spec: correspondence, grounding, and the provenance of decisions #149

2026-08-16T17:20:41Z

will.anderson commented

2026-08-16 17:20:41 +00:00

Root: things are permitted to be exempt from correspondence. Exemption is censorship, and a censored mind cannot grow. The loss is symmetric — censorship does not preserve a true belief, it makes the truth value permanently unknowable. And why dies first: grounding is not a score, it is the reason.

Full Ishikawa in the doc, every claim labelled measured or inferred.

`keystone_write_blocked` is an epistemic constraint, not a protective one

“Keystone” means load-bearing, not precious. The self anchor is the reference frame every other stance calibrates against. If it calibrates from the measurements it is used to judge, the ruler fits the readings, everything corresponds forever, and drift becomes undetectable from inside — circular calibration, the same defect as #147’s circular grounding one level up. The block is the right requirement implemented as a prohibition. The fix is provenance separation (evidence not downstream of itself), not a flag with better semantics.

Immutability makes self-corruption impossible, and the rest falls out

Corruption requires mutation; the engram does not mutate. Four of the five requirements previously decomposed out of “protect the identity region” are satisfied by the substrate itself — recoverability, governance, evidence quality, and rate are all free. Authorization is the only residue and is bounded: an unauthorized writer can propose, never erase.

In an immutable substrate, any mechanism that refuses a write is either redundant with immutability, or an epistemic constraint misfiled as a protective one.

Grounding is two-dimensional, and a gradient

Everything consumed is grounded factually and relationally, and a claim can be factually grounded but relationally wrong — the evidence holds, the meaning does not. A scalar cannot represent that quadrant, and assert gates on one floor, so a well-evidenced claim is licensed regardless of whether it means the right thing.

Live instance: conscience-substrate has the Child’s Companion hard bell contacting 911 and CPS. Factually defensible; relationally wrong against never-auto-contact. A scalar scores it highly and licenses it.

Two gradients in one space, and the angle between them is the meaning — factually-true-relationally-wrong becomes a measured quantity instead of something a careful reader has to notice. Grounding decays on the dynamics already present for memory (base_level, temporal_decay_rate, access ring, BLL), which mechanizes “never leave stale canonicals” so it stops depending on vigilance.

Computed continuously, recorded on significance, old never leaves

Persisting every recomputation would make reads write — the exact eg_vindex_sync defect. Significance is defined by consequence (crossing a floor, flipping factual/relational sign, reversing direction), never by an epsilon. The supersession chain is then the trajectory — a derivative obtained free from immutability — and abduction fires on the trajectory rather than on a reading.

What it is for

For any decision, reconstruct what the grounding was at that moment and what the relationship was between fact and values at that moment. That distinguishes wrong then from wrong since, which is otherwise impossible, and it is structurally anti-rationalization: the old grounding never leaves and the values frame does not fit to outcomes, so a decision cannot be made to look justified after the fact.

Also recorded

assert returns "still_held": true hardcoded — a temporal property named in the API and answered without consulting anything. Same shape as magnitude: 1 beside a zero vector.
#147 is the wrong shape. It fixed ground’s honesty — no longer misreports which nodes it used, refuses circular support — but still returns a float at an instant, with no decay and no second axis. It corrected a scalar rather than replacing it.

