Case 9/0: the value nothing could contradict
The gate was new, mutation-tested, and it signed off. It measured the artefact; what had failed was where the value came from.
🕵️ Show the full case file → 📋 Session protocol →
Case file · Drift Division
The gate had been built that same morning: fifteen unit tests, six controls over real files, and five mutations watched turning red. It approved a PDF that set the book in the wrong typeface, and it was right to: none of its five rules asks where a value came from.
Show glossary
- conformance
- What a gate like opus-pdf-check asks: does the artefact meet what the profile declares? Answered by measuring the artefact — colour space, embedding, resolution, page box.
- provenance
- The other question, and no measurement of the artefact answers it: did this value come from the home that declares it? A correctly embedded typeface satisfies conformance whichever typeface it is.
- a value's home
- The one versioned place a value is declared. The book's typographic family lives in the brand BY ROLE — reading, display, ui; the work's profile names the role and never the family.
- enumerated debt
- A list of exceptions inside the gate itself, each with its reason and the order that ends it. An exception naming a file that no longer exists makes the gate FAIL: the list cannot rot in silence.
- negative control
- Watching a gate turn RED before believing a green. Five mutations of the rule code, red every one, green on restore.
The protocol to declare, version and verify this → ontoref.dev
The double ledger — what it cost, and what it left
After the intervention no hand-written print template remains — four retired, none surviving — and the preamble is emitted from the profile and the brand. The new validator compares seven values against their home and was watched turning red four times: a planted .tex, a planted typst invocation, a hardcoded family and a margin that is not the profile’s. The whole corpus went through the chain: 55 of 59 documents compose and pass the profile, three are refused by the ODT conformance gate for prior drift, and one fails on a framed box longer than a page, which is a layout decision a person owns.
What the crime cost
- Rules of the gate that could see the wrong family 0 of 5
- Mutations the gate had already passed, red each time 5
- Profile values transcribed by hand into the template 9
- Of those, verified against their home 0
- Days since an ADR governed this same drift 0 · the same day
- Families in force for one destination, measured the day before 6
- What caught it a stale exception
What changing the class of check left behind
- Composition values written by hand, afterwards 0
- Templates retired — none survives hand-written 4
- Provenance checks, value by value 7
- Mutations of the new validator, red every one 4
- Stale exceptions retired from the enumerated debt 4
- Documents that compose and pass the profile 55 of 59
The case files as RESOLVED, with a figure best left unsoftened: zero days between the ADR that governed this drift and its reproduction. Governing where a value lives does not stop anyone holding a copy; what stops it is there being nowhere to copy it to.
The point of abandonment — what the table doesn't show
What stopped being watched was not the typeface: it was the question «where did this value come from?». The project had it answered for FAMILIES, with a home and a biop, and had answered it the day before in an ADR. What it did not have was a mechanism that asked it while COMPOSING, which is the moment a value gets transcribed.
The suspects — the false leads
| «Colour space is measured with gs -sDEVICE=inkcov» | “Ruled out by measuring: inkcov gives the SAME four numbers, to five decimals, for the RGB original and for its CMYK conversion. It renders onto a CMYK device and measures ink, so it answers about the render and not about the document.” | Wrong instrument |
| «The TrimBox is right: pdfinfo says so» | “Ruled out by measuring: poppler SYNTHESIZES the TrimBox when the file declares none. «Trimmed exactly at the sheet» and «never trimmed» read alike, and a broken override that stripped every box from a real output passed the gate.” | Synthesized witness |
| «The gate exited 1, so the source is not conformant» | “Ruled out by reading the report: the gate had exited 1 for not finding its contract — a path relative to the CWD — and not because of the document. A report that cannot be parsed is a gate that DID NOT RUN.” | Exit code read as verdict |
| «This document is losing twelve figures» | “Ruled out by opening the package: the twelve images are ORPHANS, content.xml references none of them, and the only string resembling the tag is draw:image-opacity, an attribute. Of 59 documents, exactly one shows figures.” | Package mistaken for body |
| «The template carries the profile's values: its header says so» | “Ruled out by asking the home: the brand declares reading = Literata with Georgia as its FALLBACK. The header told the truth about eight values and lied about the ninth, which is precisely what makes a provenance claim useless without a checker.” | Header without a checker |
The weapon — The weapon, verbatim
% templates/latex/book-template.tex — retired 2026-09-20
% EVERY VALUE COMES FROM THE PROFILE, none is an opinion of this template.
