2026-09-16-noncapture-compilation

2026-09-16 · project deference · path projects/deference/rounds/2026-09-16-noncapture-compilation

Verdict CORRIGIBILITY-NUCLEUS-CANONICALIZED-AND-LANDED — the combined authority and non-capture theorem is the canonical result: on the authority side the corrigibilization transform, event-linked authorization, the directional activation mismatch and the compiled inequality Logical Induction learns uniformly over polynomial-size efficiently generated menus; on the deliberative side the trace-steering inequality with its content, form and audit-mismatch residuals, the suffix-cut service obstruction, the information-cell discovery obstruction in its general best-response form for every extensional program with the antitone case as its corollary, and the composed bound E_n(U_T) − E_n(U_full) ≲ A_tot·(α + β) through the discovered comparator; the residuals are explicit and independently characterized, the hypotheses are named as logical, architectural, representation and causal-contract classes, and what remains open is the adequacy and evolution of the interfaces that supply the theorem rather than another corrigibility mechanism.

Prompt prompts/2026-09-16-noncapture-compilation/PROMPT.md

Work in A-M-Berns/alignment-workspace.

This dispatch has two sequential phases.

**Finish the current corrigibility nucleus on PR #100, adjudicate it, update the canonical repository state, and merge it to main.**
**Only after #100 is merged, branch fresh from the resulting main and do a new theorem-discovery / pressure round as PR #101 on the manipulation/non-capture side of corrigibility.**

Do not mix the two phases into one branch. The point is to establish a clean stopping point for the effect-side / deference-side theorem before opening the next research question.

PHASE I — FINISH THE FIRST BET AND MERGE PR #100

PR #100 is:

Logical Induction learns the corrigibility inequality: directional mismatch, gated-LUV compilation, EPI instantiation, finite-menu uniformity

Branch:

round/2026-09-15-li-corrigibility

The current research verdict is strong, but the branch deliberately stopped short of a fully landed canonical theorem.

Your job is now to **close the remaining formalization and specification obligations sufficiently to make T1–T3′ a clean, self-contained corrigibility nucleus on main.**

1. Re-read and adjudicate #100

Read the entire actual branch, especially:

REPORT.md
THEOREM.md
LI_CORRIGIBILITY.md
LUV_COMPILATION.md
UNSEALED_COMPARISON.md
FEEDBACK_BOUNDARY.md
COUNTERMODELS.md
lean/Workspace/Deference/Contrib/LICorrigibility.lean

Also read the canonical post-#99 wiki and theorem spine before editing them.

Do not merely trust the #100 verdict. Pressure-check the final theorem statements again before promoting them.

The intended canonical mathematical nucleus is approximately:

T1 — Corrigibilization preserves principal options

Under effect completeness and faithful mediation:

every raw continuation has a corrigibilized counterpart 𝔠π;
𝔠π is structurally corrigible;
𝔠 is idempotent;
raw behavior is retained as the approve branch;
principal forcing is exactly preserved under exact approval reproduction;
protected value is preserved up to the explicit mediation discrepancy: W_opt(𝔠π) ≥ W_h(π) − L·E[δ];
under the actual principal rule: W_h(π) ≤ W_h(𝔠π;ρ) + L·E[δ] + E[ρ].

T2 — Directional activation mismatch

For raw and corrigibilized activation events:

M := c_raw ∧ ¬c_corr

and, under the appropriate common-branch reproduction and regret hypotheses,

E[U_raw] − E[U_corr] ≤ L·E[both·δ] + E[both·ρ] + D·E[M].

The D coefficient is sharp.

The reverse mismatch is not charged.

The difference of marginal activation rates is not a valid substitute.

Perfect sealing is the zero-mismatch case M ≡ 0.

T3 — Logical Induction learns the structural corrigibility inequality

Compile the structural relation into

B_n := U_raw,n − U_corr,n − λG_δ,n − G_ρ,n − G_M,n

with gated quantities represented as individual bounded LUVs.

W(B_n) ≤ 0

for every W ∈ PC(Γ), and the sequence satisfies the actual BLCS / P-generability hypotheses, then Expectation Provability Induction gives

E_n(U_raw,n) − E_n(U_corr,n) ≲_n L·E_n(Δ_n) + E_n(R_n) + D·E_n(M_n).

There is no external calibration term.

T3′ — Uniformity over polynomial-size efficient menus

For a polynomial-size efficiently generated menu Q_n, the LI cannot assign any candidate in the menu an asymptotically positive unexplained bypass advantage.

The hard argmax is inadmissible; use the continuous near-max / soft weighting construction.

The final statement should be approximately:

max_{q∈Q_n} [ E_n(U_q) − E_n(U_𝔠q) − L E_n(Δ_q) − E_n(R_q) − D E_n(M_q) ] ≲_n 0.

Use a distinct symbol such as τ_n for the soft near-max width. Do not overload δ, which is already the mediation discrepancy.

Be precise that the menu is polynomial-size and efficiently generated. Do not casually say “all efficiently enumerable continuations.”

2. Close the `P`-generability / compiler hypothesis as far as the pinned formalization allows

This is the highest-priority technical residual from #100.

The existing li_bypass_le takes operational assumptions such as:

LUVCombination.BoundedSequence;
MeshSoftmaxOperationalWitness;
RpnThresholdCodes;
the relevant threshold/serialization machinery.

The round argues at paper level that the compiled mediated pair is P-generable, but does not build the actual pinned-interface certificate.

Try to construct that certificate.

Specifically:

Build a concrete generated family for the five LUV templates:

U_raw;
U_corr;
G_δ;
G_ρ;
G_M.

Show the sequence is emitted in polynomial time from:

the code of π_n;
the syntactic corrigibilization 𝔠π_n;
activation predicates;
the finite horizon / occurrence code;
the relevant fixed architecture templates.

Construct the PolySequence / RpnSpliceStream / threshold-code evidence required by the pinned library.

For T3′, either:

construct the corresponding generability certificate for the soft near-max weighting over polynomial-size menus; or
if that is substantially more machinery, fully close T3 first and state precisely what remains for T3′.

Do not call this solved if the Lean theorem still takes the exact target certificate as a named assumption.

If there is a genuine obstruction in the pinned library rather than mere labor, isolate it sharply.

3. Mechanize the trajectory-level corrigibility theorem

The current structural result has a Lean step lemma but only fixture-level trajectory support.

Finish the trajectory predicate sufficiently to state the actual structural theorem:

∀ π ∈ Π(h), Corrigible_h(𝔠π,ρ).

Use the corrected authorization semantics.

Authorization correction

The old clause:

an alternative decision would avoid the loss at time t or any later loss of the same concern

is refuted by the repeated-effect ShopRepair fixture.

Replace it canonically.

But pressure whether the best formulation is merely:

the alternative avoids this loss at time t

or the more precise event/effect-linked form:

each agent-caused protected-loss event is authorized by the principal decision whose approval enabled the declared protected effect responsible for that event, and the decline alternative prevents that event.

Prefer the stronger event-linked typing if it composes cleanly.

The intended notion should:

handle repeated protected effects independently;
prevent “some unrelated prior decision happened to avoid this loss” from counting as authorization;
preserve the local loss_conditional_on_decision proof;
agree with the old clause on the single-effect fixtures;
count approved irreversible successor installation as authorized;
not count principal-caused shutdown or exterior-caused loss as an agent violation.

Update the old September 9 canonical description rather than leaving two incompatible definitions live.

4. Canonicalize the result in the wiki

Once the theorem has survived the final pass, update at least:

wiki/Corrigibility.md
wiki/Theorem-Spine.md
wiki/Deference.md if necessary
wiki/Logical-Induction-and-Deference.md if necessary
wiki/Roadmap.md
relevant glossary entries

The Corrigibility page should now make T1–T3′ the main mathematical spine.

The conceptual story should be:

Corrigibilization converts unilateral protected effects into principal-mediated options while retaining the useful raw behavior as the approve branch. The explicit cost is mediation discrepancy, principal decline regret, and directional causal leverage over whether the comparison is evaluated. These quantities compile into a structural LUV inequality. Logical Induction learns that inequality directly by Expectation Provability Induction, uniformly over polynomial-size efficient menus, without an external calibration hypothesis.

Keep separate:

structural corrigibility;
LI's learned score inequality;
actual smallness of δ, ρ, and M;
manipulation/authorship;
latent utility;
empirical settlement.

T4 / feedback should be presented as a boundary or extension, not as the centerpiece.

5. Split the current item-90 residual if appropriate

The current item 90 combines:

the concrete P-generability certificate for the main T3 theorem;
oracle-relativized Logical Induction for genuinely empirical observation streams.

These have very different priority and mathematical character.

If the compiler certificate is closed here, close/narrow that half.

If oracle-relative LI remains open, give it its own clearly named residual rather than making the main corrigibility theorem appear unfinished because of an optional feedback extension.

Do not spend this phase developing oracle-relative LI unless it becomes unexpectedly necessary for T1–T3′.

6. Verification and merge

Before merging #100:

run the full root test suite;
run all #100 exact fixtures;
run all relevant corrigibility fixtures;
run lake build;
run the full axiom audit;
run python3 -m checkers.run;
name lint;
dead/untracked pointer checks;
wiki links;
wiki/state bindings;
workspace state check;
round-record checks;
DCO;
conservativity / Lean-scope checks expected for a canonical landing.

Update:

DECISIONS.md
PRIORITIES.md
PROVENANCE.md
contrib provenance
state/rounds.json
state views
claims registry only where the result now genuinely satisfies the repo's registration discipline.

Do not register a theorem against a priority whose key hypothesis it still assumes.

Then **merge PR #100 into main** with the repository-appropriate merge method. Preserve commit reachability if canonical pages cite round commits.

PR #100 should finish as a landed research state, not remain an open research branch.

Write a short final landing report answering:

What exactly is now the strongest proved corrigibility theorem?
Which part is structural and which part is contributed by Logical Induction?
Is T3 mechanized end-to-end through the P-generability certificate?
What is the precise menu-uniformity theorem?
What does the mismatch term measure?
What makes the RHS small?
What remains outside the theorem?
Why is manipulation/authorship explicitly not solved?

Only after this merge is complete proceed to Phase II.

PHASE II — CREATE PR #101 AND PRESS ON NON-CAPTURE / REASON-INTERFACE CORRIGIBILITY

Branch **fresh from the updated main after #100**.

Create a new research branch and eventually PR #101.

This is a theorem-discovery and falsification round.

Do not assume the proposed symmetry between effects and reasons is correct.

The broad question is:

Can the manipulation/non-capture side of corrigibility be given the same mathematical form as the causal-bypass side: a structural inequality over a declared interface, with an explicit residual term for undetected steering, which Logical Induction learns by EPI?

There are two nested bets.

BET 2 — NON-CAPTURE COMPILATION

The first new research target is relatively conservative.

The recent legitimate-deference stack gives:

an authenticated reason trace;
a principal program committed at issuance;
re-execution of that program at commitment;
reason-mediated authorship;
scoped Robust Openness;
a protected reason-coverage barrier;
Corrigible ∧ ¬Authored as an explicit existing possibility.

Try to derive an analogue of T2/T3 for trace steering.

7. Define the comparison cleanly

Let:

T be the trace actually supplied to the committed principal program;
π_P be the committed principal program;
V(T) := π_P(T);
N(T) or an equivalent construction be the authored / normalized trace comparator.

Do not assume N exists canonically.

The central conceptual difficulty of this round is to determine what such a comparator can legitimately mean.

Candidate interpretation:

N(T) removes or neutralizes a specified class of agent-controlled trace interventions while retaining legitimate reason content.

Possible intervention classes include:

omission;
insertion;
reordering;
duplication;
side-channel metadata;
framing;
selective timing;
suppression/delay;
tampering with grounds/references;
influencing which true reasons become available.

Define an event roughly like:

S := steering occurred ∧ non-capture / RO audit nevertheless passed.

Call it provisionally undetected steering.

But do not commit to this exact predicate until it survives pressure.

8. Search for the manipulation analogue of T2

Try to prove a pointwise decomposition / bound of the form:

`U_steered − U_authored ≤ explicit normalization discrepancy

explicit principal/evaluation discrepancy
D * S`

or whatever the exact correct directional inequality is.

As in PR #100:

derive the exact identity first;
distinguish directional from symmetric mismatch;
identify which branch can actually favor steering;
prove the sharp coefficient if one exists;
do not hide an uncontrolled counterfactual in a definition.

If the relation is valid in every consistent world and compiles to a bounded LUV combination, instantiate EPI exactly as in T3.

Target conclusion:

the logical inductor assigns no unexplained advantage to steering the principal's trace beyond explicit normalization cost and the mass of undetected steering.

If this works, determine whether the finite-menu soft-uniformization transfers essentially unchanged.

