Release blockers: first-run experience, and two false-decay bugs

docs/DIRECTION.md

@@ -63,8 +63,9 @@ What the model declared does not quietly stop resolving. Symbol-granular decay v
 what it excluded (INV-025).
 
 *Claims:* the model does not rot silently.
-*Kills it:* erosion fires often enough on a healthy repository to be tuned out. Unmeasured
-— #10 is the number, and no horizon past this one is worth starting before it exists.
+*Kills it:* erosion fires often enough on a healthy repository to be tuned out. #10 is now
+measured — a median of 3 re-reads per change, down from 12 — so this horizon stands and the
+ones after it are worth starting.
 
 ### H2 — Outcome carries evidence — *mechanism built, value unproven*
 
@@ -163,9 +164,24 @@ comes:
 
 ## The number that governs all of it
 
-**#10 — nobody has measured what it costs to keep a model current.** A peer's trial gave
-a fragment: four `validate` rounds, five assertions, two files of fifty-six. Nobody has
-measured the weekly cost of keeping that from rotting.
+**#10 — what it costs to keep a model current. Measured, and it is not prohibitive.**
+
+The unit is a *re-observation*: a reference a change invalidated, which someone opens,
+reads and confirms. First-time observations are excluded — that is the model growing, not
+the tax of keeping it.
+
+| | n | median | mean | max |
+|---|---|---|---|---|
+| before symbol-granular decay | 20 changes | **11.5** | 15.0 | 80 |
+| after symbol-granular decay | 7 changes | **3.0** | 4.6 | 14 |
+
+A change used to force re-reading roughly 88% of the model's references; it now forces
+about 19%. The three worst figures all predate the narrowing work and were the gate
+generating its own rubber stamps.
+
+**What this does not establish:** n=7, one repository, 16 assertions, one author who wrote
+both the model and the code. The cost on a model somebody else maintains is larger and is
+not knowable from here.
 
 If that number is small, every horizon above is worth building. If it is large, none of
 them matter, because the model will be abandoned before it is ever contradicted by an

docs/semantic-specification.md

@@ -515,6 +515,26 @@ behavior and is valid.
 
