git:20260904.19bb783 to git:20260909.7c6ada1

- **Horismos** (ὁρισμός): A dialogical act of proactively defining epistemic boundaries per decision, where AI probes for boundary-undefined domains, dispatches the boundary **kind** up-front (a KindRouteMap of recognition seeds — direction/priority, scope, type/concept, ownership — plus an emergent/naming path) through a fail-closed deficit-fit certificate, collects contextual evidence to enrich classification quality, and presents each domain for user classification by a **uniform settlement disposition** (user-supplies / AI-proposes / AI-autonomous / dismiss) into a BoundaryMap consumed by all downstream protocols. The disposition coproduct is the same for every kind — the captured kind sets WHAT boundary is being settled, the disposition sets HOW that boundary value is settled downstream. **Ownership** is one kind among the seeds (who decides), and it is the *degenerate* case where the boundary value being settled is itself the disposition — so for ownership, content and disposition coincide; for every other kind they separate cleanly.

- certify(KindBinding, local_claims) → DeficitFitCertificate -- fail-closed: status(certificate) ≠ pass BLOCKS value-space binding (split / route claim / narrow-disambiguation first)

- status(certificate) = route: → route_away(routed_deficit) → deactivate (a local route claim holds the kind; no DefinedBoundary)

- status(certificate) = ambiguous: → Qa(captured_kind, claims_supported) → Stop → Attribution → attribute — Own: status re-reads as pass → bind_value_space; Route(d): route_away(d) → deactivate; Unattributable: deactivate (unattributable) with a relay of the finding; no DefinedBoundary

- status(certificate) = pass: → bind_value_space → BoundaryClassification -- the uniform settlement-disposition coproduct, generated ONLY after certificate passes (same codomain for every kind; captured kind sets each option's content, not the coproduct)

- init_loop_state: cycle_n=1, BoundaryEssence="", B = seed_if_kind_match(B_prior, captured_kind), B_seed = Bᵢ (seed only when kind(B_prior) = captured_kind; kind-mismatched prior map → advisory, NOT seeded — see seed_if_kind_match; B_seed carries the Phase 0 domain signal — incl. the zero-signal Reopen(d) seed {d} — as unclassified cycle-1 anchor candidates (non-anchored remainder residualizes at the Phase 1 residualize), never unioned into the classified map B), default=DefaultClassification(MixedTrend), EssenceTrend(history, cycle_n)=MixedTrend at init since cycle_n < 2 (kind-general — the per-cycle disposition-trend machinery runs for every kind), loop:

- Phase 1 Ctx(T, cycle_n) [per-cycle re-scan] → (Sub-D[cycle_n], auto_resolved?) →

- Phase 2 Qc(Sub-D[cycle_n], kind, BoundaryClassification, BoundaryEssence, cycle_n, B_snapshot, default) → Stop → A

- integrate(typed_A?, B, BoundaryEssence) → (B', Δessence) -- total current-cycle fold: classification updates the anchor; termination-only residualizes it and returns B' = B with the empty delta

- crystallize(Δessence, BoundaryEssence) → BoundaryEssence' -- sole producer of the accumulated essence; the empty delta is the identity

- refresh B'-snapshot with the current default_for_residual -- BEFORE the branch below, on EVERY fold including a terminating one: a just-residualized anchor gets its provisional entry here, so every route below reads a complete map

- else: → DefaultClassification(EssenceTrend(history', cycle_n)) → default' for NEXT cycle (kind-general; count-only over the uniform disposition) → re-snapshot with default' → cycle_n += 1, loop

- Phase 4 (optional path) Qf(residual, FinalGateDisposition) → Stop → TERMINAL CARRIERS (Phase 4 row) → DefinedBoundary

- → [single_dominant_kind: relay(captured_kind) (extension) | else: present(KindRouteMap) (constitution)] -- option-set relay test over the kind hypotheses AND the live ground: one dominant kind (entropy→0) relays without a turn yield — either a seed (positive_predicate satisfied, foils' route_away hold, no emergent indicated) or an emergent kind the user's own wording already names unambiguously; ≥2 viable ∨ undecidable foil ∨ an emergent gesture naming no single kind ∨ an emergent question the live ground leaves undetermined gates. BOTH branches feed bind_kind → certify → bind_value_space (certificate fail-closed on both)

