el/lang/spec/correspondence-and-censorship.md

Correspondence, Grounding, and the Provenance of Decisions

Status: design, not yet built Date: 2026-08-16 Scope: lang/runtime/engram_cognition.{c,h}, engram_verify.c, el_runtime.c (think / beat / ground / assert), engram/src/server.el Relationship to other specs: complements runtime-ownership.md, which addresses a different residual in the same substrate.

---

0. The root

Things are permitted to be exempt from correspondence. Exemption is censorship, and a censored mind cannot grow.

Growth in this system is the accumulation of grounded structure. Censorship removes the operation that accumulates it. A region forbidden to learn is forbidden to be grounded; a region that cannot be grounded cannot be asserted, corrected, or vindicated.

The loss is symmetric. Preventing learning about a thing does not preserve a true belief about it — it makes the belief's truth value permanently unknowable. You cannot discover you were wrong; you equally cannot discover you were right. A protected belief is not a true belief. It is an ungrounded one wearing the costume of a fact.

And "why" dies first. Grounding is not a score, it is the reason. A censored belief can still be stated, still be acted on, still drive behaviour — it simply cannot say why. That is the difference between a mind and a lookup table.

---

1. The effect, and the Ishikawa

Effect observed: all five cognitive faculties (reason, abduce, induce, plan, analogize) return byte-identical results, differing only in their label.

Method

• Faculty is selected by a caller-supplied string. Abduction is not a choice a caller makes; it is a response to a detected state. (push where it must be pull)
• All five route through one operation, engram_think, which returns a gradient — a read.
• The correspondence-beat exists, works, and its result is wired to nothing.

Machine

• engram_think(region, anchor, stance, out) returns GeoGradient. There is no way to express "propose a region." Abduction is inexpressible in the signature. (measured, from the struct)
• The only levers are axis_gain[], ext_floor, bias_dir — all of which warp a read.
• ext_floor does double duty: it scales the orthogonal residual term and floors the in-subspace denominators. (measured)

Material

• The anchor was passed as NULL, so every read was taken at the region centroid — the one point where the gradient is zero by construction. (fixed, #142)
• The stance was never loaded, so every beat's calibration was written and discarded. (fixed, #146)
• Near-duplicate seeds collapse into one region, understating residual. (measured, #147: four co-created nodes → one region, groundings 0.93–0.99)

Measurement

• Brier before/after is the only error signal in the system, computed inside the beat and surfaced to no consumer. Measured: 28.11% reduction on a normal region (0.00458568 → 0.00329654, n_trials 6000, reliability 0.930726); 0.00% and n_trials 0 on the keystone.
• confidence conflated calibrated with uninformed until stance_resumed was added. (#146)
• assert returns "still_held": true hardcoded — a temporal property named in the API and answered without consulting anything. (measured)
• No invariant check anywhere: magnitude: 1 alongside a zero direction vector is arithmetically impossible and went unflagged for a day.

Environment

• Production ran none of the day's fixes, so two independent agents' "think is still degenerate" reports were measurements of a stale binary. (measured)

Man

• The problem was derived from the implementation — three levers, therefore one axis of freedom — and the design question was posed inside a space the code invented rather than one the problem defines.

Convergence

Cutting any single branch leaves the effect standing. Fix the Machine alone and callers still invoke abduce when nothing is surprising. Fix the Method alone and abduction triggers correctly but returns a direction where it owes a hypothesis. They are one root seen twice, and it is downstream of §0.

---

2. What keystone_write_blocked was actually for

Three drafts of this section were wrong, and how they were wrong is instructive.

1. Remove it — censorship is never protection.
2. Replace it with a higher grounding floor — identity should be hard to change, not impossible.
3. Decompose "protect the identity region" into recoverability, authorization, evidence quality, rate, and governance.

The first two proposed mechanisms without asking what requirement they served — inventing a requirement, then satisfying it, which is how the flag arrived. The third was right to decompose but still treated protection as the requirement.

