Model the two layers this project shipped and did not model

docs/semantic-specification.md

@@ -791,6 +791,18 @@ Measured elsewhere, in a repository running a comparable layer: a freeze of 12,4
 annotations across 965 files held for as long as nothing asked *"you are already
 editing this file, so why is it still unaccounted for"*.
 
+**INV-023 answers file membership, not behavioural coverage.** A changed file maps to a
+Node when *any* assertion cites *any* symbol in it, so adding a new capability to an
+already-modelled module satisfies the gate while the behaviour it implements exists in no
+Flow. This repository did exactly that to itself in v0.2 (#51): two new layers landed in
+an engine file that was already mapped, and nothing reported that they were unmodelled.
+
+Decay does not cover the gap either, now that it is symbol-granular (§6.3.1): a symbol
+nobody cites cannot go stale. The precision that removed 93% of spurious decay also
+removed the accidental coverage a whole-file hash used to provide — the same trade as
+§6.3's, one level up. **The model now owes a declaration where the tool used to stumble
+over one.**
+
 ### 13.0.1 INV-024 DECAY-DISCHARGE
 
 Confidence falling is a **disclosure**. Two rules turn it into an obligation:

examples/traceos-itself/model/flows/account.md

@@ -0,0 +1,81 @@
+---
+id: flow.account
+type: flow
+domain: integrity
+lifecycle: current
+coverage_declared: partial
+trigger: { kind: event, ref: event.change.landed }
+realizes:
+  - intent.reference-is-an-address
+nodes:
+  - { id: node.account.cite,    type: action,   name: Cite the record that asked for the behavior }
+  - { id: node.account.resolve, type: decision, name: "Does that record still resolve?" }
+  - { id: node.account.check,   type: action,   name: Run the check an outcome declares }
+  - { id: node.account.verdict, type: decision, name: "Did the declared outcome occur?" }
+  - { id: node.account.refute,  type: action,   name: Record that the model was wrong }
+relationships:
+  - { type: next, source: node.account.cite,    target: node.account.resolve }
+  - { type: next, source: node.account.resolve, target: node.account.check, condition: "resolves" }
+  - { type: next, source: node.account.check,   target: node.account.verdict }
+  - { type: next, source: node.account.verdict, target: node.account.refute, condition: "refuted" }
+  - { type: interacts_with, source: node.account.cite,   target: external.repository }
+  - { type: interacts_with, source: node.account.refute, target: external.reader }
+  - { type: transitions_to, source: node.account.resolve, target: state.intent.unresolved }
+  - { type: transitions_to, source: node.account.verdict, target: state.outcome.checked }
+  - { type: transitions_to, source: node.account.refute,  target: state.outcome.refuted }
+  - { type: depends_on, source: flow.account, target: external.repository }
+outcomes:
+  - { id: account.checked,  states: [{ subject: outcome, value: checked }],
+      verified_by: assert.account.outcome-declares-its-check }
+  - { id: account.refuted,  states: [{ subject: outcome, value: refuted }],
+      verified_by: assert.account.refuted-is-an-error }
+  - { id: account.rotted,   states: [{ subject: intent, value: unresolved }],
+      verified_by: assert.account.intent-is-provenance }
+assertions:
+  - id: assert.account.intent-is-provenance
+    claim: "an Intent is checked by whether its record still resolves, never by whether its sentence is true"
+    subject: intent.verification
+    lifecycle: current
+    about: [node.account.cite, node.account.resolve]
+    evidence:
+      - { kind: implementation, locator: "traceos/engine.py#validate_intents" }
+      - { kind: implementation, locator: "traceos/check_locators.py#main" }
+      - { kind: documentation, locator: "skills/reference/vocabulary.md#INV-028 INTENT-IS-PROVENANCE" }
+  - id: assert.account.outcome-declares-its-check
+    claim: "an outcome that declares no check reads differently from one that is checked, everywhere it is reported"
+    subject: outcome.verification
+    lifecycle: current
+    about: [node.account.check]
+    evidence:
+      - { kind: implementation, locator: "traceos/engine.py#validate_outcome_verification" }
+      - { kind: implementation, locator: "traceos/explore.py#build" }
+      - { kind: test, locator: "tests/run_tests.py#inv_outcome_can_be_refuted" }
+  - id: assert.account.refuted-is-an-error
+    claim: "an outcome refuted by its own check takes integrity to INVALID, because the model is wrong rather than stale"
+    subject: outcome.refutation
+    lifecycle: current
+    about: [node.account.refute, node.account.verdict]
+    evidence:
+      - { kind: implementation, locator: "traceos/engine.py#validate_outcome_verification" }
+      - { kind: test, locator: "tests/run_tests.py#inv_outcome_can_be_refuted" }
+      - { kind: documentation, locator: "docs/semantic-specification.md#6.4 An Outcome declares how it is checked — INV-027" }
+---
+
+## Intent
+
+The two layers added in v0.2, modelled as behavior rather than only described in prose.
+
+This flow exists because the ones beside it could not hold it. `flow.reconcile` compares
+the model against the code; this one compares a behavior against **the decision that
+asked for it** and against **what actually happened**. Those are different subjects, and
+folding them into reconciliation would have hidden the only step in the whole system
+where evidence can say the model is *wrong* rather than out of date.
+
+## Why it was nearly not modelled at all
+
+It was added to the engine, the specification, the reference digest, both skills and the
+explorer before anything modelled it — and the gate said nothing, because INV-023 maps
+**files**, and `traceos/engine.py` was already mapped by other assertions. New behavior
+inside an already-mapped file is invisible to a file-granular ratchet.
+
+That is a real hole, it is filed, and this flow is the correction rather than the excuse.