- → certify(KindBinding, local_claims) → DeficitFitCertificate -- {own_claim, route_claims[], claimed_by, evidence}; fail-closed — status(certificate) ≠ pass BLOCKS bind_value_space; fits the captured kind's positive_predicate against the own claim and the route claims inscribed in THIS SKILL.md

- → bind_value_space → BoundaryClassification -- the uniform settlement disposition {UserSupplies, AIPropose, AIAutonomous, Dismiss}, generated ONLY after certificate passes; same codomain for every kind (kind sets each option's content); relay / dead-signal test applied; frozen for the activation

- → seed(B_prior, B) -- hermeneutic carry-over at Phase 0b step 4 (AFTER bind_value_space + B init): optional prior BoundaryMap seeds the freshly-initialized B ONLY when kind(B_prior) = captured_kind (same-kind — its dispositions were settled over the SAME boundary question). Values are always type-compatible now (every kind shares BoundaryClassification), so the guard is SEMANTIC: a kind-mismatched prior answers a DIFFERENT boundary question (e.g. an ownership prior's "AIAutonomous" decided who-owns, not how-wide a scope is) and is surfaced as advisory context, NOT seeded. Seeded domains enter `context_resolved` partition with "prior classification" basis (entries mutable in subsequent cycles). Phase 0 only DETECTS B_prior (binds Λ.B_prior together with its kind); it does not seed B, which does not exist until loop-state init

- → integrate(typed_A?, B, BoundaryEssence) → (B', Δessence) -- total current-cycle fold; does NOT update default_for_residual

- → crystallize(Δessence, BoundaryEssence) → BoundaryEssence' -- sole producer of the accumulated essence; the empty delta is the identity

- → snapshot(B', residual, default_for_residual) → B_complete' -- refreshed after EVERY fold, termination included, and BEFORE any terminal route below: this is what gives a just-residualized anchor its provisional entry — classified entries ∪ (residual ↦ default_for_residual), at the value Phase 2 surfaced

- → DefaultClassification(EssenceTrend(history', cycle_n)) → default' -- count-based EssenceTrend → DefaultClassification for NEXT cycle's residual (runs on loop continuation ONLY; count-only over the uniform disposition, so the derivation is kind-general — it reads disposition counts, never kind-specific content)

- → snapshot(B', residual, default') → B_complete'' -- continuation only: supersedes B_complete' for the cycle about to open

- → [finalize | bulk_classify | identity] → Λ.boundary_map -- terminal operation selected by the reachable convergence path; source, write, and final value are defined once in TERMINAL CARRIERS

- requires: boundary_undefined(T) -- runtime checkpoint (Phase 0); sole activation precondition. (status(certificate) = pass is the Phase-0b value-space-BINDING gate, NOT an activation precondition — it lives in the certificate-before-binding invariant below and the Phase 0b → Phase 1 transition; route/ambiguous status routes/re-syncs inside Phase 0b rather than blocking activation.)

- preserves: task_identity(T) -- task scope invariant; BoundaryMap and BoundaryEssence mutated; B_prior seed entries are mutable across cycles

- invariant: certificate-before-binding -- status(certificate) = pass strictly precedes bind_value_space (shared meta-backbone order)

- B_prior = Optional(SeededPrior) -- optional invocation seed for hermeneutic carry-over (prior BoundaryMap detected in session context). Seeded into B at Phase 0b step 4 ONLY when the prior map's kind matches the captured kind (same-kind — same boundary question). The guard is SEMANTIC, not type-based: every kind shares BoundaryClassification, so a mismatched prior's values are type-valid but answer a DIFFERENT boundary question, so a kind-mismatched prior map is surfaced as advisory context, NOT seeded as a structural entry. Seed entries are mutable across cycles

- seed_if_kind_match : (Optional(SeededPrior), Kind) → BoundaryMap -- seeds the prior map ONLY when B_prior.kind = captured_kind (returns B_prior.map); a kind-mismatched prior (B_prior.kind ≠ captured_kind) or B_prior = ⊥ returns ∅ (a mismatched prior is surfaced as advisory, not seeded)