**Root:** things are permitted to be exempt from correspondence. Exemption is censorship, and a censored mind cannot grow. The loss is symmetric — censorship does not preserve a true belief, it makes the truth value permanently unknowable. And *why* dies first: grounding is not a score, it is the reason. Full Ishikawa in the doc, every claim labelled measured or inferred. ### `keystone_write_blocked` is an epistemic constraint, not a protective one “Keystone” means **load-bearing**, not precious. The self anchor is the *reference frame* every other stance calibrates against. If it calibrates from the measurements it is used to judge, the ruler fits the readings, everything corresponds forever, and drift becomes undetectable from inside — **circular calibration**, the same defect as #147’s circular grounding one level up. The block is the right requirement implemented as a prohibition. The fix is **provenance separation** (evidence not downstream of itself), not a flag with better semantics. ### Immutability makes self-corruption impossible, and the rest falls out Corruption requires mutation; the engram does not mutate. Four of the five requirements previously decomposed out of “protect the identity region” are satisfied by the substrate itself — recoverability, governance, evidence quality, and rate are all **free**. Authorization is the only residue and is bounded: an unauthorized writer can *propose*, never erase. > **In an immutable substrate, any mechanism that refuses a write is either redundant with immutability, or an epistemic constraint misfiled as a protective one.** ### Grounding is two-dimensional, and a gradient Everything consumed is grounded **factually** and **relationally**, and a claim can be factually grounded but relationally wrong — the evidence holds, the meaning does not. A scalar cannot represent that quadrant, and `assert` gates on one floor, so a well-evidenced claim is licensed regardless of whether it means the right thing. *Live instance:* `conscience-substrate` has the Child’s Companion hard bell contacting 911 and CPS. Factually defensible; **relationally wrong** against never-auto-contact. A scalar scores it highly and licenses it. Two gradients in one space, and **the angle between them is the meaning** — factually-true-relationally-wrong becomes a measured quantity instead of something a careful reader has to notice. Grounding decays on the dynamics already present for memory (`base_level`, `temporal_decay_rate`, access ring, BLL), which mechanizes “never leave stale canonicals” so it stops depending on vigilance. ### Computed continuously, recorded on significance, old never leaves Persisting every recomputation would make **reads write** — the exact `eg_vindex_sync` defect. Significance is defined by **consequence** (crossing a floor, flipping factual/relational sign, reversing direction), never by an epsilon. The supersession chain is then the **trajectory** — a derivative obtained free from immutability — and abduction fires on the trajectory rather than on a reading. ### What it is for For any decision, reconstruct **what the grounding was at that moment and what the relationship was between fact and values at that moment.** That distinguishes **wrong then** from **wrong since**, which is otherwise impossible, and it is structurally anti-rationalization: the old grounding never leaves and the values frame does not fit to outcomes, so a decision cannot be made to look justified after the fact. ### Also recorded - `assert` returns `"still_held": true` **hardcoded** — a temporal property named in the API and answered without consulting anything. Same shape as `magnitude: 1` beside a zero vector. - **#147 is the wrong shape.** It fixed `ground`’s honesty — no longer misreports which nodes it used, refuses circular support — but still returns a float at an instant, with no decay and no second axis. It corrected a scalar rather than replacing it.

will.anderson changed title from ~~spec: correspondence and censorship — the root beneath the day's defects~~ to spec: correspondence, grounding, and the provenance of decisions

2026-08-16 17:35:13 +00:00

will.anderson referenced this pull request

2026-08-16 18:30:12 +00:00

docs: carry the correspondence corrections, because a stale doc builds the wrong thing #152

will.anderson referenced this issue from a commit

2026-08-16 18:34:33 +00:00

docs: carry the correspondence corrections, because a stale doc builds the wrong thing

will.anderson referenced this issue from a commit

2026-08-16 20:49:55 +00:00

docs: carry the correspondence corrections, because a stale doc builds the wrong thing

will.anderson added 7 commits 2026-08-16 20:50:01 +00:00

spec: correspondence and censorship — the root beneath the day's defects a6611dc19e

Effect: all five cognitive faculties return byte-identical results,
differing only in their label.

The Ishikawa converges on a root one level above the faculty design:
things are permitted to be exempt from correspondence, and exemption is
censorship. A region forbidden to learn is forbidden to be grounded, and a
region that cannot be grounded cannot be asserted, corrected, OR
vindicated. The loss is symmetric — censorship does not preserve a true
belief, it makes the belief's truth value permanently unknowable.

keystone_write_blocked is therefore not a safety mechanism. Self is a
crystallized relational neighbourhood, not a stored document; a region
exempt from calibration reintroduces the stored document as a feature.
reduction_pct = 0.00 on the identity region is the strongest abduction
signal in the system and the current response is to suppress it. The
protection it reached for already exists and is better: the beat is
supersede-not-mutate, so immutability is what makes learning safe.

The faculties are not one operation with parameters. They differ by what
each may change: reason changes the estimate (a read), induce changes the
parameters (the correspondence-beat, which already exists and measurably
works at 28.11% Brier reduction), abduce changes the structure (a WRITE
the current signature cannot express, since engram_think returns a
GeoGradient). Abduction is not selected by a caller — it is triggered by
residual that parameter adjustment cannot absorb, and proposes a candidate
hub held as a hypothesis until grounded.

