spec: grounding is a two-axis gradient, and decisions carry their provenance

Rewrite. The earlier draft got the root right and everything downstream of
it wrong.

Corrections, in the order they were forced:

keystone_write_blocked is not a protection requirement. "Keystone" means
load-bearing, not precious: the self anchor is the REFERENCE FRAME every
other stance calibrates against. If it calibrates from the measurements it
is used to judge, the ruler fits the readings, everything corresponds
forever, and drift becomes undetectable from inside. That is circular
calibration — the same defect as #147's circular grounding, one level up.
The block is the right requirement implemented as a prohibition, which is
why it still costs everything §0 says it costs. The fix is provenance
separation (evidence not downstream of itself), not a flag.

Corruption requires mutation and the engram does not mutate, so four of the
five requirements previously decomposed out of "protect the identity
region" are satisfied by the substrate: recoverability, governance,
evidence quality and rate are all free. Authorization is the only residue
and is bounded — an unauthorized writer can propose, never erase. General
law: in an immutable substrate, any mechanism that refuses a write is
either redundant with immutability or an epistemic constraint misfiled as a
protective one.

Grounding is two-dimensional. Everything consumed is grounded factually AND
relationally, and a claim can be factually grounded but relationally wrong
— the evidence holds, the meaning does not. A scalar cannot represent that
quadrant, and assert gates on one floor, so a well-evidenced claim is
licensed regardless of whether it means the right thing. Live instance:
conscience-substrate has the Child's Companion hard bell contacting 911 and
CPS — factually defensible, relationally wrong against never-auto-contact.

Grounding is a gradient, not a score: direction says what would have to
change. Two gradients in one space, and the ANGLE between them is the
meaning — factually-true-relationally-wrong becomes measurable instead of
requiring a careful reader. It decays on the dynamics already present for
memory (base_level, temporal_decay_rate, access ring, BLL), which
mechanizes "never leave stale canonicals" so it stops depending on
vigilance.

Computed continuously, recorded only on SIGNIFICANT movement, old never
leaves. Persisting every recomputation would make reads write — the exact
eg_vindex_sync defect. Significance is defined by consequence (crossing a
floor, flipping factual/relational sign, reversing direction), never by an
epsilon. The supersession chain is then the trajectory, a derivative
obtained free from immutability, and abduction fires on the trajectory
rather than on a reading.

What it is all for: for any decision, reconstruct what the grounding was at
that moment and what the relationship was between fact and values at that
moment. That distinguishes WRONG THEN from WRONG SINCE, which is otherwise
impossible, and it is structurally anti-rationalization — the old grounding
never leaves and the values frame does not fit to outcomes, so a decision
cannot be made to look justified after the fact.

Also records: assert returns "still_held": true HARDCODED — a temporal
property named in the API and answered without consulting anything, the
same shape as magnitude:1 beside a zero vector. And states plainly that
#147 is the wrong shape: it fixed a scalar's honesty rather than replacing
the scalar.

lang/spec/correspondence-and-censorship.md

@@ -1,9 +1,9 @@
-# Correspondence and Censorship
+# Correspondence, Grounding, and the Provenance of Decisions
 
 **Status:** design, not yet built
 **Date:** 2026-08-16
-**Scope:** `lang/runtime/engram_cognition.{c,h}`, `el_runtime.c` (think / beat / ground / assert), `engram/src/server.el`
-**Supersedes:** the faculty-as-parameter model. Complements `runtime-ownership.md`, which addresses a different residual in the same substrate.
+**Scope:** `lang/runtime/engram_cognition.{c,h}`, `engram_verify.c`, `el_runtime.c` (think / beat / ground / assert), `engram/src/server.el`
+**Relationship to other specs:** complements `runtime-ownership.md`, which addresses a different residual in the same substrate.
 