 ## 8. Lifecycle and Effective Reality
 
+
+#### Wording is not a contradiction
+
+Nothing in this system reads a claim (§6.1), so "the strings differ" cannot mean "the
+propositions conflict". Treating it that way produced ten errors and an INVALID model
+from five assertions on one subject on the first outside run of this tool, with nothing
+actually in conflict.
+
+Two findings, because two different things were being conflated:
+
+| Finding | Level | Condition |
+|---|---|---|
+| `CONTRADICTION` | error | same subject, overlapping selectors, and the **latest observations disagree** — one supported, one refuted |
+| `SUBJECT_NOT_DISCRIMINATING` | warn | same subject, overlapping selectors, different wording — reported **once per subject** |
+
+The first is decidable and is a real conflict a person must resolve, so it is reported
+per pair. The second is a modelling smell: either the assertions describe different
+aspects and want different subjects, or they compete and want `when` selectors. The
+count of pairs was never information, only arithmetic.
+
 ### INV-016 CURRENT-ONLY-RESOLVES
 
 ```
@@ -758,6 +778,29 @@ carry all four tiers, including an empty `unknown`.
 
 ## 13. Coverage
 
+#### An impact result that reaches most of the model says nothing
+
+The tiers are useful only while they stay different sizes. Measured (#5):
+
+| graph | entities | median reached by one change | worst |
+|---|---|---|---|
+| synthetic, 10 flows | 61 | 15% | 20% |
+| synthetic, 50 flows, fanout 4 | 301 | 9% | 15% |
+| synthetic, 200 flows, fanout 6 | 1,201 | 5% | 7% |
+| `examples/ecommerce` | 32 | **61%** | 66% |
+| `examples/traceos-itself` | 45 | **56%** | 89% |
+
+**The tier system does not collapse with scale** — that hypothesis is refuted; as the
+graph grows a change reaches proportionally *less* of it, and `certain` stays at two
+entities while `inspect` absorbs the distance. Where it collapses is the opposite end:
+small models in which every flow invokes another, which is what a model looks like in its
+first week.
+
+So the result carries `share_reached` and `discriminates`, and a result above 50% is
+reported as **DID NOT DISCRIMINATE** rather than as an answer — the shape of INV-026 one
+level down. It is a fact about the model, not a finding about the change, and saying so
+prevents the worst reading: that a change genuinely touches two thirds of a system.
+
 ### INV-011 UNCERTAIN-NE-UNKNOWN
 
 | | Meaning | Detectable by |
@@ -1072,6 +1115,19 @@ the moment it was read. The line range is derived from git's own hunk header at
 time and never stored, so INV-022 is untouched; what is stored is a hash of what the
 observer actually read, which is what an observation is for.
 
+The range is resolved with `git blame -L :<symbol> <file>`, which answers **at HEAD**.
+`git log -L` was tried first and is wrong for this: its hunk header reports the range as
+it stood at the last commit that touched the symbol, so any later commit editing the file
+above it shifts the answer — measured here, a 111-line insertion moved a function from
+line 717 to 747 and the hash was taken over the wrong 68 lines.
+
+Trailing blank lines are dropped before hashing, for the same reason `observed_norm`
+drops them: git's funcname block includes the blank lines that follow a symbol, so
+inserting a new function *after* one otherwise reads as an edit *to* it.
+
+Both were false positives in the safe direction. Both were still wrong, and a checker that
+cries wolf is discharged by rubber stamp (§13.0.1).
+
 Order of answers, strongest first:
 
 | | Needs history | Answers |

examples/traceos-itself/observations/2026-09.jsonl

@@ -336,3 +336,19 @@
 {"assertion": "assert.account.refuted-is-an-error", "reference": "tests/run_tests.py#inv_outcome_can_be_refuted", "observed_at": "2026-09-11T18:46:04.738311Z", "observed_ref": "f26f2ce06224ef1e9b123037e12cae65cad7faeb", "observed_blob": "a606ebde9c7623449f35cf98c6cfce3aa0252d17", "observed_norm": "dfce6a969090055d37d4a2d9ff0e571705741370", "supports": "supports", "observer": "agent", "kind": "test", "observed_symbol": "eb9f59f8d40526d33cfdc19a57c3aeceda4a42ef"}
 {"assertion": "assert.account.refuted-is-an-error", "reference": "docs/semantic-specification.md#6.4 An Outcome declares how it is checked \u2014 INV-027", "observed_at": "2026-09-11T18:46:04.889538Z", "observed_ref": "f26f2ce06224ef1e9b123037e12cae65cad7faeb", "observed_blob": "d2dbcc769ff00277b490d96ee57815ca592274ec", "observed_norm": "507d522809b19fdb877b1e1eaa57d214797f7871", "supports": "supports", "observer": "agent", "kind": "documentation", "observed_symbol": "b94b214f0662c0ac504dbd623c537b5eefd476b9"}
 {"assertion": "assert.account.refuted-is-an-error", "reference": "docs/semantic-specification.md#6.4 An Outcome declares how it is checked \u2014 INV-027", "observed_at": "2026-09-11T18:46:49.687941Z", "observed_ref": "9ecbb96f77e658ab42510fbc51a5ed9d6cf5c84e", "observed_blob": "e4631904a0714750114cc07fd176754330b9a058", "observed_norm": "a89789dc84043df5ee8fe5fd4a0dcce274f354fe", "supports": "supports", "observer": "agent", "kind": "documentation", "observed_symbol": "6cdaa20b4be30d3825f2cd51b6b6263948da3988"}
+{"assertion": "assert.account.intent-is-provenance", "reference": "traceos/engine.py#validate_intents", "observed_at": "2026-09-11T19:33:47.753376Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "5214a57c1b1270220d65aca990a162f986b7dc45", "observed_norm": "84b72b9bbc2d810dae9855d50112212a8952b370", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "f8cef002fe697744492e6c2bc32ce6d6a9228ade"}
+{"assertion": "assert.account.outcome-declares-its-check", "reference": "traceos/engine.py#validate_outcome_verification", "observed_at": "2026-09-11T19:33:47.890274Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "5214a57c1b1270220d65aca990a162f986b7dc45", "observed_norm": "84b72b9bbc2d810dae9855d50112212a8952b370", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "f3163972e97d9264f1a62296038b9471188bf28e"}
