Wiki · Architecture & Decisions
Phase 7 — RESULTS
[redacted: category] — 1 internal hostname. Nothing else was altered. The document is otherwise exactly as it is written in the repository, and the sha256 below is of the original, so what was ingested stays checkable.How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
This is the design record of the part of the estate whose job is to stop the rest of it claiming more than it has measured. It runs to architecture notes, numbered decision records, phase plans, and the results written after each phase ran.
It is for anyone curious how a decision was actually reached — what was considered, what was refused, and what the refusal cost. The decision records are the most durable part: each names one choice, the alternatives, and the consequence accepted in exchange. The failure-modes page is worth the detour, because it states each refusal as something you could go and test rather than as a promise.
Read the architecture page first. It opens by declaring itself part design and part built, which sets the tone for the whole section. Then the first decision record, then whichever phase interests you — read as a pair, the plan and the results page written afterwards, including the phases where a premise turned out to be wrong and the receipt says so.
What it is not: a description of running software, and not a complete record. Three documents from this area were withheld from publication, because they describe private infrastructure or the operator declined them; they are listed as withheld rather than quietly dropped, so you can see that they exist.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.
Status: ACCEPTANCE NOT MET — 9 of 12 items closed, but 2 of the phase's 7 acceptance clauses FAIL
Written from: what happened, not from PHASE-7.md's expectations.
Phase 7 is NOT complete, and it is not merely incomplete — it FAILS ITS OWN ACCEPTANCE.
I marked this
EXECUTEDon first writing and that was a degradation, corrected here. §4 ofPHASE-7.mdis a conjunction of seven clauses. Two fail:
- "the witness still refuses the writer's key" — FALSE. It accepts it (§1).
- "the two fixtures distinguishable with no text read, reviewed by
/organic-operatorand not only by me" — NEVER DONE.ui/lib/sp_ui_web/live/lab_live.exdoes not exist.SP.ControlPlane.Scenehas no caller outside its own tests.PHASE-7.md's Bound line reads *"
SP.ControlPlane.Scenein the root zero-dep app, and a renderer inui/"*. I built the core half, closed the phase, and wrote a results document. Nine items closing is not the same as a phase passing, and recording the gap in prose while the status line said EXECUTED is exactly the apparent harmony the truth contract forbids.
1. The headline, and it is adverse
The off-box witness is compromised. node2 answers and the writer's key works —
identified directly (hostname = uni-lab-79740c, machine-id 1eeab8064da94079,
both declared planes), not inferred from an unreachable probe.
It was custodian for exactly one reason: the writer could not write there. The anchor now stands on git alone — tamper-evident, not unforgeable.
Within one session the reading went corroborated (03:48) → blocked_unreachable
(14:51) → compromised (17:05). Item 7.10's vocabulary, built hours earlier, held all
three apart. witness.json's own claim_note predicted it: "adding the writer's key
to that box would end it silently, which is why it is re-measured on every capture."
It was not silent.
2. Dispositions
| # | item | disposition |
|---|---|---|
| 7.0 | premises checked, the open failure reproduced | DONE — reproduced at seed 2000; it was my test, not a suite flake. async: true + one git subprocess per sha, 33 cases racing for process slots. Fixed at the root, not retried |
| 7.1 | Scene — a pure function of state |
DONE |
| 7.2 | F24 — unbacked renders as fog, not an error | DONE |
| 7.3 | F25 — evidence absent ⇒ fog and entry refused | SUPERSEDED by 7.9 on the operator's co-sign; the guarantee moved to authoring |
| 7.4 | F26 — liveness only from a real probe | DONE |
| 7.5 | F27 — the claim fence | DONE — and it was already structural: 8 of 11 tests passed in red because a node has no prose field |
| 7.6 | material from truth_class, no style flag |
DONE — see §3 |
| 7.7 | place the anchor off-box | BLOCKED — not on a co-sign. The premise is gone (§1). An anchor I could place alone is not a witness, and I could place it alone |
| 7.8 | mix format --check-formatted |
STANDING KNOWN-FAIL on lib/sp/brain/language.ex, carried since Phase 3, reformat still owed its own commit |
| 7.9 | fog is walkable; refusal moves to the desk | DONE — F25 amended, 5/5 mutations killed |
| 7.10 | witness gates report BLOCKED | DONE — and it found §1 on its first live run |
| 7.11 | address all drift | PARTIAL — 8 signals triaged, ADR-0002 amended, 2 signals now equal: true; the five malformed comparisons are co-signed and not yet repaired |
3. What item 7.6 cost, and why it is the item of this phase
My first fix was worse than the defect it closed. The red was real —
material(%{truth_class: :OBSERVED}) with no receipt_ref key drew :lit_solid. I
closed it with a bare def material(_), do: :fog, went green, killed eleven
mutations, and was about to commit.
An adversarial pass over the same function found the fix answered :fog for nil,
for 42, for a whole %Scene{} — collapsing absent into nil one level up, the
distinction the module is built on. It moved entry/1's crash later rather than
removing it. And a test in that same file mandated the broken fallback by regex,
so the guard and the defect agreed with each other. Green proved nothing.
And the falsifier was reachable twice without adding a function: %Scene{} is
publicly constructible, so a hand-built scene skipped of/1 and handed a renderer a
:style key that node/2 refuses by name; and item 7.2's live-document guard did
not bind row to class, so swapping the OBSERVED and SIMULATED cells in §8.2 left
the whole suite green — the authority document is a second place that chooses the
appearance.