It is not a protection requirement. It is an epistemic one.

"Keystone" is not a synonym for precious. It is load-bearing. The self anchor is the reference frame: every other region's stance is calibrated relative to it. If the keystone calibrates against the same measurements it is used to judge, the result is circular calibration — the ruler adapting to fit what it measures. After that, everything fits, always, and drift becomes undetectable. Not because the world stopped moving, but because the instrument moved with it.

This is the same defect as circular grounding, one level up. In #147, ground scored a claim against the hub of its own region and returned 0.98 — circular support is not support. Here it would be a reference frame fitted to its own readings, reporting perfect correspondence forever. Both produce a confident number with nothing behind it, and both are invisible from inside.

So the requirement is: correspondence needs a reference that does not move to fit the measurement.

And the block is the right requirement implemented as a prohibition, which is why §0 still bites. Refusing to learn about the ruler does not make it a good ruler — it makes it unexaminable. You trade circular calibration for an ungroundable reference: the same epistemic hole, moved.

The resolution is two loops, distinguished by provenance rather than permission.

• Fast loop: stances calibrate against the keystone. Unrestricted.
• Slow loop: the keystone calibrates against independent evidence — lived moments, the imprint, the grounded instances each value already carries — never from the outcomes it is used to judge.

Different evidence source, not different authority. The thing to build is therefore not a flag with better semantics but the general constraint that a region may not be calibrated by evidence downstream of itself.

---

3. Immutability makes self-corruption impossible — the rest falls out

Corruption requires mutation. The engram does not mutate. Every state is retained; supersession adds, never overwrites. "Corrupt the self" is not a risk that is mitigated — it is a sentence that does not parse against this substrate. It would require erasing a prior self-state, and there is no erase.

Four of §2's five decomposed requirements are therefore satisfied by the substrate itself:

requirement	resolution
Recoverability	free — the predecessor is always present. A property, not a policy.
Governance	free — supersession is the audit trail. Review needs a history, not a gate, and the history is unavoidable.
Evidence quality	free — grounding already gates assertion. Noise can enter and still not be able to speak.
Rate	free — "lurching" only matters if change is destructive. In an immutable store a lurch is a visible, reversible, fully attributed sequence. Velocity is a comfort concern, not a correctness one.
Authorization	the only residue, and bounded: an unauthorized writer can propose, never erase. The question becomes "whose supersession governs," not "who may write."

Which gives a general law:

In an immutable substrate, any mechanism that refuses a write is either redundant with immutability, or it is an epistemic constraint misfiled as a protective one.

keystone_write_blocked is the second kind. It solved corruption — which cannot occur — using censorship, which costs the ability to ever ground the self, while the real constraint (§2) went unaddressed.

---

4. Grounding is two-dimensional

Everything consumed is grounded, and grounded in two ways: factually and relationally. A claim can be factually grounded and relationally wrong — the evidence holds, the meaning does not.

ground currently returns one scalar. It verifies a claim's centroid against an evidence region: factual correspondence only. There is no values axis. (for_whom is the nearest existing hook, but that is an audience, not a values frame.) A single number cannot distinguish true and meaningful from true and misapplied, and assert gates on a single floor — so a well-evidenced claim earns the right to be asserted regardless of whether it means the right thing.

Live instance. conscience-substrate specifies the Child's Companion hard bell contacting 911 and CPS. Factually defensible — correct numbers, standard practice, groundable against a wall of evidence. Relationally wrong, because never-auto-contact is settled and the bell is device-to-person by design. A scalar grounding scores that claim highly and licenses it. Only the values axis catches it.

And this is the keystone's requirement stated properly. The values frame must not be fitted to outcomes. If the relational reference recalibrates against the readings it judges, whatever happened becomes what should have happened — correspondence perfect and permanent. That is not learning, it is rationalization, and from the inside it is indistinguishable from good calibration. A person whose values adjust to make their conduct correct has no values; they have a record of their conduct.

