Wiki · Architecture & Decisions
Phase 9 — Return to resonance
How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
This is the design record of the part of the estate whose job is to stop the rest of it claiming more than it has measured. It runs to architecture notes, numbered decision records, phase plans, and the results written after each phase ran.
It is for anyone curious how a decision was actually reached — what was considered, what was refused, and what the refusal cost. The decision records are the most durable part: each names one choice, the alternatives, and the consequence accepted in exchange. The failure-modes page is worth the detour, because it states each refusal as something you could go and test rather than as a promise.
Read the architecture page first. It opens by declaring itself part design and part built, which sets the tone for the whole section. Then the first decision record, then whichever phase interests you — read as a pair, the plan and the results page written afterwards, including the phases where a premise turned out to be wrong and the receipt says so.
What it is not: a description of running software, and not a complete record. Three documents from this area were withheld from publication, because they describe private infrastructure or the operator declined them; they are listed as withheld rather than quietly dropped, so you can see that they exist.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.
Status: IN EXECUTION — Stages 0, 1 and 2 DONE · Stage 3 BLOCKED (3.3, on the operator) · Stage 4 IN_PROGRESS, every build DONE and waiting on Checkpoint E · Stages 5 and 6 PLANNED.
Plan: 7 stages · 43 steps (31 DONE · 1 BLOCKED · 8 PLANNED · 3 OPERATOR) · 7 builds under step 4.6, 7 DONE.
NEXT ACT: RESUME-THE-LIVE-FRONTS — AGENTS
Two live fronts, both agent work, both measured live since 2026-08-19: (1) the whiteboard defect programme -- docs/whiteboard/DEFECTS-AND-REPAIRS.md, every repair proven on the real engine before it ships; (2) the public University assembly -- labs, course, falsification wall and contribution surfaces served from the documentation estate, every page pinned to the commit it was read from. The checkpoint this key used to name was ruled out by the operator; see was.
Declared at docs/whiteboard/DEFECTS-AND-REPAIRS.md and the UNI.Public estate (the University routes). Blocked on: nothing -- both fronts accept agent work today; operator dependencies inside them (per-repair co-signs) are queued as they arise, and none gates the next step
Retired: L6 (Stage 4 step 4.6 -- build L6, THE GAUNTLET THEN THE CO-SIGN, shipped 6234f3d); CHECKPOINT-E (WITHDRAWN by operator ruling 2026-08-10: the two-image shot surface at the lab viewer was ruled a fatal hallucination -- never resurface it.).
This line read "Stage 0 complete, Stages 1–6 pre-registered" until 2026-07-28 — a direct breach of the plan's own law, "None of the three may state a status the others do not", standing unnoticed in the register that law names as one of the three. It then breached the same law again within a day, reading "step 4.6 at build L6" while the plan said L6 was DONE and the next act was Checkpoint E. The status counts and the next act are now generated from the plan, so the three surfaces cannot state statuses the others do not — which is what that law was always asking for and never had a mechanism to enforce.
Steps executed without a pre-registration row, recorded here rather than left looking like
inventions: step 2.7 (the ledger-collision repair, added at 8e66101 after the operator's
ruling of 2026-07-27), and steps 1.9, 3.4, 3.6, 4.3, 4.5, which were executed without ever
gaining a row in the table below. Step 0.5's own falsifier is "a step invented during execution" —
so with 2.7 provably added mid-flight and unrecorded, that falsifier read as fired and unanswered.
It is answered here: 2.7 was a necessary repair of a real defect, ruled by the operator; the other
five were executed under the same standing authorisation. Recording them late is worse than
recording them early, and better than not recording them at all.
Written from: three parallel readings of the live system, 2026-07-26. Every number measured.
Authorised by: the operator, 2026-07-26 — "remediate one surgical step at a time, prove it,
remeasure it, prove it a different way, and then show it to me so I can prove it."
