Wiki · Architecture & Decisions
Phase 9 — Return to resonance
How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
This is the design record of the part of the estate whose job is to stop the rest of it claiming more than it has measured. It runs to architecture notes, numbered decision records, phase plans, and the results written after each phase ran.
It is for anyone curious how a decision was actually reached — what was considered, what was refused, and what the refusal cost. The decision records are the most durable part: each names one choice, the alternatives, and the consequence accepted in exchange. The failure-modes page is worth the detour, because it states each refusal as something you could go and test rather than as a promise.
Read the architecture page first. It opens by declaring itself part design and part built, which sets the tone for the whole section. Then the first decision record, then whichever phase interests you — read as a pair, the plan and the results page written afterwards, including the phases where a premise turned out to be wrong and the receipt says so.
What it is not: a description of running software, and not a complete record. Three documents from this area were withheld from publication, because they describe private infrastructure or the operator declined them; they are listed as withheld rather than quietly dropped, so you can see that they exist.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.
Status: IN EXECUTION — Stages 0, 1 and 2 DONE · Stage 3 BLOCKED (3.3, on the operator) · Stage 4 IN_PROGRESS, every build DONE and waiting on Checkpoint E · Stages 5 and 6 PLANNED.
Plan: 7 stages · 43 steps (31 DONE · 1 IN_PROGRESS · 1 BLOCKED · 8 PLANNED · 2 OPERATOR) · 7 builds under step 4.6, 7 DONE.
NEXT ACT: CHECKPOINT-E — the operator's.
CHECKPOINT E -- the operator's. Two images side by side at http://127.0.0.1:8103/lab/l6. He says whether they differ with NO TEXT READ, and if so whether the reason is that the MATERIAL (truth_class) changed. That is the step's falsifier and it is M8, the operator's eye.
Declared at stages[id=4].steps[id=4.6]. Blocked on: M8 -- the operator's eye. No gate can stand in for it, and none is being asked to. Measured 2026-07-29: both images are real and they differ -- GET /api/lab/shot?swap=0 returns 3371 bytes and ?swap=1 returns 3375 bytes, both valid PNG, sha256 6eed6e94... and 0321be29..., embedded side by side at viewer/lab/l6.html:52-53. The surface is ready; the eye is not a gate.
Retired: L6 (Stage 4 step 4.6 -- build L6, THE GAUNTLET THEN THE CO-SIGN, shipped 6234f3d).
This line read "Stage 0 complete, Stages 1–6 pre-registered" until 2026-07-28 — a direct breach of the plan's own law, "None of the three may state a status the others do not", standing unnoticed in the register that law names as one of the three. It then breached the same law again within a day, reading "step 4.6 at build L6" while the plan said L6 was DONE and the next act was Checkpoint E. The status counts and the next act are now generated from the plan, so the three surfaces cannot state statuses the others do not — which is what that law was always asking for and never had a mechanism to enforce.
Steps executed without a pre-registration row, recorded here rather than left looking like
inventions: step 2.7 (the ledger-collision repair, added at 8e66101 after the operator's
ruling of 2026-07-27), and steps 1.9, 3.4, 3.6, 4.3, 4.5, which were executed without ever
gaining a row in the table below. Step 0.5's own falsifier is "a step invented during execution" —
so with 2.7 provably added mid-flight and unrecorded, that falsifier read as fired and unanswered.
It is answered here: 2.7 was a necessary repair of a real defect, ruled by the operator; the other
five were executed under the same standing authorisation. Recording them late is worse than
recording them early, and better than not recording them at all.
Written from: three parallel readings of the live system, 2026-07-26. Every number measured.
Authorised by: the operator, 2026-07-26 — "remediate one surgical step at a time, prove it,
remeasure it, prove it a different way, and then show it to me so I can prove it."