% TextBlock 16 x 24.7 cm · Margins 2.5cm · BodySize 12pt · ...
% families reading (the brand says who that is)
...
\setmainfont{Georgia} % <- the brand says Literata; Georgia is its FALLBACK
The copy did not come from nowhere: Georgia was in both templates retired that same morning, and they were open because the ENGINE was being chosen. The typeface was noise for the measurement at hand, which is exactly how it travelled unlooked-at.
The turn — The repair
# scripts/nu/latex-preamble.nu — the preamble is generated, not stored
let family = (brand-family ($profile.families | first).brand)
...
$"\\setmainfont{($family.family)}"
# and the check that was missing does NOT measure the PDF: it compares the
# emitted preamble against its home, value by value
$ nu scripts/nu/adr-check-print-route.nu
print route: preamble generated from the profile and the brand, no versioned
template and no typst EXIT=0
The question that triggered it was not mine: «wouldn’t it make sense to generate the template from the settings configured in the ncl?». The precedent was already in the repo — the ODT template is emitted from its contract — and I had read, in that same session, the profile’s own header saying «who each family is, the brand declares». I followed the template instead of the pointer.
The verdict
The uncomfortable part is that everything done well that morning stayed well done: the gate measured what it claimed to, five mutations had turned it red, and the PDF met the profile. The defect entered through the one place where no question was possible. And it was caught by a mechanism watching something else: retiring three templates left an exception of the enumerated debt naming a missing file, the gate refused BY DESIGN, and its own case text — six families for one printed destination, measured the day before — named the confusion being repeated at that moment. An ADR had governed that drift the same day; it governed where a value lives, not the act of copying it. Which is why the repair was not another check: it was removing the destination.
| A copied value has nothing to contradict it | The preamble is GENERATED from the profile and the brand (latex-preamble.nu), and nothing is left written by hand. Checking narrows an error class; generating removes it — a preamble with no values of its own cannot get the family wrong. |
| The gate measured the artefact, not the provenance | The two questions are separated and both have a mechanism: opus-pdf-check keeps measuring the artefact against the profile, and adr-check-print-route.nu compares the emitted preamble with the profile and the brand VALUE BY VALUE. ADR-029's constraint is what runs the second. |
| The header asserted a provenance nobody checked | The generated file opens with GENERATED … not edited, regenerated and lists where each value comes from. A provenance claim in a hand-written file is folklore; in a derivative it is its generation record. |
| What caught it was a stale exception, sideways | This one HELD, and it is the mechanism that did the work: composition-values-defined-once enumerates its drift with the reason for each exception, and REFUSES when one of them names a file that no longer exists. Retiring three templates left the list stale, the gate failed by design, and its own case text — «Georgia in both templates, Literata in the style contract» — named the confusion being repeated at that very moment. |
| An ADR governed this drift the same day and did not prevent its reproduction | Because it governed WHERE a value lives, not the act of copying it elsewhere. ADR-029 removes the destination: there is no versioned template to transcribe into, and the validator refutes a preamble that did not come from its home. An ADR that declares the home also needs nothing to be able to hold a copy. |
The reconstruction — the session, replayed with protocol
What was asked — reconstructed from .coder/2026-09-20-16-interfaz-editorial.plan.md:535 — the task's row, verbatim, with its line number. The same plan adds at :548 that «6.3 is bl-015 … graduates_to = 'Adr», and the session's opening brief (.coder/2026-09-20-17-bloques-6-7.prompt.md:9) orders block 6 first.
