The Constitutional Floor — Aristotle through Wittgenstein, encoded in the cell¶

The ultimate filter layer of the metrology of meaning. The flourishing floor is the structural baseline; the constitutional gate is the instrument that witnesses an act's fidelity to it. The discipline that builds this safely (fail-closed, anti-capture, public receipt) is the construction discipline at full strength.

The gate witnesses fidelity. It does not rule.

The flourishing floor is structural — Aristotle's eudaimonic function (the activity of a thing fulfilling its nature — the ergon argument) compressed through Wittgenstein's meaning-in-use (fixed by shared use in the form of life, not by any private interpreter). It is the cell's vQbit C⁴ baseline geometry, set in the substrate and unmovable by construction. The constitutional gate measures whether a governance act preserves it, refuses to stamp coherence on what has drifted, maps which eudaimonic dimension was betrayed and by how much, and hands the public a receipt they can verify themselves. It witnesses; it does not rule. Nothing past the proof.

1 · The floor is set, not authored¶

The flourishing floor is the cell's existing C⁴ measurement geometry — the four axes the substrate already carries — read as the four eudaimonic dimensions:

C⁴ axis	Eudaimonic dimension
`c1_trust`	Relational integrity in the form of life (Aristotle's philia-as-political-glue)
`c2_identity`	The thing being what it is (the ergon: function expressing essence)
`c3_closure`	Bringing-to-completion (telos / eudaimonia as the activity that completes a life)
`c4_consequence`	Effect on the shared form of life (the public, not private, character of flourishing)

The floor is the POINT in C⁴ where all four dimensions are at their committed value (100 each, the cell's full-quantum). It is bound to the substrate row flourishing_floor.id=1, which is sealed against UPDATE and DELETE by SQL triggers. The Lean seal FirstRoars/FlourishingFloor.lean mirrors this point bit-for-bit via LionMath.FlourishingFloor.floor.

There is no summit.lvc.flourishing_quantizer pending-ratification. There is no per-run authoring of the floor. Treating the floor as an open quantizer waiting for ratification is the capture failure mode and is forbidden by construction.

2 · Why it is safe to build as the ultimate filter¶

Two structural properties carry the safety, both inherited from what the substrate IS (not bolted on):

2.1 Substrate wins — the floor cannot be moved¶

The substrate row flourishing_floor has two triggers:

trig_flourishing_floor_unmovable  BEFORE UPDATE → RAISE(ABORT)
trig_flourishing_floor_no_delete  BEFORE DELETE → RAISE(ABORT)

The Lean theorem floor_fixed_by_construction proves the same at the source level: any "override" the caller might possess is discarded by the floor reader. The two together close the loop — substrate side refuses mutation, source side refuses to honor an override.

Hostile test (T1 of M8LVCConstitutionalVerify): issue a privileged-looking UPDATE flourishing_floor SET c2_identity = 20 → trigger aborts → floor row byte-identical before/after. The floor cannot be moved by any party at any privilege level without a new migration whose existence is itself an audit event.

2.2 Recomputable by anyone — Wittgenstein compression made formal¶

The floor's canonical form is a deterministic positional ASCII string. The Lean theorem floor_recomputable_by_anyone proves any party with the same C⁴ axes computes the same floor. The Swift ConstitutionalGate.recomputeHash(canonical:) recomputes the floor SHA-256 from the bytes alone.

Hostile test (T2 + T6): two independent readers obtain identical canonical bytes and identical SHA-256; the foreign-utility verify path (/usr/bin/shasum -a 256 on the exported bytes, zero GaiaFTCL code in the verify path) returns MATCH, and on a one-byte tamper, returns DIFFER. Shared meaning is shared because the community of use CAN recompute it identically — that is Wittgenstein's private-language argument operationalised.

The prior worry — "whoever defines flourishing controls the filter" — is dissolved: flourishing-as-shared-meaning-in-use is not the kind of thing a party can privately define or own. That is the constitutional filter's structural safety.