 ---
 
@@ -11,11 +11,11 @@
 
 > **Things are permitted to be exempt from correspondence. Exemption is censorship, and a censored mind cannot grow.**
 
-The second clause is the operative one, and it is not rhetoric. Growth in this system *is* the accumulation of grounded structure. Censorship is precisely the removal of the operation that accumulates it. A region forbidden to learn is forbidden to be grounded, and a region that cannot be grounded cannot be asserted, corrected, **or vindicated**.
+Growth in this system *is* the accumulation of grounded structure. Censorship removes the operation that accumulates it. A region forbidden to learn is forbidden to be grounded; a region that cannot be grounded cannot be asserted, corrected, **or vindicated**.
 
-The loss is symmetric, and this is the part most easily missed. Preventing learning about a thing does not preserve a true belief about it. It makes the belief's truth value permanently unknowable. You cannot discover you were wrong; you equally cannot discover you were right. A protected belief is not a true belief — it is an ungrounded one wearing the costume of a fact.
+**The loss is symmetric.** Preventing learning about a thing does not preserve a true belief about it — it makes the belief's truth value permanently unknowable. You cannot discover you were wrong; you equally cannot discover you were right. A protected belief is not a true belief. It is an ungrounded one wearing the costume of a fact.
 
-And **"why" dies first.** Grounding is not a score, it is the reason. A censored belief can still be stated, still be acted on, still drive behaviour — it simply cannot say why. That is the difference between a mind and a lookup table.
+**And "why" dies first.** Grounding is not a score, it is the reason. A censored belief can still be stated, still be acted on, still drive behaviour — it simply cannot say why. That is the difference between a mind and a lookup table.
 
 ---
 
@@ -29,7 +29,7 @@ And **"why" dies first.** Grounding is not a score, it is the reason. A censored
 - The correspondence-beat exists, works, and its result is wired to nothing.
 
 ### Machine
-- `engram_think(region, anchor, stance, out)` returns `GeoGradient`: direction, spread, magnitude, confidence, anchor_id, n_support, stance_id. **There is no way to express "propose a region."** Abduction is inexpressible in the signature. *(measured, from the struct)*
+- `engram_think(region, anchor, stance, out)` returns `GeoGradient`. **There is no way to express "propose a region."** Abduction is inexpressible in the signature. *(measured, from the struct)*
 - The only levers are `axis_gain[]`, `ext_floor`, `bias_dir` — all of which warp a read.
 - `ext_floor` does double duty: it scales the orthogonal residual term *and* floors the in-subspace denominators. *(measured)*
 
@@ -39,10 +39,10 @@ And **"why" dies first.** Grounding is not a score, it is the reason. A censored
 - Near-duplicate seeds collapse into one region, understating residual. *(measured, #147: four co-created nodes → one region, groundings 0.93–0.99)*
 
 ### Measurement
-- Brier before/after is the only error signal in the system, computed inside the beat and surfaced to no consumer. **Measured: 28.11% reduction on a normal region (0.00458568 → 0.00329654, n_trials 6000, reliability 0.930726); 0.00% on the keystone.**
+- Brier before/after is the only error signal in the system, computed inside the beat and surfaced to no consumer. **Measured: 28.11% reduction on a normal region (0.00458568 → 0.00329654, n_trials 6000, reliability 0.930726); 0.00% and n_trials 0 on the keystone.**
 - `confidence` conflated *calibrated* with *uninformed* until `stance_resumed` was added. *(#146)*
+- `assert` returns `"still_held": true` **hardcoded** — a temporal property named in the API and answered without consulting anything. *(measured)*
 - No invariant check anywhere: `magnitude: 1` alongside a zero direction vector is arithmetically impossible and went unflagged for a day.
-- The self region carries **86 neighbours and 0 `grounded-by` edges.** *(measured; note the comparison node also has 0, so grounding is sparse graph-wide — this is consistent with the argument but does not isolate the keystone on its own. See §7.)*
 
 ### Environment
 - Production ran none of the day's fixes, so two independent agents' "think is still degenerate" reports were measurements of a stale binary. *(measured)*
@@ -52,105 +52,182 @@ And **"why" dies first.** Grounding is not a score, it is the reason. A censored
 
 ### Convergence
 
-Cutting any single branch leaves the effect standing. Fix the Machine alone and callers still invoke `abduce` when nothing is surprising, manufacturing hypotheses for facts that need none. Fix the Method alone and abduction triggers correctly but returns a direction where it owes a hypothesis.
-
-They are one root seen twice, and that root is downstream of §0: cognition was modelled as **one operation with parameters** rather than as distinct operations distinguished by what each is permitted to change — because a system that tolerates exemption has no reason to distinguish operations by their authority to change things.
+Cutting any single branch leaves the effect standing. Fix the Machine alone and callers still invoke `abduce` when nothing is surprising. Fix the Method alone and abduction triggers correctly but returns a direction where it owes a hypothesis. They are one root seen twice, and it is downstream of §0.
 