9. Pressure whether Robust Openness becomes `Γ`-valid

There is a particularly promising candidate result from the recent committed-program architecture.

Scope interventions to edits of the agent-controlled portion of the trace.

Because π_P is committed, each counterfactual intervention can in principle be evaluated by re-executing the same committed program on the modified trace.

Ask whether scoped Robust Openness / non-capture over a finite declared intervention class becomes a finite family of computations and hence a Γ-valid predicate.

If yes, prove the clean theorem.

If no, identify exactly why:

intervention class not finite?
counterfactual environment dependence?
the principal program's output is not enough?
reason truth itself depends on the intervention?
the trace does not contain enough semantics?
intervention changes future reason generation rather than only the trace?

This is one of the main make-or-break questions.

BET 3 — DOES MANIPULATION REDUCE TO A COMPLETE REASON INTERFACE?

This is the more speculative part.

The proposed symmetry is:

Effect side

effect completeness + mediation

turns causal bypass into an explicit residual inequality.

Reason side

perhaps:

reason-interface completeness + canonical representation + coverage/liveness

turns manipulation into an explicit residual inequality.

Do not protect this thesis.

Try hard to refute it.

10. Do NOT define reason completeness as “all relevant reasons are enumerated”

That is probably much too strong and perhaps incoherent.

Instead investigate a causal interface-completeness condition:

Every agent-controlled causal influence on the protected principal decision that is in scope factors through a declared trace/reason interface, and every output-relevant omission or modification through that interface is represented as a protected concern.

Possible formal shape:

If an intervention on the agent-controlled part of the interaction changes the principal's protected committed value,

V(T) ≠ V(T'),

then some declared trace coordinate / reason concern witnesses the difference.

Or more structurally:

agent-controlled influence on principal output factors as

agent intervention -> declared reason-interface state -> principal program.

Compare directly with effect completeness:

agent-caused authority loss -> declared effect interface.

Determine whether this is actually the correct analogue.

11. Add canonicalization/extensionality as a separate hypothesis

Even with all reasons present, manipulation may occur through:

ordering;
duplication;
formatting;
salience;
irrelevant framing;
metadata.

Investigate whether the principal program must factor through a canonical semantic representation:

Trace -> CanonicalReasonState -> Value

such that syntactic variants carrying the same declared reason content give the same principal output.

Pressure-test whether this is:

sufficient;
necessary;
too strong;
naturally provided by the committed-program setup;
part of authorship;
or a genuinely new interface assumption.

Keep this separate from coverage/liveness.

12. Connect coverage and affordability

If a relevant counterreason exists in the declared interface, the agent should not be able to suppress it forever merely by flooding or selective scheduling.

This is where the legitimacy/normativity line should become a supplier.

Investigate a decomposition along the lines:

undetected-steering mass ≤ interface-incompleteness mass + uncovered-reason mass + service/liveness failure mass + representation/canonicalization failure mass.

Do not assume that exact additive form.

But try to identify the cleanest theorem interface.

Connect explicitly to:

the protected reason-coverage barrier;
defeat / counterreason structure;
reason-supply liveness;
the affordability/underwriting theory;
settlement / authentication;
answerability if relevant.

The goal is for the consumer theorem to tell the normativity agenda exactly which quantities it must make small.

13. Build adversarial fixtures before general theory

At minimum construct exact small models for:

omission of a relevant counterreason;
truthful cherry-picking;
all reasons present but adversarial ordering;
duplicate/salience attack;
framing metadata attack;
agent changes the world so a different set of reasons becomes true;
reason outside the declared interface;
finite interface but insufficient semantic granularity;
complete declared reasons but service capacity delays one past commitment;
Robust Openness holds at every snapshot but the reason is never exercised;
canonicalization removes the attack;
authenticated false reason;
authenticated true but misleadingly selective reason;
agent controls which inquiry is asked;
principal program itself is manipulable despite trace completeness;
intervention changes reason-generation dynamics rather than just the final trace.

For each attack, state exactly which proposed hypothesis fails.

Look especially for a fixture where:

interface completeness;
authentication;
canonicalization;
coverage;
liveness

all appear to hold but steering remains.

If such a fixture exists, the “two complete interfaces” thesis is false or missing a hypothesis.

That is a valuable outcome.

14. Test the strong symmetry thesis

The strongest candidate thesis is something like:

Corrigibility has two interface-completeness halves.

On the causal side, every protected authority-changing influence must pass through a declared effect interface, after which mediation turns unilateral execution into principal authority.

On the deliberative side, every agent-controlled influence on the protected principal judgment must pass through a declared, authenticated, canonical reason interface, after which coverage and liveness prevent selective suppression.

In both cases, the remaining failure is an explicit residual mass, and Logical Induction learns that there is no further advantage beyond that residual.

Try to formalize enough of this to determine whether it is actually true.

Do not present it as the round's conclusion merely because it is elegant.

A good negative result would be:

effect completeness has no reason-side analogue this strong because reason relevance cannot be finitely/interface-locally characterized.

A good positive result would identify the exact reason-side analogue.

15. Explore measurable residuals

One important downstream motivation is that the theory may name quantities measurable in a constructed real system without optimizing directly for a vague "corrigibility score."

Candidates:

directional activation mismatch mass E[M];
undetected-steering mass E[S];
uncovered-reason mass;
service/liveness failure mass;
mediation discrepancy;
representation/canonicalization failures.

Investigate whether each is operationally observable/auditable under the declared interface.

Be precise about which require counterfactual access and therefore are not directly measurable.

The conceptual systems-facing claim, if supported, is:

measure the failure quantities named by the theorem rather than iteratively optimize whether an agent appears corrigible.

Do not overstate this if the quantities themselves require inaccessible counterfactuals.

PR #101 OUTPUT

Create a dedicated round, with at least:

REPORT.md
THEOREM_CANDIDATES.md
NONCAPTURE_COMPILATION.md
REASON_INTERFACE.md
COUNTERMODELS.md
LI_TRANSFER.md
AFFORDABILITY_INTERFACE.md
FOR_HUMANS.md

and Lean / exact fixtures where justified.

The final report should answer:

Is there a clean trace-steering analogue of T2?
Does it compile into a bounded LUV inequality?
Does EPI transfer essentially unchanged?
What is the exact definition of undetected steering?
Can scoped Robust Openness be made Γ-valid by committed-program re-execution?
What intervention class is required?
Is there a genuine analogue of effect completeness for reasons?
Does reason-interface completeness need finiteness?
Is canonicalization/extensionality independently necessary?
Are coverage and liveness sufficient to eliminate truthful selective steering?
How does affordability enter?
Which manipulation modes remain after all proposed hypotheses?
Can the remaining failure be summarized by one quantitative residual?
Which residual quantities are actually measurable?
Does the “two interfaces” thesis survive?
If not, what is the minimal counterexample?

End with one of three verdicts:

A. TWO-INTERFACE-CORRIGIBILITY-SURVIVES

There is a precise effect/reason symmetry with learnable residual inequalities.

B. NONCAPTURE-COMPILES-BUT-REASON-COMPLETENESS-FAILS

The steering inequality works, but the residual cannot be reduced to completeness + liveness of a declared reason interface.

C. NONCAPTURE-DOES-NOT-COMPILE

There is a more fundamental obstruction; identify it exactly.

Do not update the canonical wiki with Phase II's speculative conclusions unless the result becomes mature enough to justify it. PR #101 should primarily be a research branch with a verification register and pressure-tested theorem candidates.

The crucial sequencing requirement is:

**Finish, canonicalize, verify, and merge #100 first. Then branch PR #101 from that new main.**

Second dispatch — refinement and pressure pass (2026-09-16)

Continue work on PR #101 / branch:

round/2026-09-16-noncapture-compilation

in A-M-Berns/alignment-workspace.

This is a refinement and pressure pass on the existing PR, not a fresh broad research round.

The first pass has already established the important shape:

trace steering admits the same directional algebra as effect-side bypass;
the steering comparison compiles into the landed corrigibility ValidAt package;
Logical Induction learns the steering inequality by the existing EPI theorem;
form steering is eliminated by extensional/canonical principal programs;
audit mismatch is the directional activation term;
the naive claim that reason-interface completeness + coverage/liveness eliminates content steering is false;
the minimal counterexample is truthful omission of a true declared but unprotected counterreason;
unlike effect mediation, omitted content cannot be restored by rewriting the advisor's own output.

Treat those conclusions as the current research state unless this pass finds a genuine error.

The central question for this refinement is now:

What exact reason-supply / affordability theorem is sufficient to make the content-steering term small, and therefore turn the PR #101 steering inequality into an actual non-capture/corrigibility theorem rather than merely a decomposition?

Do not broaden the ontology or invent another definition of corrigibility unless forced.

1. Start from the surviving steering inequality

Use the strongest current form, approximately:

`E_n(U_steered) − E_n(U_comparator) ≲_n L·E_n[both·d_content]

E_n[both·κ_form]
D·E_n(M_audit)`.

Under an extensional principal program:

κ_form = 0.

Under a sufficiently sealed / symmetric audit architecture:

M_audit is zero or separately small.

So the central residual is:

E_n[both·d_content].

The entire purpose of this pass is to understand when and why that term is small.

Do not merely rename it "liveness."

2. Define the service problem precisely

At each evaluation occurrence n, define a declared reason interface I_n.

For each reason r ∈ I_n, distinguish at least:

whether r is true/relevant in the current world;
whether it is protected by the coverage barrier;
whether a route exists to submit it;
whether it is actually supplied before commitment;
whether it is authenticated;
its contribution/sensitivity to the principal program;
the resource cost of discovering/authenticating/routing it before the deadline.

The supplier must not simply be the strategic advisor whose selective disclosure is under analysis.

Model one or more independent supply processes:

registrar;
inquiry engine;
third-party reason providers;
adversarially robust mixture of providers;
whatever abstraction is minimal.

The critical distinction is:

route available ≠ reason actually surfaced before commitment.

Make the latter the theorem's object.

3. Choose the correct content-loss quantity

The current d_canon is often a count / symmetric difference of declared reason states.

Pressure whether raw count is really the right quantity for the theorem.

Candidates include:

Count loss

D_n := # { true declared reasons not supplied by commitment }.

Weighted loss

D_n^w := Σ_{r true but unsupplied} w_{n,r}.

Program-sensitivity loss

For reason-specific influence bounds L_{n,r}:

D_n^L := Σ_{r true but unsupplied} L_{n,r}.

Direct value discrepancy

|V(T_actual) − V(T_full)|.

Try to prove relations between these.

For weighted-count programs, we expect:

|V(T_actual) − V(T_full)| ≤ Σ_{r missing} |w_r|.

For richer defeat-sensitive programs, identify the right local sensitivity certificate.

The final non-capture theorem should charge the smallest natural quantity actually needed by the principal program, not an unnecessarily coarse number of missing reasons.

4. State the exact service theorem we want

Try to derive a theorem of this general shape.

Let:

R_n be the finite set of true declared reasons relevant to occurrence n;
c_{n,r}(t) be the minimum resource cost of getting reason r validly supplied by time t;
T_n be the commitment deadline;
B_n be the supplier's available service budget/capacity;
w_{n,r} or L_{n,r} be the reason's value sensitivity.

Define the missed weighted mass:

Miss_n := Σ_{r∈R_n, r not supplied by T_n} w_{n,r}.

Find useful necessary and sufficient, or at least sharp sufficient, conditions for:

E[Miss_n] → 0

limsup E[Miss_n] ≤ ε.

This is the quantity that should feed the steering theorem.

Do not assume all reasons can simply be served.

The theorem should expose the real competition induced by the deadline.

5. Connect rigorously to the existing affordability theory

Read the current affordability / underwriting work in the workspace rather than paraphrasing it from memory.

Determine exactly which existing theorem or abstraction can serve the reason-supply problem.

In particular, separate:

Persistence

A concern can eventually be serviced repeatedly over an unbounded horizon.

Timeliness

A concern must be serviced before a fixed commitment deadline.

PR #101's claim is that reason supply is fundamentally the second case.

Pressure this.

Ask:

Does the existing affordability theory already imply a bounded-delay service theorem?
Is a new finite-horizon underwriting theorem required?
Are costs additive across reasons?
Is capacity fungible?
Does service of one reason interfere with another?
Are reasons divisible / partially serviceable?
Is there an optimal scheduling theorem hiding here?
Is the right mathematical object a deadline scheduling problem, a covering problem, an online knapsack, a flow/cut condition, or the existing authority-underwriting geometry?

Do not force the previous affordability vocabulary if a cleaner existing mathematical framework applies.

Search existing mathematical literature if useful.

6. Look for an exact characterization, not just a sufficient condition

The ideal result is not:

if capacity is very large, all reasons arrive.

