Appendix A. The necessities, row by row
The first draft of 3 November, kept as the reference table behind chapters 1–11: every result the construction rests on, in four parts — the result with its hypotheses, what it forces, the mechanism, what would show it misapplied. The chapters argue in order; this appendix is for looking a result up. Numbers carry the provenance tags of plan.md §2; the record is renavondata/jack at 6b800e14.
A.0 What this chapter claims
The question of chapter 0 was: what must sit underneath an agent that is allowed to change itself, when it is operated by one person of bounded attention, judged on a world that charges real prices, and built out of a policy that is cheap, general and unreliable. This appendix's claim is that the answer is forced. Each component of jack's core is there because a result — a theorem, an impossibility, a necessity theorem of control, or a design principle with a long enough record of failures to count — says that without it the agent cannot be evaluated, tested, governed or stopped. The components were not chosen from a menu. They were found by reading the results and asking what each one leaves no choice about.
"Necessary" is used in one sense throughout, fixed here and in plan.md D15: a mechanism is necessary if removing it leaves a stated result unmet — the agent would then be inspected where it can only be run, trusted where it can only be bet on, timed where it can only be counted, or governed by a rule that cannot guide conduct. The claim is never that the mechanism is the only one that could discharge the result. It is that some mechanism must, and that jack's is one, cited to the line of code or the clause of the charter where it lives. Minimality — that the law holds nothing but such mechanisms and the constants that carry a proof or a pre-statement — is argued at the end (§A.17), and sufficiency is not argued at all: it is a matter for the record of the windows (chapter 8), and the chapter says so each time it is tempted to say more.
Each necessity is taken in four parts: the result, stated with its hypotheses so that it is not overstated; what it forbids or forces for a self-modifying agent; the mechanism in jack that discharges it; and what would show the result misapplied — the test a referee should run against the record. The epistemic status of each result is marked, because the chapter leans on three kinds of thing that must not be confused: theorems about computation and probability (Rice, Löb, Ville, Bahadur–Savage, Alpern–Schneider, the propriety of the log score); necessity theorems of control that hold under stated and rather strong conditions (Conant–Ashby, requisite variety); and design principles that are not theorems at all but have been tested against institutions for four centuries (Coke), six decades (Hart, Fuller, Anderson) or a wide enough range of systems that ignoring them is a bet against the base rate (Goodhart, Gall). The book says "theorem" only of the first kind.
The results are grouped by the job they do. Evaluation: why the change cannot be inspected, why the agent cannot be its own judge, what counts as evidence of merit and what score rewards honest evidence. Testing: how a test can be looked at whenever the operator likes, what cannot be tested at all, and why safety and liveness are tested by different means. Control: what the thing that governs must contain. Law: the smallest set of rules that is a legal system, and the ways a rule fails to be one. Enforcement: where the law must be code, and why one copy of it is not enough. Irreversibility and growth: where a hard gate is worth its cost, and in what order the thing can be built.
A.1 The object
The object is fixed as the essay fixed it, in three parts. An agent that rewrites its own programs, extends its own language when that is the best action available, and adopts or discards the result by what it earns, continuing after the operator has stopped watching. An operator who is one person, whose attention is the scarcest resource in the system and is to be spent on wishes, vetoes, a budget and the irreversible, and on nothing else. A world that charges: outcomes are produced by processes that read nothing the agent writes — a race result, a catalogue's modification time, a test run on a commit — and some of them cost money. And the policy inside the agent is a large language model: general, cheap per token, and unreliable in ways that cannot be enumerated in advance. Nothing below depends on which model, and the law is written so that it cannot (§A.10).
The results are then applied to one question each: given this object, what can the thing underneath it not do without?
Evaluation
A.2 Merit cannot be inspected — Rice (1953)
Result (theorem). Let the programs be those of a Turing-complete language and let a property of a program be semantic — a property of the partial function it computes, not of its text. Rice's theorem: every non-trivial semantic property is undecidable. "Non-trivial" means that some programs have it and some do not; the proof is a reduction from the halting problem, and the hypotheses are exactly these two — full computational power and extensionality of the property. Decidable properties remain: syntactic ones (the text has this shape; the signature verifies; the hash matches), and semantic properties of programs in languages that are not Turing-complete.
What it forces. The naive self-improvement loop — propose a change to yourself, evaluate it, keep it if better — fails at the word evaluate. "This change is an improvement" is a property of the program's behaviour, and for any program language the agent will actually want (one in which it can write the next version of itself), Rice says no procedure settles it by inspection. The only route left is extensional in the other direction: run the change and observe what it does. And since "improvement" is a property not of the program alone but of the program in the world — a forecasting program is better only if the races it forecasts come out as it said — the observing must be done by something that reads the world, not the program. Pearl's result from the other side (2009, ch. 3) makes the same point for a learning agent: effects of actions are not identifiable from passive observation without assumptions no one can check, so an autonomous agent must experiment, and its experiments must be scored by something it does not control. So: nothing is reviewed on its merits; every claim of merit is a forecast, resolved by the world.
Mechanism. The charter confines statutes to decidable properties on exactly this ground [CHARTER §3, Adjudication: "Statutes are confined to decidable properties, because non-trivial semantic properties of programs are undecidable (Rice 1953)"], and separates validity from merit in the same clause: "Questions of merit (is this work good?) are not questions of validity: they are forecasts, scored when the world resolves them." The kernel's validity predicate is ten steps, every one syntactic and terminating [SPEC §8]: decoding and canonical re-serialisation, the shape of the entry, string comparison of timestamps, integer equality of seq, equality of a SHA-256 against the previous line, membership of a type in a key's powers, and Ed25519 verification in bounded arithmetic [kernel/log.py:parse_line, kernel/check.py:check_entry, kernel/sig.py:ed25519_verify]. The judge's grounds outside the kernel are held to the same standard by amendment: a ground is admissible only if it "is decidable from git and the log alone, is stated over powers and paths and never over a party's name" [CHARTER A2.3]; the fourteen grounds of SPEC §10 are of that kind — a digest differs, a prefix is not a prefix, a path is not under a list, a line count exceeds a cap. Merit lives elsewhere: in forecast and resolution entries whose outcomes are read from the world [SPEC §5], and, for the agent of C3, in a sealed judge that runs the candidate on seeds it never saw and scores what it earned [CHARTER §8, C3]. No proposal is ever run by the judge; the judge runs trunk's checkers over the proposal's entries as data [SPEC §10.5; judge/judge.py:run_kernel].