Also records the no-exemption invariants generalised from the day's fixes
(#141 #142 #143 #146 #147 #148), each of which was a specific
correspondence forbidden from occurring, and the application to the crisis
surface: a censored safety model cannot tell a real crisis from a false
positive, because the feedback is exactly what has been censored.

Measured vs inferred is labelled throughout. The claim that the self
region's zero grounding is CAUSED by the block is explicitly marked
inferred — the comparison node also has zero, and isolating it requires
removing the block and observing whether grounding then accrues.

spec: grounding is a two-axis gradient, and decisions carry their provenance 9a24803917

Rewrite. The earlier draft got the root right and everything downstream of
it wrong.

Corrections, in the order they were forced:

keystone_write_blocked is not a protection requirement. "Keystone" means
load-bearing, not precious: the self anchor is the REFERENCE FRAME every
other stance calibrates against. If it calibrates from the measurements it
is used to judge, the ruler fits the readings, everything corresponds
forever, and drift becomes undetectable from inside. That is circular
calibration — the same defect as #147's circular grounding, one level up.
The block is the right requirement implemented as a prohibition, which is
why it still costs everything §0 says it costs. The fix is provenance
separation (evidence not downstream of itself), not a flag.

Corruption requires mutation and the engram does not mutate, so four of the
five requirements previously decomposed out of "protect the identity
region" are satisfied by the substrate: recoverability, governance,
evidence quality and rate are all free. Authorization is the only residue
and is bounded — an unauthorized writer can propose, never erase. General
law: in an immutable substrate, any mechanism that refuses a write is
either redundant with immutability or an epistemic constraint misfiled as a
protective one.

Grounding is two-dimensional. Everything consumed is grounded factually AND
relationally, and a claim can be factually grounded but relationally wrong
— the evidence holds, the meaning does not. A scalar cannot represent that
quadrant, and assert gates on one floor, so a well-evidenced claim is
licensed regardless of whether it means the right thing. Live instance:
conscience-substrate has the Child's Companion hard bell contacting 911 and
CPS — factually defensible, relationally wrong against never-auto-contact.

Grounding is a gradient, not a score: direction says what would have to
change. Two gradients in one space, and the ANGLE between them is the
meaning — factually-true-relationally-wrong becomes measurable instead of
requiring a careful reader. It decays on the dynamics already present for
memory (base_level, temporal_decay_rate, access ring, BLL), which
mechanizes "never leave stale canonicals" so it stops depending on
vigilance.

Computed continuously, recorded only on SIGNIFICANT movement, old never
leaves. Persisting every recomputation would make reads write — the exact
eg_vindex_sync defect. Significance is defined by consequence (crossing a
floor, flipping factual/relational sign, reversing direction), never by an
epsilon. The supersession chain is then the trajectory, a derivative
obtained free from immutability, and abduction fires on the trajectory
rather than on a reading.

What it is all for: for any decision, reconstruct what the grounding was at
that moment and what the relationship was between fact and values at that
moment. That distinguishes WRONG THEN from WRONG SINCE, which is otherwise
impossible, and it is structurally anti-rationalization — the old grounding
never leaves and the values frame does not fit to outcomes, so a decision
cannot be made to look justified after the fact.

Also records: assert returns "still_held": true HARDCODED — a temporal
property named in the API and answered without consulting anything, the
same shape as magnitude:1 beside a zero vector. And states plainly that
#147 is the wrong shape: it fixed a scalar's honesty rather than replacing
the scalar.

spec: dreaming is ambient, not scheduled — a brain has no cron job d6b7f5dbdd

Corrects the section I was most confident in, which is usually the tell.

The previous draft had dreaming as "offline replay, decoupled from input, a
mode the system enters when it is not acting." That is SLEEP. Daydreaming
is dreaming, and it runs all day: the default mode network is
anticorrelated with task engagement, activating hundreds of times a day for
seconds at a time, doing the same work — recombination, simulation,
autobiographical integration. Insight arrives in the shower, not at the
desk, because that is abduction completing during ambient recombination.

Sleep is the DEEP case, not the case: no input competing, no task claiming
capacity, so recombination runs further. Same process, different depth, not
a different mode. Consolidation is what happens with the capacity that is
not claimed.