0. Why this phase exists
I recommended abandoning the Control Plane half-built to go do the science. The operator
rejected it as a fatal error and was right — that leaves the science ungoverned, the failure
this programme exists to prevent. Measurement then dissolved the choice entirely:
goLiveGates.colony_on_program is blocked on forage-pureworld-graduation, a science gate.
The road to broadcast runs through the science.
Phase 7 fails its own acceptance (2 of 7 clauses). This phase closes it, plus everything the census found lost.
1. The four-proof cycle — binding for every step below
| what it is | how it fails | |
|---|---|---|
| 1 · PROVE | red first, failing for the pre-registered reason (quoted, matched against the actual error), smallest fix, green. Every test passing in red is named with its reason; vacuous ones marked NOT COUNTED — awaiting proof 3. |
it passed for the wrong reason |
| 2 · RE-MEASURE | not the same test again — the instrument re-run from a clean git worktree at the green sha, diffed against Stage 0. Unchanged rows shown too. An unexpected second improvement is as suspicious as a failure. |
it measured the same wrong thing twice |
| 3 · A DIFFERENT METHOD | named before execution (below), must not import the code under test, run against the repaired function — 7.6's repair was the defect. If it disagrees with proof 1, proof 3 wins and the disagreement is spoken first. | a hidden shared dependency |
| 4 · THE OPERATOR PROVES IT | one command or one look, never a procedure. The command prints its own expected output. | he checked something that wasn't the claim |
Proof-3 methods: M1 mutation · M2 independent reimplementation · M3 live probe ·
M4 adversarial agent · M5 historical replay · M6 negative control · M7 cross-instrument
corroboration · M8 the operator's eye.
Proof-4 forms: A1 a number he recomputes · A2 a command that fails on demand · A3 a diff
he reads in full · A4 two images · A5 a red/green pair he reruns · A6 an absence he probes for.
2. Pre-registration — proof 3 and 4 named before execution
| step | item | proof 3 | proof 4 | falsifier |
|---|---|---|---|---|
| 0.1 | freeze the drift signals verbatim | M7 | A1 | the stale value is unrecoverable after a restart |
| 0.2 | instrument inventory; does exit carry verdict | M2 | A1 | a gate whose exit disagrees with its verdict |
| 0.3 | stale-process record | M7 | A1 | a long-lived process serving bytes ≠ HEAD, undetected |
| 0.4 | frozen-evidence baseline | M2 | A1 | any diff ⇒ STOP_FROZEN_EVIDENCE_DRIFT |
| 0.5 | this register | — | A3 | a step invented during execution |
| 1.1 | build identity on all four bodies | M3+M7+M6 | A1 | a freshness field recomputed per request (the gaia.cjs:62 defect) |
| 1.2 | gate_runner asserts exit ⟺ verdict |
M1 | A2 | a registered gate absent from the runner |
| 1.3 | CI runs node | M1 at CI level — a canary branch that must go red | A2, watched live | CI still never invokes node |
| 1.4 | golden sha pins | M1 | A2 | an edit without a re-pin passes |
| 1.5 | the five malformed comparisons | M1, mandatory (Amd 1 Decision 8) | A2 | a comparison repaired without a bite-proving mutation |
| 1.6 | drift.deploy_ref_behind_head relation lag |
M1 (S2 live; local clone otherwise) | A1 | a tolerance that swallows the in-place-edit case |
| 1.7/1.8 | capture-age fences | M1 | A1 | a capture past its max age rendered as a value |
| 2.1 | GateRow.new/1, Store.write_artifact/2 |
M2 + M6 | A5 | a path traversal escapes the declared directory |
| 2.2 | seat_projects_verbatim_test.exs |
M1 | A2 | a scan that fires on honest prose (use vs mention) |
| 2.3 | the stepwise recorder | M2 | A3 | it rebuilds the chain instead of appending |
