LVC Close Conditions — Strict Accounting

The frontier-naming property of the metrology of meaning. A discipline that names its boundary precisely is alive. A discipline that claims no boundary is marketing. This page is the alive/dead test applied to the LVC layer itself. The top-level frontier map lives at Metrology-Frontier.

GFTCL-LION-LVC-005. For each named-open boundary, this doc states exactly what would close it: the falsifiable assertion, the artifact that produces it, the mechanism that confirms or refutes. No vague "field validation"; concrete pass/fail thresholds.

A close condition with no pass/fail threshold is not a close condition — it's a wish. Every entry below ends in a number, a binary outcome, or a published artifact.

---

A. Gaps in the hostile-verify suite (close in code, this cell)

A1. Metal kernel Float32 verdict divergence

Today. The reconciliation invariant (CPU exact-Rat wins over naive float) is proven against a deterministic Float64 reference written in Swift. The Metal kernel itself didn't surface a verdict flip at N=37; Float32 hardware rounding absorbed the drift.

Close condition. A test asserts: for every (trajectory, ε) the engine ever evaluates, the engine's returned verdict equals the CPU exact-Rat verdict — regardless of what the GPU kernel computed. Two ways to confirm:

1. *Property test.* Generate 10,000 random fixtures with nu, lambda ∈ {1/3, 1/7, 1/13, 2/7} and trajectory lengths in [2, 1000]. For each: compute exact-Rat verdict; compute Metal kernel verdict; assert engine returns exact-Rat verdict on every single one. CLOSED on 10,000/10,000 agreement at the engine level (the kernel may disagree with exact; the engine never does).

2. *Adversarial search.* Bisect over trajectory length up to 100,000 with nu=1/3 to find the *smallest N* at which the Metal kernel's Float32 output disagrees with exact at the integer ε boundary. State that N publicly. CLOSED when N is published AND the engine still returns exact at that N.

Artifact. M8LVCKernelStressTest — extends M8LVCHostileVerifyTest with the property test + adversarial search. Outputs (min_N_kernel_diverges, num_engine_disagreements_with_exact, num_engine_disagreements_with_kernel). CLOSED when num_engine_disagreements_with_exact == 0 over 10,000 fixtures.

A2. H5 pixel-color assertion at known coordinates

Today. PNG file size (38,016 bytes) and raster dimensions (960×400) asserted. Pixel colors not checked.

Close condition. Render LVCDivergenceRibbon with a fixture whose local-GTWED hot segment is at trajectory index i=4 of 8. Sample pixel (x=240, y=200) (center of segment 4 in the 960×400 raster). Assert: R > 0.6 AND B < 0.4 (the hot-color band). Render a second fixture with zero drift at the same index; sample same pixel; assert R < 0.4 AND B > 0.6 (the cool-color band). The same coordinate must paint differently when the drift differs. CLOSED when both assertions hold; REFUSED if the ribbon colors don't track real local-GTWED.

Artifact. H5b block in M8LVCHostileVerifyTest using bitmap.colorAt(x:y:). The ribbon's Canvas heat-color path becomes a falsifiable claim about a specific pixel.

A3. H6 foreign-machine reproduction

Today. Subprocess on the same machine receives only the canonical witness string and reproduces the SHA-256 bit-for-bit.

Close condition. A standalone single-file binary gaiaftcl-lvc-verify (Foundation + CryptoKit only, sovereign Apple stack) takes the canonical + expected hash via CLI args, prints MATCH / DIFFER, exits 0/1. The binary is scp'd to a *different* Mac (or any UNIX with Apple-compatible shasum/Python), run on the same canonical+expected, produces MATCH. CLOSED on a witnessed run of (machine_A_sealed → machine_B_verified) with a published shell transcript showing the second machine's hostname/uname differs from the first. REFUSED if the second machine produces a different hash for the same canonical.

Artifact. New executable target gaiaftcl-lvc-verify (≈80 LOC, only Foundation + CryptoKit.SHA256). Wiki page LVC-Foreign-Verify-Transcript.md records the witnessed run (hostnames, sysctl output, sha256 transcripts on both machines).

---

B. Domain quantizer summits

B1. summit.lvc.legal_quantizer — currently closedRefuted in sentiment form

To move to closedConfirmed the cell ships a PropositionalLegalQuantizer and field-validates it.