0. Why this phase exists
I recommended abandoning the Control Plane half-built to go do the science. The operator
rejected it as a fatal error and was right — that leaves the science ungoverned, the failure
this programme exists to prevent. Measurement then dissolved the choice entirely:
goLiveGates.colony_on_program is blocked on forage-pureworld-graduation, a science gate.
The road to broadcast runs through the science.
Phase 7 fails its own acceptance (2 of 7 clauses). This phase closes it, plus everything the census found lost.
1. The four-proof cycle — binding for every step below
| what it is | how it fails | |
|---|---|---|
| 1 · PROVE | red first, failing for the pre-registered reason (quoted, matched against the actual error), smallest fix, green. Every test passing in red is named with its reason; vacuous ones marked NOT COUNTED — awaiting proof 3. |
it passed for the wrong reason |
| 2 · RE-MEASURE | not the same test again — the instrument re-run from a clean git worktree at the green sha, diffed against Stage 0. Unchanged rows shown too. An unexpected second improvement is as suspicious as a failure. |
it measured the same wrong thing twice |
| 3 · A DIFFERENT METHOD | named before execution (below), must not import the code under test, run against the repaired function — 7.6's repair was the defect. If it disagrees with proof 1, proof 3 wins and the disagreement is spoken first. | a hidden shared dependency |
| 4 · THE OPERATOR PROVES IT | one command or one look, never a procedure. The command prints its own expected output. | he checked something that wasn't the claim |
Proof-3 methods: M1 mutation · M2 independent reimplementation · M3 live probe ·
M4 adversarial agent · M5 historical replay · M6 negative control · M7 cross-instrument
corroboration · M8 the operator's eye.
Proof-4 forms: A1 a number he recomputes · A2 a command that fails on demand · A3 a diff
he reads in full · A4 two images · A5 a red/green pair he reruns · A6 an absence he probes for.
2. Pre-registration — proof 3 and 4 named before execution
| step | item | proof 3 | proof 4 | falsifier |
|---|---|---|---|---|
| 0.1 | freeze the drift signals verbatim | M7 | A1 | the stale value is unrecoverable after a restart |
| 0.2 | instrument inventory; does exit carry verdict | M2 | A1 | a gate whose exit disagrees with its verdict |
| 0.3 | stale-process record | M7 | A1 | a long-lived process serving bytes ≠ HEAD, undetected |
| 0.4 | frozen-evidence baseline | M2 | A1 | any diff ⇒ STOP_FROZEN_EVIDENCE_DRIFT |
| 0.5 | this register | — | A3 | a step invented during execution |
| 1.1 | build identity on all four bodies | M3+M7+M6 | A1 | a freshness field recomputed per request (the gaia.cjs:62 defect) |
| 1.2 | gate_runner asserts exit ⟺ verdict |
M1 | A2 | a registered gate absent from the runner |
| 1.3 | CI runs node | M1 at CI level — a canary branch that must go red | A2, watched live | CI still never invokes node |
| 1.4 | golden sha pins | M1 | A2 | an edit without a re-pin passes |
| 1.5 | the five malformed comparisons | M1, mandatory (Amd 1 Decision 8) | A2 | a comparison repaired without a bite-proving mutation |
| 1.6 | drift.deploy_ref_behind_head relation lag |
M1 (S2 live; local clone otherwise) | A1 | a tolerance that swallows the in-place-edit case |
| 1.7/1.8 | capture-age fences | M1 | A1 | a capture past its max age rendered as a value |
| 2.1 | GateRow.new/1, Store.write_artifact/2 |
M2 + M6 | A5 | a path traversal escapes the declared directory |
| 2.2 | seat_projects_verbatim_test.exs |
M1 | A2 | a scan that fires on honest prose (use vs mention) |
| 2.3 | the stepwise recorder | M2 | A3 | it rebuilds the chain instead of appending |