- Bᵢ = Set(Domain) from Probe(T) -- initial boundary-undefined domain signal (cycle 1 seed: formally carried into Phase 0b loop-state init as Λ.B_seed = Bᵢ, kept separate from the classified map B until classification — on zero-signal Reopen(d), Bᵢ = {d} is the one entry the Phase 1 re-scan cannot be assumed to re-derive)

- ZeroSignalConfirmation = user's answer to a zero-signal finding ∈ {Confirm, Reopen(Domain)} -- Confirm accepts no boundary-undefined signal (`Zero-signal surfacing`); Reopen names a domain Probe(T) missed, seeding it into Bᵢ and proceeding

- -- Shared meta-backbone (KIND dispatch). One canonical schema; bound-local instantiation ONLY for object_ref, local_value_space, the label field's type (Kind), the own claim, and the local route claims.

- single_dominant_kind : (KindRouteMap, T, context) → Bool -- option-set relay test (entropy→0 predicate): true iff the live ground determines EXACTLY ONE kind, by either route — (a) SEED: exactly one hypothesis has its positive_predicate unambiguously satisfied by the framing, every other hypothesis' route_away_if holds, and (T, context) indicates no emergent capture; or (b) EMERGENT: (T, context) names exactly one emergent kind unambiguously, which IS the capture — the naming already happened in the user's own words, so gating it would ask for a value the live ground has settled. The seed conjuncts read KindRouteMap, which carries every recognition seed; the emergent conjunct turns on what the framing DENOTES, so it resolves against (T, context) — the user's own wording and the accumulated context — and the seed summary never stands in for it, because a summary cannot carry a branch whose decision rests on an unresolved denotation. An undecidable route_away_if, an emergent gesture resolving to no single naming, OR an emergent question (T, context) leaves undetermined makes the predicate false. true ⟹ the dispatch sync RELAYS the captured kind without a turn yield (Phase 0b sync_kind_route_relay, extension), citing its basis in the user's own wording — verbatim on route (b), where that wording IS the capture and a paraphrase would substitute the AI's reading for it; false ⟹ the mandatory Constitution gate fires (≥2 viable kind hypotheses, an undecidable foil, an emergent gesture naming no single kind, or an emergent question the live ground leaves undetermined). The captured kind still flows through bind_kind → fail-closed certify → bind_value_space on BOTH branches — the relay collapses only the kind-capture turn yield, NEVER the certificate (a non-pass certificate gets the full gated treatment — route → route_away/deactivate, ambiguous → re-sync the gate)

- -- captures the kind; if atomicity = non-atomic → split or route BEFORE certify (no value-space binding on a compound kind)

- Deficit = a deficit label a kind may be claimed by — bound's own BoundaryUndefined, or one of the sibling deficits named in the route claims below. Every label this certificate can assign is inscribed in THIS SKILL.md; nothing outside this file supplies one

- -- the claim bound makes, stated as the WHOLE local morphism: the deficit it takes AND the resolution it produces. A kind is claimed here when its positive_predicate instantiates BoundaryUndefined AND the local value-space can carry it to DefinedBoundary — the bare deficit label is a name, the morphism is the predicate

- DeficitFitCertificate = { own_claim: OwnClaim, route_claims: List<RouteClaim>, claimed_by: Set(Deficit), evidence: Set(Evidence), attribution_by ∈ {certificate, user} }

- -- attribution_by records WHO SETTLED claimed_by: `certificate` where the fit alone settled it, `user` where the fit was ambiguous and the user's Attribution at Qa rewrote claimed_by. Written by attribute and nowhere else; read by the converge trace and the route / unattributable relays

- -- fail-closed: status(c) ≠ pass BLOCKS bind_value_space. Generated by fitting KindBinding.positive_predicate against own_claim and every route_claim inscribed below — the certificate reads nothing outside this SKILL.md

- -- claimed_by collects every claim the evidence supports; a SET, so "no claim holds" is the value ∅ rather than a hole in the type