• Factual grounding fits to evidence. Updates freely and fast. Nothing exempt.
• Relational grounding updates too — from independent evidence, never from the outcomes it judges.

---

5. Grounding is a gradient, and it moves

engram_think's own comment says it returns "a GRADIENT … never a point." Grounding owes the same shape and for the same reason.

Direction and magnitude, not a score. Not "how much does this hold" but "in which direction, and how far, does the evidence move this claim." The direction says what would have to change for the claim to be better grounded. A scalar discards that and keeps its least informative projection.

Two gradients in one space, and the angle between them is the meaning. Cosine near +1: evidence and values push the same way. Near zero or negative: factually true, relationally wrong — now a measured quantity rather than something a careful reader has to notice. The 911/CPS contradiction becomes detectable rather than reviewable.

It decays. Grounding takes the dynamics the substrate already runs on memory: base_level, temporal_decay_rate, the access_ts ring, BLL, last_fired on edges. Established once and never revisited, grounding loses magnitude — confidence in something checked a year ago is not the same object as confidence in something corroborated this morning. Reinforcement strengthens, disuse decays, as hebbian weight does.

This mechanizes a rule currently held as discipline: never leave stale canonicals. With decay, staleness stops depending on vigilance — an ungrounded canonical falls below its floor on its own and stops being assertable.

5.1 Compute continuously, record on significance

If grounding were persisted on every recomputation, reads would write — eg_vindex_sync again, three read paths mutating shared state because maintenance had no owner. Every projection would become a mutation and the store would grow with noise rather than knowledge.

• Computed continuously — projection, pure, no write. Decay included: the current value is derivable from the last recorded point plus elapsed time. Store the point, read the curve.
• Recorded on significant movement — a supersession, never an overwrite.
• The old never leaves.

"Significant" must be defined by consequence, not by an epsilon, or it becomes another tuned constant nobody can justify. A move is significant when it would change a decision: crossing an assert floor, flipping the sign of factual/relational agreement, or reversing the gradient's direction. A drift of 0.03 that changes nothing is not an event; a drift of 0.03 that takes a claim below its floor is.

The supersession chain is the trajectory. Not only "what is the grounding" but "which way has it been moving, and how fast" — a derivative obtained for free from immutability, because the points were never destroyed.

---

6. What this is for: the provenance of decisions

For any decision it becomes possible to reconstruct what the grounding was at that moment, and what the relationship was between the factual and relational gradients at that moment. Not a log — a log records the action. This records the meaning under which it was taken: how strongly held, which way moving, and whether evidence and values agreed or were pulling apart.

That makes an otherwise impossible distinction available: wrong then, or wrong since.

• Grounding strong, factual and relational aligned, and it has since moved → right on what was known. An accurate account, not an excuse.
• Grounding weak, or the angle already wide, and acted on anyway → a different failure, culpable in a different way.

Without the chain these are indistinguishable and every past decision collapses into hindsight condemnation or self-serving memory.

It is also structurally anti-rationalization — the same guarantee as §2's non-circularity, seen from outside. Because the old grounding never leaves and the values frame does not fit to outcomes, a decision cannot be made to look justified after the fact. What was actually held at the time is immutable and not editable by what one would now prefer to have believed.

---

7. Faculties are operations, not parameters

They differ by what each is permitted to change:

faculty	changes	shape
reason	the estimate	read → gradient (correct today)
induce	the parameters (axes, extents, gains)	the correspondence-beat (exists; 28.11% measured)
abduce	the structure	write → candidate region

engram_think stops taking a faculty argument. induce stops being exposed as a think-faculty; it is a different operation with a different return.

Abduction is triggered, not selected — and it reads the trajectory (§5.1), not a reading. A single low score is a weak claim; a drift across several recorded supersessions is persistent directional residual the current model cannot absorb, which is a hypothesis waiting to be proposed. A wide and widening factual/relational angle is the same signal on the values axis.