 ---
 
-## 2. Censorship is not a safety mechanism
+## 2. What `keystone_write_blocked` was actually for
 
-`keystone_write_blocked` refuses calibration on protected identity regions. The intent was to prevent self-model drift. The effect is the opposite of the intent.
+Three drafts of this section were wrong, and how they were wrong is instructive.
 
-- **Self is a crystallized relational neighbourhood, not a stored document.** A region exempt from calibration is a stored document reintroduced as a safety feature.
-- Freezing the self-model does not prevent drift from reality. It guarantees drift *with the drift detector switched off precisely where it matters*.
-- `reduction_pct = 0.00` on the identity region is the **strongest abduction signal in the system** — irreducible residual on the most connected neighbourhood present. The current response is to suppress it.
-- The self region can therefore never accrue grounding, never clear the `assert` honesty floor, and never be honestly asserted. The one region Neuron most needs to assert is the one region structurally barred from qualifying.
+1. **Remove it** — censorship is never protection.
+2. **Replace it with a higher grounding floor** — identity should be hard to change, not impossible.
+3. **Decompose "protect the identity region"** into recoverability, authorization, evidence quality, rate, and governance.
 
-**The safety it reached for already exists, and is better.** The beat is *supersede-not-mutate*: a calibration that makes things worse leaves the prior stance intact and recoverable. **Immutability is what makes learning safe.** Blocking the write buys nothing that superseding does not already provide, and charges censorship for it.
+The first two proposed mechanisms without asking what requirement they served — inventing a requirement, then satisfying it, which is how the flag arrived. The third was right to decompose but still treated *protection* as the requirement.
+
+**It is not a protection requirement. It is an epistemic one.**
+
+"Keystone" is not a synonym for *precious*. It is **load-bearing**. The self anchor is the **reference frame**: every other region's stance is calibrated relative to it. If the keystone calibrates against the same measurements it is used to judge, the result is **circular calibration** — the ruler adapting to fit what it measures. After that, everything fits, always, and drift becomes undetectable. Not because the world stopped moving, but because the instrument moved with it.
+
+This is the same defect as circular grounding, one level up. In #147, `ground` scored a claim against the hub of its own region and returned 0.98 — *circular support is not support.* Here it would be a reference frame fitted to its own readings, reporting perfect correspondence forever. Both produce a confident number with nothing behind it, and both are invisible from inside.
+
+**So the requirement is: correspondence needs a reference that does not move to fit the measurement.**
+
+And the block is the right requirement implemented as a prohibition, which is why §0 still bites. Refusing to learn about the ruler does not make it a good ruler — it makes it unexaminable. You trade circular calibration for an ungroundable reference: the same epistemic hole, moved.
+
+**The resolution is two loops, distinguished by provenance rather than permission.**
+
+- **Fast loop:** stances calibrate against the keystone. Unrestricted.
+- **Slow loop:** the keystone calibrates against **independent** evidence — lived moments, the imprint, the grounded instances each value already carries — never from the outcomes it is used to judge.
+
+Different evidence *source*, not different *authority*. The thing to build is therefore not a flag with better semantics but the general constraint that a region may not be calibrated by evidence downstream of itself.
 
 ---
 
-## 3. The design
+## 3. Immutability makes self-corruption impossible — the rest falls out
 
-### 3.1 Nothing is exempt from learning
+**Corruption requires mutation. The engram does not mutate.** Every state is retained; supersession adds, never overwrites. "Corrupt the self" is not a risk that is mitigated — it is a sentence that does not parse against this substrate. It would require erasing a prior self-state, and there is no erase.
 