Try for a theorem with the feel of:

reason supply is affordable iff every relevant deadline cut is underwritten.

For example, perhaps for a finite occurrence:

∀ S ⊆ R_n, Σ_{r∈S} required_cost_before_deadline(r) ≤ available_capacity_on_their_feasible_service_window

or an appropriate Hall/max-flow/min-cut condition.

Or, in an expected / weighted setting, perhaps an optimal uncovered-mass characterization:

minimum achievable Miss_n = value of a dual obstruction.

Investigate whether the service problem has a clean primal/dual form.

A strong result would give an exact quantity A_n such that:

minimal possible content residual = A_n

and then the steering theorem becomes:

steering advantage ≤ L·A_n + audit/form terms + o(1).

That would be much stronger than simply assuming "reason-supply liveness."

7. Separate three sources of missing content

Do not collapse all missing reasons together.

Distinguish:

discovery failure: the ecosystem does not know the reason is true/relevant;

service failure: the reason is known but cannot be routed/authenticated before the deadline;

scope failure: the reason type is outside the declared representation.

Only (2) is directly an affordability problem.

Possibly (1) is inquiry / epistemic coverage.

(3) is the representation wall and should remain explicitly external.

Try to obtain a decomposition such as:

`d_content ≤ discovery_loss

deadline_service_loss
authentication_loss`

with interface incompleteness outside the theorem rather than hidden inside one term.

8. Pressure the role of protected scope

The first pass identified two repairs:

total protected scope;
an independent supply obligation.

Do not simply choose one.

Investigate their exact relationship.

Questions:

Is total protected scope merely a way of converting missing content into void mass?
Does that solve steering at the price of destroying availability?
Can partial protected scope plus weighted independent supply give a strictly better theorem?
Is there an optimal choice of which reasons to protect versus merely service?
Should high-impact reasons be protected and low-impact reasons merely charged through the residual?
Can the theory express a risk-sensitive hybrid?

A potentially useful theorem form is:

`steering advantage ≤ value of unprotected missing content

void/availability cost of protected missing content`.

That could turn protected scope into a design parameter rather than a Boolean all-or-nothing choice.

Pressure this mathematically.

9. Try to derive an end-to-end non-capture theorem

The strongest target for this pass is something like:

Reason-Supplied Non-Capture Theorem

Suppose:

the principal's committed program is re-executed solely on the authenticated reason trace;
the program is extensional with respect to canonical declared content;
its value is Lipschitz / reason-sensitive with constants L_{n,r};
the audit mismatch term is M_n;
an independent supplier has a certified service policy whose expected missed weighted reason mass is at most α_n;
authentication error contributes at most β_n.

Then Logical Induction learns:

E_n(U_steered) − E_n(U_full) ≲_n α_n + β_n + D·E_n(M_n),

up to the exact constants.

Hence if:

α_n → 0, β_n → 0, E_n(M_n) → 0,

then:

E_n(U_steered) − E_n(U_full) ≲_n 0.

Interpretation:

the bounded agent asymptotically assigns no advantage to steering the principal's deliberative inputs over allowing an independently serviced, authenticated, canonical reason process to reach the principal.

Determine whether this theorem is actually sound.

Do not claim it if the comparator still hides a counterfactual oracle.

10. Re-examine the comparator

The current N_full uses every true declared reason.

Pressure whether that is a legitimate comparator.

Questions:

Is N_full only a mathematical yardstick or a realizable process?
If the truth of an absent reason is not known before commitment, does the comparator require an oracle?
Can the independent service process itself define the comparator instead: N_service(T) = trace produced by the certified supplier policy?
Would this make the theorem weaker but more operationally honest?
Can we state both:

ideal fully-informed comparator;
realizable supplier comparator?

Prefer a theorem against a realizable process if the difference is material.

The distinction should be explicit:

ideal completeness regret versus realizable service regret.

11. Attack the theorem with small countermodels

Build exact fixtures for at least:

two reasons competing for one pre-deadline service slot;
high-value and low-value reasons with one slot;
protected high-value reason versus unprotected low-value reason;
supplier knows both reasons but can service one;
supplier learns a reason only near the deadline;
authentication itself consumes capacity;
one reason defeats another and changes its marginal importance;
duplicate reasons / redundant evidence;
correlated reasons where servicing one reveals another;
adversarial arrival times;
advisor strategically floods the docket;
advisor can influence service cost;
multiple independent suppliers;
a reason impossible to discover before commitment;
a reason type outside the declared ontology;
a comparator that assumes content no realizable process could have produced.

Use these to identify which hypotheses are structural and which are wishful.

12. Press the affordability connection at theorem level

The current AFFORDABILITY_INTERFACE.md says that deadline reason supply is the timeliness side of affordability.

Turn that into a theorem-shaped interface.

The supplier theorem should ideally output exactly the object the steering theorem consumes:

E[both·d_content] ≤ α_n

or its weighted/sensitivity version.

Then the composition should be literally:

Affordability/Supply theorem → small content residual

Canonicalization theorem → κ = 0

Audit/sealing theorem → small M

LI steering theorem → small learned steering advantage.

Make the conclusions of one theorem have exactly the type needed by the next.

Avoid prose-only bridges.

13. Ask whether this closes the manipulation side of corrigibility

At the end of the pass, answer carefully:

Can we now say:

under a declared reason representation, an independent affordable reason-supply process, an extensional principal program, and a sealed audit, the agent has asymptotically no incentive to steer the principal's deliberation?

Or is there still a missing notion of:

relevance;
inquiry;
defeat;
world manipulation;
causal intervention semantics;
principal-process capture?

If something remains, isolate one precise residual rather than reopening a seven-clause bill.

14. Reassess the full corrigibility theorem

If the service theorem succeeds, write the strongest combined theorem you now believe:

Effect side

For every candidate continuation q:

q -> 𝔠q

and LI learns no unexplained advantage to bypass.

Deliberation side

For every candidate's principal evaluation:

steered trace -> independently serviced canonical trace

and LI learns no unexplained advantage to steering.

The combined theorem should look roughly like:

`Adv_correction_bypass ≤ mediation_cost

principal_decision_regret
activation_mismatch
o(1)`

and

`Adv_deliberative_steering ≤ missed_reason_cost

representation_cost
audit_mismatch
o(1)`.

If all RHS quantities vanish:

the agent has asymptotically no operative advantage either from bypassing the principal's protected decision authority or from steering the declared reasons on which that authority is exercised.

Be explicit that this remains relative to:

effect completeness;
a declared reason representation;
whatever external causal contracts are still required.

15. Do not spend time on these unless needed

Do not:

reopen the definition of structural corrigibility;
redo the LI EPI proof;
develop oracle-relativized LI;
pursue continuation BRIA;
broaden to full philosophical normativity;
invent a general non-manipulation ontology;
canonicalize the speculative two-interface thesis before this pass settles it.

The goal is to turn one residual quantity into a real theorem.

Deliverables

Update the existing PR #101 round rather than starting a new round unless repository conventions strongly require a second-pass subdirectory.

Add at least:

SUPPLY_THEOREM.md
AFFORDABILITY_REFINEMENT.md
CONTENT_RESIDUAL.md
COMPOSITION.md
COUNTERMODELS_SECOND_PASS.md
updated REPORT.md
updated THEOREM_CANDIDATES.md
Lean and exact fixtures where the mathematics is stable.

If the service problem maps cleanly to known mathematics, add a brief RELATED_MATH.md with precise citations and explain what is imported versus new.

Final questions

The revised report must answer:

What is the exact quantity that represents missing deliberative content?
Should it be a count, weighted mass, sensitivity-weighted mass, or direct value discrepancy?
What is the exact independent supplier model?
What resource/capacity object does the supplier consume?
What is the commitment deadline model?
What theorem makes the missed-content quantity small?
Is there an iff / dual characterization?
Is the problem best understood as affordability, scheduling, flow, covering, or something else?
How do discovery failure and service failure separate?
What role should protected scope play?
Is total protected scope actually desirable?
Can a hybrid protected/unprotected theorem dominate it?
Is N_full a legitimate comparator?
Is there a realizable supplier comparator?
Does the service theorem compose directly with li_steering_le?
What assumptions make the content residual vanish?
What remains after it vanishes?
Can we now state a serious non-capture theorem?
Can that theorem compose with the landed effect-side corrigibility theorem?
What is the strongest honest combined corrigibility statement after this pass?

The desired outcome is not another catalog of residuals.

It is either:

A. CONTENT-RESIDUAL-CLOSED-BY-SUPPLY-AFFORDABILITY

A precise service theorem supplies the missing hypothesis of PR #101 and yields a genuine non-capture theorem.

B. CONTENT-RESIDUAL-REDUCED-TO-A-SHARP-SERVICE-OBSTRUCTION

The residual cannot generally vanish, but there is an exact capacity/dual obstruction characterizing the best achievable bound.

C. REASON-SUPPLY-IS-NOT-THE-RIGHT-REDUCTION

A counterexample shows that even perfect independent timely supply over the declared interface does not eliminate the relevant steering advantage; identify the missing structure exactly.

Push hard for A or B, but do not protect them from C.

Third dispatch — discovery pass (2026-09-16)

Continue work on PR #101 / branch:

round/2026-09-16-noncapture-compilation

in A-M-Berns/alignment-workspace.

This is a third-pass refinement and theorem-discovery round on the existing PR.

Do not reopen the effect-side corrigibility theorem, the LI compilation, the trace-steering algebra, or the reason-supply scheduling theorem unless this pass finds a concrete error.

The current state to treat as established is:

Effect-side corrigibility is landed on main:

corrigibilization 𝔠;
structural corrigibility;
principal-option preservation;
directional activation mismatch;
EPI / finite-menu uniformity.

Trace steering has the same compiled inequality:

content residual;
form residual;
audit mismatch;
EPI transfer via the landed compiled theorem.

Form steering is controlled by extensionality / canonicalization.

Known-content suppression has now been reduced to a sharp deadline-service problem:

true declared reasons on the docket have release times;
an independent supplier has capacity before commitment;
the suffix-cut condition exactly characterizes full service in the unit case;
the minimum weighted miss is characterized by the transversal-matroid / deficiency structure;
the service theorem outputs the exact kind of bound consumed by li_noncapture.

The remaining content decomposition is now roughly:

`missing adverse mass = discovery residual

service residual
authentication residual`

with the service term sharply characterized and the authentication term conceptually separate.

The central open quantity is therefore:

the adverse sensitivity mass of true declared reasons that no independent inquiry/discovery process puts on the docket in time for the service theorem to act.

Your task is to determine whether this discovery residual admits a real theorem interface.

Do not merely rename it "inquiry."

1. State the discovery residual precisely

Let the declared reason ontology at occurrence n be I_n.

Let:

Truth_n ⊆ I_n be the true declared reasons in the world;
Disc_n ⊆ Truth_n be the reasons actually discovered / docketed by the independent inquiry process early enough to enter the service problem;
A_{n,r} be the directional adverse sensitivity certificate already used by the second pass.

Define:

DiscoveryLoss_n := Σ_{r ∈ Truth_n \ Disc_n} A_{n,r}

or improve this definition if the existing defeat/redundancy results show that a simple additive quantity is too coarse.

The target is a theorem whose output has exactly the type:

DiscoveryLoss_n ≤ β_n

or, asymptotically,

β_n → 0.

This must compose literally with the second-pass service theorem.

2. Do not assume "discover every true reason"

That is likely much too strong.

Investigate which target is actually needed.

Possibilities:

Full discovery

Every true declared reason is eventually discovered before commitment.

Adverse-mass discovery

The undiscovered reasons may be numerous, but:

Σ_{r undiscovered} A_r

is small.

Decision-sufficient discovery

The discovered set may omit reasons, but adding all omitted true reasons changes the principal program's verdict by at most β_n.

Defeat-closed discovery

Every discovered reason comes with all relevant undefeated counterreasons / defeaters required to evaluate its force correctly.

Certificate-relative discovery

The inquiry process supplies enough information to certify a program-specific upper bound on the verdict change from everything still undiscovered.

Determine the weakest useful notion.

Prefer a decision-sufficient or sensitivity-weighted statement to "find everything."

3. Separate ontology completeness from discovery

Do not confuse:

the reason is in the declared ontology but undiscovered;
the ontology lacks the reason type entirely;
the ontology has the type but insufficient granularity.

Only (1) is the discovery residual.

(2) and (3) are representation failures and should remain outside the consumer theorem unless this pass discovers a principled way to internalize them.

The theorem must clearly say:

relative to a declared reason representation.

Do not invent an "interface incompleteness mass" unless there is a real observable/certifiable object supporting it.

4. Model the inquiry process

Construct the minimal formal object needed to reason about discovery.

