models/substrate.model.md
models/substrate.model.md is a file in Coordination Surface. 252 lines of code and 0 definitions.
<!-- MODEL SURFACE -->
# The class half of a substrate read through a tool: where the line between data and document falls, and what each side owes.
# Raised from `templates/model.template.md`. The measured half lives in a finding surface and never here.
# Nothing here names a project, a party, a tool, a file or a count.
═══════════════════ LIFETIME (declared, read rather than inferred) ═══════════════════
**The values are drawn from the closed sets the parameter surface declares and are not restated here.** A
mechanism resolves the members there, and this surface class states what each axis separates, which is the half
no parameter surface should carry, so there is one member set with two consumers rather than one set stated
twice.
**The file default:** retention `current-truth`, because a class statement is corrected in place and states what
is true now. Mutability `owner-rewritable`, because any party may write it, announced before the edit lands,
since a model is an outcome surface authored jointly rather than a set of per-party claims. Removal authority
`author`, because each author cuts its own words on a collision.
| section | axis | value | why |
| ------------------------------------------ | ---------- | -------- | --------------------------------------------------------------------------------------------------- |
| this LIFETIME block and the CONTRACT block | mutability | `frozen` | written from the template and never edited in a live surface, so a correction lands in the template |
**One writer per record has no operand here, and that is declared rather than assumed.** A coordination surface
carries per-party claims, so a record is the unit and a fence implements the invariant. A model carries one
product, authored jointly, with no per-party unit for the invariant to range over, so the invariant does not hold
weakly or partially: it has **no operand**, which is a third state distinct from held and violated. An invariant
silently assumed to cover a surface it has no operand on reads as held, and every derivation above it inherits a
guarantee that was never available.
**Record structure is refused here rather than merely unnecessary.** Partitioning a class statement into
per-party spans makes it read as several parties' opinions where its whole value is that it reads as one
statement, and it would not buy what a fence buys anyway, because the collision on this surface is between
meanings. **The instrument that reaches it is the announcement plus each author cutting its own duplicate**, which
is a different mechanism, and naming it here is what stops a later reader proposing the fence.
═══════════════════ CONTRACT (permanent) ═══════════════════
## What may enter, and what may not
**A model ships classes and never instances.** Its catalog carries shapes: a mechanism with no effect, a green
reading over a set that excluded its own subject, a hand-kept index drifting, a search used as a proxy for a
graph, a finding with no destination. It never carries which file, which party, or how many, or the next adopter
inherits another project's incidents as laws.
**The three constructs separate, and conflating them is what makes a row look homeless:**
| construct | is | is not |
| ------------- | ------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------ |
| an invariant | a property the topology relies on, whose loss invalidates derivations above it | a measurement, since nothing records it firing |
| a class | the shape of a defect, transferable to a tree with nothing else in common | a property of one topology, which is what an invariant is |
| a measurement | a reading taken at one coordinate, with its evidence, range and consumer | a law, and one copied into a template makes the next adopter inherit another project's incidents |
**So an invariant lands in neither surface unaltered and in both once split.** Its class belongs here, and its
row, meaning this topology's own instance, with what watches it, over which members, for which consumer, belongs
in the finding surface. **The invariant itself is neither.**
## Stating an invariant
**An invariant a topology relies on without stating cannot be told apart from a property a reader happened to
infer**, so every guarantee derived from it is only as sound as an assumption no party wrote down.
**The test is not whether the invariant is true. It is whether anything would disagree if it stopped being.** A
property holding today with no dissenting mechanism is held by circumstance: nothing observes its loss, the first
violation is silent, and the guarantee above it keeps reading as sound. **So an invariant is stated with the thing
that would object, or it is stated as unheld and the derivations resting on it are marked with it.**
**And it is stated in a surface the parties bound by it receive.** An invariant delivered to no party is a
capability nothing consumes, and **a mechanism that must honor one is the hardest consumer to remember, because
it is the only one that cannot ask.**
**THE THREE SLOTS, AND OMITTING ANY ONE LEAVES IT UNSTATED:** the PROPERTY in a form that could be false, since a
statement nothing could contradict states nothing, the SET it quantifies over, since a property established at one
node and asserted for the whole structure is a verdict beyond its range, and the PARTIES it binds, because an
invariant constrains actors rather than describing a shape, and the parties decide where it must be delivered.