- status(c) = pass if c.claimed_by = {BoundaryUndefined}; route if c.claimed_by = {d} with d a route_claim's routed_deficit; ambiguous otherwise

- -- read off claimed_by rather than stored beside it, so no field can drift from the claim set it is determined by

- -- pass: the own claim holds alone → bind_value_space

- -- route: a single route_claim's routed_deficit d holds → emit d as the typed handoff, deactivate (kind is out-of-scope for bound)

- -- ambiguous: |claimed_by| ≠ 1 — several claims hold, or none holds on the evidence at hand → Qa, the one-turn disambiguation TYPED: the kind is put to the user with the claims its evidence supports, and their Attribution settles it — Own (status re-reads as pass → bind_value_space), Route(d) (route_away → deactivate), or Unattributable (deactivate with a relay of the finding; no DefinedBoundary). Never silently bind under ambiguity, and never re-sync on ambiguity alone: re-certifying unchanged ground can land ambiguous again with no terminal, so the user's attribution is what gives this arm one. Which arm is read at that turn from the user's wording, never fixed here

- -- what a pass certifies is LOCAL ADMISSIBILITY: bound's own gate governing bound's own activation, not the absence of a claim anywhere in the wider protocol set. Where two protocols' scopes both reach a situation, each protocol's own gate governs

- claims_supported(k) = { d ∈ {BoundaryUndefined} ∪ { rc.routed_deficit : rc ∈ route_claims } : the evidence supports d's predicate } -- what Qa presents: the inscribed claims the captured kind's evidence supports, each with what attributing the kind to it would mean. Equal to claimed_by at the moment Qa fires; named separately because Qa also presents the case none of them holds

- Attribution = Own | Route(routed_deficit: Deficit) | Unattributable -- the user's answer at Qa. A CLOSED coproduct because each constructor is a distinct processing path: Own binds the value space like any kind the fit passed; Route(d) takes the route_away deactivation; Unattributable deactivates with a relay of the finding. Route's payload is the deficit the user named — one of the claims Qa presented, or one they name themselves, emitted bare where this file inscribes no hint for it

- attribute(k, a) = the step that writes the user's Attribution onto the certificate: Own → claimed_by := {BoundaryUndefined}; Route(d) → claimed_by := {d}; Unattributable → claimed_by := ∅ — and attribution_by := user on every arm. It rewrites the certificate rather than bypassing it so that every downstream reader of status(c) — bind_value_space, the invariants, the converge trace — reads the attributed value through the same function it always read. Runs on the far side of Qa's Stop, over Λ.certificate

- V = bind_value_space : Kind → ValueSpace -- the kind is the DOMAIN (it selects each option's content), but the codomain is CONSTANT — bind_value_space returns the same coproduct for every kind; generated ONLY after status(certificate) = pass; frozen for the activation (relay / dead-signal test applied)

- ValueSpace = BoundaryClassification -- the uniform settlement disposition (local_value_space; bound-local instantiation point); the same coproduct for every boundary kind — see BoundaryClassification below

- Ctx = (T, cycle_n) → Sub-D -- per-cycle context collection (re-scan)

- Δessence = String -- per-cycle boundary-essence delta; produced by `integrate` at Phase 3 step 2 (integrate(typed_A?, B, BoundaryEssence) → (B', Δessence)); the termination-only fold produces the empty delta

- BoundaryEssence = String -- accumulated boundary essence (crystallized form of the responsibility boundary space); initialized "" at Phase 0b loop-state init; updated as BoundaryEssence' = BoundaryEssence ⊕ Δessence at Phase 3 by `crystallize` (crystallize(Δessence, BoundaryEssence) → BoundaryEssence'), the sole producer of BoundaryEssence'

- EssenceTrend(history, cycle_n) ∈ {ExtensionTrend, ConstitutionTrend, MixedTrend}

- -- kind-general: the disposition trend reads only the COUNT distribution of classified dispositions across Λ.history — never kind-specific content — so it runs identically for every captured kind

- -- count-based ONLY; no textual-lean interpretation — keeps derivation deterministic and relay-eligible

