Quanta · milestone spec · v1 draft · for red-pen

Bound Claims

Every claim a builder leaves behind carries a check the system can re-run — a command receipt, a structural proof from the code graph, or an honest “judged” label — and anything unbound is displayed as unverified, everywhere, always. Named by the experiment that killed its predecessor.

Draft for Robert’s annotation · direction ratified 2026-07-08 · S1 shipped · S2+ not started

The story in one minute

Last night we finished a controlled experiment: two teams of AI builders, same twelve-step feature, handing work forward like a relay. The team whose briefings we expected to win — machine-rendered, structured, "smarter" — shipped more surviving defects, not fewer. The autopsy found why: its builders left behind confident statements — "this is tested," "this is wired in," "this can't run twice" — and nothing ever checked those statements against the code. The purest specimen: a safety test that existed, passed, and was connected to nothing, while the record said "gated."

This milestone makes that sentence impossible to write. Every claim a builder leaves behind carries a check the system can re-run — and a claim without one is displayed as unverified, everywhere, always.

What I decided (each one annotatable)

Three courts, no fourth. Every claim binds one way: a command receipt (a check that re-runs red/green), a reach receipt (structural proof from the code graph — "this test is actually executed," "only this module writes this store"), or an honest judged label (a human call, shown as a human call).
Unbound renders fenced. A claim with no binding — or whose binding fails against the current tree — shows as unverified on every surface. No exceptions, because exceptions are how the losing tower died.
The graph finally meets the ledger. Plato can already prove who-runs-what and who-writes-what; the ledger already holds claims. This wires them together — the capability the truth-class method spec logged as an ask becomes machinery.
Rulings ride free. "Robert approved X" is just a claim whose receipt is your verbatim words + scope + document version. Same courts, same fencing — the governance layer costs no separate build.

A claim's journey (the spine)

  1. A builder finishes a step and sheds a claim. "The defeater path is gated." Today that sentence enters the record naked. After this milestone, the mint asks one question first: what court will try this claim?
    ↘ go deeper — the mint contract
    Claim kinds declare a required court. A kind with requiredCourt set refuses a bare mint (the refutation-attempted precedent: closed vocabulary, refusal court, named reasons). Bindings are auto-derived where possible — a deposit citing a test file gets its reach receipt computed, not typed.
  2. The claim binds to its court. A test-related claim gets the command that re-runs it. A wiring claim ("this is executed by the gate") gets a structural proof computed from the code graph. A taste call gets the judged label — visible as judgment, never dressed as fact.
    ↘ go deeper — reach receipts (the new court)
    New receipt kind: reach — {claimKind: wired-into-gate | sole-writer | consumed-by, target, proofQuery, pin}. Verified by the existing reach/invocation-graph queries at the current tree; verdicts are holds / broken / cannot-certify(with named fences) — a graph blind spot renders cannot-certify, never a false green. Each claimKind ships its mutation fixture (unwire the test → broken must fire).
  3. Anyone reads the claim — and sees its standing, not just its words. Bound-and-holding reads as settled. Bound-but-broken reads as stale. Judged reads as judged. Unbound reads as unverified — fenced, everywhere, fail-closed. This is the step that kills the disease: the next builder (or you, months later) can no longer inherit a naked sentence as truth.
    ↘ go deeper — the read-side sweep
    Every claim-rendering surface (halo, claim status, driver duty) labels binding state. A sweep gate asserts zero claims render as settled without a live binding; its degenerate control — a gutted fencer that renders everything settled — must fail the sweep.
  4. The world changes; the binding notices. Someone unwires the test, adds a second writer, edits the text a receipt greps for — the recompute court turns that claim's standing red at the next pass. Supersede a claim and its consumers get poked (the used-by lane). Truth decays visibly instead of silently.
  5. Your morning render tells you what's actually settled. Not what builders asserted — what still proves. And "claims everyone leans on that nothing has ever fought" surface for attack, because the fights machinery from last night's towers is already on trunk feeding this.

What could go wrong (named, with the counter)

Binding bureaucracy. Minting gets annoying; builders stop shedding claims. Counter: bindings auto-derived wherever possible; only claim kinds that declare a required court refuse bare mints.
Vacuous receipts. A check that can't go red is worse than none. Counter: every receipt type ships with its mutation fixture; a receipt that survives its own deliberate break fails the gate.
Graph blind spots. Dynamic imports and shell indirection can hide wiring. Counter: reach receipts carry the graph's own completeness fences — a blind spot renders "cannot certify," never a green.
Performance. Re-verifying every binding on every read would crawl. Counter: currency stamps + recompute-on-change, the existing snapshot discipline — never a full re-run per read.

The five slices

S1 — the orphaned-test tripwire. A test that exists but is wired to nothing turns the gate red. SHIPPED last night (#201) — already caught nothing on trunk because trunk is clean; proven by planted orphan.
S2 — reach receipts. The new court: wiring and sole-writer claims proven structurally. The Plato⇄ledger wiring.
S3 — read-side fencing. Binding state rendered on every surface; the zero-naked-claims sweep gate.
S4 — the rulings court. Your decisions as bound claims (verbatim + scope + document version; provisional-until-confirmed). Timing is your call below.
S5 — the lift experiment. Same tower laboratory, binding ON vs OFF, sealed in advance. Produces the number: escape reduction per unit of ceremony.
The kill number, sealed now so we can't fudge it later: if S5 shows less than a 20% escape reduction, the milestone stops at S2 and we bank it as hygiene, not an organ.

Your calls ★

1 — Does this page's shape hold?

The direction is ratified; this page is the shape. Three courts (no fourth without your word), unbound-renders-fenced with zero exceptions, rulings riding the same machinery. Red-pen anything that reads wrong — especially the three-courts boundary.

2 — When does the rulings court land?

S4 could ride immediately after S3 (governance gets bound claims early, closing the laundering hole from the contract incident) — or wait until S5's number proves the mechanism. Early = protection sooner; late = evidence first. Your timing.

3 — Sign off the kill number.

<20% escape reduction in the lift experiment = stop at S2. Too strict, too loose, or right?