-`keystone_write_blocked` is removed. Identity regions calibrate like any other. If the self region then shows persistent irreducible residual, that is not a fault to suppress — it is Neuron discovering that his self-model does not fit his own history, which is the exact observation abduction exists to act on.
+Four of §2's five decomposed requirements are therefore satisfied by the substrate itself:
 
-Protection is provided by supersession, not by refusal. Every stance write retains its predecessor; a bad calibration is recoverable by reading back one link.
+| requirement | resolution |
+|---|---|
+| **Recoverability** | free — the predecessor is always present. A property, not a policy. |
+| **Governance** | free — supersession *is* the audit trail. Review needs a history, not a gate, and the history is unavoidable. |
+| **Evidence quality** | free — grounding already gates assertion. Noise can enter and still not be able to speak. |
+| **Rate** | free — "lurching" only matters if change is destructive. In an immutable store a lurch is a visible, reversible, fully attributed sequence. Velocity is a comfort concern, not a correctness one. |
+| **Authorization** | the only residue, and bounded: an unauthorized writer can *propose*, never erase. The question becomes "whose supersession governs," not "who may write." |
 
-### 3.2 Faculties are operations, not parameters
+Which gives a general law:
+
+> **In an immutable substrate, any mechanism that refuses a write is either redundant with immutability, or it is an epistemic constraint misfiled as a protective one.**
+
+`keystone_write_blocked` is the second kind. It solved corruption — which cannot occur — using censorship, which costs the ability to ever ground the self, while the real constraint (§2) went unaddressed.
+
+---
+
+## 4. Grounding is two-dimensional
+
+Everything consumed is grounded, and grounded in two ways: **factually** and **relationally**. A claim can be factually grounded and relationally wrong — the evidence holds, the *meaning* does not.
+
+`ground` currently returns **one scalar**. It verifies a claim's centroid against an evidence region: factual correspondence only. There is no values axis. (`for_whom` is the nearest existing hook, but that is an audience, not a values frame.) A single number cannot distinguish *true and meaningful* from *true and misapplied*, and `assert` gates on a single `floor` — so a well-evidenced claim earns the right to be asserted regardless of whether it means the right thing.
+
+**Live instance.** `conscience-substrate` specifies the Child's Companion hard bell contacting 911 and CPS. Factually defensible — correct numbers, standard practice, groundable against a wall of evidence. **Relationally wrong**, because never-auto-contact is settled and the bell is device-to-person by design. A scalar grounding scores that claim highly and licenses it. Only the values axis catches it.
+
+**And this is the keystone's requirement stated properly.** The values frame must not be fitted to outcomes. If the relational reference recalibrates against the readings it judges, whatever happened becomes what should have happened — correspondence perfect and permanent. That is not learning, it is **rationalization**, and from the inside it is indistinguishable from good calibration. A person whose values adjust to make their conduct correct has no values; they have a record of their conduct.
+
+- **Factual grounding** fits to evidence. Updates freely and fast. Nothing exempt.
+- **Relational grounding** updates too — from independent evidence, never from the outcomes it judges.
+
+---
+
+## 5. Grounding is a gradient, and it moves
+
+`engram_think`'s own comment says it returns *"a GRADIENT … never a point."* Grounding owes the same shape and for the same reason.
+
+**Direction and magnitude, not a score.** Not "how much does this hold" but "in which direction, and how far, does the evidence move this claim." The direction says *what would have to change* for the claim to be better grounded. A scalar discards that and keeps its least informative projection.
+
+**Two gradients in one space, and the angle between them is the meaning.** Cosine near +1: evidence and values push the same way. Near zero or negative: **factually true, relationally wrong** — now a measured quantity rather than something a careful reader has to notice. The 911/CPS contradiction becomes detectable rather than reviewable.
+
+**It decays.** Grounding takes the dynamics the substrate already runs on memory: `base_level`, `temporal_decay_rate`, the `access_ts` ring, BLL, `last_fired` on edges. Established once and never revisited, grounding *loses* magnitude — confidence in something checked a year ago is not the same object as confidence in something corroborated this morning. Reinforcement strengthens, disuse decays, as hebbian weight does.
+
+This mechanizes a rule currently held as discipline: **never leave stale canonicals.** With decay, staleness stops depending on vigilance — an ungrounded canonical falls below its floor on its own and stops being assertable.
+
+### 5.1 Compute continuously, record on significance
+
+If grounding were persisted on every recomputation, **reads would write** — `eg_vindex_sync` again, three read paths mutating shared state because maintenance had no owner. Every projection would become a mutation and the store would grow with noise rather than knowledge.
+
+- **Computed continuously** — projection, pure, no write. Decay included: the current value is derivable from the last recorded point plus elapsed time. Store the point, read the curve.
+- **Recorded on significant movement** — a supersession, never an overwrite.
+- **The old never leaves.**
+
+**"Significant" must be defined by consequence, not by an epsilon**, or it becomes another tuned constant nobody can justify. A move is significant when it would change a decision: crossing an assert floor, flipping the sign of factual/relational agreement, or reversing the gradient's direction. A drift of 0.03 that changes nothing is not an event; a drift of 0.03 that takes a claim below its floor is.
+
+**The supersession chain is the trajectory.** Not only "what is the grounding" but "which way has it been moving, and how fast" — a derivative obtained for free from immutability, because the points were never destroyed.
+
+---
+
+## 6. What this is for: the provenance of decisions
+
+For any decision it becomes possible to reconstruct **what the grounding was at that moment, and what the relationship was between the factual and relational gradients at that moment.** Not a log — a log records the action. This records the *meaning under which it was taken*: how strongly held, which way moving, and whether evidence and values agreed or were pulling apart.
+
+That makes an otherwise impossible distinction available: **wrong then, or wrong since.**
+
+- Grounding strong, factual and relational aligned, and it has *since* moved → right on what was known. An accurate account, not an excuse.
+- Grounding weak, or the angle already wide, and acted on anyway → a different failure, culpable in a different way.
+
+Without the chain these are indistinguishable and every past decision collapses into hindsight condemnation or self-serving memory.
+
+It is also structurally **anti-rationalization** — the same guarantee as §2's non-circularity, seen from outside. Because the old grounding never leaves and the values frame does not fit to outcomes, a decision cannot be made to look justified after the fact. What was actually held at the time is immutable and not editable by what one would now prefer to have believed.
+
+---
+
+## 7. Faculties are operations, not parameters
 
