Wiki · Evidence & Verdicts
Phase 7 item 7.0 — premises checked, blind spots named, and the open failure **reproduced**
How to read this page
Three ways to read this page. Precise is the document itself, exactly as it is written in the repository. Plain and Clear were written for this website to help you meet that document — they are about it. They are not it, and they are not evidence.
Eighty-seven dated pages: receipts, pre-registrations, handoffs, validation records and review verdicts. A receipt is written at the moment a piece of work was checked. It names what was claimed, the commit and the seed, what was actually run, and the outcome in one of a small set of controlled words. Then it names what the work did not achieve. That last part is what makes it a receipt rather than an announcement. A pre-registration is the same discipline run in advance: the conditions that would count as a pass and the conditions that would falsify the claim are written down before the run, so neither can be adjusted once the numbers arrive.
That is why so many small dated stubs are an audit trail rather than noise. No one of them is meant to be a good read. The value is in the sequence and in the dates, because you can watch a prediction be registered, then the run happen, then the verdict land — sometimes against the prediction. Pages here record a falsified result, a rejected fix, a retracted overclaim, and a green receipt that turned out not to be reproducible from the commit that carried it. A record that carried only successes would be worth a good deal less than this one.
A gentle way in is to read a pre-registration first, so the shape becomes familiar, then a result page, then one of the corrections. This section sits off the main navigation on purpose: it is the record you check the rest of the site against, not the place to begin.
What it is not: documentation, and not a summary. Nothing here has been tidied in hindsight. Every entry reads as of its date, a later entry may overturn an earlier one, and the presence of a page is not a claim that its result stood.
Your browser cannot switch reading levels, so the document itself is shown.
Precise — the source document
This is the document. Rendered from the repository at the commit above, with nothing rewritten for the web. A gate re-renders it on every deploy and fails the build if a single byte differs.
Date: 2026-07-26 · Repo: UNI.Minecraft @ d524ad1
Plan: docs/control-plane/phases/PHASE-7.md §0.1 (UNI-FLAGELLUM)
Headline: the Phase 6 "unnamed failure" reproduced on the second run of three, and it was MY OWN TEST — not the suite's documented flake band, which is what I said it was likely to be. That attribution was wrong.
Premise 1 — "the unnamed Phase 6 failure is a known flake"
FALSE. It was mine, and it reproduced.
Three full runs at fixed seeds, output captured this time:
seed 1000 → 840 tests, 0 failures
seed 2000 → 840 tests, 1 FAILURE
seed 3000 → 840 tests, 0 failures
The failure:
1) test EVERY commit named in the ledger exists in git — invented history fails here
(SP.ControlPlane.ControlPlaneLedgerIsRealTest)
47d0ef9 is not a commit in this repository — the ledger is asserting a history that does not exist
47d0ef9 is a real commit. It is Phase 2's red commit, in this repository,
reachable right now.
Root cause — mine, and structural rather than incidental
The test I wrote for Phase 5 item 5.2 ran async: true and spawned one git
subprocess per sha. With 33 concurrent cases competing for process slots, a
spawn intermittently failed — and a failed spawn is indistinguishable from "no
such commit" if you only check the exit code.
The test that exists to prove the ledger is not asserting an invented history was itself asserting an invented failure.
Fixed at the root, not retried
async: false— a file that shells out has no business racing 32 other cases.- One
git rev-parsecall for the whole set instead of N.
A retry would have hidden it. The point of this test is to be believed when it fails.
And I got the fix wrong once, at the shell, before shipping it
The first attempt used git rev-parse --quiet --verify <shas…>. --verify
takes exactly one argument, so it failed for every input. Rather than assume
twice in one item, I checked the semantics directly:
$ git rev-parse "47d0ef9^{commit}" "75e2fc4^{commit}" → exit 0
$ git rev-parse "47d0ef9^{commit}" "deadbee^{commit}" → exit 128, echoes "deadbee^{commit}"
Plain rev-parse resolves every argument, exits non-zero on the first that does
not, and names it. That is exactly the check wanted.
The blind spot, honoured
The check's stated blind spot was: "N runs that pass do not prove absence — record the count and call it not-reproduced-in-N, never fixed."
Post-fix: 4 runs at seeds 4000–7000, all 840/0.
So the honest claim is: reproduced once in 3 pre-fix runs; not reproduced in 4 post-fix runs, after a root-cause fix. Not "fixed".
Premise 2 — "ui/ can render without the Control Plane writing"
CONFIRMED by contract, with its blind spot standing.
ui/mix.exs, as amended 2026-07-25 (ADR-0007):
The UI still NEVER writes engine state and NEVER writes
evidence/gates.ndjsonor any receipt. It gained exactly one new ability: it may SUBMIT a command toSP.ControlPlane… The UI proposes; the Control Plane authors. …a polled read still actuates NOTHING (the Door's law, inherited).