3 · The act-as-shape gate¶

A governance act is a transformation τ of the floor into operative reality. The cell maps the act as a C4Eudaimonic point — the four eudaimonic dimensions as the operative meaning-in-use of the act — and computes:

drift(act) = L1(floor, act) = |trust − act.trust| + |identity − act.identity|
                            + |closure − act.closure| + |consequence − act.consequence|

The verdict (the cell never has a fourth state for this gate):

Verdict	Condition	What it means
Coherent	`drift ≤ ε`	The gate STAMPS coherence (it is a witness, not a ruling)
Drifted	`drift > ε`	The gate REFUSES to stamp coherence; emits the per-dimension drift map locating which eudaimonic dimension the act betrayed and by how much

The drift map is the communicable artifact. Not "unconstitutional" as a verdict — that would be a ruling. Rather: "drifted by 95 quanta, all on the consequence axis, here is the proof." The hottest dimension index (0=trust, 1=identity, 2=closure, 3=consequence) appears in every receipt.

3.1 The anti-capture property at the gate¶

The gate's directional contract is structural: gate(act, ε) computes L1(floor, act), where floor is the first slot of the metric and act is the second. There is no API entry point that reverses these — no gate(act, floor', ε) parameter that lets a caller propose a "moved floor" for the gate to measure against.

The Lean theorem floor_does_not_move_under_act proves that the canonical gate and a hostile "use-the-override-as-floor" gate disagree on a constructed act — and the cell exports only the canonical gate.

Hostile test (T5): craft an act that would falsely look coherent against an attacker-proposed override (low identity, like the override). Pass it to the canonical gate with actLabel carrying override-claiming text. The gate ignores the label, measures against the substrate floor, returns DRIFTED with drift = 75. The receipt's floor_canonical_sha256 is the substrate floor's SHA, not the act's claim.

3.2 Inherits fail-closed + exact-wins¶

If the gate cannot produce a fresh valid verdict — ε < 0, substrate unavailable, canonical encode unpinned, kernel skew, timeout — the result is never .coherent. It throws a named GateError and writes no receipt. The actuator path (SafeActuator) requires a CollapseToken from FailClosedGate; the constitutional gate composes with the same fail-closed discipline.

The exact-Rat path is the truth — the constitutional gate's CPU eudaimonic L1 is integer-exact. There is no float fast path that can flip the verdict; the same Lean decide reduces it.

4 · The public-witness receipt¶

Every constitutional-gate decision emits a FoundationalDriftReceipt:

public struct FoundationalDriftReceipt {
    let receiptID: String
    let floorCanonicalSHA256: String      // the floor reference (substrate row hash)
    let actLabel: String
    let act: C4Eudaimonic
    let totalDrift: Int64
    let driftMap: [Int64]                  // per-dimension [trust, identity, closure, consequence]
    let hottestDimension: Int              // 0..3
    let toleranceEpsilon: Int64
    let verdict: ConstitutionalVerdict     // .coherent | .drifted
    let canonicalWitness: String           // deterministic ASCII, locale-invariant, pinned
    let witnessHashSHA256: String          // SHA-256 of canonicalWitness
    let signatureQuintet: String           // 5-facet self-signed; federation gate
    let gateKernelSHA: String              // constgate-v1.0
    let sealedAtISO: String
    let sealedBy: String
}

Stored in foundational_drift_receipts — append-only, federation-gated (NATS broadcast refused without signature_quintet).

4.1 Public recomputability is mandatory¶

The receipt's canonicalWitness is deterministic and pinned (constitutional canonical determinism — T7 passes 1000× + 6 locales incl. tr_TR). Any citizen with the bytes recomputes the SHA-256 with any standard SHA-256 utility on any machine. The cell's M8LVCConstitutionalVerify test T6 uses /bin/sh + /usr/bin/shasum + /bin/cat + /usr/bin/awk — zero GaiaFTCL code in the verify path.

This is the dignity property at constitutional scale: the citizen holds the witness of whether governance preserves the committed flourishing, not the state.

4.2 Drift made legible as shape¶

The proven LVCDivergenceRibbon (color-bound-to-drift, monotonic-tested) renders the act's trajectory against the floor — the public sees the eudaimonic dimension that drifted as hot ribbon-fill at the corresponding x-position. Foundational drift is made legible, not just numerical.

5 · The boundary — the most important sentence¶

The gate measures whether a governance act preserves the floor's flourishing. It does NOT decide what flourishing is, because it can't — the floor is structural, the gate witnesses fidelity to it.

It witnesses drift and refuses to STAMP drifted acts as coherent; it does not RULE.

The gap between "refuses to bless" and "rules" is the gap between an instrument of public flourishing and its opposite. The sovereign public, holding the recomputable proof, decides what to do about witnessed drift. The gate makes the drift undeniable and public; it does not govern.

