ontoref — Case 3/0: the witness that certified a world which no longer existed

🩺 Show the full clinical history → 📋 Session protocol →

Clinical history · Software Pathology

The witness did not fail. It did not warn. It did not error. It looked exactly where it had always looked, found nothing wrong there, and certified — in green — that all was well. It did so three times in a single session. And all three times the cause was the same, and this is the uncomfortable part: someone had IMPROVED the very mechanism it was watching. The patient is the whole series. The pathogen is old. What is new is that this time the floor was laid, the mechanism WAS pointed at the surface that hurt, and the witness existed. And still.

History No. 3/0Diagnosis: ANTI-PAP · UNWITNESSED COVERAGEStatus: RESOLVED

"It is all green." That is what the witness said, with the number in front of it: zero findings. And it was true — of the files it was reading. What it did not say, because it had no way to say it, is that it had spent three hours looking at an ever-smaller subset of what existed. Nobody lied. Nothing broke. The world simply grew, and the receipt stayed where it was.

Show clinical picture

witness: A signed receipt that a check ran and what it returned. It proves structure, never truthfulness. And — this is the whole case — it proves THAT it ran, never THAT IT LOOKED AT EVERYTHING IT SHOULD HAVE.
coverage: What a check actually reads: which files, which formats, which levels. It is the one thing no witness carries — which is why a check can go green over a shrinking fraction of reality without its receipt ever expiring.
extent: The axes a mechanism exists over: its formats, its levels, its languages, its locations. When the extent grows and the coverage does not, the check does not fail. It approves.
relapse: Case 404-PAP-bis fixed the term: the same pathogen, another organ. This is the relapse of the series' pathogen — declared twice, no witness — with one turn of the screw: HERE THERE IS A WITNESS, and it is the witness that lies.

The protocol to declare, version and verify this → ontoref.dev

The double ledger — what it cost, and what it left

The figures on the left are the clinical picture. Those on the right, the discharge. And there is an asymmetry worth facing: the cost column is full of ZEROS — zero warnings, zero CI recipes, zero findings emitted — and the zeros ARE the symptom, not its absence. A zero in the box marked “warnings emitted while going blind” is not a healthy system: it is a system with no way to say “I do not know”. The entire cure fits in giving it that word.

What the crime cost

Blindings of the SAME witness, in one session 3
…and all three were caused by an IMPROVEMENT 3
Warnings the witness emitted while going blind 0
Hours between writing the anti-pattern and committing it under 4
Files the inherited gate looked at 10 of 110
CI recipes that called that gate 0
Checks that went quiet when their source failed 1 (returned an empty list)
Checks satisfiable without fixing anything 1 (14 strings, 304 keys untouched)
Moves a generator failed to follow 4 · in one binary
Resolvers returning the path that had just failed 1

What the case left behind

The rule the witness is extended in the SAME act as the mechanism
The proof falsify against the NEW capability, not the old one
The missing primitive coverage ⊇ extent, or it breaks
…and it already worked on one axis adding a language fails the build
The witness, today 2 formats · 2 levels · 2 route origins
State 0 Hard · 28 routes · 25 pages

The point of abandonment — what the table doesn't show

The point of abandonment came when the witness — freshly taught to read the consumer’s routes — went blind AGAIN the moment those same routes moved from TOML to NCL. A second blinding can be called bad luck. A third, on the same witness, in the same afternoon, for the same reason, cannot. And the temptation at that point is exactly the wrong one, because it is the comfortable one: promise to be more careful. Add it to a list. Write in the style guide that one must remember to update the checks. That is advisory prose, and this project has spent three case files proving advisory prose binds nobody — least of all an agent. The agent that broke the rule three times had written it that same afternoon, in an ADR, under its own name: gate-green-over-nothing. Writing it was not enough. NOTHING THAT DEPENDS ON REMEMBERING IS ENOUGH. The only honest way out is to make forgetting IMPOSSIBLE: extending the mechanism must break the check, and the only road back to green must run through falsifying the check against the NEW capability.

Differential diagnosis — what was ruled out

Carelessness	“"I forgot to update the check." It happened THREE TIMES, in four hours, to the same agent, on the same witness, while it was drafting an ADR whose anti-pattern is literally named `gate-green-over-nothing`. Carelessness does not repeat with that precision. When the same failure appears three times in one turn, what failed is not attention. It is structure.”	ruled out
A badly written check	“"The check was badly written." It was not. It was CORRECT the day it was written, and correct is what it stayed — about a world that had ceased to exist. The blindness did not come from an error. It came from TIME: the distance between the moment it was written and the moment the mechanism moved.”	ruled out — and there is the finding
Undeclared coverage	“"Coverage was never declared." It was. `coverage` in `lexicon.ncl` names its globs, its sources, its projections, and a contract refuses an omitted surface. And the witness went blind anyway — because the coverage declared what the check READ, not what it SHOULD read. Declaring your coverage with nothing to check it against is declaring your own opinion.”	ruled out — necessary, insufficient
"We need more discipline"	“"We need more discipline." GUILTY — of being useless. It is exactly the advisory prose this protocol has spent three case files proving does not bind: it does not hold a human under deadline and it does not hold a probabilistic actor at all. This very case proves it — the agent that broke the rule three times had WRITTEN it that same afternoon. Discipline is not the treatment. It is the symptom of having none.”	GUILTY — of being useless