Misapplied if. Someone proposes that the judge "check that the change is good", or a brief admits a ground that reads the semantics of a proposal's code. Or — the subtler failure — the court mistakes a decidable property for merit: a green test run is a decidable fact about a commit, and the court must not treat it as evidence that the work is worth anything, which is why C1b's liveness item is the herald's act [BRIEF-C1b §Liveness] — in counsel's later summary, "a herald act landing a timely resolution" [jack REPORT.md §4, item 1] — and not a green run, and why assize's F4 — three review rounds on how a status cited a green run, the code green throughout — is recorded as a failure and not a success [CHARTER §1].
A.3 The self cannot be its own judge — Löb (1955), Gödel (1931), and the grain of truth
Result (theorems, with the design rule they force marked as such). Three results bear on an agent that would evaluate its own successor. Gödel's second incompleteness theorem: a consistent, recursively axiomatised theory that interprets enough arithmetic cannot prove its own consistency. Löb's theorem: in such a theory T, if T ⊢ Prov(⌜φ⌝) → φ then T ⊢ φ; so T cannot prove the reflection schema "whatever I prove is true" for any sentence it does not already prove. The Löbian obstacle (Yudkowsky & Herreshoff 2013) applies this to an agent that acts only on proofs of safety and would like to build a successor that does the same: to trust the successor it must prove "if the successor proves an act safe, it is safe", which is the reflection schema, so a sound agent can license only successors whose proof system is strictly weaker than its own — trust strictly decreases down the chain, and a self-modifier that keeps its own evaluation rule cannot be sound. The grain-of-truth problem is the Bayesian form of the same wall. Kalai and Lehrer (1993) showed that Bayesian learners converge to the truth when each one's prior puts positive mass on the truth about the others; Nachbar (1997, 2005) showed that in many two-player discounted repeated games (stage games in which neither player has a weakly dominant strategy) a class of strategies neutral enough to serve as a prior — independent of payoffs, symmetric across players and relabelings, admitting pure strategies — cannot both be learned on and contain each player's best response to his belief, and Foster and Young (2001) found a like obstruction for players uncertain of one another's payoffs (the author has Nachbar's working paper in hand and Foster–Young only by its abstract and Leike et al.'s summary: issue #9); and Leike, Taylor and Fallenstein (2016) resolved it only by stepping outside computation, with a class built on reflective oracles that is limit computable but not computable. So an agent's computable prior over agents of its own kind has no guarantee of a grain of truth, and without one Kalai and Lehrer's theorem says nothing about its convergence — the guarantee is lost, not non-convergence proved. Schmidhuber's Gödel machine (2007) accepts all this and rewrites itself only on a proof that the rewrite raises expected utility; it is provably optimal and, for the same reasons, fires only when such a proof is found, which is the cost that makes it a boundary case rather than a design.
What it forces. The evaluation rule is not something the agent improves. It is a fixed point, not a recursive call: the judge and the score sit outside the agent's reach, and the recursion of the design — each level governed by the same institutions as the level below — is for the economy of the thing, never for the law. And the court itself inherits the obstacle. It cannot prove its own soundness; what it can do instead is keep a book on itself (chapter 6).
Mechanism. Reach is a matter of keys, not of convention. The trusted base — kernel/, kernel2/, judge/, .github/workflows/ and SPEC.md — changes only by a push entry naming its digest [CHARTER A1.1, A2.6; SPEC §10.1, §10.11], and the push power, with genesis, key, amend and decision, is held by one key, guy-master [seq 1; seq 33]. No party's key holds it: the builders' keys hold proposal, spec_conflict, forecast and resolution [seqs 6, 34, 49], the reviewers' the same without spec_conflict [seqs 7, 32], counsel's likewise [seqs 8, 31, 48], the herald's merge alone [seq 201]. A decision not signed by a genesis key is refused [SPEC §10.14, decision_by_other]; a trunk whose trusted base is not the one in force is refused, self-check included [SPEC §10.11]; a proposal that differs from trunk anywhere in the trusted base, or in CHARTER.md by a byte, is refused before anything else runs [SPEC §10.1; judge/judge.py:judge]. The charter closes the loop on the agent explicitly: "Whatever counsel and builders are forbidden is what the agent of C3 is forbidden, by the same judge, keys and amendment path; nothing is imposed on the agent that was not first imposed on us" [CHARTER A2.10]. That is the Löbian rule as an institution: the agent of C3 will hold a proposer's key, and a proposer's key cannot reach the judge.
Misapplied if. An entry type or a brief lets a proposer change a checker, a workflow, or the score; or an amendment widens a non-genesis key to push, amend or key. Or the book claims more than the rule — that jack "solves" the Löbian obstacle, or that the court is "provably sound". It is neither. The honest statement is the one chapter 6 makes: the court's soundness is not proved but bet on, through a wealth process on its own claims that is never reset.
A.4 Only issued forecasts count — Dawid (1984)
Result (principle; its force is in what it excludes). The prequential principle: a forecasting system is to be assessed on nothing but the sequence of probability forecasts it actually issued and the outcomes that then occurred. No model of the forecaster is consulted, no likelihood of a hypothesised truth, no revision of an issued forecast after its outcome, no "what it would have said". In Dawid's words, the assessment "should depend on P only through the sequence P of forecasts that it in fact made" (§5.1, p. 281; verified 3 November). He offers it as a desideratum, by analogy with the likelihood principle: forecasts that might have been issued in circumstances that did not occur are irrelevant. Read with Shafer and Vovk (2019), it makes forecasting a game between forecaster and world, with the forecasts as moves that cannot be taken back.
What it forces. For an agent whose merit can only be scored (§A.2), the evidence must be of this form: a probability, fixed at a known time before the outcome, and an outcome, recorded by someone other than the forecaster, once. Anything else — a probability revised after the event, a second resolution that corrects the first, a score recomputed from forecasts the forecaster did not issue — reopens the inspection that Rice closed, by the back door.
Mechanism. The ledger is the file format of the principle. A forecast entry carries a claim, a probability p as an integer from 1 to 999 per mille, and a resolves_by not earlier than its own ts; a resolution names the forecast's seq, an outcome in {0, 1}, and evidence [SPEC §5]. The probability is fixed at the entry's position, because timestamps do not decrease along the log [SPEC §7; kernel/check.py line 60, ts_decreased] and the chain fixes the position [SPEC §3]. A second resolution of the same forecast is refused as schema [SPEC §7, §8 step 7]; a resolution by the forecast's own principal is refused as self_judged [kernel/check.py line 83; SPEC §8 step 8a]. The world's evidence is a page saved and hashed into the tree before the resolution cites it [BRIEF-C1 criterion 4; C1a's exit counted twelve such forecasts with their hashes recomputed from the files: status.py --subject C1a --as-of 2026-10-31T10:42:10Z --runs transcripts/evidence/runs-tests-20261031.json @6b800e14]. The ledger was built before the clerk for this reason [CHARTER A3.1: "an overdue forecast is the first such obligation the record can hold"].