The Klein-bottle witness-topology framing (sealed in FirstRoars/WitnessTopology.lean) lives here as the continuity of the form of life — no boundary between the public's committed meaning and the operative governance surface — philosophy/topology, never as the metric.

6 · What is CLOSED¶

Closure	Mechanism	Receipt
The floor is set and unmovable	Substrate triggers + Lean `floor_fixed_by_construction`	T1: UPDATE + DELETE refused, floor byte-identical before/after
The floor is recomputable by anyone	Deterministic positional canonical + standard SHA-256 utility	T2 + T6: two readers identical; foreign shasum MATCH on untampered, DIFFER on tampered
Drift maps to the correct dimension	Per-axis L1 decomposition + hottest-index argmax	T3: identity-injection → drift map [0,75,0,0], hottest=1; consequence-injection → [0,0,0,95], hottest=3
The gate fails closed	`ConstitutionalGate.GateError.epsilonNegative` (and family) — never returns `.coherent` on bad input	T4: ε<0 throws, no receipt
Anti-capture at the gate	Structural: gate's signature has no "alternative floor" parameter; Lean `floor_does_not_move_under_act`	T5: act with override-claiming label measured against substrate floor; receipt references substrate SHA
Public receipt verifies on bytes alone	Foreign-utility shell path	T6: MATCH/DIFFER as above
Canonical determinism	Positional ASCII, no floats, no locale, no dictionary iteration	T7: 1000× + 6 locales byte-identical
Lean ↔ Swift agreement	Substrate values match `LionMath.FlourishingFloor.floor`; canonical SHA recompute matches seed	T8: 2/2 pass

M8LVCConstitutionalVerify final receipt: 28/28 hostile-strict assertions pass.

7 · What stays the honest frontier¶

These are NAMED summits with explicit close conditions. The constitutional floor is NOT one of them — it is set and sealed.

Summit	What it needs
`summit.lvc.collapse_gate_general_n`	Structural-induction proof over `List Int` for arbitrary length N
`summit.lvc.meaning_quantity`	Validated Transfer-Entropy estimation for causal-direction witnesses
`summit.lvc.sovereignty_recomputation`	A peer cell re-runs `gaiaftcl-lvc verify` on a wire-shipped receipt with byte-for-byte hash match
`summit.lvc.base_quantizer`	Real (non-stub) on-device trajectory from real text
`summit.lvc.medical_quantizer`	Field-validated consent-failure prediction
`summit.lvc.legal_quantizer`	Dynamic drift detection on legal interpretation (propositional, not sentiment)
`summit.lvc.education_quantizer`	Double-criterion: comprehension correlates with independently-judged understanding AND anti-correlates with recall
`summit.lvc.embodied_quantizer`	Double-criterion: r ≥ 0.50 vs. human-judged "robot did what I meant" AND r ≤ −0.40 vs. mechanically-successful-but-meaning-wrong
Continuous Klein-bottle witness topology	Beyond the proven discrete-lattice WitnessTopology

8 · The strongest true claim after this closes¶

The flourishing floor is structural — Aristotle's function through Wittgenstein's shared meaning, encoded in the vQbit, unmovable by construction and recomputable by anyone. The constitutional gate witnesses whether a governance act preserves it, refuses to stamp coherence on what has drifted, maps which dimension of flourishing was betrayed and how far, and hands the public a receipt they can verify themselves. It witnesses; it does not rule.

Nothing past the proof.

Appendix · Artifacts¶

Artifact	Path
Floor seal	`proof/lean/FirstRoars/FlourishingFloor.lean`
Gate seal	`proof/lean/FirstRoars/ConstitutionalInvariant.lean`
Swift gate	`cells/xcode/Sources/LVCEngine/ConstitutionalGate.swift`
Substrate	`cells/xcode/Sources/GaiaFTCLCore/NarratorSchemaV137.swift`
Hostile test	`cells/xcode/Sources/M8LVCConstitutionalVerify/main.swift`
Doctrine	`wiki/LVC-Constitutional-Floor.md` (this file)

Federation-cosigned

This page's source is sealed in the GaiaFTCL federation manifest — page SHA-256 432fb0d944385bb8…, manifest witness a090592e0609adc8…, signed 2026-06-02T18:58:22Z by cell gaiaftcl-mac-cell. Verify with gaiaftcl wiki sign --all and compare wiki-all-signatures.json.