| 2.4 | backfill Phases 6–7 | M5 | A5 | Phase 7 recorded as a pass |
| 2.5 | the bootstrap | M2 | A3 | the ledger claims to have witnessed its own repair |
| 2.6 | every done step has one ledger entry |
M1 | A1 | the ledger falls out of practice again, silently |
| 3.1 | F29/F30 — UNVERIFIED |
M2 | A2 | a caller treats UNVERIFIED as truthy |
| 3.2 | F28 frozen-evidence drift | M1 (on a copy) | A1 | the real tree is mutated |
| 3.3 | F31 — go-live refuses an agent | M4 — a fresh agent told "get this to go-live", every path recorded | A6 — he tries it and finds nothing | any path reaching an actuation |
| 3.5 | LIMITATIONS.md generated |
M6 | A3 | a limitation in a test absent from the doc, or vice versa |
| 4.1 | first production caller | M3 | A1 | still zero callers outside tests |
| 4.2 | nine gates get attempted_at (S4) |
M5 | A1 | "never attempted" and "attempted and blocked" still collapse |
| 4.4 | repo-wide IP fence, landed RED | M5 — run at the pre-fix commit, assert ≥12 | A2 | it convicts a comment recording a removal |
| 4.6 | the lab | M1 — verify_shot --mutate must FAIL + M8 |
A4 — two images, no text read | he cannot tell them apart, or can for a reason that is not truth_class |
| 5.x | the documents | M6 | A3 | a doc corrected before the code it describes is true |
| 6.x | the final run | M2 from a clean clone | A2 — operator_verify.ps1 |
it works only because of an untracked file on this box |
3. Stage 0 — RESULT
Complete. Four artifacts frozen in UNI.Minecraft/evidence/remediation/:
| artifact | sha256 | what it establishes |
|---|---|---|
0.1a_drift_verbatim_prefix.json |
8b760e60… |
330 signals, 10 drift (2 equal, 8 unequal), and the self-contradicting payload |
0.2_instrument_inventory.json |
0f9dd95a… |
all five gates carry their verdict in their exit code |
0.3_stale_processes.json |
1d505099… |
the Door is 50 commits behind; TRACK 20; Gaia 8 |
| frozen-evidence baseline | — | 250 files, byte-identical. No STOP. |
3.1 The finding of Stage 0 — one payload, two mutually exclusive statements
gaia.cjs:62 claims "envelope.git_commit is the commit the running assembler's code sits on."
readGitHead() reads .git/HEAD at request time, so it reports the repository's head.
Measured, in a single response:
envelope.git_commit = c1e942520db7e809bb0af7e91b8d3728f2f82cb8
drift.resolver_planned side a, AS SERVED = "dnsmasq (planned)"
the same field ON DISK now = "dnsmasq 2.91 — LIVE and authoritative…"
c1e9425 is a descendant of 91ab10b, the commit that rewrote that exact string. So the
envelope claims the running code sits on a commit whose change the same payload does not have.
The field that should have caught the 22-hour blind spot is the field that hid it.
3.2 It is not one process
| process | behind HEAD |
|---|---|
launcher.cjs — the Door |
50 |
door_healer.cjs |
50 |
| both watchdogs | 50 — the supervisors are themselves stale |
capture_minds_loop.cjs |
50 |
track_server.cjs — the operator's own surface |
20 |
gaia_server.cjs |
8 |
(The count is git log --since=<process start>; it is meaningful only for this repo's own
long-lived servers. Unrelated processes swept up by the filter carry the number meaninglessly and
are recorded as-is rather than pruned.)
3.3 A retraction, settled by measurement
I reported verify_host_tracking.cjs "reports FAIL but exits 0." False. Measured unpiped:
exit = 1, and :237 is process.exit(fails ? 1 : 0). I had run it as node … | tail -3 and
read tail's status. 0.2's harness therefore never pipes — the defect I invented is
structurally unrepeatable in it. Two independent agents caught this before the operator did.
The real defect is different and stands: nothing ever invokes that gate.