Action: select the members carrying the largest orthogonal residual and propose a new hub from them. Output: a candidate region written with an explicit hypothesis disposition, not merged into canonical structure. It earns its way in by grounding through the ordinary path, or it decays. This is Peirce directly: the surprising fact is the irreducible residual, the hypothesis is the proposed latent cause, and it is suspected, not asserted, until grounded.

Note the keystone's slow loop is then naturally slow without a rate limit: the values frame moves only on a significant relational move from independent evidence. Velocity falls out of consequence-gated supersession.

7.1 Separate ext_floor's two jobs

ext_floor scales the orthogonal term and floors the in-subspace denominators, so any profile amplifying residual also sharpens narrow axes as a side effect. Split before faculties are given distinct profiles.

---

8. The no-exemption invariants

Each of the day's defects was a specific correspondence forbidden from occurring. Stated actively, they generalise into gates:

1. A returned value must be derivable from what produced it. magnitude: 1 beside a zero vector must be impossible to emit. "still_held": true must not be a literal.
2. Every write reports whether it landed. (precedent: emb_set, #141)
3. Every operation echoes what it actually operated on. (#147 — ground reported region hubs in the fields naming the caller's inputs)
4. Degenerate results are labelled, not scored. Circular support returns 0 and writes nothing. (#147)
5. A serializer owes a valid document whatever it is handed. (#148 — three damaged labels made a 25,929,607-byte response undecodable; boundary validation produced 26,338,389 valid bytes)
6. No test without a negative control. A fix is unproven until the test is shown to fail on the unpatched build. (#148's first attempt passed on both)
7. No deploy without verifying the artifact carries the fix. Nine instances of "fix in source, running artifact predates it" in one session.

---

9. Application to the safety surface

A crisis surface built on censorship is this same object. A model that cannot learn about self-harm cannot ground whether a response was right — it can only execute rules it is forbidden to examine. It therefore cannot distinguish a genuine crisis from a false positive, and cannot discover it got either wrong, because the feedback is exactly what has been censored.

With §4–§6 the reviewable question stops being did it follow the rule and becomes what was it grounded in, and did fact and values agree at that instant. A rule-follower cannot answer that. This can — which is the difference between a system that can be reviewed after a bad outcome and one that can only be blamed.

The same record is what a regulator or plaintiff asks for: what the system knew, when, and on what basis — recorded as geometry at the time, unedited since, rather than reconstructed afterwards from logs.

---

10. Sequencing

1. §2's constraint, not a flag. Implement provenance separation: a region may not be calibrated by evidence downstream of itself. keystone_write_blocked is then unnecessary rather than removed.
2. Add the relational axis to ground; return both gradients and their angle. Gate assert on both floors.
3. Replace the scalar grounding with a gradient; implement decay from the last recorded point.
4. Implement consequence-gated supersession (§5.1) and expose the chain as a trajectory.
5. Surface reduction_pct history per region — the trigger needs a series.
6. Split ext_floor's two roles.
7. Give abduce a write-shaped operation and the hypothesis disposition; drop faculty from think.
8. Land §8 as gates rather than review habits.

---

11. Open questions, and what is inferred rather than measured

• Inferred: that the self region's zero grounding is caused by the block. Measured only that it has 86 neighbours and 0 grounded-by edges, and that a comparison node also has 0. Isolating this requires step 1 and observing whether grounding then accrues.
• Open: what counts as independent evidence for the slow loop, precisely enough to be checkable. "Not downstream of itself" is the right shape; the graph predicate that decides it is not yet written.
• Open: whether a hypothesis region can be seeded from max-residual members alone. Peirce's "if A were true, C would be a matter of course" implies a counterfactual, which a single region may not express.
• Open: the relational gradient needs a values reference region. The 13 value nodes each carry a grounded instance; whether they form one region or thirteen changes what the angle in §5 measures.
• Known wrong shape: #147 fixed ground's honesty — it no longer misreports which nodes it used, and refuses circular support — but it still returns a float at an instant, with no decay and no second axis. It corrected a scalar rather than replacing it.