The new quantizer.

• Per window (≈ 128 tokens of legal text), extract four structural counts using on-device NaturalLanguage:
• obligation_count — shall / must / will clauses (lexical-class + verb-tense filter via NLTagger(.lexicalClass))
• condition_count — if / unless / provided that / notwithstanding clauses
• definition_count — means / shall mean / capitalised-term-followed-by-definition introductions
• xref_count — Section/Paragraph cross-reference patterns (regex on the token stream)
• The trajectory is [Int64] with each window's quanta as obligation×1000 + condition×100 + definition×10 + xref (packed structure; the four-axis form would extend MeaningTrajectory and re-open the seal — packed-quantum is the minimum-disruptive form).
• Range check: trajectory samples are NOT in [-1000, +1000] (the H2 falsifier inverts).

Field-validation close condition.

• N=200 real legal documents with known dispute outcomes from a public-record source (e.g. US federal court contract-dispute opinions where the contract text is reproduced).
• For each: compute LVC drift between the original contract clause and either (a) the version after amendment, or (b) the version interpreted by the disputing parties' filings.
• Pass criterion: Spearman correlation between LVC drift and dispute outcome ≥ 0.50, p < 0.05, on a held-out 50-document validation set.
• Refute criterion: correlation ≤ 0.20 (null result; published).
• Pre-registered with the validation set hash before the analysis runs (anti-p-hacking).

Artifact. PropositionalLegalQuantizer.swift + M8LegalFieldValidation (offline-cohort harness). Wiki page records the pre-registration hash and the held-out result with equal weight to a confirmation.

B2. summit.lvc.education_quantizer — currently closedRefuted in sentiment form

To close: double-bind correlation.

The new quantizer. Per concept-as-taught text and concept-as-restated text, extract a [claim, mechanism, condition, relation] four-axis structure (same packed-quantum technique). GTWED measures concept-preservation distance.

Field-validation close condition. Both must hold simultaneously on N=200 student restatement pairs:

1. *Comprehension correlation.* Independently-judged understanding (rubric scored by ≥2 graders, inter-rater κ > 0.6) correlates with low LVC drift. Spearman r ≥ +0.50, p < 0.05.

2. *Anti-recall correlation.* Token-overlap exact-match score (a naive "memorisation" proxy) correlates negatively with LVC drift. Spearman r ≤ -0.30, p < 0.05.

A high token-match restatement that is *not* a real understanding (pure regurgitation) must show high GTWED. A low token-match restatement that IS a real understanding (paraphrase) must show low GTWED. The double-bind is what proves the quantizer measures comprehension and not memorisation.

Refute criteria. Either correlation fails its threshold → REFUSED, published equal weight.

B3. summit.lvc.medical_quantizer — currently pre_registered

Mechanism is live. Close requires patient field witness.

Pre-registered prediction. In real informed-consent dialogs, LVC drift above the safety threshold ε (set to 25th percentile of pilot data) predicts patient-side incomprehension events (defined as: patient asks for re-explanation, withdraws consent, or fails a 3-question comprehension check) with sensitivity ≥ 0.80 and specificity ≥ 0.70 on a held-out cohort of 50 dialogs.

Field-validation close condition.

• Cohort: 200 real informed-consent dialogs with audio (IRB-approved; consent for research recording). On-device transcription via Speech framework → quantizer.
• Outcome label: trained clinician marks each dialog with a binary comprehension_event flag from the audio.
• ROC-AUC ≥ 0.80 against the labels.
• Pre-registered analysis plan filed with IRB before data collection.
• Refute: ROC-AUC ≤ 0.65 → REFUSED, published.

Artifact. M8MedicalConsentPilot harness + IRB-pre-registered analysis plan filed publicly on the cell's NATS subject gaiaftcl.lvc.medical.pre_registration. Equal-weight publication.

---

C. Theoretical / structural summits

C1. summit.lvc.collapse_gate_general_n — ✅ closedConfirmed (witnessed)

Closed. The four metric axioms of the LVC collapse-gate metric — non-negativity, identity of indiscernibles, symmetry, and the triangle inequality — now hold for trajectories of arbitrary equal length N, proved by structural induction over List Int, not sampled. This is the equal-length (ν = 0, all-diagonal) regime the gate actually runs on: the quantizer emits M and Mτ at the same band width, so the gate's comparison is always equal-length.

