Spec · v1 draft · for red-pen · Quanta

Receipts Carry the Living Map

Every receipt arrives with its slice of the map already inside it — who depends on this, what it touches, where to look next — kept true by three independent rails, so no agent ever has to choose to fetch or refresh the graph. Push at session start lost; truth bound at the point of use won. This is that verdict, applied to the map itself.

v1.1 · red-penned & ruled 2026-07-13 · builds after the seam battery lands

Where this came from (so the memory is anchored)

You asked for the graph to live inside the receipts — embedded at mint, updated automatically, never a recommendation an agent may or may not follow. Two earlier pieces make this possible now. First, the always-fresh engine (specced June 25, built): the graph itself revalidates on every read and never serves a stale picture. Second, the seam receipts being falsification-tested tonight — their "two records must agree" checker is exactly the guard this design needs. This spec is the composition of the two.

↘ go deeper — the measured basis for "recommendations don't work"
EXP-H (the compiled-mind experiment) found richer front-loaded context did NOT reduce escapes at depth; EXP-TB found claims bound to the artifact at the moment of use moved builder behavior unprompted. Push at session start lost; pull at point-of-use won. This spec applies that verdict to the graph itself.

The journey — one receipt, from mint to an agent's hands

  1. Mint: the slice is born inside the receipt, stamped. When any receipt is minted, we compute its map fragment — who consumes this, blast radius, the seams it sits on, where the engine is blind — and embed it in the record with the graph version it was computed at. The record stays immutable forever; the slice never claims to be current, it claims "true as of graph X" — which is checkable. Even an agent reading the raw file with no service gets an honest, dated map.
    ↘ go deeper — the record shape
    graph_context: { computed_at:{global_hash, head_sha}, artifact_keys, consumers_topk (backward reach, k=5), blast_radius:{files, gate_legs}, seams:[ids], fences:[verbatim blindness], weak } — minted by the deposit layer via one backward-reach call against the always-fresh snapshot. Additive schema bump; settled records never rewritten.
  2. The living copy sits beside it — a maintained view, never pretending to be settled truth. A small sidecar file keyed by the record's id holds the current slice. The immutable record and the living sidecar are joined into one answer at read time. From the agent's chair, the slice simply IS in the receipt — no choice-point, nothing to remember to run. Same move as "gates deposit, not agents."
    ↘ go deeper — where sidecars live
    Local: .genome-graph/slices/<record-id>.json, gitignored, regenerable from scratch. Service: under the service's own data root, keyed repo+record — never inside a served repo (consistent with the write-footprint fix). Carries refreshed_at + refresh_reason (mint | write-through | read-repair | backfill).
  3. Three independent rails keep it true — because no single one is trusted. (1) Write-through: every gate run and driver beat diffs what changed and recomputes only the touched slices — "which slices does this change affect" is itself one reach query. (2) Read-repair: at serve time the slice's stamp is checked against the live graph; mismatch → recompute that one slice on the spot, heal the sidecar, serve fresh — a week of lapsed write-through still can't hand an agent a stale slice. (3) The parity gate: a standing gate leg samples records every run, recomputes their slices, and goes RED on any divergence — divergence enumerated, never silent. We never trust the maintenance machinery; we gate it.
    ↘ go deeper — the rails' mechanics
    scripts/slice-sweep.mjs --changed <files> (reverse-reach → recompute; wired into gate epilogue, driver beat, post-commit hook, all fail-open with warnings) and --all (daily beat + backfill). Read-repair lives in the serve route: stamp mismatch → one reach query against the held-fresh snapshot, 500ms budget, failure serves the mint-time slice labeled stale:true. The parity leg samples N=10 records seeded by HEAD (reproducible), deep-compares, REDs with record ids; census entry + self-falsification fixture (planted corrupt sidecar → RED). The parity check is structurally an AGREE seam — the receipt kind under falsification tonight guards this design.
  4. The agent reads one thing and gets both truth and terrain. "This check passes — and here are its 3 consumers, its 14-file blast radius, the two seams it sits on, and the one place the engine is blind." The map arrives fragment by fragment, riding on truths the agent was already reading — never a wall of context at session start, never a query it might skip.
  5. Proof, not faith: every rail must be shown catching a planted change. We plant a real graph change (add/remove a consumer). Kill write-through → read-repair must heal at serve. Kill both → the parity gate must go RED. A do-nothing refresher must turn the gate RED (the degenerate control). Bars set before data: zero unexplained divergence across 14 driver beats; mint overhead ≤ 250ms; heal ≤ 500ms — measured from raw.
The one constraint we never cheat: settled records are never rewritten. The mint-time slice is stamped, not edited; the living copy is a sidecar that admits to being a maintained view. A slice that cannot recompute serves labeled STALE or CANNOT-CERTIFY — never silently fresh.

