical inputs differ, or a field can be edited after the fact | no — after the item's wording was corrected, §5 |
| 4.4 | a two-variable result is claimable | no |
| 4.5 | a short run reads as complete, or an overrun reads as ELIGIBLE |
no |
| 4.6 | a non-converged fit produces a result file, or a crash is recorded as a negative | no |
| 4.7 | an appender infers the terminator from anywhere else | no |
The phase premise held. deps: [] carries durable persistence with File,
:crypto and stdlib JSON. Checked before anything was built on it, as the
plan required. git diff mix.exs is empty. No STOP_PROTOCOL_CHANGE_REQUIRED.
3. Both canaries fired, and neither was deleted
| canary | planted | outcome |
|---|---|---|
| "STATED LIMIT — nothing persists an anchor yet" | Phase 3, item 3.6 | FIRED. Replaced by the assertion it pointed at. |
| "no Phase 2 module performs disk IO" | Phase 2, F11 | FIRED. Narrowed from a blanket to an allowlist. |
Deleting a canary that fires is how a limit quietly stops being tracked. Both were replaced with what they were guarding, and both replacements were mutation-tested.
A guard was deliberately weakened, and this is the exact trade
The disk-IO scan was always a proxy for the real rule, a read never actuates, and it only held while nothing persisted anything.
- Weaker: one module may now touch disk.
- Stronger: it is an allowlist of exactly one. A second writer, or a writer inside a module that reads, now fails — which the blanket could never distinguish.
- Unchanged: every read's purity is asserted directly, function by function, and never depended on this scan.
4. Item 3.6 is upgraded — and the residual is asserted, not footnoted
Now true: the anchor persists beside the ledger. A reload that has lost its tail fails to attest. Losing one entry is caught. A stale anchor no longer attests a grown chain. An absent anchor is a refusal, never a pass.
Still not true: it does not stop a tamperer with write access to the store
directory, who truncates ledger.ndjson and rewrites anchor.json to match.
Nothing local can. It needs an anchor the ledger's writer cannot reach.
store_anchor_in_practice_test.exs performs that attack and asserts it
succeeds. A limit that is only written down stops being true quietly; a limit
that is asserted fails loudly when it moves.
5. ADVERSE — a fourth pre-registered phrase was imprecise
Item 4.3 read "the same run twice produces byte-identical canonical bytes". Taken literally that is false and must stay false: a run record carries wall-clock start and end, and two executions genuinely happen at different moments. A record that hid that would be lying.
Split into two things, tested separately: identity (code, env, inputs,
params, seeds, planned_n, stopping_rule, hashed into run_id) and record
(times, exit code, outputs, actual_n).
planned_n and stopping_rule sit inside the identity on purpose.
CLAUDE.md: "never increase replicates after seeing a width." Because both are
hashed, lowering the plan to make a short run look COMPLETE, or declaring a
stopping rule once the numbers are in, changes what run this is. The
laundering leaves a mark.
Four phases, four pre-registered phrases wrong on contact — §2 of Phase 3's results, plus this. The pattern is stable: prose written before a thing exists compresses a distinction the thing turns out to need.
6. ADVERSE — two of my own tests contradicted each other
run_status_refusals_test asserted the status vocabulary was five words.
run_failure_refusals_test asserted :FAILED_RUN is in it, "so it cannot be
a surprise value nothing renders". Both mine, written an hour apart, and they
cannot both hold.
The failure test is right. Corrected to six on the merits, not by loosening whichever assertion was easier to move.
7. ADVERSE — two real defects in Store, caught by my own new tests
store.ex's moduledoc namedevidence/gates.ndjson— failing the very guard it was written to satisfy. A module that names the canonical evidence file is one edit from writing to it.- An empty store did not create its ledger file, so a correctly initialised
store loaded as
not_a_store. An initialised store with no entries is a real state, not an absent one.
8. What is built, and the one thing that is not yet proven
| module | what |
|---|---|
SP.ControlPlane.Store |
durable append-only persistence; the only module that touches disk |
SP.ControlPlane.Run |
immutable identity, six statuses, three refusals from real flagellum defects |
SP.ControlPlane.Pair |
exactly one differing variable, or VOID |
SP.ControlPlane.Ledger |
from_entries/1, named as the trust boundary it is |
Not yet proven: the Control Plane has the capability to record its own
mutations and has not yet used it. No Control Plane ledger has been persisted
in anger. Capability is not practice — this programme has said so twice already
about the anchor, and the same distinction applies here. PHASE-5.md item 5.2
makes the first real entry.