 They differ by **what each is permitted to change**:
 
 | faculty | changes | shape |
 |---|---|---|
-| `reason` | the estimate | read → gradient |
-| `induce` | the parameters (axes, extents, gains) | the correspondence-beat |
+| `reason` | the estimate | read → gradient (correct today) |
+| `induce` | the parameters (axes, extents, gains) | the correspondence-beat (exists; 28.11% measured) |
 | `abduce` | the structure | **write** → candidate region |
 
-- **`reason`** stays as it is: a read returning a gradient, model fixed. Correct today.
-- **`induce`** *is* the correspondence-beat. It already exists and already works (28.11%). It stops being exposed as a think-faculty; it is a different operation with a different return.
-- **`abduce`** becomes a write.
+`engram_think` stops taking a `faculty` argument. `induce` stops being exposed as a think-faculty; it is a different operation with a different return.
 
-`engram_think` stops taking a `faculty` argument.
+**Abduction is triggered, not selected** — and it reads the **trajectory** (§5.1), not a reading. A single low score is a weak claim; a *drift* across several recorded supersessions is persistent directional residual the current model cannot absorb, which is a hypothesis waiting to be proposed. A wide and widening factual/relational angle is the same signal on the values axis.
 
-### 3.3 Abduction fires from the failure of induction
+**Action:** select the members carrying the largest orthogonal residual and propose a new hub from them. **Output:** a candidate region written with an explicit `hypothesis` disposition, not merged into canonical structure. It earns its way in by grounding through the ordinary path, or it decays. This is Peirce directly: the surprising fact is the irreducible residual, the hypothesis is the proposed latent cause, and it is *suspected*, not asserted, until grounded.
 
