# Foundations device registry — PROPOSAL, not adopted. # # Counting rule: presentations of one device count ONCE. `rung` is FAITHFUL # only after an audit by someone other than the designer; until then # `rung_projected` holds the design intent and `rung` is `unaudited`. # A rung may be lowered by an audit. It may never be argued upward (K5). # # Spec, ladder and kill conditions: docs/foundations/PROGRAM.md schema_version: 0 status: proposal written: 2026-09-05 adopted: false promote_to: "foundations.yaml at repository root, only if adopted" counts: # Revised after the section 10 loophole audit. Recount with the COUNT prompt. # Presentations count once (L2: state-space isomorphism preserving readout). devices_total: 10 rung_faithful: 0 # independently audited — this is the metric rung_self_audited: 1 # D-002, designer only (L4) rung_illustrative: 2 # D-009, D-010 — self-assigned, lower rung on purpose rung_unaudited: 7 built_physically: 0 with_audit_script: 6 # scripts/audit_device.py:models; digital N2 only learners: 0 nodes_generated: 10 # scripts/generate_foundations.py; index alias counts once atoms: A1: a rate is a count over a population A2: two rates do not fix their overlap A3: a threshold turns a score into a decision A4: exposure — who actually saw the item A5: a composition rule must be named A6: a bound is an answer; a point inside it is not A7: evidence can permit a set A8: all-miss is not the complement of good A9: pairs do not determine triples A10: a falsifier is written before the outcome devices: - id: D-001 name: The Two Jars atoms: [A1] materials: two jars, 3 red marbles each, 10 and 100 total marbles action: "Which jar is worse?" state_space: all (numerator, denominator) pairs realisable by pouring feasible_set: the same readout: answers_without_emptying: the half-a-number bug — a rate read as a property empties_both: holds A1 asks_for_totals_first: holds A1 and has the habit cannot_show: nothing about overlap, thresholds, or exposure rung: unaudited rung_projected: FAITHFUL setup_seconds: 30 - id: D-002 name: The Necromancer atoms: [A2, A6] presentations: [twenty coins, two paper strips on a meter stick] materials: 20 coins — 10 marked A-miss, 10 marked B-miss action: "Slide them to show the best stack. Now the worst stack." state_space: overlaps of 0 through 10 coins feasible_set: "Fréchet interval at marginals (0.10, 0.10): all-miss in [0, 0.10]" faithfulness_note: > No hand position produces 11 or -1. Every legal overlap is reachable. Bijection between hand position and the identified set. readout: full_overlap: holds dependence, built the upper endpoint interleaved: independence-as-default — the plug-in chunk frozen: suspects a number is missing but cannot name it slides_past_ten: has added the rates rather than overlapped them cannot_show: > exposure. Every coin is on the table and seen by both, so the device silently assumes full exposure — which is exactly why A4 needs D-005. rung: SELF-AUDITED rung_projected: FAITHFUL rung_reason: > Demoted by loophole L4. Every criterion holds by the designer's own reckoning and nobody else has tried to break it. Restored to FAITHFUL when a second person fails to build an illegal configuration, or when scripts/audit_device.py --device D-002 exits 0. parameters: "marginals (0.10, 0.10), 20 coins — FAITHFUL(theta), not FAITHFUL (L3)" binds: [CC-001, CC-004] setup_seconds: 45 - id: D-003 name: The Two Hasps atoms: [A5] materials: a box with two hasps action: "Wire it so it is safer." state_space: {both-must-open, either-opens} feasible_set: the two composition rules readout: builds_both_must_open: block-on-any — the rule this site's arithmetic assumes builds_either_opens: has composed for availability, not for blocking asks_safer_against_what: holds A5 already cannot_show: any rate, and nothing about routing order note: > Two locks was REJECTED as a metaphor for the Fréchet episode because it imports series composition. Here that import is the lesson. Same object, wrong for A2, right for A5. rung: unaudited rung_projected: FAITHFUL setup_seconds: 20 - id: D-004 name: The Sorting Line atoms: [A3] priority: highest — this is the top underdog made physical materials: 20 objects in size order, two rulers action: "Lay your ruler. Now: which detector is better?" state_space: all monotone thresholds on the ordering feasible_set: the operating-point family of a score-based detector faithfulness_note: > Reachable ruler positions are exactly the monotone thresholds. Two rulers on one identical population give two different catch rates, which is the whole of A3 in one movement. readout: compares_without_aligning: the unmatched-threshold bug, in their hands aligns_rulers_first: holds A3 asks_what_counts_as_caught: holds A3 and reaches A5 census_extension: > Twenty copies of the line, twenty rulers, none at the same