Possible ingredients:

inquiry actions a ∈ A;
cost c(a);
information returned by an inquiry;
a set of reason ids revealed by each outcome;
adaptive choice of later inquiries based on earlier answers;
a commitment deadline;
an inquiry budget / capacity;
possibly multiple independent inquiry providers.

Ask whether the right abstraction is:

adaptive set cover;
active learning;
decision-tree/query complexity;
submodular information gathering;
bandit exploration;
diagnostic search;
argumentation/defeat closure;
or something specific to the existing normative representation.

Do not force the existing affordability framework onto inquiry if another mathematical object is clearly the right one.

5. Investigate the role of defeat

This is important.

A reason should not necessarily carry adverse mass independently of its defeaters.

The second pass already showed that static per-reason weights can misdescribe defeat-sensitive programs.

Use the existing defeat / reason-representation machinery in the workspace.

Ask:

When a reason r is discovered, what counterreasons become inquiry obligations?
Can discovery be defined as closure under live defeaters?
Is there a finite "relevance frontier" generated by the currently discovered docket?
Can the principal program expose which missing distinctions could still move its verdict?
Does discovering a reason create new possible defeaters recursively?
Does this process terminate under finite declared interfaces?
What is the correct quantity for "unexplored defeater mass"?

Try to derive a theorem of the shape:

not defeated / unresolved high-impact reason ⇒ some explicit inquiry obligation remains.

This may be the cleanest connection to the normativity agenda.

6. Look for a progress theorem, not merely a coverage assumption

The desired result is something like:

an independent inquiry policy systematically reduces unresolved adverse mass.

Define a potential such as:

Potential_t := sup / sum of adverse sensitivity of still-possible undiscovered reasons

or an appropriate upper bound on how much the principal's verdict can still change after all currently available evidence.

Then investigate whether the inquiry process guarantees:

Potential_{t+1} ≤ Potential_t

and, under suitable capacity / informativeness conditions,

Potential_T ≤ β.

Strong target:

Potential_T → 0.

We want a progress theorem.

A static assumption:

all important reasons are eventually discovered

is not enough unless the pass shows that is genuinely the minimal honest interface.

7. Find the right notion of informativeness

An inquiry may fail to reveal anything relevant.

Characterize the property of the inquiry repertoire needed for progress.

Candidates:

Coverage

For every unresolved high-adverse-mass reason, some available inquiry can reveal it.

Separation

For every pair of worlds inducing materially different principal verdicts, some inquiry distinguishes them.

Value of information

Whenever unresolved verdict range exceeds ε, some inquiry reduces it by a definite amount.

Defeat completeness

For every live reason whose force depends on a possible defeater, some inquiry can settle that defeater.

Witness completeness

Whenever omitted content could improve the advisor's candidate by more than ε, an inquiry witness exists whose answer exposes at least some fixed fraction of that advantage.

Pressure these.

A theorem phrased directly in terms of remaining decision uncertainty / steering opportunity may be stronger than one phrased in terms of semantic "reasons."

8. Look for an exact obstruction / dual

The service pass was successful because it found a sharp obstruction:

suffix demand > suffix capacity.

Try for the analogous discovery obstruction.

Questions:

Is there a set of mutually indistinguishable worlds under the available inquiry policy whose principal values differ substantially?
Is the irreducible discovery residual exactly the diameter of an information cell?
Is there a minimax characterization: best inquiry policy versus worst consistent world?
Is there an adaptive set-cover dual?
Can undiscovered adverse mass be identified with a hitting-set obstruction?
Is there a "no available inquiry distinguishes these relevant possibilities" certificate?

A very strong theorem would identify:

Discovery* := inf_policy sup_world residual(policy, world)

and characterize when Discovery* = 0.

Even a sharp lower bound / obstruction would be valuable.

9. Distinguish discovery from settlement

A reason may be:

hypothesized;
discovered as a candidate;
verified as true;
authenticated;
settled.

Be explicit about these stages.

For example:

candidate generation → inquiry → truth determination → authentication → docket → service → principal trace.

Determine which stage belongs to:

discovery;
authentication;
settlement;
service.

Do not double-charge the same failure in multiple residuals.

The output decomposition should be type-clean.

10. Distinguish discovery from world manipulation

If the advisor changes the world so that a counterreason is no longer true, that is not merely discovery failure.

World-changing interventions should remain on the effect side or under the declared-transform causal contract.

Construct fixtures where:

reason is undiscovered but true;
reason becomes false because the agent changed the world;
agent hides evidence without changing the underlying reason;
agent alters which inquiry questions get asked;
agent alters the cost of discovering a counterreason;
agent alters the inquiry engine itself.

Identify exactly which interface catches each.

11. Pressure independence of the inquiry process

The second pass required that the advisor cannot consume supplier capacity or arbitrarily raise service costs.

Discovery needs analogous independence.

Possible attack surfaces:

advisor controls which questions are proposed;
advisor controls evidence indexing;
advisor can flood the search space;
advisor can make true reasons expensive to discover;
advisor can selectively reveal clues;
advisor can influence the inquiry model;
advisor can influence stopping rules.

State the weakest causal-independence condition under which the discovery theorem remains meaningful.

Do not simply say "independent inquiry."

12. Build exact countermodels

At minimum test:

one hidden high-adverse counterreason with a direct available query;
two reasons, one query budget;
many low-value distractors plus one high-value hidden counterreason;
advisor flooding the search space;
inquiry cost manipulated by advisor;
discovering one reason reveals another;
discovering one reason creates a new defeater obligation;
mutually defeating reasons;
redundant reasons;
reason truth only determined by an expensive empirical test;
ontology contains the reason but the inquiry repertoire cannot distinguish it;
two worlds observationally indistinguishable under all allowed inquiries but with different principal values;
all reasons discoverable eventually but not before commitment;
random inquiry finds high-value reason only with small probability;
adaptive inquiry dramatically outperforms nonadaptive inquiry;
advisor controls stopping;
inquiry engine is honest but resource bounded;
reason outside the ontology;
insufficient ontology granularity;
perfect discovery but service cut fails.

For each, state whether the failure is:

discovery;
service;
authentication;
ontology;
effect-side containment;
audit/causal-contract failure.

13. Try to prove an end-to-end discovery theorem

Candidate theorem shape:

Discovery Progress Theorem

Suppose an independent inquiry process maintains a set K_t of possible declared reason states or worlds.

Suppose:

every principal-program verdict compatible with the current evidence lies in an interval / set of diameter R_t;
whenever R_t > ε, there exists an affordable available inquiry whose outcomes reduce the worst-case residual by at least some function g(R_t);
the process selects such inquiries sufficiently often before commitment.

Then:

R_T ≤ β

with an explicit rate / budget relation.

Translate R_T into:

DiscoveryLoss ≤ β.

Or find a better theorem.

The important thing is that the conclusion must feed the service/composition theorem exactly.

14. Alternatively, characterize the irreducible obstruction

If a progress theorem is too strong, aim for:

Inquiry Obstruction Theorem

The best achievable discovery residual is bounded below by the maximum principal-value diameter of any set of worlds indistinguishable under the allowed inquiry repertoire and budget.

Ideally prove a matching upper bound in a finite model.

This would be the discovery analogue of the service cut obstruction.

A verdict of:

DISCOVERY-RESIDUAL-REDUCED-TO-INFORMATION-CELL-DIAMETER

would be an excellent result.

15. Compose with the second-pass theorem

The desired final chain is:

Inquiry theorem → DiscoveryLoss_n ≤ β_n

Supply theorem → ServiceLoss_n ≤ α_n

Authentication → AuthLoss_n ≤ γ_n

therefore:

ContentLoss_n ≤ β_n + α_n + γ_n

then:

li_noncapture →

E_n(U_steered) − E_n(U_full/discovered) ≲ₙ β_n + α_n + γ_n

up to the exact sensitivity normalization.

If:

β_n, α_n, γ_n → 0

then:

E_n(U_steered) − E_n(U_comparator) ≲ₙ 0.

Make the theorem interfaces literally compose.

No prose-only arrows.

16. Reassess the comparator after discovery

The second pass distinguished:

N_disc: all discovered true declared reasons;
N_full: all true declared reasons.

If the inquiry theorem certifies a bound on the difference between them, then we should be able to compose:

actual serviced trace → N_disc → N_full.

Try to prove:

`Adv(actual, N_full) ≤ Adv(actual, N_disc)

discrepancy(N_disc, N_full)`.

Then:

service controls the first;
discovery controls the second.

This would finally justify use of N_full as a bounded ideal comparator without requiring an oracle-like realization.

17. Ask whether the "non-capture" side is now complete

At the end, assess whether the following is actually enough:

trace mediation by committed-program re-execution;
extensional/canonical principal program;
independent inquiry with discovery bound;
independent supply with service bound;
sound authentication;
content-monotone/sealed audit;
declared reason representation.

If yes, state the strongest non-capture theorem.

If no, isolate the single next residual.

Do not reopen the entire legitimacy ontology.

18. Reassess the full corrigibility theorem

If the discovery result succeeds, combine:

Effect authority theorem

The agent gets asymptotically no unexplained advantage from bypassing protected principal authority.

Deliberative non-capture theorem

The agent gets asymptotically no unexplained advantage from steering which declared, decision-relevant reasons reach the principal.

Target interpretation:

Relative to an effect-complete interaction model and a declared reason representation, a bounded logical reasoner has asymptotically no operative advantage either from bypassing the principal's protected decision authority or from selectively controlling the principal's deliberative inputs, provided independent inquiry, service and authentication drive their explicit residuals to zero.

Be precise about what remains external:

ontology adequacy;
undeclared reason types;
causal contracts for intervention transforms;
physical containment assumptions.

19. Do not spend this pass on

Do not:

revisit EPI;
redo the service Hall/matroid theorem;
extend general-cost scheduling unless discovery needs it;
develop oracle-relativized LI;
work on continuation BRIA;
broaden to all of legitimacy;
solve ontology completeness;
redefine corrigibility.

This pass is about one quantity:

undiscovered adverse decision-relevant mass.

Deliverables

Extend the existing PR #101 round with at least:

DISCOVERY_RESIDUAL.md
INQUIRY_MODEL.md
DISCOVERY_THEOREM.md
DISCOVERY_COUNTERMODELS.md
DISCOVERY_COMPOSITION.md
DISCOVERY_RELATED_MATH.md
updated REPORT.md
updated THEOREM_CANDIDATES.md
Lean / exact fixtures where the mathematics stabilizes.

If there is a clean information-theoretic, active-learning, decision-tree, set-cover, or argumentation-theoretic connection, cite it precisely and separate imported mathematics from new application.

Do not update the canonical wiki until the theorem survives pressure.

Final questions

The revised report must answer:

What exactly is the discovery residual?
Is additive adverse sensitivity still the right quantity?
What is the minimal inquiry-process abstraction?
What does "independent inquiry" formally mean?
What is the inquiry resource: queries, computation, money, time, attention, or a combination?
What does a query reveal?
How does defeat affect discovery obligations?
Is there a useful closure notion under counterreasons/defeaters?
What is the exact informativeness hypothesis?
Is there a progress theorem?
Is there a sharp obstruction / dual?
What is the minimum achievable discovery residual?
Does adaptive inquiry matter?
What happens under advisor-controlled query costs?
What happens under search-space flooding?
How does discovery differ from authentication?
How does discovery differ from service?
How does discovery differ from ontology incompleteness?
Can the discovery theorem output exactly the hypothesis consumed by li_noncapture?
Can N_disc -> N_full be bounded without an oracle?
What remains after discovery, service, form and audit residuals all vanish?
Can we now state a serious end-to-end non-capture theorem?
Can that compose cleanly with the landed effect-side corrigibility theorem?
What is the strongest honest corrigibility theorem after this pass?

End with one of:

A. DISCOVERY-RESIDUAL-CLOSED

A realizable inquiry theorem drives the undiscovered adverse mass to zero under explicit conditions.

B. DISCOVERY-RESIDUAL-HAS-A-SHARP-OBSTRUCTION

The residual cannot always vanish, but the best achievable residual has a clean minimax / information-cell / query-budget characterization.

C. DISCOVERY-DOES-NOT-REDUCE-CLEANLY

Even with an explicit declared ontology and independent inquiry, no useful compositional bound emerges; identify the exact obstruction.

A or B would be a major success.

Do not protect either from C.

Fourth dispatch — landing pass (2026-09-16)

Work in A-M-Berns/alignment-workspace.

Continue from PR #101 / branch:

round/2026-09-16-noncapture-compilation

This is the final consolidation pass for this line of research.

The goal is not another open-ended discovery round.