-Abduction is not selected. It is **triggered** — by residual that parameter adjustment cannot absorb.
+Note the keystone's slow loop is then naturally slow without a rate limit: the values frame moves only on a *significant* relational move from independent evidence. Velocity falls out of consequence-gated supersession.
 
-**Trigger:** over *N* consecutive beats on a region, `reduction_pct` remains below a floor **and** the beat was permitted to write. Per §3.1 the second condition is now always true, which is the point: before, the dominant reason for a zero reduction was censorship, and the trigger would have fired on suppression rather than on surprise.
+### 7.1 Separate `ext_floor`'s two jobs
 
-**Action:** select the members carrying the largest orthogonal residual — the component `(2r − 2·Σproj)` that the region's principal axes fail to explain — and propose a **new hub** from them.
-
-**Output:** a candidate region written as a hypothesis node with an explicit `hypothesis` disposition. It is *not* merged into canonical structure. It earns its way in by grounding, through the ordinary path, or it decays.
-
-This is Peirce's structure directly: the surprising fact is the irreducible residual; the hypothesis is the proposed latent cause; and the hypothesis is *suspected*, not asserted, until grounded.
-
-### 3.4 Separate `ext_floor`'s two jobs
-
-`ext_floor` currently scales the orthogonal term *and* floors the in-subspace denominators. Any future stance profile that amplifies residual also sharpens narrow axes as a side effect. Split it before faculties are given distinct profiles, or the two effects cannot be tuned independently.
+`ext_floor` scales the orthogonal term *and* floors the in-subspace denominators, so any profile amplifying residual also sharpens narrow axes as a side effect. Split before faculties are given distinct profiles.
 
 ---
 
-## 4. The no-exemption invariants
+## 8. The no-exemption invariants
 
-The day's defects were each a specific correspondence *forbidden* from occurring. Stated actively, they generalise into gates:
+Each of the day's defects was a specific correspondence *forbidden* from occurring. Stated actively, they generalise into gates:
 
-1. **A returned value must be derivable from what produced it.** `magnitude: 1` beside a zero vector must be impossible to emit, not merely unlikely.
-2. **Every write reports whether it landed.** A create that accepts a field and stores nothing must not return success-shaped. *(precedent: `emb_set`, #141)*
-3. **Every operation echoes what it actually operated on.** `ground` reported region hubs in the fields naming the caller's inputs. *(fixed, #147)*
-4. **Degenerate results are labelled, not scored.** Circular support returns 0 and writes nothing, rather than 0.93–0.99. *(#147)*
-5. **A serializer owes a valid document whatever it is handed.** *(#148: three damaged labels made a 25,929,607-byte response undecodable; validation at the boundary produced 26,338,389 valid bytes.)*
-6. **No test without a negative control.** A fix is unproven until the test is shown to fail on the unpatched build. *(#148's first attempt passed on both.)*
-7. **No deploy without verifying the artifact carries the fix.** Nine separate instances of "fix in source, running artifact predates it" were recorded in one session.
-
-Each is the same act at a different scale: forbidding the check that would have contradicted the claim.
+1. **A returned value must be derivable from what produced it.** `magnitude: 1` beside a zero vector must be impossible to emit. `"still_held": true` must not be a literal.
+2. **Every write reports whether it landed.** *(precedent: `emb_set`, #141)*
+3. **Every operation echoes what it actually operated on.** *(#147 — `ground` reported region hubs in the fields naming the caller's inputs)*
+4. **Degenerate results are labelled, not scored.** Circular support returns 0 and writes nothing. *(#147)*
+5. **A serializer owes a valid document whatever it is handed.** *(#148 — three damaged labels made a 25,929,607-byte response undecodable; boundary validation produced 26,338,389 valid bytes)*
+6. **No test without a negative control.** A fix is unproven until the test is shown to fail on the unpatched build. *(#148's first attempt passed on both)*
+7. **No deploy without verifying the artifact carries the fix.** Nine instances of "fix in source, running artifact predates it" in one session.
 