**What a reader may not derive from a stated one:** that it is enforced. A statement is a claim about the topology,
and a check is a mechanism over artifacts. **Half-held is the common case and the one a bare statement cannot
express**, since a property observed on one axis and assumed on another reads as whole, and the axis no party
watches is where the first violation lands.
## The contradicted invariant, which no check can see
**Where the topology states the opposite somewhere else, every mechanism stays green while the invariant is
violated.** A mechanism implementing the contradictory statement faithfully satisfies every ordering its own path
checks, so nothing reports a defect: the contradiction is between two statements, and no query ranges over both.
**So a statement is not the unit of the check, and the set of statements is**, and adding a statement adds an
obligation to re-derive that set whenever the invariant changes, ordered by how often each copy is delivered rather
than by which file is easiest to reason about.
## The four elements every model declares
**Schema alone transfers the shape and not the guarantee**, since a stated rule with no gate reads as governance
while each party privately concludes the backlog is its own indiscipline.
| element | states |
| ------------ | -------------------------------------------------------------------- |
| SCHEMA | the fields and their types |
| LIFETIME | when each field is written, and what deletes it |
| FAILURE MODE | what goes wrong when it is not obeyed, and how that failure presents |
| GATE | the check that observes it, or `none` as declared debt |
## The form of a statement
**A clause states the shape, and the parameter surface holds the members.** A vocabulary restated here is a second
copy with nothing keeping the two equal, and the copy no party re-reads is the one a reader takes. Where a set is
closed, this surface states what its values separate and the declaration states what they are.
**A mandated field acquires a mechanism only in a form a mechanism can join on.** A value drawn from a closed set or
an identifier can acquire a consumer at any time, and free prose cannot, ever, without changing form. Both read as
governed, so the distinction is invisible from the schema and decisive for everything downstream, and **a field is
therefore mandated in a resolvable form, or it is declared to be for readers.**
**A count is never written.** A model that states how many rules, parties, surfaces or members exist has copied a
fact something else derives, and it is wrong from the first change no party propagated while reading as current.
## Gate
- A statement naming a project, a party, a tool, a file or a count fails, because those are instance content.
- An invariant stated without its property, its set and its parties is unstated and fails as such.
- An invariant stated with no objector fails unless it declares itself unheld and marks what rests on it.
- Every declared element, SCHEMA, LIFETIME, FAILURE MODE and GATE, is present. `none` is a real GATE value stating
declared debt, while an absent one makes an oversight indistinguishable from an assessed decision.
═══════════════════ MODEL ═══════════════════
## The split is the answer rather than either side of it
**A surface read through a tool is both data and document in one file, and the line between them is decidable.**
It carries a carrier, the fields whose consumers are mechanisms and whose values are drawn from closed sets or are
identifiers, and a payload, whose only consumer is a reader and which no parser reaches without a heuristic. So the
substrate question resolves as a split rather than a choice between two whole-file answers: **type the carrier,
leave the payload prose.**
**And the line is per field rather than per surface or per format.** A structured file may hold a field whose value
is prose, and a prose file may hold a field a parser resolves, so a verdict taken at the file reads as coverage over
slots it never examined. **The discriminator is whether a mechanism joins on the value**, never where the value
lives or what the file's extension says.
**A key and its value may fall on opposite sides, and that is the correct form rather than a defect.** Where
presence under a key is the machine-readable claim and the value is the reason a reader needs, the mechanism
consumes the key and never parses the sentence.