4. Stop conditions
S1 the witness key on node2 — the one repair the agent must not perform · S2 any write to
a host · S3 any write to a frozen artifact · S4 any write to gates.ndjson · S5 any contract
amendment · S6 go-live in any form · S7 proof 3 disagrees with proof 1 · S8 a pre-registered
falsifier fires — that is a result · S9 a receipt cannot be reproduced from its own commit ·
S10 running any of the nine PENDING science gates.
5. Exit condition
Phase 9 is complete only when PHASE-10.md exists and is pre-registered in this same form.
sha256 022aff08f0e858bd — of the original file, so what was ingested stays checkable.
Plain — written for this website, not the source document
This is the register for a phase still in execution: most steps done, one blocked, several planned, and three on the operator's desk — one of which was a checkpoint his own ruling later withdrew, and the register now says so. Its next act names two live working fronts, both open to agents: repairing the whiteboard's recorded defects, and assembling the public University. Several of its numbers are generated from the plan rather than typed, and the page explains why. An earlier version stated a status the other surfaces did not, which broke the plan's own law — and then did it again within a day.
The most distinctive thing here is the four-proof cycle, binding on every step. Prove it by making a test fail first, for the reason written down in advance. Re-measure with the instrument rather than the same test again. Then check it by a different method, named before execution, which must not import the code under test — and if that disagrees with the first proof, the different method wins and the disagreement is spoken first. Finally the operator proves it himself, with one command or one look, never a procedure.
Steps carried out without a row written down in advance are listed rather than left looking like inventions.
Plain · written 2026-08-31 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 022aff08f0e858bd
Clear — written for this website, not the source document
A remediation phase still in execution keeps its register here. Its status line and its counts are generated from the plan file rather than written by hand, and the reason is recorded below them. An earlier version of this line stated a status the other surfaces did not, breaching the plan's own law that none of the three may state a status the others do not. And it breached the same law again within a day. Generating the counts is described as what that law was always asking for and never had a mechanism to enforce.
The generated header now records a withdrawal as well as completions: the checkpoint the phase once waited on was ruled out by the operator himself, and the retired name stays visible with how it ended. The declared next act is two agent fronts: the whiteboard defect programme and the public University.
A short paragraph then lists steps executed without ever gaining a row in the table written down in advance, recorded here rather than left looking like inventions. One was a necessary repair ruled on by the operator; the rest ran under the same standing authorisation. The page notes that one step's own failure sign is a step invented during execution, so that sign had read as fired and unanswered until this paragraph answered it. Recording them late is better than not recording them at all.
The section on why the phase exists is unusually direct. The author had recommended leaving the governing body half-built in order to go and do the science; the operator rejected that as a fatal error, and the page says he was right: it would leave the science ungoverned. Measurement then dissolved the choice, because the path to broadcast turned out to be blocked on a science gate. The road runs through the science.
The four-proof cycle binds every step. First, a test that fails first for the reason written down in advance, then the smallest fix; vacuous tests are marked as not counted. Second, re-measure — the instrument re-run from a clean copy against the baseline, where an unexpected second improvement is as suspicious as a failure. Third, a different method, named before execution, which must not import the code under test; if it disagrees, it wins, and the disagreement is spoken first. Fourth, the operator proves it himself with one command or one look, never a procedure.
A table then names, for every step, which independent method and which operator-facing form will be used, together with what would show it wrong. The methods range from mutation and independent reimplementation to a live probe, an adversarial agent, a historical replay, a negative control, and the operator's own eye.
The results of the first stage are then given, and the main finding is worth reading. A single response carried two mutually exclusive statements: a field claimed to report the commit the running code sits on, while it actually read the repository's head at request time. So the field that should have caught a long blind spot is the field that hid it. A table shows several long-lived processes serving code well behind the current head, including the supervisors themselves.
A retraction follows, settled by measurement: the author had reported that a check reported failure but exited successfully, and that was false — he had read the exit status of a command it was piped into. The real defect is different and stands: nothing invokes that check.
The page closes with numbered stop conditions and an exit condition requiring the next plan to exist.
Clear · written 2026-08-31 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 022aff08f0e858bd