Memory Feedback Loop — On Mode Completion the Loop Proposes State, Backlog and Proof Deltas, Never Applies Them

Context

The constellation-memory work closes a loop: harvest insights (component A), fold them with the interaction trace into a chronicle (B), graduate them into criteria (C/ADR-049), and surface proof candidates (G/ADR-051). The question this ADR answers is what happens at the END of a working session — at `mode complete` of the coder-workflow (ADR-011 mode guards/convergence). The accumulated reflection (chronicle, criteria, trace) now contains signals that bear on authoritative ONTOLOGY state: an FSM dimension in state.ncl may have met its transition condition; a backlog item may be completable; a proof candidate may be citable. The reflexive temptation — and the thing that would make the loop feel 'intelligent' — is to have the loop APPLY these: advance the FSM dimension, close the backlog item, attach the proof. That is the precise collapse the project's identity tension forbids. The whole memory loop is reflection (what BECAME — memory, drift); state.ncl, the backlog status, and accepted proofs are ontology (what IS — authoritative state). ADR-024 fixed that authoritative state mutates ONLY through declared operations carrying a witness; ADR-046 fixed authority as declared and learning as tuning within a declared envelope (C1) recorded as witnessed, reversible operations (C2). backlog.nu already ships propose-status and approve — a propose/approve seam built for exactly this. What is missing is the rule binding the loop to that seam: the loop is allowed to NOTICE and PROPOSE, and forbidden to APPLY.

Decision

At `mode complete` the memory feedback loop emits PROPOSED deltas and never applies them; authoritative state changes only through the existing witnessed approve path. Four mechanisms. (1) PROPOSE-ONLY HOOK — a `mode complete` proposal hook in run.nu surfaces candidate deltas of three kinds — FSM-transition proposals against state.ncl dimensions, backlog-close proposals, and proof-citation proposals (ADR-051) — each as a proposal record via backlog propose-status, NEVER as a direct mutation of state.ncl, the backlog status, or the proof set. (2) APPROVE IS THE ONLY MUTATION PATH — a proposal becomes an authoritative state change only through approve, which is a declared operation carrying a witness (ADR-024); the loop has no write path to authoritative state that bypasses approve. (3) PARTIAL REALIZATION IS DESCRIBED, NOT COLLAPSED — when harvested reality diverges from a declared state or claim (a dimension's blocker is gone but its catalyst is unmet; a milestone shipped that no proof claims), the loop DESCRIBES the half-state and proposes the delta that would move it; it never drops the declared intent because reality differs, and it never fabricates a transition to make reality and intent agree. (4) IGNORING THE LOOP IS ALSO A FAILURE MODE — the hook always RUNS at mode complete and always SURFACES its proposals (even if none are accepted), so the opposite collapse — Yang decide-and-commit blind to drift — is structurally prevented: the proposals are presented, the human disposes.

Constraints

• Hard The mode-complete hook emits FSM-transition, backlog-close and proof-citation deltas only as proposals via propose-status; it has no path to mutate state.ncl, backlog status, or the proof set directly
• Hard An FSM transition, backlog close, or proof citation proposed by the loop becomes authoritative only through approve, a declared operation carrying a witness (ADR-024); no silent or timeout-based application
• Hard When harvested reality diverges from a declared state or claim, the loop describes the half-state and proposes the delta; it never drops declared intent because reality differs nor fabricates a transition to reconcile them
• Soft The mode-complete hook always runs and always surfaces its proposals (even when none are accepted); proposals cannot be silently skipped

Alternatives considered

• Auto-apply deltas the loop is confident about (advance FSM, close backlog, attach proof) — rejected: The defining collapse: reflection (the loop) mutating authoritative ontology state directly, bypassing the ADR-024 witnessed-operation boundary. Confidence is not authority; only approve confers it.
• Drop or rewrite a declared state/claim when harvested reality contradicts it — rejected: The reality-collapses-intent ondaod violation: the half-state is a location on the flow, not a defect. The loop describes partial realization and proposes; it never erases declared intent to match reality.
• Let the loop's proposals be optional / skippable at mode complete — rejected: Permits the mirror collapse toward Yang freeze — the project silently ignoring real drift. The hook always runs and always surfaces proposals so the reflection signal is never invisible, even when declined.
• Build a dedicated proposal store and approval UI outside backlog — rejected: Duplicates the propose-status/approve seam backlog.nu already ships and the ADR-024 witnessed-operation path. Reusing them keeps a single audited mutation channel rather than a second one to secure.
• Require human acceptance but apply silently if not declined within a window — rejected: A timeout-to-apply is auto-apply with a delay — it still lets reflection mutate authoritative state without a positive witnessed act. Approve must be an explicit declared operation, never a default-on-silence.

Anti-patterns

• Loop applies a delta — The mode-complete loop advances an FSM dimension, closes a backlog item, or attaches a proof directly, mutating authoritative ontology state without a declared, witnessed approve.
• Intent erased to match reality — A declared state or claim is dropped or rewritten because harvested reality contradicts it, collapsing a legitimate half-state into a fabricated agreement between intent and reality.
• Drift silently ignored — The loop's proposals can be skipped without ever being surfaced, so real divergence between reflection and ontology is invisible and the project commits blind to drift.
• Timeout-to-apply — A proposal is applied automatically if not declined within a window, making silence a positive authorization and reintroducing unwitnessed mutation through the back door.

Related ADRs

ADR-024 · ADR-046 · ADR-011 · ADR-025 · ADR-037 · ADR-029 · ADR-049 · ADR-051