The proof that closed it.

-- proof/lean/LionPrelude/Trajectory.lean
theorem l1List_triangle :
    ∀ (x y z : List Int),
      x.length = y.length → y.length = z.length →
      l1List x z ≤ l1List x y + l1List y z
-- re-exported at the trajectory type:
theorem MeaningTrajectory.gtwedDiagonal_triangle (x y z : MeaningTrajectory)
    (hxy : x.length = y.length) (hyz : y.length = z.length) :
    x.gtwedDiagonal z ≤ x.gtwedDiagonal y + y.gtwedDiagonal z

Proof structure (what actually went through).

1. l1List is the recursive cons-by-cons twin of l1Distance; the induction runs on the structure of the first list, generalizing the other two.

2. *nil/nil/nil base case:* l1List = 0; the bound holds by decide. The mixed nil-vs-cons shapes are discharged by the equal-length hypotheses (length-contradictory).

3. *cons/cons/cons step:* combine the per-element integer triangle inequality (a-c).natAbs ≤ (a-b).natAbs + (b-c).natAbs (closed by omega) with the inductive hypothesis on the tails; omega adds them.

4. No Mathlib, zero sorry/axiom/opaque. Per-element step is omega over Int.natAbs — nothing axiomatized.

Bridge + witness. proof/lean/FirstRoars/GTWEDTriangleGeneralN.lean checks l1List agrees with the length-3 seal's gtwed3 by decide on all worked instances, and instantiates the general theorem on a length-3 and a length-6 trajectory — proven, not sampled. lake build exit 0 is the warrant.

Registry. Because this is a real Lean proof (decide-warranted, omega-closed), the closure landed in franklin_closure_registry at tier witnessed (asserted_by='hostile-verify'), via migration V145 — not provisional. The frontier-honesty guard may stand on it. lvc_summit_states.status='closedConfirmed'.

Honest scope — what this does NOT close. The ν > 0 unequal-length warping triangle inequality is a *distinct object*, now registered as the named-open summit summit.lvc.gtwed_metric_space_general. It is not provable by structural induction over the list type: the optimal warping between two trajectories is a global minimisation over alignment paths, and that optimum is not compositional position-by-position — extending a trajectory by one element can re-route the entire optimal alignment, so "assume it for the tails, extend by one head" does not even type-check. Its triangle inequality is proved instead by alignment-script composition (an x→y script and a y→z script compose to an x→z script whose cost bounds the optimum) — a different proof object that stays open and honestly carried. Closing the diagonal case did not erase the warping case; it sharpened the boundary.

C2. summit.lvc.klein_continuous — currently pre_registered

Today. Klein bottle non-orientability proven on a discrete U × V lattice with decide. Continuous manifold version named-open.

Close condition. A Lean theorem in proof/lean/FirstRoars/KleinContinuous.lean:

theorem klein_non_orientable_continuous :
  ∀ (γ : ClosedLoop) (n : Normal), traverses_u_boundary γ →
    transport n γ = -n

where ClosedLoop and Normal are defined in LionPrelude using Rat × Rat parametric coordinates over the standard [0,1]² / ~ quotient with the Klein identifications.

Concrete proof plan.

1. Add LionPrelude/ContinuousManifold.lean: RatPoint, ClosedLoop = List RatPoint, Normal = Rat × Rat, the Klein identifications (0,v) ~ (1, 1-v), (u,0) ~ (u,1).

2. Define transport: parallel transport of a normal along a closed loop. On any segment that crosses the u=1 identification, the normal's v-component is negated (the identification's pull-back).

3. Prove: a loop crossing the u-boundary an *odd* number of times has transport(n) = -n. Induction on segment count.

No Mathlib. All differential-geometry primitives built in LionPrelude. This is the named-next sub-campaign — easily one full session of careful work; possibly two.

Falsifier. The discrete lattice proof (WitnessTopology.lean) provides the structural template; the continuous version reuses the same orientation-tracking invariant on Rat × Rat. CLOSED on the Lean theorem compiling.