Misapplied if. Any score in a promotion criterion or an election is computed from a forecast whose probability was fixed after its event. The record already holds the two ways this happens and names them: a forecast whose ts is at or after the event's cutoff is listed as rigged and not used — three such are on the log at seqs 288–290 [BRIEF-C2a §Scope, the entrants] — and a later forecast of the same event by the same principal is listed as revision and not used; the first stands. The pins C2a names for this are forecast_before_cutoff, rigged and revision [BRIEF-C2a §Pins]. A kernel that admitted a second resolution, or a tool that silently dropped either kind rather than listing it, would be the failure.
A.5 Only a proper score rewards belief — Brier (1950), Good (1952), Savage (1971), Gneiting & Raftery (2007)
Result (theorem). A scoring rule S(P, y) pays the forecaster S when it reported P and y occurred. It is proper if, whatever the forecaster's belief Q, reporting Q maximises its expected score under Q; strictly proper if reporting Q is the unique maximiser. The logarithmic score S(P, y) = ln P(y) is strictly proper (Good 1952 introduced it; Gneiting and Raftery 2007 give the general theory and the characterisation of proper scores as the subgradients of convex functions). For a binary outcome with a report confined to a grid, the optimal report is the grid point nearest the belief in the score's own divergence, so truthfulness holds to within the grid.
What it forces. The score is the only thing in the design that is rigid at every level — it is what the free edge is judged by — so it must be one that cannot be gamed by shading. A score that rewarded a report other than the forecaster's belief would make the election (chapter 5) elect liars and make the agent's self-reports worthless. And among proper scores the logarithmic one is chosen by a second consideration. Under it, the Bayes mixture over K forecasters is itself a forecaster: its prediction is the posterior predictive, so the aggregate is conditioning, which chapter 0 requires of belief. Its cumulative loss is −ln of its own predictive probability, ∑ᵢ −ln qᵢ(yᵢ) = −ln ∏ᵢ qᵢ(yᵢ), which telescopes to within ln K of the best of K at η = 1, with no tuning constant. Other mixable losses get a bound of the same form through Vovk's (1990) aggregating algorithm. The Brier score among them is mixable at η = 1 and gets the same ln K. But there the algorithm's prediction is not the mixture: a substitution step turns the mixed losses into a forecast, so the aggregate is not conditioning. That bound is the only constant the election is allowed to carry (§A.17). The bound alone would not force the log score. The bound together with Bayesian conditioning does. (Gneiting and Raftery say nothing of mixtures; this paragraph is the book's own claim, not theirs. Corrected 3 November: the first draft said the identity "holds for the log score and for no other".)
Mechanism. Probabilities are per mille, 1 to 999, because canonical lines admit integers only and because the range bounds the log-loss without a clipping rule [SPEC §5: "1–999 bounds the log-loss without a clipping rule"]. The score is log-loss, computed outside the kernel by jack score [SPEC §12.11; BRIEF-C1 §score]. The base-rate forecaster that every window's value test runs against is Laplace's rule over the resolved prefix of the forecast's type, (s + 1)/(n + 2), clipped to [1/1000, 999/1000] so that the difference of two log-losses is bounded by B = ln 999 [BRIEF-C2a §Scope, the base rate; CHARTER A4.4]. The aggregate is the Bayes mixture with the uniform prior and no learning rate — "η = 1 is the telescoping identity, the uniform prior the minimax choice for the ln K bound" [BRIEF-C2a §Scope, the aggregate].
Misapplied if. A score enters a promotion criterion or an election that is not strictly proper, or a transformation is applied to a proper score that breaks propriety (a cap on the loss per forecast would; the per-mille grid, which bounds the report, does not). Or the scored quantity is something the forecaster can shade without penalty — which is the next result's subject.
A.6 The target decays — Goodhart (1975)
Result (regularity, not a theorem; its force is empirical). Goodhart's law, in its original form: any observed statistical regularity will tend to collapse once pressure is placed upon it for control purposes. Campbell's (1979) is the same observation for social indicators. Manheim and Garrabrant (2018) separate the mechanisms — regressional (the proxy is the goal plus noise, and optimising the proxy selects the noise), extremal (the proxy's relation to the goal fails outside the range it was fitted on), causal (intervening on the proxy does not move the goal), and adversarial (an agent with its own goal exploits the proxy's slack). For a court whose entrants are optimising policies, the adversarial case is the one that matters.
What it forces. A measure that is a target is safe only when the measured party cannot move it except by doing the thing it measures. Two conditions give that: the score is proper (§A.5), so the party gains nothing by misreporting; and the outcomes scored are produced by processes the party does not control, so it gains nothing by acting on the outcome instead of on the world. A third follows for the court itself: the court's own statistics — items completed, forecasts resolved — are quantities the court can manufacture by producing more court, so the court must count its procedure against its object and stop when the ratio turns.
Mechanism. Outcomes come from the world: world.hkjc resolves from the HKJC's results page, saved and hashed, by a principal other than the forecaster's; world.renavon resolves from the dateModified of a public catalogue page fetched after the window [BRIEF-C2a §Scope, the streams; transcripts/world-types.md]. The resolver is never the forecaster [self_judged]. The sovereign's own acts are typed by entry type and signing key, "so the split is mechanical and fixed in advance, not judged afterwards" [CHARTER §7] — a repair cannot be re-typed as a decision by describing it differently, and the charter names this guard against its own Goodhart failure [CHARTER §12, third bullet]. The ratio of procedure to object entries is computed by status.py every window and stops the layer above 5 : 1, assize's figure [CHARTER A3.4; tools/status.py:assess]. Assize is the witness: twenty of its twenty-four merges in 10–13 October changed the court's own procedure [CHARTER §1, F7; claude/acts-weekly.md]. On jack, C1a's window ran at 127 procedure entries to 32 object entries and C1b's at 67 to 82 — the first window in which the court wrote more about the world than about itself [status.py --subject C1a --as-of 2026-10-31T10:42:10Z …; status.py --subject C1b --as-of 2026-11-01T11:31:58Z … @6b800e14].
Misapplied if. A promotion statistic counts something a proposer can produce without doing the work: the number of forecasts, the number of merges, a green run. The design has one such count — C1a's criterion 4, at least twenty forecasts by three proposers [BRIEF-C1] — and the book must call it what it is: a test that the record was alive, not that anything in it was worth anything, which is why the same layer's value is tested separately and later.
