A claim that binds

The story

The reader half worked. Put a claim in a builder’s workspace carrying four things — what is claimed, the command that re-proves it, the files it rests on, and a stamp saying whether it is still fresh — and the builder changes behaviour without being told to. Redundant re-checking collapsed about threefold. Skepticism landed exactly where it should: stale-stamped claims were re-verified 6 times out of 6. Quality did not move.

The writer half failed. We planted 28 changes that genuinely made a banked claim false, and asked whether the claim’s own receipt would catch it. It caught 5. Twenty-three of twenty-eight falsifications left the receipt green.

Put the halves together and there is only one sentence: agents will trust the stamp exactly as much as we hoped, and the stamp is currently right about one time in five.

That is worse than it sounds, because the same experiment measured the failure mode. A check command carrying untrustworthy freshness produced more pointless re-checking than plain prose — 12/24 against 0/24. We are not one step from the win. Ship delivery on top of today’s corpus and we ship the arm that measured worse than saying nothing.

The field we never recorded

A claim today carries: the text · the receipt command · the basis files · the freshness stamp. It does not carry the one property that decides whether any of those matter:

Call it binding. It is measurable. We already built the instrument that measures it. We have never once recorded the answer on a claim.

This is the same disease as everything else caught this week — an instrument that cannot fire, reporting success. Two vacuous gates. A download counter that logged nothing. A drift detector never wired. A map served and ignored. A claim whose receipt cannot go red is that same defect one layer up: knowledge that cannot be wrong, which is knowledge that cannot be trusted.

What I decided, and why

1. Binding becomes a measured field, not an assumption.
   Every claim records how many planted falsifications its receipt actually caught. A claim never tested renders as UNPROVEN — never as trustworthy. We do not get to assume our proofs prove things.
2. The reader is told.
   The surface already shows FRESH/STALE. It gains one column: BINDS 8/10. That is the whole design in one move — the proven reader mechanism, pointed at a signal that is finally honest. Trust becomes calibrated instead of hoped for.
3. Measure before building anything.
   Slice 1 is a number, not a feature. If almost nothing binds, we learn it in days for the price of compute, and this dies at its first gate rather than after a month of plumbing.
4. Flip the producer, and accept fewer claims.
   The discriminator is measured: the broad integration receipt traced 59 modules and bound its claim; the hermetic claims traced 2–5 files and did not. So we shed from certification runs and integration gates, not cheap unit tests. Twenty binding claims beat one hundred and fifty unbinding ones, because the reader effect is per-claim, not per-corpus.
5. Binding is necessary, not sufficient.
   A claim can bind perfectly and still be worthless if no builder would ever have checked it. Binding is the floor for trust. Usefulness is a separate bar and stays a judgment call.

What could go wrong

The build — four slices, in order

1. Score the corpus. Run the plant-a-rot battery over every banked claim; publish the binding distribution. Proves: whether binding claims exist at all today. Cost: days, no build.
2. The binding column. Record measured binding; render it; UNPROVEN renders as UNPROVEN. Proves: the reader can see what is trustworthy. Cost: small.
3. Flip the producer. Shed from certification, integration gates, indexing. Stop shedding from hermetic tests. Proves: binding claims can be a byproduct of real work. Cost: medium.
4. The reader A/B, gated on binding. Same brief, two workers, binding-verified claims in one. Proves: the effect survives contact with production. Cost: one night.

Slice 1 gates everything. Slice 3 is the prerequisite for the continuous-certification ceiling the other fleet found: a claim that binds and is broad is one that can be held now rather than recently.

The ambitious version — rewritten after the measurement

The error was the frame, not the math. I treated STALE as a failure to drive to zero. But the experiment measured what a builder does with a stale claim: re-verifies, 6 out of 6. That is the claim working. A stale claim didn’t waste the builder’s attention — it aimed it. The value was never in the claim being fresh. It’s in the claim being specific enough to direct attention, carried with an honest account of what has moved since.

1. The claim is durable — written once, never expires.
   The agent that established a property writes the sentence at that moment. What it asserts was true at a pin and stays true about that pin forever. A claim is content, not a perishable. Never rewritten.
2. The sidecar is computed at read — and reports the DELTA, not a verdict.
   Not “is this fresh.” What changed between the world the claim was written in and the world now — which files moved, how far HEAD travelled, which symbols the claim names gained or lost callers. This machinery already exists and you ratified it (2026-07-13): slice-sidecar.mjs, the living copy that rides beside the immutable record, local-only, regenerable, read-repaired. We point an existing pattern at the right target.
3. The reader gets the claim and the delta, and judges for itself.
   No FRESH/STALE stamp. A stamp is us making the trust call on the agent’s behalf — the laundering your call 1 forbids. We give the trace and the delta; the intelligence weighs them. The 6/6 re-verification is what that judgment looks like when the input is honest.

The real work, and it’s a better question: what must the delta SAY to be useful? “Three files changed” is noise an agent learns to skip. “The function this claim names now has two more callers, and one is on a path its check never runs” is decision-grade. The sidecar’s job isn’t to detect change — that’s trivial — but to report change at the altitude of the claim’s own words. That is Slice 3’s actual problem, and it replaces the dead “widen the basis” work entirely. Where the delta can’t be computed completely (Plato sees imports, not spawned processes), the sidecar says so — per call 1, that admission is the product.

Your calls