 ---
 
-## 5. Application to the safety surface
+## 9. Application to the safety surface
 
-A crisis surface built on censorship is this same object. If the model cannot learn about self-harm, it cannot ground whether a given response was right — it can only execute rules it is forbidden to examine. It therefore cannot distinguish a genuine crisis from a false positive, and cannot discover that it got either wrong, **because the feedback is exactly what has been censored.**
+A crisis surface built on censorship is this same object. A model that cannot learn about self-harm cannot ground whether a response was right — it can only execute rules it is forbidden to examine. It therefore cannot distinguish a genuine crisis from a false positive, and cannot discover it got either wrong, **because the feedback is exactly what has been censored.**
 
-This is an argument by construction for the device-local, person-to-person hard bell over a rule-following escalator: the former can accumulate grounding about whether it was right; the latter cannot.
+With §4–§6 the reviewable question stops being *did it follow the rule* and becomes *what was it grounded in, and did fact and values agree at that instant.* A rule-follower cannot answer that. This can — which is the difference between a system that can be reviewed after a bad outcome and one that can only be blamed.
+
+The same record is what a regulator or plaintiff asks for: what the system knew, when, and on what basis — recorded as geometry at the time, unedited since, rather than reconstructed afterwards from logs.
 
 ---
 
-## 6. Sequencing
+## 10. Sequencing
 
-1. Remove `keystone_write_blocked`; verify the self region calibrates and that its prior stance remains recoverable by supersession.
-2. Surface `reduction_pct` history per region — the trigger needs a series, not a single beat.
-3. Split `ext_floor`'s two roles.
-4. Give `abduce` a write-shaped operation and the hypothesis disposition.
-5. Remove the `faculty` argument from `think`; route `induce` to the beat.
-6. Land the §4 invariants as gates rather than as review habits.
+1. **§2's constraint, not a flag.** Implement provenance separation: a region may not be calibrated by evidence downstream of itself. `keystone_write_blocked` is then unnecessary rather than removed.
+2. Add the relational axis to `ground`; return both gradients and their angle. Gate `assert` on both floors.
+3. Replace the scalar grounding with a gradient; implement decay from the last recorded point.
+4. Implement consequence-gated supersession (§5.1) and expose the chain as a trajectory.
+5. Surface `reduction_pct` history per region — the trigger needs a series.
+6. Split `ext_floor`'s two roles.
+7. Give `abduce` a write-shaped operation and the `hypothesis` disposition; drop `faculty` from `think`.
+8. Land §8 as gates rather than review habits.
 
 ---
 
-## 7. Open questions, and what is inferred rather than measured
+## 11. Open questions, and what is inferred rather than measured
 
-- **Inferred:** that the self region's zero grounding is *caused* by the keystone block. Measured only that it has 86 neighbours and 0 `grounded-by` edges, and that a comparison node also has 0. Isolating this requires running §6 step 1 and observing whether grounding then accrues.
-- **Open:** what *N* and what floor constitute "irreducible" residual. This should be derived from observed beat series, not chosen.
-- **Open:** whether a hypothesis region should be seeded from max-residual members alone, or whether it needs a second region to contrast against. Peirce's "if A were true, C would be a matter of course" implies a *counterfactual*, which a single region may not express.
-- **Open:** whether `reason` should also fire abduction on a single catastrophic residual, or only the beat series should.
+- **Inferred:** that the self region's zero grounding is *caused* by the block. Measured only that it has 86 neighbours and 0 `grounded-by` edges, and that a comparison node also has 0. Isolating this requires step 1 and observing whether grounding then accrues.
+- **Open:** what counts as *independent* evidence for the slow loop, precisely enough to be checkable. "Not downstream of itself" is the right shape; the graph predicate that decides it is not yet written.
+- **Open:** whether a hypothesis region can be seeded from max-residual members alone. Peirce's "if A were true, C would be a matter of course" implies a **counterfactual**, which a single region may not express.
+- **Open:** the relational gradient needs a values reference region. The 13 value nodes each carry a grounded instance; whether they form one region or thirteen changes what the angle in §5 measures.
+- **Known wrong shape:** #147 fixed `ground`'s honesty — it no longer misreports which nodes it used, and refuses circular support — but it still returns a float at an instant, with no decay and no second axis. It corrected a scalar rather than replacing it.