examples/traceos-itself/observations/2026-09.jsonl

@@ -326,3 +326,13 @@
 {"assertion": "assert.render.no-second-implementation", "reference": "traceos/explore.py#build", "observed_at": "2026-09-11T18:32:03.938884Z", "observed_ref": "4c34ce50d7b9682d0a9f9f669bae32da51c7925c", "observed_blob": "1574df8387a10f539acf564db1d2bba1815e0fd1", "observed_norm": "268333d35517dc625b97afe48071c6c420e6c7cf", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "6efad87df1b56fd5471729be3f974b6e22e5d7d8"}
 {"assertion": "assert.render.no-second-implementation", "reference": "tests/run_tests.py#tool_explore", "observed_at": "2026-09-11T18:32:04.072064Z", "observed_ref": "4c34ce50d7b9682d0a9f9f669bae32da51c7925c", "observed_blob": "a606ebde9c7623449f35cf98c6cfce3aa0252d17", "observed_norm": "dfce6a969090055d37d4a2d9ff0e571705741370", "supports": "supports", "observer": "agent", "kind": "test", "observed_symbol": "f058ed9593e81cf743f1153c09d6b227eca935e3"}
 {"assertion": "assert.reconcile.invariants-stay-tripled", "reference": "traceos/check_docs.py", "observed_at": "2026-09-11T18:42:46.285411Z", "observed_ref": "e7b476ba57714949a4341fb3e8f415a52e56295c", "observed_blob": "4b2c31ee28f11471a1a66f82f673ac788e84c743", "observed_norm": "7ac1f5309f274240048e1e9422de378c5c827382", "supports": "supports", "observer": "agent", "kind": "implementation"}
+{"assertion": "assert.account.intent-is-provenance", "reference": "traceos/engine.py#validate_intents", "observed_at": "2026-09-11T18:46:03.406375Z", "observed_ref": "f26f2ce06224ef1e9b123037e12cae65cad7faeb", "observed_blob": "a870a87f68df6f8f3608f43fe3e353e63c56e170", "observed_norm": "8d3e91f52e26d5b2f015b02c910bef33b0ea54e0", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "6669e4ad0886f3641de31d2175c77346a3a1cfb9"}
+{"assertion": "assert.account.intent-is-provenance", "reference": "traceos/check_locators.py#main", "observed_at": "2026-09-11T18:46:03.719399Z", "observed_ref": "f26f2ce06224ef1e9b123037e12cae65cad7faeb", "observed_blob": "ee8d48b7e820d3d47e46a3cdc66d5f0fabb4d37e", "observed_norm": "4fcf5afb07b8f0abd8a2046d784fcbcea48997e2", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "42bd1c541da49435a40aa14d6b68125235af9b97"}
+{"assertion": "assert.account.intent-is-provenance", "reference": "skills/reference/vocabulary.md#INV-028 INTENT-IS-PROVENANCE", "observed_at": "2026-09-11T18:46:03.900414Z", "observed_ref": "f26f2ce06224ef1e9b123037e12cae65cad7faeb", "observed_blob": "2a4cc6840e78eec6e3eadcd931836143deb72e77", "observed_norm": "17ed8d34ba79c9656d04ecc1ff06d032151bdf15", "supports": "supports", "observer": "agent", "kind": "documentation", "observed_symbol": "033e9a36ca24c01ab9738da8406d237a7eb06226"}
+{"assertion": "assert.account.outcome-declares-its-check", "reference": "traceos/engine.py#validate_outcome_verification", "observed_at": "2026-09-11T18:46:04.078772Z", "observed_ref": "f26f2ce06224ef1e9b123037e12cae65cad7faeb", "observed_blob": "a870a87f68df6f8f3608f43fe3e353e63c56e170", "observed_norm": "8d3e91f52e26d5b2f015b02c910bef33b0ea54e0", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "779b91f9340e3bc8b9d6a0972d60f9d8eae1c933"}