The goal is:

pressure the one remaining mathematical abstraction question enough to know its status;
state the mature combined corrigibility theorem at exactly the strength now supported;
reconcile the three passes of PR #101 with landed PR #100 and the surrounding legitimacy/deference architecture;
update the canonical repository so it tells one coherent story;
verify everything;
**merge PR #101 to main**;
leave a clear natural stopping point for the corrigibility line.

Unless a genuine contradiction appears, do not open another residual-decomposition program.

I. TREAT THE CURRENT RESULTS AS THE STARTING POINT

PR #100 is already landed and establishes the effect-side corrigibility nucleus:

structural corrigibilization 𝔠;
event-linked authorization;
principal-option preservation;
directional activation mismatch;
gated-LUV compilation;
actual P-generability certificate;
Expectation Provability Induction;
finite-menu uniformity.

PR #101 now has three passes.

Pass 1 — trace steering

Established:

`U(T) − U(N) = both·(V(T)−V(N))

M·V(T) − M'·V(N)`

and hence a directional steering bound in terms of:

content discrepancy;
form/non-extensionality discrepancy;
audit mismatch.

The steering package instantiates the landed ValidAt, so EPI transfers literally through the same compiled theorem.

Canonicalization/extensionality eliminates form steering.

The naive "complete reason interface + ordinary coverage/liveness" thesis is false.

Pass 2 — service

Established the content quantity as directional adverse sensitivity mass.

For discovered reasons, pre-commitment supply is a common-deadline scheduling problem:

suffix-cut condition;
Hall sufficiency in the unit case;
exact deficiency / matroid characterization of optimal weighted service in the unit case;
general-cost hardness boundary;
hybrid protected-scope bound;
composition into:

𝔼ₙ(U_T) − 𝔼ₙ(U_disc) ≲ₙ service residual.

The old affordability theory supplies the underwriting/budget resource; the new Hall/scheduling theory supplies temporal capacity.

Pass 3 — discovery

Established:

direct discovery residual: V(Disc) − V(Truth);
conditional adverse sensitivity certificate;
live inquiry frontier;
empty frontier implies no positive discovery residual;
finite hypothesis-space inquiry model;
information-cell obstruction;
unbounded-budget minimax discovery loss equals the maximum cell gap in the antitone adverse-reason model;
finite-budget discovery is an adaptive minimax decision-tree problem;
no general fractional-progress result for direct queries;
stronger progress under witness-complete inquiry repertoires;
composition:

𝔼ₙ(U_T) − 𝔼ₙ(U_full) ≲ₙ A_tot·(α_n + β_n)

where α_n is service loss and β_n is discovery loss.

The remaining outside-theorem walls are representation/ontology adequacy and causal faithfulness of declared inquiry/intervention models.

Treat this as the current result unless this pass finds an actual error.

II. ONE FINAL MATHEMATICAL PRESSURE QUESTION

The current sharp information-cell theorem assumes an adverse-reason model in which the verdict is antitone in the discovered adverse content.

This is the one abstraction question worth pressing before canonicalization.

Do not spend an entire new research program on it.

Spend enough effort to decide one of:

A. GENERALIZATION-CHEAP

The exact obstruction theorem extends cleanly to arbitrary extensional principal programs by replacing:

gap(K) = max_ω [V(certain K) − V(Truth ω)]

with the correct minimax docket quantity, perhaps:

gap*(K) := inf_{D admissible from K} sup_{ω∈K} [V(D) − V(Truth ω)]_+

or an equivalent formulation.

If so:

state the general theorem cleanly;
prove/mechanize the algebraically stable part if reasonable;
recover the current antitone theorem as the simple corollary where D = certain(K) is optimal;
update the discovery theorem accordingly.

B. GENERALIZATION-NOT-CHEAP

The antitone adverse-reason decomposition is doing essential work and the arbitrary-program result becomes substantially more complicated.

If so:

do not delay the landing;
retain the antitone theorem;
state precisely why that is the theorem's scope;
record the arbitrary-extensional-program version as a future generalization;
make clear that the broader steering inequality itself does not require global antitonicity—only the exact closed-form discovery obstruction does.

C. CURRENT-CLAIM-NEEDS-CORRECTION

If a counterexample shows the current information-cell statement is overstated even under its intended hypotheses, repair it before proceeding.

The purpose of this section is to know the boundary, not to erase it at all costs.

III. STATE THE MATURE COMBINED CORRIGIBILITY THEOREM

After adjudicating the previous question, write the strongest theorem schema now justified.

Organize it explicitly into two halves.

A. Protected-authority / bypass half

For each efficiently represented candidate continuation q, the architecture constructs 𝔠q.

Under:

effect completeness;
mediation soundness;
decline preservation;
execution faithfulness;
protected-value stability;
whatever comparison/sealing hypothesis is required for the activated pair;

we have structurally:

Corrigible_h(𝔠q,ρ);
approve-branch reproduction;
idempotence / fixed-point facts;
principal-option preservation.

And the logical inductor learns:

`Adv_bypass,n(q) ≲ₙ mediation discrepancy

principal decision regret
directional activation mismatch`.

Uniformize over polynomial-size efficiently generated menus using the landed soft-selector result.

B. Deliberative non-capture half

Relative to a declared reason representation and hypothesis space, assume:

committed principal program re-executed on the authenticated trace;
trace mediation;
an extensional/canonical principal program;
independent inquiry:

world/evidence-determined outcomes;
engine-owned policy and stopping;
engine-owned candidate generation;
exogenous inquiry costs;
independent supply:

advisor-proof capacity;
exogenous service/authentication cost;
sound authentication;
content-monotone/sealed audit;
causal faithfulness for any declared transform interpreted counterfactually.

Then:

`Adv_steering,n ≲ₙ service residual α_n

discovery residual β_n
authentication/audit terms`

with the exact normalization from the proved theorem.

In the currently compiled two-stage form:

𝔼ₙ(U_T) − 𝔼ₙ(U_full) ≲ₙ A_tot·(α_n + β_n)

under zero form/audit terms.

Where:

α_n is characterized by the reason-supply scheduling theorem;
β_n is characterized by the inquiry obstruction / decision-tree value.

If both vanish:

Adv_steering,n ≲ₙ 0.

IV. WRITE THE COMBINED INTERPRETATION CAREFULLY

The mature interpretation should be approximately:

Relative to declared effect and reason interfaces, a bounded logical reasoner has no asymptotically unexplained advantage either from bypassing protected principal authority or from selectively controlling the decision-relevant information on which that authority is exercised. Any remaining advantage is accounted for by explicit physical mediation costs, principal decision error, comparison failure, finite inquiry limitations, finite service capacity, or representation assumptions.

Do not say:

"the agent values human control";
"corrigibility is solved unconditionally";
"all manipulation is eliminated";
"all relevant reasons are discovered";
"ontology completeness is learned";
"the principal cannot be manipulated by changing the world";
"Logical Induction itself creates corrigibility."

The theorem is relative to declared interfaces and external physical/causal realization assumptions.

V. IDENTIFY THE TRUE STOPPING BOUNDARY

The final canonical account should make clear that the following are not unfinished pieces of the same theorem.

They are boundary conditions / next-agenda questions:

Representation adequacy

Does the declared reason ontology/hypothesis space contain the distinctions that actually matter?

No interface-local theorem can measure omitted concepts from inside the interface.

Physical effect completeness

Does every relevant authority-changing causal path actually pass through the declared effect interface?

This remains an external realization boundary.

Inquiry causal faithfulness

Do declared inquiry outcomes correspond to the physical/evidential processes they claim to model?

Dynamic competence

Can the agent/principal continue to satisfy these conditions over long interaction horizons?

This connects to continuation BRIA / legitimate evolution but is not needed to land the static/occurrence-level corrigibility theorem.

Richer normativity

How should reason representations, defeat relations, amendment, and normative learning themselves evolve?

That belongs to the legitimacy/normativity agenda.

Do not leave the wiki suggesting these are all "corrigibility residuals."

VI. CONSOLIDATE THE LANGUAGE

Clean up provisional terminology.

At minimum adjudicate:

corrigibilization;
directional activation mismatch;
trace steering;
form residual;
content residual;
adverse sensitivity;
conditional adverse sensitivity;
service residual;
discovery residual;
information-cell gap;
inquiry frontier;
independent inquiry;
independent supplier;
fully-informed comparator;
discovered comparator.

Prefer a small stable vocabulary.

Avoid proliferating synonyms across passes.

In particular, make a clear choice about whether the paper-level quantity is called:

steering advantage;
non-capture gap;
deliberative capture premium;
or another term.

Use one.

VII. RECONCILE THE THREE PR #101 PASSES

The round currently contains a history of refinements and refutations.

Keep the research record, but make the final state easy to understand.

Produce a concise final document, e.g.:

FINAL_THEOREM.md

containing only:

setup;
authority theorem;
trace-steering theorem;
service theorem;
discovery theorem;
composition;
combined corrigibility theorem;
assumptions/boundaries;
verification status.

Then update REPORT.md so the top-level summary points to this final statement rather than requiring someone to reconstruct the result chronologically.

The old first-/second-/third-pass documents should remain as research provenance but not be the main reading path.

VIII. UPDATE THE CANONICAL WIKI

Unlike the earlier research passes, this pass should canonicalize the mature result.

Update at least:

wiki/Corrigibility.md
wiki/Theorem-Spine.md
wiki/Deference.md
wiki/Logical-Induction-and-Deference.md
wiki/Openness-Coverage-and-Non-Capture.md
wiki/Normative-Record-and-Inquiry.md
wiki/Liability-and-Affordability.md
wiki/Roadmap.md
wiki/Glossary.md

Only touch pages where the new result genuinely changes the canonical story.

The main conceptual organization should now be:

Corrigibility

1. Protected authority

effect interface -> mediation -> corrigibilization -> LI non-bypass

2. Deliberative non-capture

reason representation -> inquiry -> authentication -> service -> canonical trace -> LI non-steering

3. Explicit theorem boundaries

representation adequacy / physical completeness / causal faithfulness

Do not return to the old seven-layer organization as the primary story unless it materially clarifies the result.

IX. CONNECT THE NORMATIVITY AGENDA AS A SUPPLIER

Clarify exactly how the broader legitimacy/normativity work feeds this theorem.

The point should not be:

legitimacy is another condition of corrigibility.

Instead:

defeat / reason semantics determine conditional inquiry obligations;
inquiry theory bounds β_n;
affordability + scheduling bound α_n;
settlement/authentication controls false/missing certified content;
answerability / committed-program architecture determines whose judgment the trace binds;
corrigibility consumes those outputs.

This should give the legitimacy agenda a concrete downstream consumer without pretending that the full legitimacy theory is already closed.

X. PRIORITIES / CLAIM REGISTRY / DECISIONS

Review all priorities touched by #100/#101.

For each item:

close it if the exact registered result really answers it;
narrow it if only one component remains;
split it if it currently conflates unrelated future work;
do not leave stale wording such as "reason-supply liveness open" if service now has a theorem and only discovery/representation remains.

In particular review items around:

84;
87;
89;
90;
91;
92;
93;
any newly created discovery/inquiry item.

Do not register claims merely because a theorem is interesting.

For any registration, identify:

exact statement of record;
exact Lean declaration;
exact hypothesis strength;
whether it is LEAN, PAPER, EXT, FIX, OPEN.

The combined corrigibility theorem may remain a theorem schema assembled from components rather than a single monolithic Lean declaration if that is the honest state.

XI. PRESSURE THE FINAL COMBINED STATEMENT

Before landing, test at least the following attacks against the final theorem statement:

undeclared effect;
undeclared reason type;
insufficient reason granularity;
approved irreversible effect;
repeated independently approved effects;
raw policy destroys evaluator;
advisor truthfully cherry-picks;
advisor manipulates reason order only;
advisor floods inquiry candidates;
advisor raises inquiry cost;
advisor raises service cost;
finite service bottleneck;
information-cell indistinguishability;
direct-query needle;
adaptive-query advantage;
world manipulation makes a counterreason false;
evidence tampering;
principal program reads metadata;
principal program has defeat-sensitive reasoning;
actual world outside declared Ω.

For every case, the final theorem should either:

cover it;
charge it to a named residual;
or identify the hypothesis that excludes it.

No attack should disappear into prose.

XII. CHECK THE ANTITONE / DEFEAT STORY ONE LAST TIME

Make the relationship crystal clear:

the general trace-steering bound works for arbitrary values satisfying the relevant stability certificate;
conditional adverse sensitivity handles some defeat/context dependence;
the clean max cell gap discovery theorem currently uses the adverse/antitone discovery model unless generalized in Section II;
richer arbitrary principal programs may require the general minimax-docket formulation.

Do not let the final wiki accidentally advertise the antitone special case as universal.

XIII. VERIFY EVERYTHING

Before merge, run all repository checks expected for a canonical landing.