The blind spot was "check for spawn, not just for writes" — and it found
something real: ui/ already mounts processes and writes, in
application.ex, producer_uni_controller.ex, overlooker_live.ex and
stream_live.ex.
That is not a contract violation — those are the broadcast surfaces, and the
contract forbids writing engine state and evidence, not all IO. But it means
"ui/ does not spawn" is false as a blanket statement, so Phase 7's lab-view
tests cannot assert it globally. They must scope to the lab view's own module,
exactly as Phase 4 had to narrow the disk-IO scan from a blanket to an allowlist.
Recorded now so that scan is written correctly the first time.
Premise 3 — "a screenshot can distinguish simulated from observed with no text read"
NOT CHECKED, deliberately, and it is not mine to check.
The blind spot was stated as: "'distinguishable to me' is not 'distinguishable
to a tired operator at hour three' — this needs /organic-operator, not my own
eye."
I have not built the fixtures yet, and when I do, my judgement of them is not
evidence. The acceptance bar in PHASE-7.md §3 is explicit that this item is
reviewed by /organic-operator and not only by me.
Marking a premise NOT CHECKED — requires a review I cannot perform on myself is
a complete and correct answer, not an omission.
Disposition
| premise | state |
|---|---|
| 1 — the Phase 6 failure was a known flake | FALSE. Reproduced; it was my own test. Root-caused and fixed; not reproduced in 4 runs since. |
2 — ui/ can render without writing |
CONFIRMED by contract — and the blind spot found that ui/ already spawns elsewhere, so the lab-view scan must be scoped, not blanket. |
| 3 — a screenshot distinguishes simulated from observed | NOT CHECKED. Requires /organic-operator; my own eye is not evidence. |
Three phases running, item N.0 has found something. This time it found that a previous phase's honest-sounding attribution — "likely the documented flake" — was wrong, and that the test which exists to catch invented history was inventing a failure.
sha256 b2e5e9a448bce00c — of the original file, so what was ingested stays checkable.
Plain — written for this website, not the source document
Three assumptions checked before anything is built on them, and the headline is a self-correction. An earlier phase had blamed an unexplained test failure on a known flake, and that attribution was wrong. The failure reproduced, and it came from a test the same author had written: it spawned one subprocess per item while running concurrently, and a failed spawn looked exactly like a missing record. So the test meant to catch invented history was inventing a failure. It was fixed at the root rather than retried, and the honest claim is not-reproduced-since, not fixed. A third premise, that a picture alone can tell simulated from observed, is deliberately left unchecked: the author's own eye is not evidence.
Plain · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is b2e5e9a448bce00c
Clear — written for this website, not the source document
A premise check with an unusually blunt headline: an earlier attribution was wrong, and the author says so first. Three premises are examined, each with the way the check itself could be mistaken written alongside it.
The first premise was that an unexplained failure had been a known flake. It is false. Three full runs at fixed seeds were captured this time, and the failure appeared in one of them, claiming a commit did not exist. The commit does exist and is reachable right now.
The root cause is named as the author's own, and as structural rather than incidental. The test ran concurrently and spawned one subprocess for every item, and under contention a spawn intermittently failed, and a failed spawn is indistinguishable from a missing record if only the exit code is read. The sentence that follows is the point of the page: the test that exists to show the record is not asserting an invented history was itself asserting an invented failure.
The fix is at the root. No concurrency for a file that shells out, and one call for the whole set instead of one per item. A retry is explicitly rejected, because the point of this test is to be believed when it fails. The author then records getting the fix wrong once at the shell, checking the semantics directly rather than assuming twice in one item, and quotes both the failing form and the working one.
The blind spot is honoured rather than waved through. Runs that pass do not show absence, so the claim is written as reproduced once before the fix and not reproduced in the runs since, after a root-cause fix, and not as fixed.
The second premise is confirmed by contract, and its blind spot found something real: the surface in question already spawns processes and writes elsewhere. That is not a contract violation, since the contract forbids writing engine state and evidence rather than all input and output, but it does mean a blanket assertion would be false, so the coming tests must be scoped narrowly. It is recorded now so the scan is written correctly the first time.
The third premise, that a screenshot can tell simulated from observed with no text read, is deliberately not checked. The reason is the strongest line on the page: the author's own eye is not evidence, so the judgement cannot be made by the person who built the thing. Marking it as requiring a review the author cannot perform on themselves is treated as a complete and correct answer rather than an omission.
Clear · written 2026-08-01 by claude-opus-5 · not yet checked by a person · about the document whose sha256 is b2e5e9a448bce00c