Your three calls — RESOLVED (2026-07-13)

✓ 1 · Living slice for raw-file readers — RULED: local-only + served

No commit churn; each checkout regenerates cheaply; the service is canonical; raw readers still get the honest mint-time stamped slice inside the record. (The rejected option — committing living slices — bought grep-visibility at the price of permanent machine-generated commit noise: a fresh printed bank statement mailed and filed every hour.)

✓ 2 · Parity gate depth — RULED: both

A 10-record spot-audit on every gate run (seconds — a broken refresher breaks dozens of slices at once, so any sample catches systemic failure within one run) plus a full audit on the twice-daily driver beat (no single corrupted record hides past 12 hours).

✓ 3 · Backfill — RULED: one sweep now

Lazy population would leave the parity gate blind over the never-served tail.

The clarification your red-pen surfaced

"Why not just compute the updated value in the receipt, so nobody sees a stale + current pair?" Because an editable receipt isn’t a receipt — settled records are never rewritten, or nothing is ever settled. But the agent already gets the single-value experience: at read time, record + sidecar join into ONE receipt with ONE slice — the current one. The two copies are plumbing under the floor. Photograph vs live camera feed: the agent is always shown the feed; the photo stays in the album, because an album you can re-shoot isn’t an album.

The fast-forward (your team’s ask — actioned same day)

The wiring graph needs no history — it derives from the code itself, so Level-1 membership (read + serve, zero owner footprint) is same-day for any repo. The org-census Level-1 wave across all 40 registered repos launched 2026-07-13. Receipts can’t backfill trust, but they have a first-run shortcut: wire a repo’s existing gate so every currently-passing check mints its fact on the first run — a repo with a real suite gets a populated truth-plane on day one. What can’t fast-forward: provenance depth — receipts that have survived time and adversaries.

What could go wrong (honest)

Hot-file thrash. A constantly-changing file re-triggers its slices every beat. Slices are bounded (top-k + counts); refresh rides the rails' natural cadence; cost measured before/after.
Graph blind spots. Where the engine can't see (parse-failed, dynamic imports), the slice inherits the fence — CANNOT-CERTIFY, never a guessed neighborhood.
The maintenance dies silently. Exactly why the parity gate exists — plus a degenerate control proving the gate can see a dead refresher.
Agents ignore the slice anyway. Possible — and measurable. Follow-on experiment (separate seal): bare claim vs claim+slice arms; measure re-derivation rate and cross-blast-radius escapes.

The step-back, answered in writing

Is this the surface of a deeper plan? Yes — general derived-truth maintenance: the prime cache, the map's derived zone, the leg manifest, and your morning projection are all the same class. Deliberately NOT built here. We build this one instance, name the minimal contract (key · basis · stamp · recompute command · parity check, one page in PROJECTIONS.md), and let the second consumer prove or bend the contract before any generalization.

Sequencing & rollback

Built AFTER the seam-experiment battery lands — its AGREE machinery is this design's parity guard, and we build on proven ground, not tonight's wet cement. Full build sequence applies (independent graded review before any code; the guard logic gets the codex+opus pair). Rollback: one flag turns off mint-embed, sweep, and read-repair; the parity leg reports SKIPPED loudly, never a silent pass; no settled record is ever touched.