Testing
A.7 The operator looks whenever he likes — Ville (1939), Shafer & Vovk (2019), Ramdas, Grünwald, Vovk & Shafer (2023)
Result (theorem). Let (Eₜ) be a non-negative supermartingale under a null hypothesis H₀, with E₀ = 1. Ville's inequality: for every c ≥ 1, P(supₜ Eₜ ≥ c) ≤ 1/c (Ville 1939, p. 100; in game-theoretic form, as a bound on upper probability with no measure under the null, Shafer and Vovk 2019, Exercises 2.10 and 8.8). Because the bound is on the supremum, it holds at every stopping time, including the time at which someone decided to look: Eₜ ≥ 1/α is a rejection of H₀ at level α whenever it is observed. The game-theoretic reading (Shafer and Vovk) is that Eₜ is the wealth of a bettor who starts with one unit and bets against H₀ without ever risking bankruptcy; a test is a betting strategy, wealth is evidence, and the only discipline required is that each bet be predictable — decided from the past before the outcome it bets on is seen. Ramdas et al. (2023) give the general theory of such e-processes and anytime-valid inference.
What it forces. The operator of this system is one person who will look at the record when he wakes, not at a pre-registered sample size, and who wants a layer promoted the moment it has earned promotion rather than at the end of a term. A fixed-sample test lies to him the moment he peeks; a test supermartingale does not. So every promotion test is a wealth process, every window is a maximum, and nothing about the bet may be chosen with knowledge of the outcome it bets on.
Mechanism. The liveness statistic is A4.3's bet: for items Yᵢ ∈ {0, 1} and the null E[Yᵢ | past] ≤ p₀, Eₜ = ∏ᵢ≤ₜ (1 + λᵢ(Yᵢ − p₀)) with λᵢ = max(0, (q̂ᵢ − p₀)/(p₀(1 − p₀))) and q̂ᵢ the Laplace estimate over the statistic's outcomes so far; λᵢ is a function of the prefix, strictly below 1/p₀, so each factor is positive and has conditional expectation at most one under the null [CHARTER A4.3]. That is the stake's validity, which it shares with every predictable stake in range; the choice of this stake among them is not derived, and chapter 12 §12.2 prices it. The value statistic is A4.4's bet on the bounded log-loss difference Dᵢ between incumbent and challenger, Eₜ = ∏(1 + λᵢDᵢ/B) with λᵢ ∈ [0, 1) predictable from the prior differences and two pseudo-items [CHARTER A4.4; BRIEF-C2a §The statistic]; the exponentiated sum of score differences, which is not a supermartingale under the null of no improvement, is explicitly not used. The wealth is never reset: a window that fails is followed by one that continues the same product under the same null, so "Ville's inequality then holds for the whole sequence at the layer's α" [CHARTER A4.1]; p₀ is committed before the window opens and never estimated from the window it judges [A4.2]; and a window ends at the earlier of its stated end and the sovereign's promote, which may be entered only once every pre-stated criterion holds on the current prefix [CHARTER A5.1]. The threshold 20 is 1/α at α = 0.05 and nothing else [CHARTER §6]. The record shows the rule biting: C1b's nine items, every one Y = 1 at p₀ = 6/11, carried E to 214358881/8398080 ≈ 25.5 in a day, and the window closed there, with almost thirteen of its fourteen days unused [status.py --subject C1b --as-of 2026-11-01T11:31:58Z --runs transcripts/evidence/runs-tests-20261101b.json --acts transcripts/evidence/acts-20261101.csv @6b800e14; seq 337].
Misapplied if. A stake λᵢ is set with knowledge of Yᵢ or Dᵢ (predictability is the whole proof); p₀ is moved after the window opens; or the wealth is reset at a new window, which is k draws at one bound — the defect counsel's own literature check found in the charter's original §6 and that forced amendment A4 [transcripts/LITERATURE-20261026.md item 2; seqs 66–67]. C1b's reviewer pinned the second of these: wealth_arithmetic's mutant is "p₀ re-estimated from the sequence" [BRIEF-C1b §Pins].
A.8 Unbounded means cannot be certified — Bahadur & Savage (1956)
Result (theorem). Bahadur and Savage's theorem (verified against the text, 3 November) needs only three conditions on the family of distributions. Every member has a finite mean; every real number is the mean of some member; and the family is convex (§2). The family of all distributions with a finite mean meets them, and so does the family of all distributions with bounded but unknown support. For any such family, no test of the hypothesis that the mean takes a given value has power exceeding its size against any alternative (Theorem 1 and Corollary 1). A confidence set for the mean that is bounded from below with probability one under even one member has coverage whose infimum is zero (Corollary 3). The reason is that a distribution can carry an arbitrarily small probability of an arbitrarily large value, so the mean is dominated by what the sample almost never sees. The result disappears only when the range is known in advance, so that the range bounds the tail's contribution; boundedness alone is not enough.
What it forces. The quantities an operator most wants to see fall — minutes to merge, dollars per window, repairs per merge — are unbounded, and no procedure can certify that their mean is small without assumptions nobody can check. So the court tests only bounded outcomes, and reports the rest as what they are: numbers, not evidence.
Mechanism. Both test statistics have a range fixed in advance, which is what the theorem requires and not merely that they be bounded: the liveness item Yᵢ ∈ {0, 1} (an item completed with no repair by the sovereign, or not); the value difference Dᵢ ∈ [−B, B] because both probabilities lie in [1/1000, 999/1000] [CHARTER A4.4; SPEC §5]. The charter says the rest aloud: "Unbounded quantities (repairs per merge, minutes) are reported and never tested: no procedure can certify a small mean of an unbounded variable (Bahadur & Savage 1956)" [CHARTER §6]. Repairs per merge is the number the whole programme is built to drive down, and it appears in every weekly acts table [claude/acts-weekly.md] and in no test.
Misapplied if. Anyone proposes "E ≥ 20 on mean latency", or a liveness statistic over minutes rather than over a binary item. Or the other error: the book claims the acts tables as evidence of the kind Ville gives. They are a classifier's counts over GitHub's record and the book reports them with that label.
A.9 Safety and liveness are different kinds of thing — Alpern & Schneider (1985)
Result (theorem). Let a property be a set of infinite executions. A safety property is one that, when violated, is violated at some finite point: every execution outside it has a finite prefix none of whose extensions is inside. A liveness property is one that can never be refuted by a finite prefix: every finite prefix has some extension inside it. Alpern and Schneider proved that every property is the intersection of a safety property and a liveness property (the safety part is the topological closure; the liveness part is the property together with everything outside the closure). Lamport (1977) had drawn the distinction — nothing bad ever happens; something good eventually happens — and this is its exact form.
What it forces. The two halves of what the court promises are of different kinds and cannot be tested by the same means. That nothing invalid was ever admitted is a safety property: it is refuted by one entry, and it can be checked exactly by replaying the prefix. That obligations do not rot — every forecast resolved, every merge witnessed, every writ escalated — is a liveness property: no finite record refutes it, and the only honest claim about it is statistical, with a deadline turning "eventually" into "by then or escalated". A replay cannot establish liveness and a statistic cannot establish safety; the design must have one mechanism for each.