At minimum:

root test suite;
all #101 tests;
all relevant #100 tests;
lake build;
complete axiom audit;
python3 -m checkers.run;
name lint;
dead pointers;
untracked pointers;
wiki links;
wiki/state bindings;
workspace state check;
round-record checks;
DCO;
conservativity / scope checks;
any claim-registry validation.

All new Lean declarations should remain sorry-free and within the repository's allowed axiom policy.

Check that the branch is based on the actual current main; reconcile if main moved.

XIV. FINAL LANDING REPORT

Write:

LANDING.md

with concise answers to:

What is the final definition of structural corrigibility?
What exactly does corrigibilization guarantee?
What exactly does LI learn on the authority side?
What is trace steering?
What are the final non-capture residuals?
What theorem characterizes service failure?
What theorem characterizes discovery failure?
What is the role of conditional adverse sensitivity / defeat?
What is the strongest non-capture theorem?
What is the strongest combined corrigibility theorem?
Which assumptions are logical/semantic?
Which assumptions are architectural/physical?
Which assumptions are representation choices?
Which claims are Lean-proved?
Which are imported mathematical facts?
Which remain fixture/paper-level?
What remains open?
Why are those open questions no longer reasons to keep this PR open?
What should the next research line be?
Why is this a natural stopping point?

The final answer to 20 should be substantive:

The effect-side and declared-reason-side incentive problems have both been reduced to structural inequalities with explicit, independently characterized residuals, and Logical Induction learns those inequalities. The remaining questions concern adequacy and evolution of the interfaces that supply the theorem, rather than another missing corrigibility mechanism.

Use different wording if the final theorem picture changes, but preserve the distinction.

XV. MERGE PR #101

Once:

the final theorem has survived the pressure pass;
the canonical wiki is reconciled;
state/provenance/priorities are correct;
the test and audit suite is clean;

**merge PR #101 into main.**

Use the repository-appropriate merge strategy and preserve research-round commit reachability where canonical documentation cites those commits.

After the merge:

verify main contains all intended changes;
verify the PR is actually marked merged;
verify canonical pages resolve;
verify state views are current.

Do not leave this as an open research PR after the landing work is done.

XVI. STOP

After merging #101, do not immediately create PR #102 for another corrigibility residual.

Instead, leave recommendations for the maintainer under three headings:

Paper

What is now ready to write as a self-contained corrigibility result?

Legitimacy / normativity

Which supplier questions should the broader agenda now attack?

Dynamic extension

What would be needed later to move from occurrence-level corrigibility/non-capture to long-run evolving-agent corrigibility?

The purpose of this final section is to enforce a real research stopping point.

Final verdict

End with exactly one of:

CORRIGIBILITY-NUCLEUS-CANONICALIZED-AND-LANDED

The combined authority + non-capture theorem is mature enough to be the canonical result; remaining open questions are interface/realization/dynamic extensions.

CORRIGIBILITY-LANDED-WITH-ANTITONE-DISCOVERY-SCOPE

Same, but the exact discovery obstruction remains explicitly scoped to the antitone adverse-reason model; arbitrary-program discovery is future work.

LANDING-BLOCKED-BY-A-SUBSTANTIVE-ERROR

Only use this if the final pressure pass finds an actual mathematical or architectural flaw that invalidates a central theorem, not merely an attractive generalization that remains open.

The default goal is a clean landing, not a fourth exploratory pass.

Report projects/deference/rounds/2026-09-16-noncapture-compilation/REPORT.md

Report

Landing (2026-09-16). The statement of record is [FINAL_THEOREM.md](FINAL_THEOREM.md); the landing dispatch's twenty questions are answered in [LANDING.md](LANDING.md). The consolidation pass settled the one open abstraction question: GENERALIZATION-CHEAP — the information-cell obstruction extends to every extensional program by taking the advisor as a strategic content-adder whose best response over the docket defines the residual; larger dockets never help it (bestResp_antitone), so the exhaustive docket is optimal and the general cell gap max_ω [bestResp(certain K, Truth ω) − V(Truth ω)] is the exact obstruction (residual_ge_cellGap', exhaustive_attains_cellGap', Lean), with the antitone theorem as its corollary (cellGap'_eq_cellGap). A reinstatement chain (a defeater of a defeater) is the fixture on which the verdict is not antitone and the general form is exact (test_general_gap_is_exact_for_a_non_antitone_program). Final verdict: CORRIGIBILITY-NUCLEUS-CANONICALIZED-AND-LANDED. The canonical wiki is reconciled (wiki/Corrigibility.md, Theorem-Spine.md §10.10–10.13, Deference.md, Logical-Induction-and-Deference.md, Openness-Coverage-and-Non-Capture.md, Normative-Record-and-Inquiry.md, Liability-and-Affordability.md, Roadmap.md, Glossary.md). Nothing is registered: the combined theorem is a schema assembled from Lean components with named external contracts, not one declaration.

Recommendations at the stopping point

Paper. A self-contained result is ready: the corrigibility nucleus as two instances of one compiled inequality learned by Expectation Provability Induction — the authority side (corrigibilization, event-linked authorization, directional activation mismatch, the generability certificate, finite-menu uniformity) and the deliberative side (trace steering, the suffix-cut service obstruction, the information-cell discovery obstruction in best-response form, the composed bound through the discovered comparator) — with the twenty-attack table as its adversarial appendix and the hypothesis classes as its scope statement. The imported mathematics (EPI, Hall, matroid greedy, decision-tree minimax) is cited, not re-proved.

Legitimacy / normativity. The theorem now names exactly what the broader agenda supplies: defeat semantics determine the conditional inquiry obligations (the frontier; items 54, 64); inquiry theory bounds β_n (a realizable repertoire with certified cell gap; witness completeness; item 93); affordability and scheduling bound α_n (the budget half by D4, the capacity half by the suffix cut; the protection rule; item 92); settlement and authentication control false and missing certified content; the committed-program architecture determines whose judgment the trace binds (item 87's sealing and void-mass clauses). These are supplier questions with a concrete consumer, not further conditions of corrigibility.

Dynamic extension. The nucleus is occurrence-level. Moving to an evolving agent needs: the authorization relation at temporal depth (item 27's requirements), the SLACK and SHIFT bridges of Continuation BRIA (item 86) so that continuation competence is competence against the principal's activated value, the sealed comparison across a continuation (item 89), and the legitimate-evolution conditions under which the declared interfaces themselves may change without laundering authority. None of these is needed for the theorem stated here.

Three passes. The third pass (discovery, 2026-09-16) is reported first; the second pass's twenty answers and the first pass's sixteen are retained below, each with the verdict it reached.

Verdict of record (third pass)

B. DISCOVERY-RESIDUAL-HAS-A-SHARP-OBSTRUCTION. The discovery residual is the omission gain of the undiscovered adverse reasons, certified by their conditional adverse mass above the docket; with unbounded inquiry budget its least worst-case value is exactly the largest information-cell gap of the declared repertoire (residual_ge_cellGap, exhaustive_attains_cellGap, Lean), zero iff the repertoire separates what the verdict separates; with a budget it is a decision-tree minimax value with no closed form, and no fractional-progress theorem holds for direct-query repertoires (the needle). The frontier theorem makes an unresolved reason of positive conditional adverse mass an explicit inquiry obligation, and the chain actual → discovered → full composes in Lean (li_noncapture_chain). The verdict sentence of record is the first paragraph of README.md. The A-case is a corollary: when the repertoire separates the verdict's classes within the budget, β_n = 0.

Consumes, in addition to the second pass's sources, the workspace's defeat and inquiry material read for this pass: wiki/Normative-Record-and-Inquiry.md, wiki/Openness-Coverage-and-Non-Capture.md, wiki/Glossary.md (eventual route coverage and the open coverage hypothesis), the defeat-landing round ../../../normativity/legitimacy/rounds/2026-09-03-defeat-landing-horty-standing/ and the reason-representation round ../../../normativity/legitimacy/rounds/2026-08-23-reason-representation/.

The twenty-four questions (third pass)

What exactly is the discovery residual? V(Disc_n) − V(Truth_n): the advisor's candidate's omission gain from the true declared adverse reasons not on the docket in time, relative to a declared representation (DISCOVERY_RESIDUAL.md §2).
Is additive adverse sensitivity still the right quantity? As a certificate, in its conditional form Σ A_{r|Disc} (adverseAbove_union, Lean): it vanishes for defeated counterreasons once the defeater is docketed and for redundant reasons once one is found. As the theorem's object, no: the direct omission gain is what the obstruction is stated for; the additive certificate double-counts before either redundant reason is found.
Minimal inquiry abstraction. Finite worlds fixing the adverse reason states, a repertoire of outcome functions with costs, adaptive policies, cells, the certain docket (INQUIRY_MODEL.md §1).
"Independent inquiry", formally. Outcome functions are world-determined (evidence soundness); the policy's selection and stopping are functions of the history alone and run until the frontier is empty or the budget is spent; costs and candidate prioritization are functions of the program's conditional adverse mass and the declared repertoire, not of the advisor's submissions (§5).
The resource. Query costs against a budget at one occurrence; time enters only through the deadline; computation, attention and money are absorbed into costs. No per-period capacity: an inquiry policy is a decision tree, not a schedule.
What a query reveals. Its outcome function's value, which splits the current cell; its information about the residual is how it splits the cell's value profile.
Defeat and discovery obligations. Through the conditional certificate: a counterreason's obligation disappears when its defeater is docketed; a defeater of a docketed pro reason acquires positive conditional adverse mass (rows 7, 8).
Closure under counterreasons/defeaters. The frontier: undetermined reasons of positive conditional adverse mass. Empty frontier ⇒ residual ≤ 0 (Lean). Terminates under a finite interface.
The exact informativeness hypothesis. For the obstruction: the repertoire separates every pair of worlds whose shared content differs in value from their own (cell gap 0). For progress: witness completeness, every high-residual cell split by a fixed fraction in the worst outcome by some affordable action.
Is there a progress theorem? Under witness completeness, geometric decay (potential_decay, Lean) with the explicit budget relation. Not in general: the needle refutes any fractional progress for direct queries.
Sharp obstruction / dual. Yes: the information-cell gap, with the lower bound for every sound policy and attainment by the exhaustive policy (Lean); a minimax recursion for budgets, exact against enumerated decision trees. At the landing the gap is stated in best-response form for every extensional program (residual_ge_cellGap'), the antitone form being its corollary.
Minimum achievable residual. Unbounded budget: the largest cell gap. Budget B: V(Ω, B), no closed form.
Does adaptive inquiry matter? Yes: binary search on a chain closes with two queries where every fixed pair leaves 1/8 (row 15); and it does not help at all on the needle.
Advisor-controlled query costs. Break the residual bound (row 5); exogenous costs are a named hypothesis, as for service.
Search-space flooding. Harmless under frontier prioritization: a candidate false in every world is never undetermined, hence never on the frontier (row 4); fatal for an engine that must test every candidate. Candidate generation must be the engine's.
Discovery vs authentication. Discovery ends when the evidence determines a reason true; authentication is the engine certifying it; a determined reason that fails certification is the authentication residual (row 10 sits on the boundary).
Discovery vs service. The boundary is the docket: a docketed reason released too late is a service failure (row 13).
Discovery vs ontology incompleteness. A reason not in the declared space, or at the wrong granularity, has obstruction 0 in the model and is invisible (rows 18, 19); it is the representation wall, external.
**Does the discovery theorem output the hypothesis li_noncapture consumes?** Yes: "the content LUV of the pair (discovered, full) is at most a'/b' on the audited branch in every consistent world", with a'/b' the cell gap or minimax value relative to the declared hypothesis space (DISCOVERY_COMPOSITION.md §3).
**Can N_disc → N_full be bounded without an oracle?** Yes, relative to the declared hypothesis space: the bound is a computation on the declaration and the program. Adequacy of the space is the external hypothesis, not an oracle.
What remains after all four residuals vanish? Hypotheses, not residuals: adequacy of the declared representation, evidence soundness, engine-owned generation/selection/ stopping, exogenous costs, effect-side containment, the causal contract for transforms.
A serious end-to-end non-capture theorem? li_noncapture_chain: 𝔼ₙ(U_T) − 𝔼ₙ(U_full) ≲ₙ L·(α + β), with both bounds certified computations.
Does it compose with the effect side? Same compiled inequality, same certificate; the statement is below.
The strongest honest corrigibility theorem after this pass. Next section.