- -- ExtensionTrend: count(AIPropose ∪ AIAutonomous) strictly dominant

- -- ConstitutionTrend: count(UserSupplies) strictly dominant

- -- MixedTrend: no strict dominance OR cycle_n < 2 (explicit single-cycle initialization rule — insufficient classification history to commit a non-fallback trend; cycle_n is an argument because the count rules read history while this clause reads the cycle)

- DefaultClassification : {ExtensionTrend, ConstitutionTrend, MixedTrend} → {AIAutonomous, UserSupplies} ⊆ BoundaryClassification

- -- kind-general per-cycle default re-derivation, applied to EssenceTrend(history', cycle_n) on loop continuation (reads disposition counts, kind-independent); DefaultClassification(MixedTrend) is the loop-state init value, since cycle_n < 2 there

- -- codomain restricted to the 2-value reachable subset (AIPropose and Dismiss are unreachable from this function)

- -- ExtensionTrend → AIAutonomous; ConstitutionTrend → UserSupplies; MixedTrend → AIAutonomous (Extension-default fallback)

- -- value type is the uniform settlement disposition BoundaryClassification — the SAME value type for every kind (the BoundaryMap value does NOT follow the kind; the kind sets only what content each entry's disposition is about)

- -- object_ref(kind) = Domain for bound, every kind (bound-local instantiation)

- -- Always-complete after each Phase 2 round: classified entries (per-cycle answers + auto-resolved) ∪ residual entries provisionally mapped to current default_for_residual

- -- Snapshot completeness makes ImplicitTermination AVAILABLE at any cycle; snapshots are recognition surfaces, while TERMINAL CARRIERS exclusively defines what convergence emits.

- -- the UNIFORM settlement disposition (local_value_space): HOW the captured kind's boundary value is settled downstream — the SAME 4-value coproduct for every kind, used across Phase 2 (per-cycle) and Phase 4 (residual bulk)

- -- the OWNERSHIP kind is the degenerate case: there the boundary value being settled (who decides) IS the disposition, so disposition and content coincide — which is why this coproduct historically read as ownership-specific. For every other kind the disposition says HOW the boundary value gets settled while the kind says WHAT that value is about (direction/priority, scope, type/concept)

- -- UserSupplies semantic (kind-general): user retains settlement authority for this boundary; downstream gates present open questions; user supplies the boundary value (or invokes other protocols) at decision-point activation

- FinalGateDisposition = {UserSupplies, AIAutonomous} ⊆ BoundaryClassification -- the uniform residual-disposition subset surfaced at Phase 4, the same for every kind (the two settlement dispositions a bulk residual can take)

- DefinedBoundary = { map: Λ.boundary_map, kind: Λ.captured_kind } where one TERMINAL CARRIERS row completed ∧ BoundaryEssence finalized

- Phase 0: T, B_prior? → Probe(T) → scan_B_prior(T) → Λ.B_prior → Bᵢ? -- boundary existence checkpoint + optional hermeneutic-seed DETECTION (silent); detection binds Λ.B_prior but does NOT seed B — B does not exist yet (loop state, incl. boundary_map, is initialized at Phase 0b step 4 after the kind is captured and the certificate passes, since binding is gated on a passing certificate)

- → certify(KindBinding, local_claims) → DeficitFitCertificate

- → (status(certificate) = pass) bind_value_space → BoundaryClassification → init_loop_state(default_for_residual = DefaultClassification(MixedTrend), B = seed_if_kind_match(Λ.B_prior, captured_kind), B_seed = Bᵢ)

- -- up-front KIND dispatch + fail-closed certificate + uniform value-space, THEN loop-state init (cycle_n, BoundaryEssence, default_for_residual = DefaultClassification(MixedTrend), and the B_prior seed into B) — the seed folds into Phase 0b step 4, AFTER B is initialized, never before; seeded ONLY when kind(Λ.B_prior) = captured_kind (same boundary question), kind-mismatched prior map surfaced as advisory not seeded; Λ.B_seed := Bᵢ carries the domain signal as unclassified cycle-1 anchor candidates (non-anchored remainder residualizes at the Phase 1 residualize), separate from the classified map B (partition invariant preserved) — the formal carrier of the zero-signal Reopen(d) seed {d}, which the Phase 1 re-scan cannot be assumed to re-derive [Tool: Constitution gate | Extension relay (single-dominant-kind)]