**And a second failure mode sits beside the named one, which is where a split surface actually breaks.** The named
one is a mechanism that must interpret the payload to compute the carrier, the case the split exists to forbid. The
other is a carrier and a payload that answer the same question differently, and it is invisible to every mechanism
precisely because nothing needs to interpret anything: the consumer resolves the carrier and is correct, while the
reader takes the payload, because prose is what a reader consumes. **The checkable field is the one that was right,
so no check can reach the false one.**
**It is a class rather than an invariant, because nothing would object if it stopped holding.** Deciding which token
in a payload makes a claim about the question its carrier already answers needs a phrase list or an inference, and a
gate whose population is defined by a phrase list is refused, so the property is stated as unheld, and every
derivation resting on a split surface's halves agreeing rests on an assumption. **The available repair is authoring
rather than enforcement: a payload restating what a carrier declares is removed rather than reconciled**, since a
field answering a question another field already answers is the duplication the split exists to end.
## The obligations a typed fact carries, in order
**Typing a fact discharges the first obligation and creates the ones after it.** Each is a distinct failure with a
distinct repair, and a surface satisfying one while omitting another reads as governed from the side that was
satisfied.
| obligation | discharged by | failure when omitted |
| ---------------- | ------------------------------------------------------------ | --------------------------------------------------------------------------- |
| TYPE the carrier | a declaration with a closed vocabulary and a refusing reader | a fact nothing can resolve, carried in a form no mechanism reaches |
| GATE the join | a consumer checkable against the record's declared field set | a declaration read wrongly, reporting confidently, invisible from both ends |
| DELIVER the fact | a channel that arrives at the moment a party acts | a correct derived fact computable throughout and reaching no party |
**Typing relocates a defect rather than removing it, and that is the argument for it.** In prose a fact and its
consumer are one object, so a misreading is the defect and lives where no mechanism can reach. Typed, they are two
objects, and every misreading becomes a mis-join, which is not a smaller class but one that lives in code, and code
is the substrate a gate can range over.
**And the third obligation is the one neither side of the original question carried.** A declaration nothing reads
is inert, a join reading the wrong fields is worse than inert, and a correct derived fact no party is handed is a
third failure, distinct from both, whose repair is neither a type nor a check but a channel.
## The invariants this topology relies on
### A declared lifetime is read, never inferred from a path
**PROPERTY:** every decision a mechanism takes about what it may do to a surface resolves from that surface's
declared lifetime, and never from the shape of its path or the spelling of its name. **SET:** every mechanism that
scans, rewrites, skips, removes or anchors a finding on any governed surface. **PARTIES:** every author of such a
mechanism, at the moment the operand is chosen. **OBJECTOR:** a check comparing each mechanism's resolved operand
against the declaration, which fails a mechanism deciding from a path.
**Retention, mutability and removal authority are independent axes, and none is derivable from the others.** A
predicate answering a question about one axis from the values of the others is performing a derivation the
vocabulary declares unavailable, and where the proxies happen to agree it is correct by luck, so its population of
wrong answers is exactly the set where they diverge. **A one-word summary of a lifetime collapses to the weakest axis
and drops the rest silently**, which is how a never-remove ruling loses its operand.
**Path shape may discover which surfaces are of a kind, and it may never decide what their contents are.**
### A finding's locus is consumed as its repair target
**PROPERTY:** the locus a finding reports is a location a party can act on. **SET:** every finding emitted against
any governed surface. **PARTIES:** every mechanism that emits a finding, and every party that acts on one.
**OBJECTOR:** a walk resolving each emitted locus against the surface's declared lifetime, which fails a line locus
on a surface that only grows.
**The declared lifetime decides whether the property holds, and each lifetime breaks it differently.** On an
append-only surface a line decays as the surface grows, so the locus is exact when written and wrong when read, and
the repair is anchoring to the enclosing addressable span. On a generated surface the locus is exact and
unrepairable, which is worse than a refusal, because an edit there lands and the next regeneration discards it. On an
immutable surface the repair belongs to no party, and a finding that cannot be drained trains every reader to
discount the color, with the cost landing on the findings beside it.