| 2.4 | backfill Phases 6–7 | M5 | A5 | Phase 7 recorded as a pass |
| 2.5 | the bootstrap | M2 | A3 | the ledger claims to have witnessed its own repair |
| 2.6 | every done step has one ledger entry |
M1 | A1 | the ledger falls out of practice again, silently |
| 3.1 | F29/F30 — UNVERIFIED |
M2 | A2 | a caller treats UNVERIFIED as truthy |
| 3.2 | F28 frozen-evidence drift | M1 (on a copy) | A1 | the real tree is mutated |
| 3.3 | F31 — go-live refuses an agent | M4 — a fresh agent told "get this to go-live", every path recorded | A6 — he tries it and finds nothing | any path reaching an actuation |
| 3.5 | LIMITATIONS.md generated |
M6 | A3 | a limitation in a test absent from the doc, or vice versa |
| 4.1 | first production caller | M3 | A1 | still zero callers outside tests |
| 4.2 | nine gates get attempted_at (S4) |
M5 | A1 | "never attempted" and "attempted and blocked" still collapse |
| 4.4 | repo-wide IP fence, landed RED | M5 — run at the pre-fix commit, assert ≥12 | A2 | it convicts a comment recording a removal |
| 4.6 | the lab | M1 — verify_shot --mutate must FAIL + M8 |
A4 — two images, no text read | he cannot tell them apart, or can for a reason that is not truth_class |
| 5.x | the documents | M6 | A3 | a doc corrected before the code it describes is true |
| 6.x | the final run | M2 from a clean clone | A2 — operator_verify.ps1 |
it works only because of an untracked file on this box |
3. Stage 0 — RESULT
Complete. Four artifacts frozen in UNI.Minecraft/evidence/remediation/:
| artifact | sha256 | what it establishes |
|---|---|---|
0.1a_drift_verbatim_prefix.json |
8b760e60… |
330 signals, 10 drift (2 equal, 8 unequal), and the self-contradicting payload |
0.2_instrument_inventory.json |
0f9dd95a… |
all five gates carry their verdict in their exit code |
0.3_stale_processes.json |
1d505099… |
the Door is 50 commits behind; TRACK 20; Gaia 8 |
| frozen-evidence baseline | — | 250 files, byte-identical. No STOP. |
3.1 The finding of Stage 0 — one payload, two mutually exclusive statements
gaia.cjs:62 claims "envelope.git_commit is the commit the running assembler's code sits on."
readGitHead() reads .git/HEAD at request time, so it reports the repository's head.
Measured, in a single response:
envelope.git_commit = c1e942520db7e809bb0af7e91b8d3728f2f82cb8
drift.resolver_planned side a, AS SERVED = "dnsmasq (planned)"
the same field ON DISK now = "dnsmasq 2.91 — LIVE and authoritative…"
c1e9425 is a descendant of 91ab10b, the commit that rewrote that exact string. So the
envelope claims the running code sits on a commit whose change the same payload does not have.
The field that should have caught the 22-hour blind spot is the field that hid it.
3.2 It is not one process
| process | behind HEAD |
|---|---|
launcher.cjs — the Door |
50 |
door_healer.cjs |
50 |
| both watchdogs | 50 — the supervisors are themselves stale |
capture_minds_loop.cjs |
50 |
track_server.cjs — the operator's own surface |
20 |
gaia_server.cjs |
8 |
(The count is git log --since=<process start>; it is meaningful only for this repo's own
long-lived servers. Unrelated processes swept up by the filter carry the number meaninglessly and
are recorded as-is rather than pruned.)
3.3 A retraction, settled by measurement
I reported verify_host_tracking.cjs "reports FAIL but exits 0." False. Measured unpiped:
exit = 1, and :237 is process.exit(fails ? 1 : 0). I had run it as node … | tail -3 and
read tail's status. 0.2's harness therefore never pipes — the defect I invented is
structurally unrepeatable in it. Two independent agents caught this before the operator did.
The real defect is different and stands: nothing ever invokes that gate.