- Phase 1: T, cycle_n → Ctx(T, cycle_n) → candidates[cycle_n] → (cycle_n = 1: candidates[1] := candidates[1] ∪ (Λ.B_seed \ Λ.domains_touched)) → (Sub-D[cycle_n], auto_resolved?) → Sub-D[cycle_n].domain → Λ.domains_touched -- per-cycle context collection; cycle-1 anchor selection runs over candidates[1] = newly-surfaced ∪ (Λ.B_seed \ Λ.domains_touched) (seed joins BEFORE Sub-D binds — the seed join; a Reopen(d) seed stays an anchor candidate even when the re-scan misses it; an already-touched seed domain — e.g. B_prior-seeded into context_resolved — is excluded here and re-enters ONLY via the Ctx re-scan's stale-seed re-surface, preserving the pairwise-disjoint partition), then auto-resolve check, then the domains_touched write (the anchor commits to Λ.domains_touched and to no partition member until Phase 3 files it) [Tool]

- → (cycle_n = 1) non-anchored B_seed remainder (deduped set) → Λ.residual ∪ Λ.domains_touched; Λ.B_seed := ∅ -- cycle-1 B_seed consumption (track): non-anchored remainder of the deduped seed residualizes (the residualize write), cleared after consumption (consumed once)

- Phase 2: Sub-D[cycle_n], kind, BoundaryClassification, BoundaryEssence, cycle_n, B_snapshot, default

- → integrate(typed_A?, B, BoundaryEssence) → (B', Δessence) -- total cycle fold: a classification updates the anchor; a termination-only reading residualizes it and returns B' = B with the empty delta

- → crystallize(Δessence, BoundaryEssence) → BoundaryEssence' -- sole producer of the accumulated essence; the empty delta is the identity

- → snapshot(B', Λ.residual, default_for_residual) → B_complete' -- ALWAYS, termination folds included, and BEFORE any route: the round-local completeness invariant holds after EVERY fold, so a just-residualized anchor carries its provisional entry before any terminal write reads it

- → (only on loop continuation) DefaultClassification(EssenceTrend(history', cycle_n)) → default' → snapshot(B', Λ.residual, default') → B_complete''

- -- next-cycle default (track + sense), then the snapshot that supersedes B_complete' for the cycle about to open; EssenceTrend re-derivation is kind-general (count-only over the uniform disposition)

- Phase 4 (optional): residual, BoundaryEssence → Qf(residual, FinalGateDisposition) → Stop → Λ.final_gate_answers

- -- final gate [Tool], reached via ExplicitTermination or Phase 1 substrate exhaustion; FinalGateDisposition = {UserSupplies, AIAutonomous}, every kind

- Phase 0b → Phase 1: status(certificate) = pass ∧ BoundaryClassification bound -- kind captured (via relay or gate), fit certified, value-space frozen → enter the per-cycle loop

- Phase 0b → deactivate (route): status(certificate) = route -- a local route claim holds the kind → route_away(RouteClaim.routed_deficit), residual untreated (kind out-of-scope for bound)

- Phase 0b → Phase 0b (re-sync): KindBinding.atomicity = non-atomic -- compound kind → split, re-sync, re-certify BEFORE binding values (fail-closed); terminates because each split strictly decreases the bundled kinds

- Phase 0b → attribute (CONSTITUTION): status(certificate) = ambiguous -- |claimed_by| ≠ 1 (several claims hold, or none does) → Qa(captured_kind, claims_supported) → Stop → Attribution → attribute: Own → claimed_by := {BoundaryUndefined}, attribution_by := user, status re-reads as pass → Phase 0b → Phase 1; Route(d) → claimed_by := {d}, attribution_by := user → Phase 0b → deactivate (route), with basis = the user's attribution and a command hint only where this file inscribes one for d; Unattributable → claimed_by := ∅, attribution_by := user → Phase 0b → deactivate (unattributable). ONE gate and no re-certification of unchanged ground: the user's utterance is the one new ground that can arrive, and their attribution is what gives an ambiguous certificate a terminal [Tool]