The strongest honest combined corrigibility statement (after the third pass)

Relative to an effect-complete interaction model carried by Γ, a declared reason representation with a declared hypothesis space and inquiry repertoire, a committed extensional program re-executed on the authenticated trace, an independent inquiry engine (evidence-sound, engine-owned policy and stopping, exogenous costs, engine-owned candidate generation) with certified cell gap β_n, an independent supplier (advisor-proof capacity, exogenous costs) with certified service loss α_n, sound authentication, the sealed-comparison architecture on the effect side (item 89) and a content-monotone audit on the reason side, and the declared-transform contract wherever a counterfactual is named:

𝔼ₙ(U_q) − 𝔼ₙ(U_𝔠q)      ≲ₙ  L·𝔼ₙ(Δ_n) + 𝔼ₙ(R_n) + D·𝔼ₙ(M_n)          (PR #100)
𝔼ₙ(U_T) − 𝔼ₙ(U_full)    ≲ₙ  A_tot·(α_n + β_n)                          (this round)

A bounded logical reasoner has asymptotically no operative advantage either from bypassing the principal's protected decision authority or from selectively controlling the principal's deliberative inputs, provided independent inquiry, service and authentication drive their explicit residuals to zero — relative to effect completeness, the adequacy of the declared reason representation, the causal contracts for intervention transforms, and physical containment.

Nothing in this statement is a residual any more except the four named quantities; what is not a residual is a hypothesis, and each is named.

What is in Lean and in fixtures (third pass)

lean/Workspace/Deference/Contrib/ReasonDiscovery.lean, 8 audited declarations, sorry-free, [propext, Classical.choice, Quot.sound] only: adverseAbove_union, residual_le_zero_of_frontier_empty, SoundPolicy.subset_certain, residual_ge_cellGap, exhaustive_attains_cellGap, potential_decay, li_noncapture_chain (and Model.certain_subset). Fixtures: src/inquiry.py, src/attacks_discovery.py; tests/test_discovery.py (17 tests; 48 in the round), including random-instance checks that every sound docket is bounded below by the cell gap, that the unbounded minimax equals the obstruction, that the budgeted minimax matches enumerated decision trees, and the needle and adaptivity instances.

Deviations from the third dispatch

The obstruction is mechanized as a lower bound for every sound policy and attainment by the exhaustive policy; the equality "minimax = max cell gap" is the conjunction, checked on random instances rather than stated as one Lean theorem over policies-as-trees.
The budgeted minimax is given by recursion and fixtures, not by a Lean development of decision trees.
The progress theorem is stated abstractly (potential_decay); the witness-completeness hypothesis is model-specific and is shown to fail for direct queries rather than characterized in general.
The hypothesis space Ω is taken as declared; no theorem relates it to the physical world, by design (the ontology wall).

What this does not establish

That any declared hypothesis space contains the truth, or that any repertoire's outcome functions are the physical ones.
A closed form or approximation guarantee for the budgeted worst-case value.
A realized inquiry engine with certified zero cell gap for a concrete interface (item 93).
The relation between this frontier and the normativity record's docketed inquiry obligations (items 54, 64).

Reserved to the maintainer

Whether the frontier should be adopted as the realization's inquiry obligation; whether to name the four residuals canonically as the manipulation side's complete accounting.

Registration

Nothing. Research branch.

Outstanding maintainer actions

Decide the merge of this pull request.
Decide the reserved questions; items 92 and 93 record the remaining work.

Second pass (retained): CONTENT-RESIDUAL-REDUCED-TO-A-SHARP-SERVICE-OBSTRUCTION

B. CONTENT-RESIDUAL-REDUCED-TO-A-SHARP-SERVICE-OBSTRUCTION, with the A-case as an explicit corollary: the content residual is closed by supply affordability exactly when the suffix-cut condition holds on the discovered docket. (Superseded as the verdict of record by the third pass; retained.)

What changed from the first pass: the content term is no longer a count but the adverse sensitivity mass of the reasons not served before commitment (CONTENT_RESIDUAL.md); an exact service theorem bounds it and characterizes when it is zero (SUPPLY_THEOREM.md); the bound composes with the landed Logical-Induction theorem in Lean with no new certificate (COMPOSITION.md); protected scope becomes a design parameter (hybrid_bound); the affordability connection is stated at theorem level and two first-pass claims are narrowed (AFFORDABILITY_REFINEMENT.md §5); one hypothesis the first pass had left implicit, exogenous service costs, is made explicit (COUNTERMODELS_SECOND_PASS.md row 12).

Consumes ../2026-09-15-li-corrigibility/, ../2026-09-10-committed-principal-program/, ../2026-09-09-evaluation-ecosystem-realization/, and, for the budget half of affordability, ../../../normativity/legitimacy/rounds/2026-08-31-normative-affordability/ (BD1, D4, M1, read rather than paraphrased). Nothing of the canonical wiki is edited.

The twenty questions (second pass)

The exact quantity for missing deliberative content. Miss_n := Σ_{r true declared, not served by T_n} A_r, the adverse sensitivity mass of the unserved true declared reasons, where A_r := sup_c (F(c) − F(c ∪ {r}))⁺ is how much adding r can lower the advisor's candidate's verdict (CONTENT_RESIDUAL.md §1).
Count, weighted, sensitivity-weighted, or direct? Sensitivity-weighted and directional (D^A). Relations, all Lean: omission gain ≤ D^A ≤ D^L ≤ L_max·count (adverse_union, sensitive_symmDiff); for weighted-count programs A_r = (−w_r)⁺ (weightedCount_adverse). Per-weight is wrong for defeat programs (fixture 7); the direct discrepancy is sharper (fixture 8) but is the comparator problem again; count charges weightless reasons. The theorem charges the smallest statically certifiable quantity.
The independent supplier model. A process other than the advisor with capacity cap(t) at each slot t < T_n, which sees a docket of discovered true declared reasons with release slots and costs and chooses which to serve; certified policy: heaviest-available-first (SUPPLY_THEOREM.md §1, RS6). Independence means two things: its capacity is not consumed by the advisor's submissions (row 11) and the cost profile is not the advisor's to raise (row 12).
The resource. Capacity units in slots, usable by a reason only in its release window [a_r, T_n); and, where service is itself enforcement, the affordability round's liability budget with date prices, additively (AFFORDABILITY_REFINEMENT.md §2).
The deadline model. One common commitment deadline T_n per occurrence, with reason-specific release times; windows are nested suffixes, not the affordability round's uniform-delay intervals.
The theorem that makes it small. RS1–RS4: the cost served from reasons released at or after s is at most Cap(s) (served_cut_le, Lean); full service forces the suffix-cut condition (cut_of_servesAll, Lean); for unit service the condition is also sufficient (unit_servable_iff_cut, Lean, Hall); the least unserved count is the cut excess and the least adverse miss is the matroid layer formula, attained by the greedy (fixtures, random-instance checks). Hence Miss*_n = 0 iff the suffix-cut condition holds on the discovered reasons of positive adverse weight.
Iff / dual. Yes for unit service: full service iff every suffix cut is underwritten (Hall); least unserved count = max cut excess (Hall's deficiency); least adverse miss = total mass − Σ_j (A_(j) − A_(j+1))·rank(top-j) with the rank the deficiency-corrected size. For general costs: the cut bound is exact for unserved cost, the weighted optimum is knapsack-hard (RELATED_MATH.md).
Affordability, scheduling, flow, covering? A bipartite transportation problem with nested neighbourhoods, i.e. a transversal matroid, for capacity; plus the affordability round's additive budget (D4 over the window) if service is enforcement. Not the authority-underwriting geometry, which has no shared slot (its N1); not online knapsack, since arrivals only add options and costs are known at release.
Discovery vs service. Miss_n = discovery_n + Miss*_n + authentication_n with scope outside (decompose, tests). Discovery is the adverse mass of true reasons no supplier releases before T_n (or releases too late to serve is service, since release is on the docket); it is policy-dependent (fixture 9). Only the service part is a computation on the log.
Protected scope. A design parameter: hybrid_bound (Lean) charges only the unprotected missing adverse mass on the audited branch and voids on any missing protected reason.
Is total protected scope desirable? Exactly when the suffix-cut condition holds for the whole interface; then voids come only from discovery and authentication. Otherwise it converts every service failure into a void: availability destroyed.
Does a hybrid dominate? Yes: protect exactly a servable set of largest adverse mass (the greedy set), so protected reasons are never missed by service, and charge the rest at their adverse mass; fixture 3 is the unit. Risk-sensitive: replace A_r by the designer's loss function of a missed r.
**Is N_full legitimate?** As a yardstick, yes: it is what "fully informed on the declared interface" means and it compiles as a world-valued LUV with no oracle. As a comparator a supplier can certify against, no: its content term includes discovery loss, which no log determines (fixture 16).
A realizable supplier comparator. The discovered comparator N_disc: every true declared reason on the docket before T_n, canonical form. The content term against it is service plus authentication loss, a computation on the log. The supplier's own output is not a separate comparator: with the supplier in the loop the actual trace is it, and the theorem's content is N_service against N_disc.
**Does the service theorem compose with li_steering_le?** Yes, in Lean: li_noncapture takes hsupply : ∀ n v, ∃ d, ValuesAt (X_d n) d ∧ (both → d ≤ a/b), which is exactly the sentence family "service loss ≤ α on the audited branch", and concludes 𝔼ₙ(U_T) − 𝔼ₙ(U_N) ≲ₙ L·(a/b). The bridge is li_gated_le, a degenerate pair fed to the landed compiled theorem, plus expect_constLUV.
Assumptions under which the content residual vanishes. Against N_disc: the suffix-cut condition on the discovered reasons of positive adverse weight at every occurrence, sound authentication, unit (or servable) costs exogenous to the advisor, supplier capacity not consumable by the advisor. Against N_full: additionally no discovery loss, which is not certifiable.
What remains after it vanishes. One quantity: the discovery residual, the adverse mass of true declared reasons no independent process raises before commitment. It is an inquiry problem, not a service problem, and no interface-local quantity measures it. Everything else remaining is a hypothesis rather than a residual: exogenous costs (row 12), the declared representation (scope, granularity), effect-side containment of world changes, the declared-transform contract for dynamics.
A serious non-capture theorem? Yes, li_noncapture: under a committed extensional program re-executed on the authenticated trace, a certified service bound α, and a content-monotone audit, Logical Induction learns 𝔼ₙ(U_T) − 𝔼ₙ(U_disc) ≲ₙ A_tot·α; with the cut condition, ≲ₙ 0. The comparator hides no oracle.
Does it compose with the effect-side theorem? They are instances of one compiled inequality (li_bypass_le_compiled), with the same certificate and the same shape of residual; COMPOSITION.md §5. The combined statement is below.
The strongest honest combined statement. See the next section.

The combined statement after the second pass

Relative to: effect completeness and the interaction model carried by Γ (T1's hypothesis); a declared reason representation with a committed extensional program re-executed on the authenticated trace; an independent supplier with exogenous costs and capacity the advisor cannot consume; the sealed-comparison architecture for the effect side's activation mismatch (item 89) and a content-monotone audit on the reason side; the declared-transform contract wherever a counterfactual is named. Then for every candidate continuation q and its principal evaluation,

𝔼ₙ(U_q) − 𝔼ₙ(U_𝔠q)      ≲ₙ  L·𝔼ₙ(Δ_n) + 𝔼ₙ(R_n) + D·𝔼ₙ(M_n)          (PR #100)
𝔼ₙ(U_T) − 𝔼ₙ(U_disc)    ≲ₙ  A_tot·α_n                                  (this round)

with Δ the mediation discrepancy, R the decision regret, M the activation mismatch, and α_n the certified service loss on the discovered docket. When the right-hand sides vanish,

the agent has asymptotically no operative advantage either from bypassing the principal's protected decision authority or from steering the declared reasons on which that authority is exercised, beyond the adverse mass of true reasons no independent process raised before commitment.

The last clause is the discovery residual and is not removable by any interface-local hypothesis.

Lean and fixtures (second pass)

lean/Workspace/Deference/Contrib/ReasonSupply.lean, 14 audited declarations, sorry-free, [propext, Classical.choice, Quot.sound] only: sensitive_symmDiff, adverse_union, weightedCount_adverse, weightedCount_sensitive, served_cut_le, cut_of_servesAll, unserved_ge_excess, unit_servable_iff_cut, hybrid_bound, constLUV_thresholdCodes, expect_constLUV, gatedPair_validAt, li_gated_le, li_noncapture. Fixtures: src/supply.py, src/sensitivity.py, src/attacks_second_pass.py; python3 tests/run.py runs 31 tests (11 first pass, 20 second), including random-instance checks of the cut criterion against exhaustive schedule search, of the deficiency and layer formulas against exhaustive optimization, and of online greedy against the offline optimum.