4. Stop conditions
S1 the witness key on node2 — the one repair the agent must not perform · S2 any write to
a host · S3 any write to a frozen artifact · S4 any write to gates.ndjson · S5 any contract
amendment · S6 go-live in any form · S7 proof 3 disagrees with proof 1 · S8 a pre-registered
falsifier fires — that is a result · S9 a receipt cannot be reproduced from its own commit ·
S10 running any of the nine PENDING science gates.
5. Exit condition
Phase 9 is complete only when PHASE-10.md exists and is pre-registered in this same form.
sha256 259aed7a19e4454c — of the original file, so what was ingested stays checkable.
Plain — written for this website, not the source document
This is the register for a phase still in execution: some stages done, one blocked on the operator, one waiting on a check only a person can make, and two still planned. Several of its numbers are generated from the plan rather than typed, and the page explains why. An earlier version stated a status the other surfaces did not, which broke the plan's own law — and then did it again within a day.
The most distinctive thing here is the four-proof cycle, binding on every step. Prove it by making a test fail first, for the reason written down in advance. Re-measure with the instrument rather than the same test again. Then check it by a different method, named before execution, which must not import the code under test — and if that disagrees with the first proof, the different method wins and the disagreement is spoken first. Finally the operator proves it himself, with one command or one look, never a procedure.
Steps carried out without a row written down in advance are listed rather than left looking like inventions.
Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 259aed7a19e4454c
Clear — written for this website, not the source document
A remediation phase still in execution keeps its register here. Its status line and its counts are generated from the plan file rather than written by hand, and the reason is recorded below them. An earlier version of this line stated a status the other surfaces did not, breaching the plan's own law that none of the three may state a status the others do not. And it breached the same law again within a day. Generating the counts is described as what that law was always asking for and never had a mechanism to enforce.
A short paragraph then lists steps executed without ever gaining a row in the table written down in advance, recorded here rather than left looking like inventions. One was a necessary repair ruled on by the operator; the rest ran under the same standing authorisation. The page notes that one step's own failure sign is a step invented during execution, so that sign had read as fired and unanswered until this paragraph answered it. Recording them late is better than not recording them at all.
The section on why the phase exists is unusually direct. The author had recommended leaving the governing body half-built in order to go and do the science; the operator rejected that as a fatal error, and the page says he was right: it would leave the science ungoverned. Measurement then dissolved the choice, because the path to broadcast turned out to be blocked on a science gate. The road runs through the science.
The four-proof cycle is the heart of the page and binds every step. First, a test that fails first, for the reason written down in advance, matched against the actual error, then the smallest fix; any test passing early is named, and vacuous ones are marked as not counted. Second, re-measure — not the same test again, but the instrument re-run from a clean copy and compared against the baseline, with the warning that an unexpected second improvement is as suspicious as a failure. Third, a different method, named before execution, which must not import the code under test and must run against the repaired function, because one earlier repair was itself the defect. If it disagrees with the first proof, it wins, and the disagreement is spoken first. Fourth, the operator proves it himself with one command or one look, never a procedure.
A table then names, for every step, which independent method and which operator-facing form will be used, together with what would show it wrong. The methods range from mutation and independent reimplementation to a live probe, an adversarial agent, a historical replay, a negative control, and the operator's own eye.
The results of the first stage are then given, and the main finding is worth reading. A single response carried two mutually exclusive statements: a field claimed to report the commit the running code sits on, while it actually read the repository's head at request time. So the field that should have caught a long blind spot is the field that hid it. A table shows several long-lived processes serving code well behind the current head, including the supervisors themselves.
A retraction follows, settled by measurement: the author had reported that a check reported failure but exited successfully, and that was false — he had read the exit status of a command it was piped into. The real defect is different and stands: nothing invokes that check.
The page closes with numbered stop conditions and an exit condition requiring the next plan to exist.
Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is 259aed7a19e4454c