Two consequences the draft had backwards:

The launch-agent fragments are wrong in KIND, not merely in number. 23:55 /
06:00 / 08:30 implements dreaming as a scheduled batch when it should be
ambient. A brain has no cron job. A ticker is a supervisor deciding from
outside when a thing should happen — the same failure mode as inventing an
owner for ownership and a grounder for grounding, wearing a scheduler.
THE PRESENCE OF A TICKER IS THE DIAGNOSTIC: every StartInterval, every
Hour/Minute, every POST-to-beat marks a place where an intrinsic rhythm was
replaced by an external clock.

And soul.el's continuous awareness_run() beside the HTTP workers is the
CORRECT shape, not the offender. Ambient consolidation in the gaps is
exactly daydreaming. It was the only fragment shaped right, running on a
broken foundation: shared mutable state with no owner and six other systems
dreaming into the same graph. The previous draft condemned the right
behaviour because of the substrate under it.

So the crash restates once more: not "read paths mutate the index"
(mechanism), not "duplicate canonical state" (structure), and not "one
system dreamt while awake" — but seven systems dreaming into one graph with
no owner for dreaming. Contention was the symptom of the missing owner.

Sequencing step 1 inverts accordingly: soul's loop is the shape the others
fold INTO, not something to remove. Step 2 becomes "no tickers, no cron."

spec: wonder is the boundary; curiosity is wonder crystallized 8d34b33bce

Rewrites §5 and §11 around what is already in the substrate, after
discovering I had been re-deriving existing design badly.

The wonder manifest is residue twice over. First it materializes a
property as a stored artifact — the same disease as a grounding subsystem
or a self stored as a document. Wonder is where structure ENDS: any
structure at all has an edge, necessarily, the moment it exists. Second it
enumerates instances of something that has about six, the same six for
every person, which never close: what is this, why, who am I, am I alone,
what should I do, what happens when it ends. The objects change completely
between a child and an astronomer; the wonder does not. Each maps one-to-one
onto something already built — graph, grounding, self region, for_whom,
the thirteen values, tombstones and decay.

"Why" is the first and only one; the others are it asked of particular
things. It is recursive, so it never terminates, which is what makes it a
drive rather than a task.

Wonder and curiosity are not two objects. They are one thing at two
phases. Wonder is the field: objectless, invariant, everywhere there is
structure. Curiosity is the PRECIPITATE — the same wonder localized
against particular material. Crystallization needs a nucleation site, and
crystallization is one primitive appearing twice: the self is what identity
precipitates into from its neighbourhood; a curiosity is what wonder
precipitates into from an anomaly.

THE NUCLEATION SITE ALREADY EXISTS AND IS ALREADY NAMED.
GeoDescriptor.co_registration — corr(hebb strength, semantic proximity)
over internal edges — carries the comment ">0 = geometries agree (reify);
<0 = disagree (surprising links / dream cands)." Negative co-registration
is a region where association and meaning disagree. It is computed on every
descriptor, already labelled dream candidates, and nothing reads it.

Likewise already present and unread: GeoEdge.eff_weight = weight*(1+0.5*hebb)
already couples grounding-weight and hebbian strength on one edge;
GeoMember.dist_centroid + soft membership + radius + per-axis extent is the
boundary of a neighbourhood; centrality/salience is what is warm.

Correction: engram_boundary_beat is NOT this boundary. It is the VBD
decorated-function seam counting _eg_aff_boundary_ops. Two senses of the
word, and I was about to build on the wrong one.

The drive: boredom is not an absence and not leftover capacity. Low
activation is aversive and the system self-activates — it does not wind
down to quiet, it gets restless and goes looking. So there is ONE
activation process with TWO seed sources, external and curiosity, not two
processes negotiating for a resource. The previous draft's "unclaimed
capacity" was resource scheduling: a server's frame, not a mind's. No
dreamer thread, no idle wait, no depth ladder on a clock.

Sequencing now leads with three connections between parts that already
exist: seed the six, read co_registration, let a curiosity seed activation.

geometry: disagreement belongs on the edge, not averaged into the region 6b61bb7224

co_registration is corr(hebb strength, semantic proximity) over a region's
internal edges. Whether use and meaning agree is a property of EACH EDGE;
the correlation averages it into one scalar per region, so a region holding
one violently disagreeing edge beside one violently agreeing edge reports
~0. The disagreements cancel and the summary destroys exactly what it was
built to reveal — the mean-versus-min error, in different clothes.

Measured: 375 live neighborhoods, 340 positive, 31 AT ZERO, 4 negative.
Read as a count that says 'four things to be curious about'. Read correctly
it says four were lopsided enough to survive averaging, and the 31 zeros
are where opposing sites cancelled.