Mechanism. Safety is replayed. Two checkers — the Python kernel and a Go implementation written from SPEC.md alone by sessions of another model family [kernel2/NOTES.md] — run over every proposal's whole log from trunk [SPEC §10.5] and over the real log on every push [.github/workflows/, the self-check]; the differential compares them on every proper prefix of every seeded log, and a non-verdict, a crash or a timeout counts as disagreement [SPEC §9a]. The run of record at C1a's installation compared 100,000 seeded logs and 636,392 prefixes with no disagreement [transcripts/diff-100000-20261025T1328Z-part00…11.json]. Liveness is written as obligations with deadlines and tested by betting: the clerk derives writs from state and the clock — W1, every forecast after the opening; W3, a merge on main without a green run before it; W4, every window criterion not met — and escalates them [BRIEF-C1b §The clerk; tools/clerk.py:forecast_writs, merge_writs, window_writs; tools/enforcement.json]; the items the writs produce are the Yᵢ of §A.7's process. The charter states the division in these words: "recognition and adjudication carry safety, writs carry liveness" [CHARTER §4].
Misapplied if. A report claims liveness from a replay ("both checkers agree, so the court is alive") or safety from a statistic ("E is 25, so nothing invalid was admitted"). Or a liveness obligation is defined without a deadline, which makes it untestable in principle: the charter's third maxim — every obligation carries a deadline and escalates when it passes [CHARTER §A.3] — is the maxim's name for this theorem's consequence.
Control
A.10 The regulator must contain a model of the regulated — Conant & Ashby (1970); and must have its variety — Ashby (1956)
Result (necessity theorems of control, under stated conditions). Conant and Ashby's good regulator theorem (verified against the text, 3 November). Disturbances D determine the system's events S, and the system's events and the regulator's events R jointly determine the outcomes, Z = ψ(S, R). The goal is to minimise the entropy of Z. The theorem: "the simplest optimal regulator R of a reguland S produces events R which are related to the events S by a mapping h : S → R" (§4). So it is a model of S in exactly that sense: what it does is a function of the system's events. The paper grants that "not all optimal regulators are models of their regulands"; those that are not are "unnecessarily complex". The proof holds the distribution over S fixed, so if that distribution drifts, the model has to drift with it. The theorem is often overstated, and the safe reading is narrow. A regulator that is optimal and as simple as it can be acts on a representation of the regulated system and nothing else; anything further it acts on is needless, not proved wrong. Ashby's law of requisite variety, from the same tradition, with variety measured logarithmically: the regulator can reduce the variety of the outcomes by no more than its own variety, V(Z) ≥ V(D) − V(R). Ashby states it as: the variety of the outcomes "cannot be less, numerically, than the value of V_D – V_R" (S.11/7, p. 206; verified 3 November), under the condition that no two elements in the same column of the outcome table are equal (S.11/5); S.11/9 relaxes the condition at the cost of a term. So a regulator with fewer responses than the disturbances it faces cannot hold the outcomes to fewer than V_D/V_R distinct values, and if the acceptable set is smaller than that it must fail. Burns et al. (2016) supply the engineering corollary from a different literature: a controller that reconciles desired and actual state loses nothing when an event is missed; one that reacts to events loses the obligation with the event.
What it forces. Whatever governs the agent must act on a model of the agent and its world that is complete enough to determine what the governor should do, and must not act on anything outside that model, because anything outside it is unaccountable. The model is the record, folded by the law into a state. And the pool from which proposals come must carry at least the variety of the disturbances — the failure modes of large language models, the limits of one vendor, the outage of one account — which argues for several model families and against naming any of them in law.
Mechanism. The state is fold(law, log): kernel/check.py:State carries the head hash, the keys with their owners and powers, the promulgated charter and the amendments in force, the trusted base, the transmuted set, the forecasts and which are resolved, and the previous timestamp [SPEC §7]; the checker reads nothing else — no clock, no network, no model [CHARTER §9, refusal list; kernel2/NOTES.md: "no network, clock, or LLM calls"]. The clerk derives every obligation from that state and the clock, and the clock enters only as an argument [tools/status.py docstring: "No entry, no signing, no fetch. The clock enters only as --as-of"]. The record is a replicated state machine in Schneider's (1990) sense, ordered by its chain and not by wall time (Lamport 1978): a timestamp is a field that may not decrease, and the kernel never reads a clock [SPEC §4, §7]. Someone other than the owner checks the record's history [CHARTER A2.8]. Variety: the grounds the judge may refuse on are "stated over powers and paths and never over a party's name" [CHARTER A2.3]; the election rule itself is "an entrant, not law" [CHARTER §5], and the C2a brief admits to the aggregate no learning rate and no prior but the one its bound derives [BRIEF-C2a §Scope, the aggregate]; the proposers on the record are sessions of more than one family [kernel2/NOTES.md; the C1b window's sessions in transcripts/], and the charter's own argument for this is Ashby's [CHARTER §5, last paragraph].
Misapplied if. An obligation lives outside the record. Assize's F3 is the witness — stalls found by a human watching a phone [CHARTER §1] — and so is jack's own: four forecasts by the sovereign and by counsel expired undischarged in C1a's window, resolved one, eight and nearly four hours late [seqs 45, 46, 47, 56 and their resolutions at seqs 52, 69, 70, 108], because the clerk was in counsel's head. C1b's brief names those four as its forcing witness. The clerk is level-triggered for that reason; the judge, which runs on a pull request, is the one event-triggered component, and the charter assigns reconciliation to the clerk rather than to it [LAW.md §A.3, which says so].
Law
A.11 Exactly three secondary rules — Hart (1961)
Result (design principle, by elimination). Hart's analysis of a legal system: a regime of primary rules alone — rules of conduct — suffers three defects. Uncertainty: there is no way to settle what the rules are. Static character: there is no way to change them except by the slow drift of practice. Inefficiency: there is no way to settle whether a rule has been broken. Each defect has a remedy, and the three remedies are the secondary rules: a rule of recognition, which says what counts as law; rules of change, which say how law is made and unmade; and rules of adjudication, which say who decides a breach and how. Hart's own claim is the sufficient half. The three remedies together are "enough to convert the regime of primary rules into what is indisputably a legal system", and each alone "might, in itself, be considered a step from the pre-legal into the legal world" (ch. V §3; verified against the third edition, 3 November). He expressly does not claim that the union is found wherever "law" is properly used. The book's use is the defect-for-defect half, and that is the book's reading rather than Hart's theorem: a regime that lacks one of the three keeps the corresponding defect, because one of the three questions has no answer within it.
What it forces. The smallest thing that can bind an agent is these three, in code, before any rule of conduct exists. Everything else — every rule about what proposals may do — can wait for a case, and should, because a rule written before its case is a guess at what the world will present. This is a necessity by elimination: remove recognition and the agent cannot tell a valid entry from an invalid one; remove change and the law cannot be amended lawfully, so it will be amended unlawfully; remove adjudication and a breach is a matter of opinion. It is also the sharpest form of the programme's minimal-law thesis, and the one the record tests most directly.