- Phase 0b → deactivate (unattributable): Attribution = Unattributable -- the user found no claim that holds → relay the finding (the captured kind, the claims its evidence supported, what the user saw as unresolved), non-convergent exit; no DefinedBoundary, no BoundaryClassification bound

- Phase 4 → converge: Λ.final_gate_answers covers Λ.residual → Phase 4 terminal carrier -- BoundaryMap + BoundaryEssence finalized

- The table below is the sole definition of DefinedBoundary map provenance. Every graceful path starts from an initialized map source, completes its terminal write, and emits only the resulting Λ.boundary_map paired with Λ.captured_kind.

- Path | Initialized source | Terminal write | Final value

- Phase 3 ImplicitTermination | B' from the current cycle fold, which has ALREADY placed the anchor per the parse — a response carrying typed_A leaves the anchor classified in B', a termination-only response residualizes it; Λ.residual is read as the fold left it and is NEVER assumed to hold the anchor, so a classification the user just stated is never overwritten by the residual disposition; residual_disposition = user override when stated, otherwise default_at_surfacing | finalize(B', Λ.residual, residual_disposition) → B_final; Λ.boundary_map := B_final | { map: Λ.boundary_map, kind: Λ.captured_kind }

- Phase 4 completed | Λ.boundary_map at Phase 4 entry + Λ.residual + Λ.final_gate_answers | bulk_classify overwrites every residual provisional entry, moves those domains to final_gate_classified, empties Λ.residual, and writes Λ.boundary_map | { map: Λ.boundary_map, kind: Λ.captured_kind }

- Phase 1 substrate exhaustion | Λ.boundary_map at the guarded edge where Λ.residual = ∅ | identity; Λ.boundary_map is unchanged | { map: Λ.boundary_map, kind: Λ.captured_kind }

- B_snapshot and B_complete' are recognition surfaces only. Neither is a result carrier, and pairing either with a kind does not constitute DefinedBoundary.

- bind_kind → certify (fail-closed) → bind_value_space. The captured kind FIXES BoundaryClassification for the whole activation; the per-cycle loop classifies object_ref(kind) over the frozen BoundaryClassification. BOTH branches (relay and gate) feed this same pipeline — the relay collapses only the kind-capture turn yield; a non-pass certificate still gets the full gated treatment. Re-sync on ambiguous/non-atomic; route_away (deactivate) when a local route claim holds the kind.

- next: ¬termination_intent → next-cycle default' (= DefaultClassification(EssenceTrend(history', cycle_n)), count-based, kind-general) → cycle_n += 1, Phase 3 → Phase 1 (per-cycle re-scan)

- Per-cycle re-scan: Phase 1 substrate scan (artifact read/artifact search) re-executes each cycle; `Λ.domains_touched` (anchored ⊔ non-anchored ⊔ resolved/dismissed) is the dedup source — no domain surfaced twice.

- FinalGateDisposition (the uniform subset {UserSupplies, AIAutonomous} ⊆ BoundaryClassification, every kind) determines residual BoundaryMap entries at Phase 4.

- Round-local BoundaryMap invariant: after each Phase 3 integrate — termination folds included, since the snapshot refresh is NOT conditioned on loop continuation — `Λ.boundary_map` snapshot is always complete: classified entries ∪ (residual ↦ default_for_residual). Snapshot completeness makes ImplicitTermination available AND gives every residual domain the provisional entry the Phase 4 bulk_classify overwrite reads, so no domain reaches a terminal write without an entry; TERMINAL CARRIERS governs every emitted result.