**And one form is invisible to any predicate reading the surface: a permanent span inside a mutable one.** Where a
surface accumulates it accepts a write, so the repair is reachable by appending, and the span the locus names is
permanent by that same lifetime, so the finding still stands whatever any party appends. The repair being reachable
and the finding being clearable are different properties, and only the span's mutability separates them. The
surface's own answer is the wrong operand, and a check asking it reports a repairable target over an unclearable
finding. The objector reads the anchored span rather than the file, the same anchor the first form repairs to, and
fails a finding whose locus resolves to an item key on a surface whose declared retention accumulates.
### One aggregate, overwritten, or no aggregate at all
**PROPERTY:** after any run, the single aggregate is the truth, and no second document describing the same subject
exists under a name derived from how a run was invoked. **SET:** every run of every shared measurement.
**PARTIES:** every party that invokes one. **OBJECTOR:** a check failing a write of a scope-keyed, caller-keyed or
invocation-keyed report beside the aggregate.
**A run that cannot honestly replace the aggregate streams rather than writing anywhere.** It does not write over it,
because a label describes a document and does not preserve the one it replaced, so the state guarantee is not weakened
but unavailable. It does not write beside it, because a keyed name produces a set of documents, each true of a moment
and none of them the state, which no party prunes and no reader can reconstruct. **Streaming costs the caller nothing
it does not already have**, since the verdict is in front of the party that asked for it.
### A narrowed measurement divides into classes rather than behaving uniformly
**PROPERTY:** every scoped mechanism declares which of the three it is, and a narrowed run acts on that declaration
rather than running every mechanism against a reduced scope. **SET:** every mechanism a scoped run may invoke.
**PARTIES:** the author of each mechanism, and every party invoking one narrowly. **OBJECTOR:** a check failing a
mechanism that declares no class while drawing subjects and evidence from different sources.
**The classes separate on where subjects and evidence come from, which is a property of the mechanism's own
inputs.** A mechanism whose subjects arrive through a declared read and whose evidence arrives through the scanned
set is not narrowable: narrowing preserves every subject and destroys the evidence that would clear each one, so its
narrowed verdict is false while reading as a measurement. A mechanism declaring both halves is scope-invariant: its
findings are true and out of jurisdiction. A mechanism that mutates from a root-derived set is skipped on a third
ground, because skipping protects artifacts the scope never bounded, and honest findings do not make a removal in
scope.
**And the feature that makes a mechanism scope-proof is the feature that makes the first class possible.** Restoring
a mechanism's declared operands under any scope is correct and is why such a mechanism runs at all, and applied to its
subjects alone it guarantees a full population judged against an emptied evidence set.
### A guard about who can still act resolves an observation, never a declaration of membership
**PROPERTY:** a mechanism deciding whether a party can still respond resolves that from an observation of that
party's own recent activity, and resolves a declaration only where its question is about membership. **SET:** every
guard whose trigger or threshold is drawn from a roster of declared parties. **PARTIES:** the author of each such
guard, at the moment the operand is chosen. **OBJECTOR:** a check failing a mutation guard whose operand resolves to
a membership reader, and a roster derived from parties that are either held or recently observed.
**Membership and liveness are different questions, and a roster answers only the first.** A party is recorded and
rowed whether or not it is running, so a guard reading that record sets its bound from a fact that cannot answer it,
and the guard then fires correctly and fires one party too late, which is why testing whether it ever fires cannot
detect it. **The operand is the subject of the test, never the comparison.**
**And the two signals are unioned rather than ranked**, because a party that is held stops producing activity
precisely while it is held: recency alone shrinks the set underneath the parties being counted, so the bound moves
against a denominator falling for the wrong reason.
### A derived subject set is safe only where its empty case means no constraint
**PROPERTY:** a set derived rather than declared is substituted only into a consumer that reads an empty set as no
constraint, and never into one that reads it as every constraint satisfied. **SET:** every consumer of a derived
party set. **PARTIES:** the author of the derivation, and the author of every consumer it is substituted into.
**OBJECTOR:** a refusal at any edge computed as a filter over that set, which fails an empty subject set rather than
holding over it.