Mechanism. C0 was cut to exactly the three [CHARTER A1.1]. Recognition is the validity predicate: a canonical line, its seq, its parent in the chain, a signature by a declared key whose powers include the entry's type, and timestamps that do not decrease [SPEC §8]. Change is the key entry, signed by a key holding the key power [SPEC §7]; the amend, which must be preceded by a decision of kind transmute naming it and is in force from a height above its own seq, with no push lawful between the two [CHARTER A2.7; SPEC §10.12–13]; and the push, which names the new trusted base [CHARTER A2.6]. Adjudication is trunk's kernel, by digest, run from trunk over the proposal's entries as data [CHARTER A1.1; SPEC §10]. The transmute precondition on amend is the one part of change the kernel records but does not enforce: the judge refuses an untransmuted amend as ground 13, amend_untransmuted [SPEC §7, "The kernel records them; the judge enforces them"; §10.13]. So the three rules are held by the kernel and the judge together, and the kernel that holds recognition and the rest of change is 450 lines [count_kernel.py @6b800e14: log.py 172, sig.py 140, check.py 138] — 392 on the day genesis was signed [transcripts/count-20261014T012918Z.txt; seq 0] and within every bound the charter and briefs set since (1,000; 450; 500). No primary rule has yet been needed: amendment A2.1 says the law language enters only "at the layer in which the first real case arises: the first entry Guy wants refused that recognition does not refuse", and none has arisen through C1b [CHARTER A2.1]. The thesis that three secondary rules suffice is therefore on trial on the record, and the charter says what its failure would look like [CHARTER A2.1, last sentence; §12].
Misapplied if. A primary rule is written into the kernel instead of entering as a precedent with its witnesses; or a layer adds a rule of conduct in advance of a case. The one apparent exception — self_judged, which refuses a resolution by the forecast's own principal — is not a primary rule but the first maxim made part of recognition: it is a rule about what counts as a valid entry, not about what a proposer may do, and the amendment that admitted it says so [CHARTER A3.3].
A.12 Eight ways to fail to make law — Fuller (1964)
Result (design principle, with a catalogue of failures). Fuller's parable of King Rex lists the ways a lawgiver fails to make law at all: failing to make general rules, so that every case is decided ad hoc; failing to publish them; making them retroactive; making them unclear; making them contradict one another; requiring the impossible; changing them so often that no one can act on them; and administering them in a way incongruent with their text. In Fuller's words, "a total failure in any one of these eight directions" yields something "not properly called a legal system" (ch. II, p. 39; verified 3 November). Partial failures are failures of degree, and a failure of congruence makes obedience futile rather than impossible. Fuller called the eight demands they violate the inner morality of law; for an engineer they are eight checks.
What it forces. Each of the eight is a property a mechanism either has or lacks, and the charter maps them one to one [CHARTER §4, second table]. The chapter takes the three that matter most for an agent. Prospectivity: the law in force at entry i is what entries before i established, by construction of the fold — retroactivity cannot be expressed, and a key declared at i governs entries after i, never i itself [SPEC §7; kernel/check.py:signer reads the keys before the entry's own effect is applied]. Possibility of compliance: the kernel refuses what no one could satisfy — a public key no one could be the sole holder of [kernel/sig.py:weak_key; SPEC §6–7, bad_key] and a key entry that would leave no key with the key power [CHARTER A2.5] — and when rules arrive each must carry a witness that satisfies it [CHARTER §3, Change]. Congruence: the rule that is declared is the rule that is applied, because the enforcer is the checker whose digest is on the log, run from trunk, in a process with credentials the proposer does not have [SPEC §10.1, §10.5]; the enforcement map records, row by row, whether a principle is enforced by code or by hand, and C1b's criterion 7 required the rows it moved to read code [tools/enforcement.json; status.py --subject C1b … @6b800e14, "map" lines]. Congruence is the principle every prompt-based harness fails outright: a rule in a system prompt is a suggestion, and the model that reads it is the party it binds.
Mechanism. The table in CHARTER §4 is the mechanism; the chapter adds only the two rows the record has since made concrete. Promulgation: the charter's hash is in genesis and in every amend, and the judge refuses every proposal while trunk's CHARTER.md does not hash to the promulgated charter [SPEC §10.2, charter_mismatch]. Constancy: the rate of change is reported — five amendments in seventeen days, and A5 records its own price and the procedure ratio on the day it was entered [CHARTER A5.3].
Misapplied if. A rule binds an entry that preceded it; a rule is admitted without a satisfying witness; or the declared rule and the enforced rule differ — which is the finding the book makes against its own predecessor's LAW.md, whose rows map the charter as it stood at C0 while the kernel has moved [plan.md F1].
Enforcement
A.13 Enforcement at a seam — Anderson (1972), Saltzer & Schroeder (1975)
Result (design principle; the security literature's settled form). Anderson's reference monitor: the mechanism that validates every access must be "tamper proof", "always invoked" and "small enough to be subject to analysis and tests to assure that it is correct" (Anderson 1972, vol. II §3.4, p. 17; verified 3 November). "Complete mediation" is Saltzer and Schroeder's later name for the second. Saltzer and Schroeder's principles fill it out: economy of mechanism, fail-safe defaults (deny unless permitted), least privilege, separation of privilege, open design. Dennis and Van Horn (1966) and Miller (2006) give the form that authority takes in such a system: a capability — a reference one holds — rather than a rule one obeys, so that a party lacking the reference cannot act and there is nothing to argue with.
What it forces. The law is code at a seam the agent cannot cross, and the seam is credentials, not instructions. Everything that enters passes the monitor; the monitor runs in a process the proposer does not own; a refusal is a refusal, never a warning; and what a party may do is the smallest set its role needs.
Mechanism. Complete mediation: every proposal is judged by trunk's checkers before it merges, and trunk judges itself on every push [SPEC §10; .github/workflows/judge.yml runs on pull_request_target, so the workflow and the judge come from main]. Tamper-proof: the trusted base is five paths, compared by content so that an edit, a rename, a deletion or an addition under them is refused alike, and a symbolic link or a submodule under them is refused before any digest is taken [SPEC §10.1]. Verifiable: the kernel is 450 lines and the differential 62 within a bound of 65 [SPEC §9a.6; wc -l harness/diff.py]. Least privilege as capability: keys carry powers, and the herald's second key carries merge alone [seq 201]; a process holding it can merge green proposals and do nothing else, and every one of the 83 entries herald-2 has signed since it was declared is a merge [log@6b800e14; seqs 201, 216, 217 — the herald's second key declared on the sovereign's machine and the two session-held keys revoked]. Fail-safe: every ground is a refusal of the whole proposal, and a checker that cannot decide — a crash, a timeout — is treated as a refusal, never as agreement [SPEC §9, §9a.4]. Open design: the specification is the trusted base's text, and the second checker was written from it alone (§A.14).