9. Verification
| command | result |
|---|---|
mix test |
PASS — 765 tests, 4 doctests, 0 failures |
mix test test/sp/control_plane |
PASS — 211 tests, 0 failures (82 red) |
mix compile --warnings-as-errors --force |
PASS — 127 files |
mix format --check-formatted — Control Plane |
PASS |
mix format --check-formatted — repo-wide |
FAIL, standing known-fail (PHASE-3-RESULTS §3) |
git diff mix.exs |
empty |
evidence/gates.ndjson |
964ea25c…1d8a4c44 unchanged |
verify_gaia · gaia_lint |
PASS — 12 checks / 0 violations |
mc_test.exs |
untouched |
10. Standing state, unchanged
P8 = FULL_PARITY = false, first unsatisfied rung P4, irreducibly external.
nursery-fenced-red-stocked remains FAIL, falsified 2026-07-19.
No verdict has been authored about any real scientific claim.
11. Next act
PHASE-5.md — the witness: an off-box anchor, the first real
Control Plane ledger, and a Gaia seat that projects it verbatim. Phase 4 is
complete only because that plan exists (ORCHESTRATE-RULES.md §1).
sha256 f70c3033ce421829 — of the original file, so what was ingested stays checkable.
Plain — written for this website, not the source document
This records the fourth phase. Its headline has two halves. The ledger — the running list of results, only ever added to — now has somewhere durable to live, so the body no longer has to borrow a commit history as its audit trail. And both warning devices planted in earlier phases went off on schedule, and neither was deleted.
That second half is the part worth reading. When a stated limit stops being true, the note that named it is replaced by the assertion it was pointing at, rather than quietly removed — because deleting a warning that fires is how a limit stops being tracked.
The page is candid about the trades. One guard was deliberately weakened, and the exact trade is written out: weaker in one respect, stronger in another, unchanged in a third. A residual risk is stated rather than footnoted, and a test performs the attack it does not stop and asserts that it succeeds.
The closing state matters as much as the rest: the body now has the capability to record its own changes and has not yet used it, and no verdict has been authored about any real scientific claim.
Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is f70c3033ce421829
Clear — written for this website, not the source document
This page reports the fourth phase against its plan, written down before the work. It names the commits, the receipt that records what was run, and the bound honoured: no row written to the real gate ledger (only ever added to), no confidence level moved, no dependency added.
The headline has two halves. The ledger now has durable storage, so the body that exists to replace a commit history as an audit trail need not borrow one. And both canaries planted in earlier phases fired; neither was deleted.
The disposition table records every item done, one carrying a named residual. Storage is two plain files, with adding-only enforced before the write, so a refused write writes nothing and names where the histories part. A comparison with two or more differences is void and unclaimable, with deliberately no way to force, claim or override it. Non-convergence halts before scoring and writes nothing, mismatched lengths raise before any average, and a crash outranks everything. The line-ending hazard that had cost a rollback is now a test.
The table of failure signs is honest about one entry: for loss it did not fire, and for a tamperer it did — deliberately. The phase premise held, checked before anything was built on it.
The section on the canaries is the heart of the page. One had said that nothing persisted an anchor yet; it fired and was replaced by the assertion it pointed at. One had said no module in an earlier group touched disk; it fired and was narrowed from a blanket ban to an allowlist. The page says plainly that deleting a canary which fires is how a limit quietly stops being tracked. It then states the exact trade. Weaker, because one module may now touch disk. Stronger, because it is an allowlist of exactly one, so a second writer now fails where the blanket ban could not tell the difference. And unchanged, because every read's purity is asserted directly and never depended on that scan.
The anchor upgrade is split into what is now true and what is still not. A reload that has lost its tail fails to attest, losing an entry is caught, a stale anchor no longer attests a grown chain, and an absent anchor is a refusal, not a pass. What it still does not stop is a tamperer with write access to the directory who truncates the ledger and rewrites the anchor to match — nothing local can, and closing it needs an anchor the writer cannot reach. A test performs that attack and asserts that it succeeds, on the reasoning that a limit merely written down stops being true quietly, while an asserted limit fails loudly when it moves.
Three further adverse results follow. A phrase written in advance was imprecise and would have been false taken literally, so identity and record were split apart. Two planning fields were deliberately folded into the identity, so that lowering a plan after seeing the numbers changes what run it is and leaves a mark. Two of the author's own tests contradicted each other and were resolved on the merits, not by moving whichever assertion was easier. And two real defects in the new storage were caught by its own new tests.
A closing section names the one thing not yet shown: the capability to record its own changes exists and has not been used, and capability is not practice. The standing state records a parity claim still false, a gate still failing, and no verdict authored about any scientific claim.
Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is f70c3033ce421829