Etiology — the cause — resolve_framework_root — a resolver that returns the path that just failed

// gen-content-graph — resolve_framework_root

project_root
    .join("..")
    .join("rustelo")
    .canonicalize()
    .unwrap_or_else(|_| project_root.join("..").join("rustelo"))
//                     └─ returns the path that JUST failed

// Three layers down, nickel says:
//   Error: "IO error"
// and the graph ships with zero nodes. The page renders. Nobody complains.

And that binary had failed to follow the ontology through four moves: to .ontoref/ontology/, to the constellation root, into a nested site, and to protocol-shipped defaults. Four moves. Zero warnings.

Treatment — The primitive that already worked on one axis and nobody had named

# The contract that ALREADY did this on one axis, unrecognised:

CoversDeclaredLanguages   # adding `fr` to `languages` FAILS THE BUILD
                          # until all 45 concepts answer for it.
                          # A half-added language CANNOT SHIP.

# Generalised, it is the missing primitive:

  the MECHANISM declares its EXTENT    (formats · levels · languages · locations)
  the CHECK     declares its COVERAGE  (which of those it reads)
  a gate:       coverage ⊇ extent, or the build breaks
  the witness carries the extent's digest

# And the inversion:
#   before → improving the mechanism BLINDS its witness, in silence
#   after  → improving the mechanism BREAKS its witness, loudly

It was built twice — CoversDeclaredLanguages and CoversEverySurfaceAndLanguage — without recognising they were the same thing. This case exists, in part, to name it.

Prognosis

The series asks: with ontoref, would it not have gone like this? And here the answer changes shape, which is the reason to publish it. In the three previous cases the answer was NO for one reason: the mechanism existed and was never pointed at the surface that hurt. THIS TIME THE MECHANISM WAS POINTED. The floor was laid. There were contracts, there were gates, and there was a witness. And it still failed — because a witness proves THAT a check ran and what it returned, and does NOT prove that it looked at everything it should have. Coverage is unwitnessed. That is the gap, and it belongs to the protocol, not to whoever wrote the check. And there is an aggravating factor that makes it worse and more useful: all three blindings were caused by an IMPROVEMENT. I let the site own its templates, and the witness knew only the framework’s. I let the consumer own its routes, and it read only the image’s. I put those routes under contract, and it read only TOML. Every time I extended the mechanism, its witness fell behind — and instead of breaking, it approved. The act of improving a system is precisely what blinds its watchman. A check is written against the world as it is; the instant you improve the world, the check certifies a world that no longer exists, and it certifies it in green. It does not fail, it does not warn: it looks where it always looked, finds nothing wrong there, and signs. The cure is not remembering. The cure is that coverage expires on its own.

A witness proves it RAN, not that it LOOKED AT EVERYTHING	Coverage becomes part of the witnessed surface. A receipt that does not say what it looked at is not a receipt: it is a signed opinion.
Coverage expires when you IMPROVE the mechanism	The mechanism declares its extent; the check declares its coverage; a gate demands coverage ⊇ extent. Extending the mechanism breaks the check instead of blinding it.
A green check cannot tell "all clear" from "I did not look"	The witness carries the extent's digest. A receipt issued against the old extent stops being green and becomes unproven — a different word, and today it was not.
A check can measure what is easy instead of what is true	Falsify against the capability, not the metric. «Has a title?» is satisfied by 14 strings; «has a body renderer?» cannot be satisfied without fixing the page.
A check can go quiet when its source fails	A failure to load the source is a finding, not an empty list. Returning zero findings because you could not look is the worst kind of green.
A resolver can return a WRONG answer instead of NO answer	It returns an error naming the candidates it tried. A path that does not exist, handed back as if it did, travels three layers before surfacing as a blank screen.

Prophylaxis — what enforces the lesson today

✓
Coverage expires when the mechanism improves: coverage ⊇ extent, or the build stopsadr:072/coverage-superset-of-extent
✓
A check can — and must — say «I did not look» instead of signing greenadr:072/a-check-can-say-i-did-not-look
✓
The negative case per axis, seen to refuse, stays in the treetest:.ontoref/reflection/tests/test_expediente_coverage.nu
✓
In the chaingate:just expedientes-check

Discharge and prophylaxis

This case’s own opening measurement was made with a throwaway script, and that script still returns a false positive the gate that replaced it no longer does. It is the best way to phrase the discharge: the difference between measuring once and declaring forever is that what is declared CAN EXPIRE — and can therefore TELL YOU that it has. A number measured by hand is true the day you measure it. A contract is true until it stops being true, and on that day it says so.