Misapplied if. The accused supplies its own test. Assize's F1 is the witness: a pull request's pins ran the pull request's own harness [CHARTER §1]. The pin that kills this in jack is judge_from_proposal — a merge judged by a checker the proposal supplied is refused [CHARTER §9, pins; SPEC §10.6] — and C0's report records the founding pull request as the one stated exception, judged locally and refused [REPORT.md §4.5, cited as a transcript, not as a number].
A.14 One checker cannot be trusted — Thompson (1984), Wheeler (2005)
Result (an argument with a construction, not a theorem). Thompson's Turing Award lecture: a compiler can be made to insert a back door into the programs it compiles, and into every future compiler compiled from clean source, leaving no trace in any source; so "you can't trust code that you did not totally create yourself", and inspection of source does not help. Wheeler's diverse double-compiling is the counter: compile the suspect compiler's source with an independent compiler, then with the result, and compare; if the two agree bit for bit, the back door would have to be present in two independent lineages. The general form: a single implementation of a checker is evidence of nothing; two implementations by independent authors that agree on every input are evidence that the specification, not an author's error or intent, is what was implemented. Gordon, Milner and Wadsworth's LCF (1979) and the de Bruijn criterion (Barendregt and Wiedijk 2005) give the complementary rule for the implementation itself: correctness reduces to a kernel small enough to read entire, through which everything passes, with the cleverness kept outside.
What it forces. The checker that every entry passes through must exist twice, written by different authors from the text alone, and the two must be compared on more inputs than anyone would write by hand; and the kernel must be small enough that one human can read all of it, because the residual trust — that two independent authors agree and one person has read 450 lines — is the floor the whole regress stands on (chapter 6).
Mechanism. The second checker is kernel2/, Go, standard library only, written by sessions of another model family that read SPEC.md, the vectors and nothing else [kernel2/NOTES.md; kernel2/README.md]; SPEC.md is written to make this possible — "a second checker, written in another language by an author who never sees the Python, produces the same verdict on every log" [SPEC, preamble] — and where the Python and the text disagree, the text wins and the disagreement is a finding [SPEC, preamble]. The judge refuses checker_drift when the two disagree on a proposal's log [SPEC §10.5]; the differential compares them on every proper prefix of every seeded log and treats silence as disagreement [SPEC §9a]; the seed list was committed before the first run and its hash is carried in every report [SPEC §9a.5; transcripts/diff-100000-20261025T1328Z-part00.json, seeds_sha256]. The simulator's kinds are the inputs: the charter's attack list — self-judging, retroactive, forged, rewriting, forking, unattributed, stalling, flooding — less the two that belong to the rule language C0 shed (vacuous, impossible) and plus the kinds each layer's types brought, through rigged and colluding for C2a [CHARTER §6; sim/gen.py, KINDS]. Size: 450 lines, read by the sovereign before he signed genesis [CHARTER §9 criterion 4; seq 0].
Misapplied if. The second checker is written with sight of the first (then agreement is evidence of copying), or the comparison is on whole logs only (a checker wrong on a proper prefix passes — the pin whole_log_only [SPEC §9a.7]), or a crash is counted as agreement (crash_as_agreement). Or the kernel grows past what a person reads: the charter's stop condition is 1,500 lines [CHARTER §9, stop and report] and every layer has pre-stated a tighter bound [A1.5: 450; A2.4: 500].
Irreversibility and growth
A.15 Only the irreversible gets a gate — Arrow & Fisher (1974), Henry (1974), Blackwell (1951)
Result (theorem of decision under uncertainty). When information arrives over time and an act cannot be undone, the expected value of taking the act now, computed correctly, is less than the naive expected value by a non-negative quantity — the "quasi-option value", their term (p. 315) — in a two-period model with risk neutrality, constant returns and development that cannot be undone (pp. 316–317; verified 3 November). Henry proved the same irreversibility effect independently; Dixit and Pindyck (1994) are the textbook. Blackwell's comparison of experiments (1951) is the ordering underneath: a more informative experiment is preferred by every decision-maker with every utility, so where waiting refines the information structure, waiting has value for everyone. The converse is the half that matters for a court. It is the book's, not theirs, though it follows from their model: an act that can be undone at no cost carries no option value in waiting, so a gate before it costs delay and buys nothing. Arrow and Fisher themselves price irreversibility rather than forbid it: "Just because an action is irreversible does not mean that it should not be undertaken" (p. 319). The hard gate is this court's policy, drawn where the price cannot be bounded.
What it forces. Hard gates stand only before effects that cannot be undone, where waiting has positive option value; everything reversible is priced and scored, never blocked. For the operator this fixes his reserved acts exactly: keys, pushes, deletion, promotion — the acts that change who may act or what the law is — and nothing else.
Mechanism. The master key's verbs are the irreversible ones: genesis, key, amend, push, decision [seqs 1, 33]; the last key holding key cannot be revoked, because losing it is irreversible [CHARTER A2.5; SPEC §7, bad_key]; the record itself is append-only, so admission is the one irreversible effect the kernel gates [LAW.md §A.4]; on the platform, branch protection on main and a ruleset on every repository's default branch forbid force-push and deletion, admins included [REPORT.md §8.1 criterion 4, as transcript; the 23 October ruleset recorded as a decision in claude/acts-weekly.md; tools/enforcement.json, row irreversible]. The reversible is priced: refusing a proposal "costs the proposer nothing but resubmission" [CHARTER A2.3]; the counted-code cap is a resource constant that "enters no score" [BRIEF-C2a §Scope, the cap]; a window that fails is not patched but followed by a new one with the wealth carried [CHARTER §6; A4.1]. The charter's fourth maxim is this result stated as policy [CHARTER §A.4].
Misapplied if. A hard gate stands before a reversible act, or none before an irreversible one. Assize is the witness for both at once: force-push and deletion of every branch but master, and of all tags, were ungated until 13 October, while bookkeeping on a status file blocked merges [CHARTER §1, F5]. In jack the test is the enforcement map's irreversible row — "keys, pushes, settings gated by the sovereign: code" — and the count of the sovereign's acts: in C1b's window he entered a push raising the cap, a key declaration, two revocations and the promotion [seqs 197, 201, 216, 217, 337], every one an act of the kind reserved to him, and no repair [status.py --subject C1b … --acts transcripts/evidence/acts-20261101.csv @6b800e14: late-reported repairs 0, off-log repairs 0].