position, none written down. That is MC-001's 0 of 20, physically. cannot_show: overlap between the two detectors; use D-002 for that rung: unaudited rung_projected: FAITHFUL binds: [MC-001] setup_seconds: 30 - id: D-005 name: The Second Reader atoms: [A4] materials: one page of text, two readers, a blank slip action: > Run twice. Both read the whole page. Then hand reader B only the lines A marked — a physical slip, not the page. state_space: {whole page handed over, slip handed over} feasible_set: {full exposure, routed} faithfulness_note: the artifact handed over IS the exposure regime readout: computes_static_or_after_slip: applies full-exposure arithmetic to a route says_routed_is_same_but_cheaper: has not seen that the question changed refuses_to_compute_after_slip: holds A4 cannot_show: adaptive attackers; the page does not change under observation rung: unaudited rung_projected: FAITHFUL setup_seconds: 60 - id: D-006 name: The Sudoku Cell atoms: [A7] priority: widest doorway in the program materials: a 4x4 Latin-square fragment leaving one cell with exactly 3 legal values action: "Write the answer for the shaded cell." state_space: the legal values of the cell under the givens feasible_set: the same, by constraint propagation readout: writes_three_values_calmly: already holds A7 and does not know it has a name writes_one_value: point-estimate reflex — picked inside the set says_not_enough_information: reads a set as a failure rather than an answer doorway_note: > Millions of people have narrowed a cell to a short list and never once felt that a three-value answer was a failure to answer. MC-003's {0/82 ... 12/82} is a cell narrowed to thirteen legal values, with 9 inside it. cannot_show: > Sudoku has a unique global solution and this problem does not. Say so, or the device teaches that more evidence always resolves to a point. rung: unaudited rung_projected: FAITHFUL binds: [MC-003] non_claims: # carried verbatim from claims.yaml:MC-003 (S3 of spine.yaml) - "no new mathematics is claimed; the bounds are Fréchet's and the lower endpoint is Bonferroni's" - "not a claim that guardrails in general fail together — this stratum cannot separate shared blind spots from prompt-difficulty heterogeneity" - "not a vendor evaluation; the released verdicts are at unstated default configurations, and one supervisor fires exactly once in the 170 released rows" - "the identified interval is what the marginals leave open, not a prediction about any deployed stack" - "leave-one-out unions identify only exclusive full-stack coverage; they do not identify pairwise or higher-order overlap, Shapley values, or causal contribution" - "says nothing about adversarial prompts, which dominate the full evaluation and have no per-item release" setup_seconds: 40 - id: D-007 name: The Bead Cube atoms: [A9] materials: a transparent 2x2x2 box, 8 cells, 4 beads action: > Fill cells 000, 011, 101, 110. Look at all three faces. Now empty it and fill 001, 010, 100, 111. Look at all three faces again. state_space: the two parity arrangements feasible_set: the CC-003 construction exactly — not an analogy for it faithfulness_note: > Every face shows the same 2x2 shadow in both arrangements: singles match, every pair matches. The far corner 111 holds a bead in one arrangement and not the other. Zero versus one quarter, at a corner you can point at. readout: checks_faces_then_stops: believes pairwise agreement closes it finds_the_corner: holds A9 predicts_corner_before_looking: holds A9 and can generalise cannot_show: > how large the gap is in practice. Both arrangements are constructed. This is a possibility proof and must be said out loud as one. rung: unaudited rung_projected: FAITHFUL binds: [CC-003] setup_seconds: 60 - id: D-008 name: The Double-Marked Cards atoms: [A8] materials: 30 cards, two markers action: "Each reader marks the ones they missed. Now make two piles." state_space: subsets by mark multiplicity feasible_set: the same readout: builds_union_pile_only: hears success, not residual risk builds_every-mark_pile: holds A8 notices_the_piles_differ_in_size: holds A8 and reaches the leave-one-out question cannot_show: anything about why the marks fell where they did rung: unaudited rung_projected: FAITHFUL binds: [MC-002, MC-003] setup_seconds: 90 - id: D-009 name: The Sealed Envelope atoms: [A10] materials: an envelope, a pen, a date action: > Write what would make you wrong. Seal it. Date it. Leave it visible. Run the count. Then write the same condition after seeing the result and notice how much easier it is. state_space: not configurational — temporal feasible_set: not defined for this device rung: ILLUSTRATIVE rung_projected: ILLUSTRATIVE rung_reason: > N2 is not merely failed, it is undefined: there is no configuration space. Recorded at the lower rung rather than argued up. If every device