| 6.3 | Decidir la ruta única de impresión. **La decide 6.2 midiendo, no una opinión** | moderate |
What should have been asked
Decide the route by measuring, and deliver the decision as a GENERATOR, not as a template: no composition value written by hand in any file. Before composing anything, ask each value of its home — the work's profile, the brand by its role — and write the checker that compares what is emitted against that home, value by value. If you transcribe a value, the session has failed even if the PDF passes the gate.
| Microtask | Verifiable |
| Measure the candidate engines before holding an opinion, with the gate as referee | gs -q -dBATCH -dNOPAUSE -o - -sDEVICE=inkcov <typst>.pdf and <xelatex>.pdf → C=0.00211 against C=0.00000 over the same text |
| Check the engine can emit the standard the ADR requires, before choosing it | typst compile --help | grep -i pdf-standard → PDF/A and PDF/UA, no PDF/X |
| Ask the brand for the family by its role, never copy it from a template | nu -c 'use scripts/nu/lib.nu *; brand-family "reading"' → family = Literata, fallbacks = [Georgia, serif] |
| Write the PROVENANCE checker and watch it fail before generating anything | plant \setmainfont{Georgia} in the generator → nu scripts/nu/adr-check-print-route.nu EXIT 1 naming the family; restore → EXIT 0 |
| Never take an exit code for a gate's verdict | opus-odt-check <odt> without --contract from the constellation root → fails for not finding the contract, not for the document; with an absolute --contract → 1/1 conformant |
The gate before delegating: The provenance checker — adr-check-print-route.nu, comparing the emitted preamble against the profile and the brand — written and watched FAILING before the first PDF is composed. Without it the only gate available was the conformance one, which approves any family so long as it travels embedded, and that is why the green did not distinguish «composed with what is declared» from «composed with its fallback».
The ADR trigger: The moment it was decided that the preamble is GENERATED and not stored. Not a preference: it decides that no versioned file may hold a copy of a composition value, and every future destination inherits that. adr? should have fired there, not at the end of the session.
Case law — what enforces the lesson today
- ✓The print route and its generated preamble, with the alternatives rejected by measurement
adr:029/print-preamble-is-generated-from-the-profile - ✓The gate that refuses the PDF stays independent of the producer
adr:029/the-print-pdf-is-refused-by-its-profile - ✓The validator compares the emitted preamble with the profile and the brand, value by value
test:code/scripts/nu/adr-check-print-route.nu - ✓The family is asked of the brand by its role, never written
code/scripts/nu/lib.nu — brand · brand-family · expression-profile - ✓No typographic family outside its home, with the debt enumerated and its expiry
contract:.ontoref/biop/composition-values-defined-once.ncl#nucleus.cmd - ✓The profile's address, once per language, with the pattern narrowed to the FILE
adr:017/toolchain-paths-defined-once
⊘Declared debt: What remains is a declared limit, not a pending task: the «provenance» class is covered only where there is a generator to compare against. A composition value someone writes by hand in a file no generator emits — a prose guide, a reference ODT — is still invisible to this class of check, and all it has is the biop's enumerated debt, which watches families and not sizes, leadings or page boxes. Settling it is an order that declares those three the way the family is already declared, with its pattern and its test.
From the project vocabulary (5)
- Gate
- Typed prerequisites and policies controlling FSM state transitions in a project.
- Guide
- Feedforward control in a coding-agent harness: what steers the model BEFORE it writes — architecture docs, convention files, skills.
- Nucleus
- The `.ncl` of a cell: claim, evaluation and interface, plus the identity and lineage that make it the same cell across tissues.
- adr?
- Evaluation procedure invoked at the end of a session or feature.
- ontoref
- The protocol itself: a typed, queryable surface on which a project declares WHAT IT IS (ontology) and HOW IT ACTS (reflection), so a claim about the project can be contradicted by a machine and not only by a reader.
Perspectives