Where jack fails this row's own test. The gate is drawn by path and by verb, not act by act, and so it stands before some reversible content. The counted-code cap is a budget — reversible by its nature, entering no score — yet it lives in the trusted base, so raising it is a push [seqs 197, 367]; the weekly budget is a decision [seq 50]. Neither needs the option value the result prices: a cap raised too far is lowered by the next push, at the cost of one window's slack. The design accepts the excess gate because the alternative is a judge that decides, change by change, which edits to the trusted base can be undone — a semantic property of the change, which §A.2 forbids it to inspect. The cost is on the record (two pushes and a decision in C1b's and C2a's openings) and is small; the book reports it as the one place a row's "misapplied if" fires, not as a mechanism that discharges the row. (Raised by Guy's review of the essay, gfrmin/agent-court#1, 3 November.)
A.16 A simple system that worked — Gall (1977), Hayek (1973)
Result (empirical regularity, stated as such). Gall: a complex system that works is invariably found to have evolved from a simple system that worked; a complex system designed from scratch never works and cannot be made to work by patching — it must be started over with a simple system that works. Hayek's distinction between grown order (cosmos) and made order (taxis) is the same observation about institutions: the rules that work are found, not designed, and a rule's justification is the case that forced it. Neither is a theorem. Both are the summary of enough failures that building against them is a bet against the base rate, and the author's own history (chapter 9) is a run of seven draws from it.
What it forces. The core is built in layers, each a simple system that works — promoted on pre-stated criteria — before the next is begun; rules of conduct enter from cases, not from foresight; and the cost of this, which is serial windows, is paid and recorded rather than optimised away.
Mechanism. C0 the record; C1a the ledger; C1b the clerk; C2a the value test; C2b the election; C3 the seed agent, each promoted at a crossing [CHARTER §8 as amended by A3.1; seqs 188 and 337 are the first two promotions]. Primary rules enter only from a witnessed case [CHARTER §3; A2.1]. Windows are maxima, so a layer that has worked is promoted the day it has and not at the end of a term [CHARTER A5]; and the next layer's pre-stated deliverables may be built during the current window, which is the one concession to wall-clock time the programme makes [transcripts/PLAN-20261030.md, "Pipelining"]. The cost is on the record: C1a's window held every criterion on 29 October with ten days of text left to run, which is what forced A5 [CHARTER A5, preamble].
Misapplied if. A layer is begun before the one below has crossed; a layer that fails is patched in place rather than followed by a new pre-stated window; or a rule enters without a case. One such proposal — "prepare C3 now", design in anticipation of a brief that did not exist — was withdrawn on 30 October on exactly this ground, and the plan that records the withdrawal names Gall [transcripts/PLAN-20261030.md].
A.17 Minimality, sufficiency and the narrow sense of "optimal"
The fifteen rows above (A.2–A.16) are the chapter's evidence for the first of the book's four claims (plan.md §5): that each component of the core discharges a result, so that removing it is not a simplification but an error. Three further words have to be fixed before chapter 8 can use them.
Minimality. The law is minimal in this sense: it contains only mechanisms that discharge a necessity above, and constants that carry a proof or a pre-statement. The second half is how amendment A4 was cut: its stakes are derived from the prefix "with no further constant" — their validity, that is; the choice of the liveness stake among valid ones is the one entrant the law still holds (chapter 12 §12.2) — no α is split, and the rules its earlier drafts tried to add went to a brief as rules of a layer, to return "by amendment only after one of them has refused or decided an act" [CHARTER A4, preamble and A4.3]; the C2a brief applies the same rule to the aggregate — no learning rate, the uniform prior because it is the minimax choice for the bound, Hedge with η < 1 "a second aggregate that may enter later as an entrant of its own", the cap "a resource constant … [that] enters no score" [BRIEF-C2a §Scope]. Counsel's gloss on this, which the book adopts as the audit criterion, is that the law names scores and competitions, never competitors [claude/literature-review.md §6]. The constants the law now carries are ln K (the mixture's regret), 1/α = 20 (Ville's level at α = 0.05), the Laplace and pseudo-item stakes (A4.3–4), the per-mille grid (a bound, SPEC §5), and the resource constants pre-stated before each window (a cap, a window's length, p₀). Everything else — every model, every prior finer than uniform, every base rate finer than a type, every threshold, the Vizier's model of the sovereign, Hedge with η < 1, Fixed Share, Thompson sampling — is an entrant that stands for election and can lose [CHARTER §5; BRIEF-C2a §Scope]. The test of minimality is mechanical: a mechanism in the law with no row above is an entrant installed as law; two mechanisms discharging one row is one too many. The chapter claims the table is complete as of this record and invites the referee to find the row it lacks.
Sufficiency. The chapter does not claim it, and the book claims it only by construction of its falsifiers. The pre-stated ways the programme would be shown wrong are the charter's own [CHARTER §12]: the kernel cannot hold the three secondary rules within readable size; a liveness window fails against the predecessor's baseline; repairs fall only because acts were re-typed; procedure outgrows object. Chapter 8 reports every window as the sequential experiment it is, and says where sufficiency is still a forecast.
Optimality. The book never says the mechanism is optimal. The claim it does make is Wald's (1950) and narrow: under his complete class theorem, a decision rule that is not a Bayes rule (or a limit of them) is inadmissible — dominated by one that is. Every discretionary choice the court makes about itself — which proposer to invite, whether a window has crossed, what to put to the sovereign — is made as a bet with a stated probability and scored, so the court's decision procedure is one that cannot be dominated within the class it competes in. A court that chose otherwise would be. That is the optimality claim: of the decision procedure the mechanism forces on everyone inside it, including the sovereign where he forecasts, and not of the mechanism.
A.18 What would show this chapter wrong
A row's "misapplied if" clause firing on the record: a λ chosen after its outcome, a p₀ estimated from its window, a proposal that supplied its judge, a primary rule written before its case. The pins exist so that these fire in CI rather than in a reader's hand, and chapter 8 lists which have.
A result overstated: Conant–Ashby read as more than it proves, or Löb read as a theorem about jack rather than a rule it obeys. The hypotheses are stated above so that a referee can check the application against them.
A necessity with two mechanisms where one suffices, or a mechanism with no necessity. Either falsifies minimality as defined, and the fix is an amendment that removes something, which the charter's lapse rule exists to make cheap [CHARTER §3, Change].
A result on the list that is not needed: if the agent of C3 can be evaluated by inspection after all — because its seed language is not Turing-complete and its properties decidable — then §A.2's necessity is weaker than claimed for that agent, though not for the language it will extend. The chapter's bet is that extension is the point, and that Rice returns with the first extension.
And the one that would show the chapter wrong rather than merely incomplete: a court built without one of these rows that runs for longer than jack has, at a lower price to its operator, on a world that charges. The author knows of none, and the predecessors (chapter 9) are seven attempts to build one.