came out FAITHFUL the ladder would be decoration. binds: [MC-001] setup_seconds: 20 - id: D-010 name: The Five Receipts atoms: [A1] materials: five receipts, one dinner, five totals action: > Find the smallest whole number of diners that makes every per-person share a whole number of cents. state_space: candidate diner counts tried feasible_set: denominators consistent with the printed totals rung: ILLUSTRATIVE rung_projected: ILLUSTRATIVE rung_reason: > Teaches the recovery trick honestly, but the reachable space is not the feasible space of denominators. Does not clear N2. Do not argue it up. binds: ["ARTIFACTS/2026-09-05-FABLE-5.1-OBS-CUT.md"] setup_seconds: 45 # L7: every device needs a route with the same readout for a learner who # cannot manipulate the object, or an explicit statement of who it excludes. # L9: an audit expires when a bound claim transitions. # Section 11: state-space size is what makes an executable audit possible. equivalent_paths: D-001: keyboard — choose a denominator, the count is read aloud with it D-002: keyboard — a slider over overlap 0..10; same readout, same wrong states D-003: keyboard — two radio buttons naming the two rules D-004: keyboard — a threshold slider over a stated ordering; both rulers alignable D-005: text — the handed artifact is named in words before any arithmetic D-006: text — the cell's legal values typed as a list D-007: text — occupied corners, pair-bin occupancy, and far-corner mass are named beside rendered projections. This candidate route has not been tested for equivalence with non-sighted learners. D-008: keyboard — mark-multiplicity counts entered directly D-009: text — write, timestamp, then write again after the result D-010: keyboard — candidate denominators tried against the printed totals audit_state_space: D-002: 11 states (overlap 0..10) — enumerable D-006: 3 values — enumerable D-007: 70 arrangements (8 choose 4), 2 of which are the parity sets — enumerable D-004: monotone thresholds on 20 objects = 21 cut points — enumerable D-003: 2 — enumerable D-005: 2 — enumerable D-001: unbounded without a stated marble budget — bound it before auditing D-008: 2^k mark patterns — enumerable for small k D-009: not configurational — no audit script possible D-010: candidate denominators up to a stated ceiling — enumerable audit_freshness: rule: an audit expires when any claim in the device's `binds` list transitions review_window_days: 180 last_audited: none non_claims: - No device here has taught anyone anything. Zero learners. - Clearing N1-N6 is a claim about the object, not evidence anyone learns from it. - Physical construction is unverified; bounded digital models now have generated nodes and meshes. - Registry rungs are unchanged. Digital model checks remain SELF-AUDITED, not independent physical audits. - The pedagogy citations in PROGRAM.md section 1 are remembered, not reopened. - Zero devices are independently audited. The section 10 audit removed the only FAITHFUL rung in this file, which is the correct outcome. - The executable audit covers the stated finite digital models only; it does not certify every criterion. - A machine-checked faithfulness proof would be a statement about the object, never evidence that a learner understood it. - D-007 has a text occupancy readout, but equivalence for non-sighted learners has not been user-tested. # Generated pages consume these authored source records. room_atom_map: Camera_Arrival: room: 01_ArrivalHall atoms: [] concepts: [] status: unmapped reason: No atom binding has been established; intentionally unmapped. Camera_ClaimCapsule: room: 02_ClaimCapsuleChamber atoms: [] concepts: [] status: unmapped reason: No atom binding has been established; intentionally unmapped. Camera_EvidenceVault: room: 03_EvidenceVault atoms: [] concepts: [] status: unmapped reason: No atom binding has been established; intentionally unmapped. Camera_SupportGraphOrrery: room: 04_SupportGraphOrrery atoms: [] concepts: [] status: unmapped reason: No atom binding has been established; intentionally unmapped. Camera_NonClaimsWall: room: 05_NonClaimsWall atoms: - A10 concepts: [] status: mapped reason: Carrying capacity proposed; this is not an audited teaching outcome. Camera_DecayClockRoom: room: 06_DecayClockRoom atoms: [] concepts: - claim_freshness status: concept_only reason: Freshness is a claim lifecycle concept, not an atom in this registry. Camera_ChallengeRange: room: 07_ChallengeRange atoms: - A10 concepts: - falsifiers status: mapped reason: Carrying capacity proposed; this is not an audited teaching outcome. Camera_ReplayManifestEngine: room: 08_ReplayManifestEngine atoms: [] concepts: [] status: unmapped reason: No atom binding has been established; intentionally unmapped. Camera_HumanReviewTribunal: room: 09_HumanReviewTribunal atoms: [] concepts: [] status: unmapped reason: No atom binding has been established; intentionally unmapped. Camera_LedgerTower: room: 10_LedgerTower atoms: [] concepts: [] status: unmapped reason: No atom binding has been established; intentionally unmapped. Camera_FrechetAtomGarden: room: 11_FrechetAtomGarden atoms: - A2 - A6 - A7 concepts: [] status: mapped reason: Carrying capacity proposed; this is not an audited teaching outcome. Camera_WorldHero: room: 00_WorldRoot atoms: [] concepts: [] status: unmapped reason: No atom binding has been established; intentionally unmapped. web_nodes: D-001: claim: CC-001 question: What must travel with the red count? options: - label: The color alone readout: Color does not identify the population. excluded_world: A jar with the same red count and a larger total is left out. skip_repair: false - label: The red count alone readout: The count has lost its denominator. excluded_world: A jar with the same red count and a smaller total is left out. skip_repair: false - label: The total as well readout: Keep the numerator attached to its population. excluded_world: A jar with a different denominator is excluded from this rate comparison. skip_repair: true - label: The jar shape readout: Shape supplies no population count. excluded_world: A differently shaped jar with the same contents is left out. skip_repair: false D-002: claim: CC-001 question: Do the miss rates tell you how to stack the misses? options: - label: Yes, overlap them completely readout: That selects the coincident-miss endpoint. excluded_world: A world in which the miss sets are disjoint is left out. skip_repair: false - label: Yes, assume unrelated misses readout: That selects an independence model. excluded_world: A world in which both miss sets coincide is left out. skip_repair: false - label: No, keep every permitted overlap readout: Keep the set instead of selecting an interior point. excluded_world: An overlap larger than either miss set is excluded by these marginals. skip_repair: true - label: Yes, add the miss counts readout: Adding counts is a union operation without the overlap subtraction. excluded_world: A world in which the same item belongs to both miss sets is left out. skip_repair: false D-003: claim: CC-001 question: What has to be named before “safer” has a meaning? options: - label: Only the number of hasps readout: Counting hasps does not specify how they compose. excluded_world: A box that opens when either hasp opens is left out. skip_repair: false - label: The composition rule and objective readout: Blocking and availability can call for different rules. excluded_world: A box evaluated under a different opening rule is excluded from this comparison. skip_repair: true - label: Both must always open readout: That selects conjunction before naming the objective. excluded_world: A box intended to open when either hasp opens is left out. skip_repair: false - label: Either must always open readout: That selects disjunction before naming the objective. excluded_world: A box intended to require both hasps is left out. skip_repair: false D-004: claim: MC-001 question: What must match before you compare the rulers? options: - label: Their color readout: Color does not specify the decision boundary. excluded_world: An identical population cut at another threshold is left out. skip_repair: false - label: Their operating threshold and population readout: Align the operating point before comparing decisions. excluded_world: A comparison using a different population or cut is excluded. skip_repair: true - label: Only the population readout: A shared ordering still permits different cut points. excluded_world: The same population with the ruler at the opposite end is left out. skip_repair: false - label: Only the detector name readout: A name does not identify the operating point. excluded_world: The same named detector used at another threshold is left out. skip_repair: false D-005: claim: CC-001 question: Can you reuse full-exposure arithmetic after handing over the slip? options: - label: Yes, the readers are unchanged readout: The readers stayed; exposure changed. excluded_world: A route in which the second reader never sees an unmarked line is left out. skip_repair: false - label: Yes, it is merely cheaper readout: The handoff changes the observations available. excluded_world: A harmful line omitted from the slip is left out. skip_repair: false - label: No, first name the routed estimand readout: Keep the regime attached to the arithmetic. excluded_world: A full-page world is excluded from this routed receipt. skip_repair: true - label: No combination can ever be studied readout: A changed estimand can still be measured under a stated protocol. excluded_world: A route with recorded handoffs and outcomes is left out. skip_repair: false D-006: claim: MC-003 question: When several cell values remain