+{"assertion": "assert.account.outcome-declares-its-check", "reference": "tests/run_tests.py#inv_outcome_can_be_refuted", "observed_at": "2026-09-11T19:33:48.039614Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "7f3011345598a6d0c995a9fb4953d59cb99f58e4", "observed_norm": "15c3438e2017d07c21c28ae7d9f6ad35c31652b9", "supports": "supports", "observer": "agent", "kind": "test", "observed_symbol": "7b0b6b84da830e6dc8b2fc8d9ea8f474ff987051"}
+{"assertion": "assert.account.refuted-is-an-error", "reference": "traceos/engine.py#validate_outcome_verification", "observed_at": "2026-09-11T19:33:48.174059Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "5214a57c1b1270220d65aca990a162f986b7dc45", "observed_norm": "84b72b9bbc2d810dae9855d50112212a8952b370", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "f3163972e97d9264f1a62296038b9471188bf28e"}
+{"assertion": "assert.account.refuted-is-an-error", "reference": "tests/run_tests.py#inv_outcome_can_be_refuted", "observed_at": "2026-09-11T19:33:48.315693Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "7f3011345598a6d0c995a9fb4953d59cb99f58e4", "observed_norm": "15c3438e2017d07c21c28ae7d9f6ad35c31652b9", "supports": "supports", "observer": "agent", "kind": "test", "observed_symbol": "7b0b6b84da830e6dc8b2fc8d9ea8f474ff987051"}
+{"assertion": "assert.account.refuted-is-an-error", "reference": "docs/semantic-specification.md#6.4 An Outcome declares how it is checked \u2014 INV-027", "observed_at": "2026-09-11T19:33:48.456838Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "ebc370482855c3380efcf099ae0cd7e9a6d189fd", "observed_norm": "9b7f9882dd0d7ebaacbf3fc51955b2b18726c7dc", "supports": "supports", "observer": "agent", "kind": "documentation", "observed_symbol": "4dcf2fcd77fe80e4e09b651bfb8c4cd3609fe76e"}
+{"assertion": "assert.implement.not-ours", "reference": "docs/semantic-specification.md#Non-goals", "observed_at": "2026-09-11T19:33:48.602083Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "ebc370482855c3380efcf099ae0cd7e9a6d189fd", "observed_norm": "9b7f9882dd0d7ebaacbf3fc51955b2b18726c7dc", "supports": "supports", "observer": "agent", "kind": "documentation", "observed_symbol": "e309627465118b875616e98df6463b5cd49dd2bd"}
+{"assertion": "assert.reconcile.confidence-decays", "reference": "traceos/engine.py#computed_confidence", "observed_at": "2026-09-11T19:33:48.764900Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "5214a57c1b1270220d65aca990a162f986b7dc45", "observed_norm": "84b72b9bbc2d810dae9855d50112212a8952b370", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "e7d38f35bddf5544e0165922bcb37492793f120a"}
+{"assertion": "assert.reconcile.unverifiable-is-not-verified", "reference": "traceos/engine.py#Git", "observed_at": "2026-09-11T19:33:48.912315Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "5214a57c1b1270220d65aca990a162f986b7dc45", "observed_norm": "84b72b9bbc2d810dae9855d50112212a8952b370", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "a60bd89e4305913604e40eff71b6418b54ec7ed5"}
+{"assertion": "assert.render.no-second-implementation", "reference": "tests/run_tests.py#tool_explore", "observed_at": "2026-09-11T19:33:49.061765Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "7f3011345598a6d0c995a9fb4953d59cb99f58e4", "observed_norm": "15c3438e2017d07c21c28ae7d9f6ad35c31652b9", "supports": "supports", "observer": "agent", "kind": "test", "observed_symbol": "45025670400c01277270393f7a67c6300a7b4ab0"}
+{"assertion": "assert.trace.four-tiers", "reference": "traceos/engine.py#impact", "observed_at": "2026-09-11T19:33:49.204495Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "5214a57c1b1270220d65aca990a162f986b7dc45", "observed_norm": "84b72b9bbc2d810dae9855d50112212a8952b370", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "65f836e5f398caa147047b90156eeeec8322eecc"}
+{"assertion": "assert.trace.four-tiers", "reference": "tests/run_tests.py#inv_impact_ne_changed_files", "observed_at": "2026-09-11T19:33:49.354436Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "7f3011345598a6d0c995a9fb4953d59cb99f58e4", "observed_norm": "15c3438e2017d07c21c28ae7d9f6ad35c31652b9", "supports": "supports", "observer": "agent", "kind": "test", "observed_symbol": "b0dedb1f3fdb3dd7609f6a8ac2faf85c2d8e2184"}
+{"assertion": "assert.trace.unknown-is-gated", "reference": "traceos/cli.py", "observed_at": "2026-09-11T19:33:49.501471Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "bb69674159ca6e6cdbccbe1013b6bfe4ffafc721", "observed_norm": "9749889510ef4ddcc4768204007cac03a02de95c", "supports": "supports", "observer": "agent", "kind": "implementation"}
+{"assertion": "assert.trace.unknown-is-not-safe", "reference": "traceos/engine.py#impact", "observed_at": "2026-09-11T19:33:49.643433Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "5214a57c1b1270220d65aca990a162f986b7dc45", "observed_norm": "84b72b9bbc2d810dae9855d50112212a8952b370", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "65f836e5f398caa147047b90156eeeec8322eecc"}
+{"assertion": "assert.trace.unknown-is-not-safe", "reference": "tests/run_tests.py#inv_impact_ne_changed_files", "observed_at": "2026-09-11T19:33:49.797159Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "7f3011345598a6d0c995a9fb4953d59cb99f58e4", "observed_norm": "15c3438e2017d07c21c28ae7d9f6ad35c31652b9", "supports": "supports", "observer": "agent", "kind": "test", "observed_symbol": "b0dedb1f3fdb3dd7609f6a8ac2faf85c2d8e2184"}
+{"assertion": "assert.understand.observes-before-asserting", "reference": "traceos/engine.py#observe", "observed_at": "2026-09-11T19:33:49.946099Z", "observed_ref": "f77c48ef7d7e3d66a4ad6335652d4708d772cb4e", "observed_blob": "5214a57c1b1270220d65aca990a162f986b7dc45", "observed_norm": "84b72b9bbc2d810dae9855d50112212a8952b370", "supports": "supports", "observer": "agent", "kind": "implementation", "observed_symbol": "81e37c012d1ed637d3c9b13477cdd384b6da63d8"}