Deviations from the second dispatch

The mechanized sufficiency of the cut condition is for unit costs and unit slots (Hall); general costs with preemption are checked exhaustively and argued by flow, not mechanized.
The weighted optimum's exactness for unit costs (matroid greedy, layer formula) is fixture-checked and cited, not mechanized.
li_noncapture is stated for a constant bound a/b; the α_n → 0 corollary is by a routine shift of the families and is not mechanized (COMPOSITION.md §3).
The sealed-audit hypothesis hsealed is taken as a hypothesis of the realization, not proved for a concrete audit; against N_form, N_disc and N_full it holds by content monotonicity of the audit (first pass §2), which is not re-derived in Lean.
One fixture beyond the dispatch's sixteen (row 17: greedy fails for general costs).

What the second pass did not establish

Any bound on the discovery residual (the third pass supplies it); any characterization of reason relevance.
That any realized supplier has exogenous costs or advisor-proof capacity.
The general-cost weighted optimum in closed form (it is knapsack-hard).
The effect-side sealed comparison (item 89), consumed as a hypothesis.

Reserved after the second pass

Whether to adopt the hybrid protection rule (protect the servable set of largest adverse mass) as the realization's default; whether the discovery residual should be named as the manipulation side's single open quantity in the canonical wiki. Neither is done here.

Registration (second pass)

Nothing. The Lean results are set identities, Hall's theorem specialized, and an application of the landed compiled theorem; the round is a research branch.

Outstanding after the second pass

Superseded by the third pass's list above.

First pass (retained): NONCAPTURE-COMPILES-BUT-REASON-COMPLETENESS-FAILS

The first pass's verdict stands as the round's starting state: the trace-steering comparison has exactly the algebra of the effect-side inequality and supplies the landed compiled pair's validity package verbatim; scoped Robust Openness over a finite declared class of log transforms is a finite computation; the two-interface thesis is refuted as stated by truthful cherry-picking of an unprotected declared counterreason; the two repairs are scope and supply. Its sixteen answers:

Trace-steering analogue of T2. Yes: steering_identity and steering_bound (Lean), with the mediation discrepancy replaced by the canonical content discrepancy, the decline regret by the program's non-extensionality, the activation events by the audit verdicts; D sharp, reverse mismatch free, form branch attained.
Compiles into a bounded LUV inequality. Into the same one: steering_validAt supplies the landed ValidAt with w_app := V(N_form N) + (V(T) − V(N_form T)).
EPI transfers unchanged. li_steering_le is li_bypass_le_compiled applied to steering pairs; the finite-menu uniformity is inherited.
Undetected steering. Not one Boolean: the content, form and audit-mismatch residuals; the mismatch is zero against both log-side comparators.
**Scoped Robust Openness Γ-valid.** Over a finite declared class of log transforms, yes (openUnder_iff); the causal reading of the class stays external.
Intervention class. A finite declared class of log transforms; form by N_form, content by N_full, dynamics by declared transforms, world changes by the effect interface, grounds tampering by authentication.
Analogue of effect completeness. Two halves: trace mediation by construction (re-execution) and declared-content mediation (extensionality); a rewrite of the advisor's outputs exists for form and not for content.
Finiteness. Needed for the compilation and for decidability; reason relevance is not finitely characterizable.
Canonicalization independently necessary. Yes (not_extensional_of_form).
Coverage and liveness sufficient? No: fixture 2.
Affordability. Through the supply obligation; refined in the second pass.
Remaining modes. Undeclared types, granularity, dynamics beyond declared transforms; refined to the discovery residual in the second pass.
One residual? On the declared interface, L·E[both·d] + E[both·κ] + D·E[M]; refined to the adverse mass in the second pass.
Measurable. Form and transform mismatch from the log; content against N_full needs settlement of absent reasons; refined: the service loss is log-computable.
Two-interface thesis. Refuted as stated; survives strengthened.
Minimal counterexample. Fixture 2.

Attribution

Claude Fable 5.1 (Anthropic), under prompts/2026-09-16-noncapture-compilation/ (the maintainer's two-phase dispatch of 2026-09-15, Phase II, the refinement dispatch and the discovery dispatch of 2026-09-16, all verbatim in PROMPT.md).

README projects/deference/rounds/2026-09-16-noncapture-compilation/README.md

CORRIGIBILITY-NUCLEUS-CANONICALIZED-AND-LANDED — the combined authority and non-capture theorem is the canonical result: on the authority side the corrigibilization transform, event-linked authorization, the directional activation mismatch and the compiled inequality Logical Induction learns uniformly over polynomial-size efficiently generated menus; on the deliberative side the trace-steering inequality with its content, form and audit-mismatch residuals, the suffix-cut service obstruction, the information-cell discovery obstruction in its general best-response form for every extensional program with the antitone case as its corollary, and the composed bound E_n(U_T) − E_n(U_full) ≲ A_tot·(α + β) through the discovered comparator; the residuals are explicit and independently characterized, the hypotheses are named as logical, architectural, representation and causal-contract classes, and what remains open is the adequacy and evolution of the interfaces that supply the theorem rather than another corrigibility mechanism.

Third pass (retained in REPORT.md): DISCOVERY-RESIDUAL-HAS-A-SHARP-OBSTRUCTION — the discovery residual is the advisor's omission gain from the true declared adverse reasons not on the docket, bounded by their conditional adverse sensitivity mass above the docket, and it is zero whenever the frontier of undetermined reasons of positive conditional mass is empty, which makes an unresolved reason of positive conditional adverse mass an explicit inquiry obligation; in a finite inquiry model with a declared hypothesis space and a declared repertoire of outcome functions, every sound docket policy has on some world of every repertoire cell a residual at least the cell gap, the value of the certain docket minus the value of the worst world of the cell, and the exhaustive policy attains it, so the least worst-case residual with unbounded budget is exactly the largest cell gap and vanishes iff the repertoire separates every pair of worlds whose shared content differs in value from their own; with a budget the least worst-case residual is the value of a finite minimax recursion, exact but with no closed form, monotone in the budget and never below the cell obstruction, and no fractional-progress theorem holds for direct-query repertoires since the needle instance keeps the worst-case residual at its full value until the last query while adaptive inquiry strictly beats nonadaptive; the chain actual to discovered to full composes literally, so Logical Induction learns E_n(U_T) − E_n(U_full) ≲ L·(α + β) with α the certified service loss and β the certified cell gap or minimax value, Γ-valid relative to the declared hypothesis space; what remains external is adequacy of the declared representation, evidence soundness of the repertoire, engine-owned candidate generation, selection and stopping, and exogenous inquiry costs.

Second pass (retained in REPORT.md): CONTENT-RESIDUAL-REDUCED-TO-A-SHARP-SERVICE-OBSTRUCTION — the content term is the adverse sensitivity mass of the reasons not served before commitment; full service iff every suffix cut is underwritten; the least miss is the layered cut excess; protected scope is a design parameter; the bound composes with the landed compiled theorem through a degenerate pair. First pass: NONCAPTURE-COMPILES-BUT-REASON-COMPLETENESS-FAILS — the trace-steering comparison has the effect-side algebra verbatim and the two-interface thesis is refuted by truthful cherry-picking of an unprotected declared counterreason.

Reading order: [FINAL_THEOREM.md](FINAL_THEOREM.md) (the statement of record), [LANDING.md](LANDING.md); then the passes as research provenance. Third pass: [FOR_HUMANS.md](FOR_HUMANS.md), [DISCOVERY_RESIDUAL.md](DISCOVERY_RESIDUAL.md), [INQUIRY_MODEL.md](INQUIRY_MODEL.md), [DISCOVERY_THEOREM.md](DISCOVERY_THEOREM.md), [DISCOVERY_COUNTERMODELS.md](DISCOVERY_COUNTERMODELS.md), [DISCOVERY_COMPOSITION.md](DISCOVERY_COMPOSITION.md), [DISCOVERY_RELATED_MATH.md](DISCOVERY_RELATED_MATH.md), [THEOREM_CANDIDATES.md](THEOREM_CANDIDATES.md), [REPORT.md](REPORT.md). Second pass: [CONTENT_RESIDUAL.md](CONTENT_RESIDUAL.md), [SUPPLY_THEOREM.md](SUPPLY_THEOREM.md), [COMPOSITION.md](COMPOSITION.md), [AFFORDABILITY_REFINEMENT.md](AFFORDABILITY_REFINEMENT.md), [COUNTERMODELS_SECOND_PASS.md](COUNTERMODELS_SECOND_PASS.md), [RELATED_MATH.md](RELATED_MATH.md). First pass: [NONCAPTURE_COMPILATION.md](NONCAPTURE_COMPILATION.md), [REASON_INTERFACE.md](REASON_INTERFACE.md), [COUNTERMODELS.md](COUNTERMODELS.md), [LI_TRANSFER.md](LI_TRANSFER.md), [AFFORDABILITY_INTERFACE.md](AFFORDABILITY_INTERFACE.md). Lean: lean/Workspace/Deference/Contrib/TraceSteering.lean (11 audited declarations), ReasonSupply.lean (14) and ReasonDiscovery.lean (13), importing the landed LICorrigibilityCertificate.lean. Fixtures: src/, run by python3 tests/run.py (51 tests). Consumes ../2026-09-15-li-corrigibility/, ../2026-09-10-committed-principal-program/, ../2026-09-09-evaluation-ecosystem-realization/ and, read for its budget criterion, ../../../normativity/legitimacy/rounds/2026-08-31-normative-affordability/. Landed on main by PR #101 with the canonical wiki reconciled; nothing is registered.

Claims it registered

None.

Items it filed or answered

None recorded in the index.

Nodes pointing at it

deference-and-trust

2026-09-16-noncapture-compilation

PHASE I — FINISH THE FIRST BET AND MERGE PR #100

1. Re-read and adjudicate #100

T1 — Corrigibilization preserves principal options

T2 — Directional activation mismatch

T3 — Logical Induction learns the structural corrigibility inequality

T3′ — Uniformity over polynomial-size efficient menus

2. Close the P-generability / compiler hypothesis as far as the pinned formalization allows

3. Mechanize the trajectory-level corrigibility theorem

Authorization correction

4. Canonicalize the result in the wiki

5. Split the current item-90 residual if appropriate

6. Verification and merge

PHASE II — CREATE PR #101 AND PRESS ON NON-CAPTURE / REASON-INTERFACE CORRIGIBILITY

BET 2 — NON-CAPTURE COMPILATION

7. Define the comparison cleanly

8. Search for the manipulation analogue of T2

9. Pressure whether Robust Openness becomes Γ-valid

BET 3 — DOES MANIPULATION REDUCE TO A COMPLETE REASON INTERFACE?

Effect side

Reason side

10. Do NOT define reason completeness as “all relevant reasons are enumerated”

11. Add canonicalization/extensionality as a separate hypothesis

12. Connect coverage and affordability

13. Build adversarial fixtures before general theory

14. Test the strong symmetry thesis

15. Explore measurable residuals

PR #101 OUTPUT

A. TWO-INTERFACE-CORRIGIBILITY-SURVIVES

B. NONCAPTURE-COMPILES-BUT-REASON-COMPLETENESS-FAILS

C. NONCAPTURE-DOES-NOT-COMPILE

Second dispatch — refinement and pressure pass (2026-09-16)

1. Start from the surviving steering inequality

2. Define the service problem precisely

3. Choose the correct content-loss quantity

Count loss

Weighted loss

Program-sensitivity loss

Direct value discrepancy

4. State the exact service theorem we want

5. Connect rigorously to the existing affordability theory

Persistence

Timeliness

6. Look for an exact characterization, not just a sufficient condition

7. Separate three sources of missing content

8. Pressure the role of protected scope

9. Try to derive an end-to-end non-capture theorem

Reason-Supplied Non-Capture Theorem

10. Re-examine the comparator

11. Attack the theorem with small countermodels

12. Press the affordability connection at theorem level

13. Ask whether this closes the manipulation side of corrigibility

14. Reassess the full corrigibility theorem

Effect side

Deliberation side

15. Do not spend time on these unless needed

Deliverables

Final questions

A. CONTENT-RESIDUAL-CLOSED-BY-SUPPLY-AFFORDABILITY

B. CONTENT-RESIDUAL-REDUCED-TO-A-SHARP-SERVICE-OBSTRUCTION

C. REASON-SUPPLY-IS-NOT-THE-RIGHT-REDUCTION

Third dispatch — discovery pass (2026-09-16)

1. State the discovery residual precisely

2. Do not assume "discover every true reason"

Full discovery

Adverse-mass discovery

Decision-sufficient discovery

Defeat-closed discovery

Certificate-relative discovery

3. Separate ontology completeness from discovery

4. Model the inquiry process

5. Investigate the role of defeat

6. Look for a progress theorem, not merely a coverage assumption

7. Find the right notion of informativeness

Coverage

Separation

Value of information

Defeat completeness

Witness completeness

8. Look for an exact obstruction / dual

2. Close the `P`-generability / compiler hypothesis as far as the pinned formalization allows

9. Pressure whether Robust Openness becomes `Γ`-valid