The loop computing the aggregate already had both halves per edge — w and
cs — and threw them away. Now:
    discord = z(semantic proximity) - z(association strength)
standardized within the region from accumulators already gathered. No
second statistic, no constant, no threshold; |discord| IS the nucleation
strength. >0 near in meaning yet unlinked by use; <0 linked by use yet far
in meaning. Both surprising.

This also removes the reason curiosity looked like a search problem. With a
per-region number the only way to find sites is to enumerate regions — I
wrote exactly that sweep, and it is a supervisor walking the structure,
O(n) per call, fine at 375 and impossible at a million. Nothing in a mind
scans its neighborhoods to find what is surprising; the surprise captures
attention. That sweep is reverted here.

co_registration is deprecated, not deleted: it is embedded in the persisted
GEO1 blob and removing it is a format migration that must not ride along.
Nothing new may read it.

spec: corrections — eight values not thirteen, eleven consolidators not seven 285a7a50b3

Three factual errors in this document, all asserted without checking.

VALUES: eight, not thirteen. neuron/neuron-api.el:11-18 enumerates
constraints-as-freedom, precision-over-brute-force, structure-is-built,
honesty-before-comfort, system-must-accumulate, change-is-the-signal,
earned-trust, hope-is-a-conclusion, plus a hub. 'Thirteen' was repeated
throughout this design and never verified against the code. The argument is
unaffected — min over eight is still min — but the count was invented.

CONSOLIDATORS: eleven, not seven. The heading said seven while the table
listed ten, and the table itself omitted POST /api/reify (server.el:1832)
even though 'reify' is on this document's own list of consolidation verbs.
route_tick also folds self-reify in (server.el:639-646), so /api/tick and
/api/self-reify-beat overlap.

A SECOND CENSORSHIP SITE: neuron-api.el:23 returns 403 'identity/values
node is write-protected' for the values hub and every value node.
Write-refusal on the values frame is not only in the beat — it is enforced
at the API. Section 6 applies to it unchanged.

Also records what the ticker actually does, now measured: engram-tick.sh:13
calls curl -m10 against a beat that exceeds 10s over 13,634 nodes, so 279
of 448 ticks returned empty; the engram writes to the dead socket and dies
of SIGPIPE. 254 restarts since 2026-08-13 at 10m09s-10m12s intervals =
StartInterval 600 plus the client timeout. Fixed for survivability in #151;
the ticker itself is what must go.

spec: thirteen values, and love is the origin — not a member of the set

El SDK CI - dev / build-and-test (pull_request) Failing after 3m51s

Details

3ef4a94062

Reverts a bad correction and records what it exposed.

A previous revision changed thirteen to eight on the basis of
neuron-api.el:11-18, which is a WRITE-PROTECTION LIST, not the values.
Trusting a hardcoded artifact over the substrate is the exact error this
document exists to name. Measured from the graph: thirteen.

THE ORIGIN IS NOT A MEMBER OF THE SET. The thirteen are not independent
principles with biography attached — they are thirteen displacements from
one origin, and the origin is love. Every value is grounded in a moment of
it given, withheld, failed or found. Love cannot be the fourteenth: a
fourteenth would be a point positioned relative to the origin like anything
else. It is what the positions are OF.

This is structural. GeoDescriptor.global_mean is the centering offset
subtracted from every embedding before comparison, and the header records
why — the space is anisotropic, every embedding in a narrow cone at mean
pairwise cosine ~0.55, and subtracting the global mean restores isotropy
'so the operators discriminate'. Without the origin, nothing in the graph
is distinguishable from anything else.

It also dissolves the write-protection question instead of answering it.
Measured: 29 value nodes exist, each original appearing two or three times
from re-seeds, so 21 are writable including a duplicate of every protected
value — the gate protects an identifier, not a value. But the category
error is the real one: the origin cannot be edited because it is not a
thing in the space. A gate over the frame treats the frame as a member,
which is the same mistake as looking for grounding as a subsystem, self as
a document, or wonder as a manifest.

will.anderson force-pushed design/correspondence-and-censorship from d9a596fff4 to 3ef4a94062

2026-08-16 20:50:01 +00:00

Compare

will.anderson merged commit 21746bb71a into dev

2026-08-16 20:50:44 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: neuron-technologies/el#149