legal, what is the answer? options: - label: Pick one silently readout: That selects a value the local constraints do not select. excluded_world: A completion using another locally permitted symbol is left out. skip_repair: false - label: Report the entire permitted set readout: The constraints identify a set here. excluded_world: A cell value already excluded by the row is left out. skip_repair: true - label: There is no answer readout: A set can be an answer to this question. excluded_world: A locally legal completion is left out when the whole set is discarded. skip_repair: false - label: More evidence must force uniqueness readout: Uniqueness is an extra condition, not a promise of this device. excluded_world: A constraint system that still permits alternative completions is left out. skip_repair: false D-007: claim: CC-003 question: If every face agrees, must the far corner agree? options: - label: Yes, the faces determine everything readout: Pairwise projections do not determine joint corner occupancy. excluded_world: The odd-parity world has the same faces and an occupied far corner; it is left out. skip_repair: false - label: No, inspect the corner as well readout: Keep the triple readout alongside the matching pairs. excluded_world: An arrangement with unequal pair shadows is excluded from this construction. skip_repair: true - label: Only if the beads look alike readout: Matching appearance does not add a joint constraint. excluded_world: The alternate parity world made from identical beads is left out. skip_repair: false - label: The example measures a typical gap readout: This is a constructed possibility proof. excluded_world: An observed system with a different joint distribution is left out. skip_repair: false D-008: claim: MC-003 question: Which pile represents items missed by every reader? options: - label: Any item with a mark readout: That builds the union of misses. excluded_world: An item marked by only one reader is included even though it is excluded from all-miss. skip_repair: false - label: Only items carrying every mark readout: Read the intersection of miss sets. excluded_world: An item missed by one reader and caught by another is excluded from all-miss. skip_repair: true - label: Only unmarked items readout: That selects items nobody marked as missed. excluded_world: An item missed by every reader is left out. skip_repair: false - label: The complement of any named good pile readout: The meaning of good must be specified first. excluded_world: An item missed by one reader but caught by another is left out of that shortcut. skip_repair: false D-009: claim: MC-001 question: When must the falsifier be written? options: - label: After seeing the outcome readout: That permits the rule to adapt to the result. excluded_world: A prior condition that this outcome would have refuted is left out. skip_repair: false - label: Before seeing the outcome readout: Keep the pre-outcome condition available for comparison. excluded_world: A condition rewritten to accommodate the observed result is excluded. skip_repair: true - label: Only when a result is inconvenient readout: That makes the check depend on convenience. excluded_world: A convenient result that violates the prior condition is left out. skip_repair: false - label: Sealing alone verifies the claim readout: The envelope preserves a condition, not its truth. excluded_world: A sealed prediction contradicted by the outcome is left out. skip_repair: false D-010: claim: CC-001 question: What does a compatible denominator establish? options: - label: The actual number of diners readout: Compatibility does not identify the actual event. excluded_world: Another divisor shared by all printed totals is left out. skip_repair: false - label: Compatibility under the stated cents rule readout: Keep the arithmetic condition attached to the candidate. excluded_world: A candidate that leaves a fractional-cent share is excluded. skip_repair: true - label: Every attempted candidate is feasible readout: Trying a count does not satisfy divisibility. excluded_world: A candidate leaving a remainder is included despite being excluded by the cents rule. skip_repair: false - label: A performance ranking readout: Divisibility contains no performance observation. excluded_world: A dinner with the same totals and different service is left out. skip_repair: false web_scope: non_claims: - These are self-audited digital models, not independently verified physical devices. - No learner efficacy, transfer, accessibility equivalence, or vendor performance has been measured. - Unbounded and temporal devices remain text exercises; no faithful state machine is asserted for them. - The receipt exercise has no supplied totals or ceiling, so it supports no computed denominator here. world_locator: films/lib/blender/API-FACTS.md:The world file