C3. summit.lvc.meaning_quantity — currently pre_registered

**The G⊕H collapse gate answers *whether* meaning survived. Transfer Entropy is the quantity that answers *how much* and *in which direction*. Distinct artifact.**

Close condition. Two artifacts must land:

1. *Mechanism.* LVCCore/TransferEntropy.swift: TE(X→Y|Y_past) over quantized trajectories using a discrete-bin estimator with Miller-Madow bias correction. The function is deterministic, exact-Rat where possible, and bit-equal across machines on the same input.

2. *Validation against analytical bound.* Synthetic data with known causal structure: y_{t+1} = α·x_t + β·y_t + ε, where the analytical mutual information per step is 0.5 · log₂(1 + α²/σ_ε²). Compute TE(X→Y) on 10,000 samples; assert estimate is within 15% of analytical in the high-N limit; assert TE(Y→X) ≪ TE(X→Y) (directional asymmetry detected).

Refute. Estimator off by >30% from analytical, or directional asymmetry not detected. Published equal-weight.

Honest dependency. TE estimation in sparse high-dim text is genuinely hard (curse of dimensionality on the joint distributions). The mechanism may close on synthetic data while the *text-application* layer stays open as a named sub-summit (summit.lvc.te_text_application).

C4. summit.lvc.sovereignty_recomputation — currently pre_registered

Same close condition as A3, restated as a summit.

Close condition. An independent party — operator, lab, opposing counsel, audit partner — on a foreign machine, given only the canonical witness JSON and the expected SHA-256, runs the gaiaftcl-lvc-verify binary (or any SHA-256 tool) and obtains the same hash bit-for-bit.

Artifact. Same gaiaftcl-lvc-verify binary as A3. The closure act is a published transcript:

$ uname -a
Darwin <foreign-hostname> 24.x.x ...
$ gaiaftcl-lvc-verify --canonical-file receipt-7b3f.canonical \
                       --expected-hash 7b3f8a92...
MATCH
$ exit code: 0

CLOSED when this transcript exists on a hostname not under this cell's control AND is signed by the foreign party.

---

D. Order of closure (the strict path)

A1, A2, A3, C4 close immediately as code. C1, C2, C3 close as Lean proofs the cell can write. B1, B2, B3 close on external field witness the cell can't fabricate. Items 5 and 8 are honestly distinguished: the *mechanism* closes in code (5), the *validity* requires field witness (8).

---

E. Refusals (what will NEVER close in code)

Some boundaries cannot close in the cell. Stating them keeps the doctrine honest:

• Patient understanding really happened in a particular consent dialog. The cell witnesses drift below ε; it does not witness understanding directly. The patient holds the receipt. Only the patient can confirm understanding.
• A legal interpretation is correct. LVC witnesses drift between interpretations against a fixed baseline; it does not declare which interpretation is right. That is a court's role, not the cell's.
• A student really learned. Same: comprehension proxy is GTWED-on-propositional-structure. The student's actual learning is the student's, not the cell's.

These are not open summits. They are *refusals*. The cell does not pretend to do them.

---

F. Mechanism for moving the table

When any close condition above is met, the substrate update is mechanical:

UPDATE lvc_summit_states
   SET status = 'closedConfirmed',           -- or 'closedRefuted'
       last_changed_at_iso = '<iso>'
 WHERE summit_id = '<summit>';

A new audit row is appended to domain_meaning_audits recording the closure (or refutation), the artifact reference (Lean file path or wiki transcript URL), and the auditor (cell or external party). The lvc_summits/feed RSS auto-publishes the status transition with equal weight to a confirmation or refutation — the constitutional doctrine: a refutation is a first-class outcome, not a failure.

---

G. The four NOT-GREEN closures (GFTCL-LION-LVC-007)

After the first hostile-verify v2 receipt landed (18/18 strict-read green), the operator named four remaining not-green items. All four are now closed by M8LVCHostileVerifyV3 (30/30 assertions pass) and the architecture pieces they required:

The honest robot posture (verbatim, the only public claim the cell makes today)

"The safety gate is built, hostile-tested, fails closed, decides within a stated budget or refuses, and its display is provably bound to real divergence. The part that READS a physical motion as MEANING is in development with a defined validation criterion."

Anything stronger than that on the embodied-quantizer front is a refusal until summit.lvc.embodied_quantizer's double criterion closes against real robot-and-human field data the cell cannot fabricate.