4. The two questions PHASE-7.md §7 requires answered
Were the two fixtures distinguishable in a screenshot with no text read, and who
said so besides me? NOT ESTABLISHED. Nobody said so besides me, because I did not
build them. Scene has no renderer — material/1 has no production caller, and
the repository's only THREE renderer chooses appearance from simulator fields and
never sees a truth class. Phase 7 is evidenced at the data layer only. The
/organic-operator review named in §3 has not run and had nothing to review.
Did item 7.7 happen, and what approval carried it? No. See §1 and §7.7 above. No approval was sought, because the co-sign was never the blocker.
Was the unnamed Phase 6 failure reproduced, retired, or still open? Reproduced and fixed — item 7.0. It was not a suite flake and the Phase 6 claim that it "likely" was is retracted.
5. Corrections this phase added to the programme (11–15)
Recorded in PHASE-7.md §6: a fix can be worse than the defect it
closes · a fence can be reachable around · the authority document is a second place
that chooses the appearance · a signal filed as structural stops being read · a
receipt captured from a dirty tree is evidence about a state no commit contains.
6. Verification at close
964 tests, 0 failures · mix format PASS on all control-plane files · mix.exs and
ui/mix.exs unchanged · evidence/gates.ndjson byte-identical
(964ea25cfe8666cae89aed23dac55bb483b654730a3259269d5e42d91d8a4c44) · Gaia 12/12
· gaia_lint 0 violations · verify_lint_bites PASS · schema-pointer gate PASS
(146/146).
verify_host_tracking 6 PASS / 1 FAIL — chip-names-resolve-via-dns, because
[redacted: internal-hostname] is ENOTFOUND. Pre-existing, re-verified against the prior
registry, carried visibly.
No row was written to evidence/gates.ndjson. No P-level moved.
7. Exit condition
PHASE-8.md exists and is pre-registered — but Phase 7 does not close.
Its acceptance is a conjunction and two clauses fail. Phase 8 may proceed on the
flagellum guards, which are independent; Phase 7 stays open and its two failing
clauses are carried by name:
- the renderer was never built —
ui/lib/sp_ui_web/live/lab_live.ex, and with it the whole reasonSceneexists. This is MINE and I skipped it. - the witness accepts the writer's key — not mine; see §1.
sha256 8f9b21d90b67738b — of the original file, so what was ingested stays checkable.
Plain — written for this website, not the source document
The phase did not pass, and its first line says so. Most items closed, but acceptance here is a conjunction of clauses and two of them fail. The author also records that he first marked this executed, calls that a degradation, and corrects it — because recording the gap in prose while the status line said otherwise is exactly the apparent harmony the project's truth contract forbids.
The headline is adverse. The outside witness is compromised: the machine answers and the writer's key works. It had been a custodian for exactly one reason — that the writer could not write there — so the anchor now stands on one thing alone, tamper-evident rather than unforgeable. Within a single session the reading moved through three different states, and the vocabulary built hours earlier held them apart.
The other failing clause is the author's own. The renderer was never built, so the thing that would have been looked at does not exist, nobody has reviewed it, and the clause is recorded as not established.
Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 8f9b21d90b67738b
Clear — written for this website, not the source document
The seventh phase opens its own report by saying it fails its own acceptance. Most items closed, but acceptance is a conjunction of clauses and two are false. A quoted note records that the author first marked the phase executed, calls that a degradation, and corrects it here. The reasoning: recording a gap in prose while the status line claims completion is exactly the apparent harmony the truth contract forbids.
The headline is adverse and comes first. The outside witness is compromised: the machine answers and the writer's key works, established by direct identification, not inferred from an unreachable probe. It had been a custodian for exactly one reason — the writer could not write there — so the anchor now stands on one mechanism alone, and the claim is stated as tamper-evident, not unforgeable. Within a single session the reading moved from corroborated, to blocked, to compromised, and the vocabulary built hours earlier held all three apart. The capture's own note had predicted that adding the writer's key would end the property silently; the page observes it was not.
The disposition table records what closed and what did not. The previously unnamed failure was reproduced and turned out to be the author's own test rather than a suite flake, and was fixed at the root, not retried. The scene is pure. Unbacked nodes render as fog, not as an error. Liveness comes only from a real probe. The claim limit holds, and the page notes it was already structural: most of its tests passed before the code existed, because a node has no prose field. One item is blocked, for an unusually clean reason: an anchor the author could place alone is not a witness, and he could place it alone.
The section on the material item is the heart of the page: a fix worse than the defect. The failing case was real. The first fix was a catch-all that answered fog for anything at all, which collapsed a distinction the module is built on and moved a crash later instead of removing it. Most tellingly, it was mandated by a test in the same file, so guard and defect agreed with each other and green proved nothing. The named failure sign was then reached twice without adding a function. Once because the structure is publicly constructible, so a hand-built scene could skip the constructor. And once because a guard did not bind a table row to a class, so swapping two cells in the authority document left the whole suite green.
The page then answers the plan's questions. Were the two fixtures distinguishable with no text read, and who said so besides the author? Not established, and nobody, because he did not build them: the scene has no caller in production, the phase is evidenced at the data layer only, and the human-flow review named in the plan had nothing to review. Did the outside placement happen? No, and no approval was sought: the co-sign was never the blocker. Was the earlier unnamed failure resolved? Reproduced and fixed, and the claim that it was likely a flake is retracted.
Verification at close is listed, including one pre-existing failing check carried visibly. The closing section says the next plan exists but this phase does not close, and names its two failing clauses. The renderer was never built, which the author says is his and which he skipped. The witness accepts the writer's key, which is not.
Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 8f9b21d90b67738b