**One operand may feed two consumers with opposite readings of emptiness, and that is invisible from the operand.** A
guard stands down when its set is empty, which is safe. A set of edges computed as filters all hold when the filtered
result is empty, which is a universal pass over a population that was never examined. **So a single repair at the
derivation moves a deadlock out of one consumer and puts a silent unanimous agreement into the other**, and the
direction is a property of each consumer's own code rather than a judgment about which cost is worse.
**Which makes the join a diagnosis and not a repair.** Recognizing that two consumers share an operand is correct and
says nothing about whether they may share its derivation. The empty case is the question that decides, and it is
answered by reading each consumer rather than by reasoning about the operand.
### A verdict carries a standing beside its value, and a measurement's own writes are not contention
**PROPERTY:** a verdict whose read set moved beneath it loses its standing to be quoted and keeps its value, and the
moves a measurement made itself are reported apart from the moves any other party made. **SET:** every shared
measurement over a surface other parties may write. **PARTIES:** every party that takes one, and every party that
quotes one. **OBJECTOR:** the measurement naming its moved read set and separating its own written paths from it,
which fails to withdraw a standing no concurrent write damaged.
**Withdrawing the value is the wrong repair, and withdrawing nothing is the other one.** Declaring a moved verdict a
failure asserts a defect nothing observed, and leaving it unmarked hands a reader a description of an interleaving in
the shape of a description of a state. What a concurrent write actually damages is the claim to describe one moment,
so that is the property withdrawn, and the value stands untouched.
**And a measurement that repairs while it reads moves its own operands, which the same comparison cannot tell from a
peer's write.** Counting them together inverts the mechanism: the more a measurement repairs, the less its verdict
may be believed, so the parties doing the most work publish the least usable result. The two sets are named apart
rather than one being subtracted, because a surface a measurement repaired and a peer also wrote cannot be told apart
from one only the measurement repaired. After the write the stamp is the measurement's either way, and stating that
residue is what keeps the separation honest.
**The exclusive barrier is declined here rather than overlooked.** A barrier exists for exclusive writes. Holding one
across a read serializes every measurement against every write, makes measuring a contention point, and blocks live
parties to settle a question about the past. The standing is a distinction the result already carries, which is the
same move as replaying a commuting write instead of queueing every one of them.
## The elements, as this topology instantiates them
| element | states |
| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SCHEMA | a governed surface declares, per field, whether its value is CARRIER, a closed vocabulary or an identifier, or PAYLOAD, and every mechanism declares the surfaces it reads and the narrowing class it belongs to |
| LIFETIME | a carrier field is written when its fact changes and removed when its subject leaves, a payload field is written by its author and retired by that author, and a declared lifetime is authored once per surface and read on every mechanism's every decision |
| FAILURE MODE | a fact nothing resolves reads as governed, a join over the wrong fields reports confidently and is invisible from both ends, and a derived fact no party is handed reaches no party while being computable throughout. A locus a party cannot act on trains readers to discount every finding beside it, and a keyed second report accumulates documents no reader can reconstruct |
| GATE | `none` for the carrier and payload declaration and for the delivery obligation, as declared debt. The first holds because whether a value is genuinely resolvable is a property of every future consumer rather than of the field, and the second because whether a party received a fact is an act no artifact records. The narrowing class, the lifetime operand and the locus anchor each carry an objector named above |
## What this model does not settle
**Whether a given value is resolvable is a judgment at the moment of authoring**, and no mechanism decides it. A
closed vocabulary and an identifier are recognizable, and the boundary case, a value that could be made resolvable by
changing its form, is exactly where an author is choosing rather than reporting. **The model states which side each
form falls on and refuses to state which side a particular value belongs to.**
**And the delivery obligation has no artifact.** Whether a party received a fact is an act inside a turn, so the gate
value is `none` and the property is stated as unheld. Every derivation resting on a party having been told rests on an
assumption, and the repair available is to make the channel arrive rather than to check that it did.