+{"assertion": "assert.account.outcome-declares-its-check", "reference": "traceos/explore.py#build", "observed_at": "2026-09-11T18:46:04.245991Z", "observed_ref": "f26f2ce06224ef1e9b123037e12cae65cad7faeb", "observed_blob": "1574df8387a10f539acf564db1d2bba1815e0fd1", "observed_norm": "268333d35517dc625b97afe48071c6c420e6c7cf", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "6efad87df1b56fd5471729be3f974b6e22e5d7d8"}
+{"assertion": "assert.account.outcome-declares-its-check", "reference": "tests/run_tests.py#inv_outcome_can_be_refuted", "observed_at": "2026-09-11T18:46:04.411249Z", "observed_ref": "f26f2ce06224ef1e9b123037e12cae65cad7faeb", "observed_blob": "a606ebde9c7623449f35cf98c6cfce3aa0252d17", "observed_norm": "dfce6a969090055d37d4a2d9ff0e571705741370", "supports": "supports", "observer": "agent", "kind": "test", "observed_symbol": "eb9f59f8d40526d33cfdc19a57c3aeceda4a42ef"}
+{"assertion": "assert.account.refuted-is-an-error", "reference": "traceos/engine.py#validate_outcome_verification", "observed_at": "2026-09-11T18:46:04.586138Z", "observed_ref": "f26f2ce06224ef1e9b123037e12cae65cad7faeb", "observed_blob": "a870a87f68df6f8f3608f43fe3e353e63c56e170", "observed_norm": "8d3e91f52e26d5b2f015b02c910bef33b0ea54e0", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "779b91f9340e3bc8b9d6a0972d60f9d8eae1c933"}
+{"assertion": "assert.account.refuted-is-an-error", "reference": "tests/run_tests.py#inv_outcome_can_be_refuted", "observed_at": "2026-09-11T18:46:04.738311Z", "observed_ref": "f26f2ce06224ef1e9b123037e12cae65cad7faeb", "observed_blob": "a606ebde9c7623449f35cf98c6cfce3aa0252d17", "observed_norm": "dfce6a969090055d37d4a2d9ff0e571705741370", "supports": "supports", "observer": "agent", "kind": "test", "observed_symbol": "eb9f59f8d40526d33cfdc19a57c3aeceda4a42ef"}
+{"assertion": "assert.account.refuted-is-an-error", "reference": "docs/semantic-specification.md#6.4 An Outcome declares how it is checked \u2014 INV-027", "observed_at": "2026-09-11T18:46:04.889538Z", "observed_ref": "f26f2ce06224ef1e9b123037e12cae65cad7faeb", "observed_blob": "d2dbcc769ff00277b490d96ee57815ca592274ec", "observed_norm": "507d522809b19fdb877b1e1eaa57d214797f7871", "supports": "supports", "observer": "agent", "kind": "documentation", "observed_symbol": "b94b214f0662c0ac504dbd623c537b5eefd476b9"}
+{"assertion": "assert.account.refuted-is-an-error", "reference": "docs/semantic-specification.md#6.4 An Outcome declares how it is checked \u2014 INV-027", "observed_at": "2026-09-11T18:46:49.687941Z", "observed_ref": "9ecbb96f77e658ab42510fbc51a5ed9d6cf5c84e", "observed_blob": "e4631904a0714750114cc07fd176754330b9a058", "observed_norm": "a89789dc84043df5ee8fe5fd4a0dcce274f354fe", "supports": "supports", "observer": "agent", "kind": "documentation", "observed_symbol": "6cdaa20b4be30d3825f2cd51b6b6263948da3988"}