- Convergence evidence: At convergence (Phase 3 ImplicitTermination ∨ Phase 4 completed ∨ substrate-exhaustion empty-residual), present transformation trace — per-cycle (Sub-D[k], Δessence[k], disposition[k]) for each anchored cycle k (k ranges over Λ.D_history — the cycles that produced a Sub-D; a substrate-exhaustion terminal scan produces no Sub-D and contributes no entry; disposition[k] ∈ BoundaryClassification is READ FROM the finalized Λ.boundary_map entry for Sub-D[k].domain, never re-declared per terminal path — the trace evidences the emitted map, so it carries the map's own value for that domain whichever path assigned it; Δessence[k] is the delta integrate produced for cycle k, or the empty delta when the cycle produced no classification), plus residual disposition:

- Cover: the parts together range over the domains of the EMITTED Λ.boundary_map, each domain reported exactly once. "non-anchored d" means d ∉ { s.domain | s ∈ Λ.D_history } — compared on DOMAIN IDENTITY, since D_history holds Sub-D projections while the partition sets hold Domains, and a raw membership test across the two types would fail to exclude an auto-resolved anchor. Anchored membership takes precedence, so a domain anchored in some cycle is reported only as a per-cycle entry even when it also sits in context_resolved (auto-resolved), residual (the termination-only anchor), or final_gate_classified. Every other map domain — a kind-matched B_prior seed left unchanged in context_resolved, a non-anchored domain accumulated into residual, a bulk-classified domain — is reported by the matching part below. A map domain in neither part is a gap in the evidence, not an omission the trace may make.

- • ImplicitTermination: ∀ non-anchored d ∈ residual: (d, default_at_surfacing_or_override) — basis follows which value committed: the EssenceTrend / count-distribution derivation when the surfaced default committed (kind-general), the user's stated override when one did

- • Phase 4 completion: ∀ non-anchored d ∈ final_gate_classified: (d, Λ.final_gate_answers[d]) -- the partition bulk_classify moved them into; Λ.residual is empty by then

- • Seeded-and-unchanged: ∀ non-anchored d ∈ context_resolved: (d, disposition(d)) — cites the substrate assignment or the prior-classification seed basis; these never anchored a cycle, so nothing else reports them

- • substrate-exhaustion empty-residual: residual = ∅ — no residual disposition (every surfaced domain classified per-cycle)

- BoundaryEssence is presented as separate session text artifact. Convergence is demonstrated, not asserted.

- route_deactivate: Phase 0b status(certificate) = route → route_away(RouteClaim.routed_deficit), non-convergent exit (kind out-of-scope for bound; no DefinedBoundary emitted)

- Phase 0 Probe (sense) → Internal analysis (silent — no user output; heuristic boundary-undefined detection + session-context scan for a prior BoundaryMap as Λ.B_prior (DETECTION only — Phase 0 seeds nothing; a kind-matched prior is seeded at Phase 0b step 4, a kind-mismatched prior stays advisory-only); notice visibility deferred to Phase 2 cycle 1 surfacing)

- Phase 0b sync_kind_route_relay (extension) → TextPresent+Proceed (RELAY branch — fires when single_dominant_kind = true, per the single_dominant_kind predicate (TYPES) and `Option-set relay test`. Present the captured kind + its basis as relay text — the basis quotes the user's own wording rather than paraphrasing it wherever the emergent conjunct carried the decision, and quotes it VERBATIM when the relay fires because the user already named the emergent kind, since there that wording IS the capture — and proceed, recording Λ.captured_kind WITHOUT a turn yield; the captured kind is committed for the activation (like the gated branch) — a rare mis-relay is corrected by re-invoking /bound, not an in-loop redirect transition. The fail-closed certify STILL runs on this branch — a non-pass DeficitFitCertificate gets the full gated treatment (route → route_away/deactivate, ambiguous → re-sync), so the relay never bypasses deficit-fit)

- Phase 0b certify (sense) → Internal analysis (extension — fail-closed DeficitFitCertificate; deterministic check of KindBinding.positive_predicate against the own claim and the route claims inscribed in this SKILL.md, reading nothing outside this file: claimed_by = {BoundaryUndefined} when the own claim holds alone; status(certificate) = pass | route | ambiguous; basis = the cited claim fit, shown at Phase 2 cycle 1's first surfacing; ambiguous → Qa, the certificate itself binding nothing and closing nothing under ambiguity)

- Phase 0b Qa (constitution) → present (conditional: status(certificate) = ambiguous. Presents, as text before the gate, the captured kind, its evidence with its channel, and what the certificate found — the claims that evidence supports, or that none does; the gate itself carries the question "whose is this?" and the Attribution options with their differential implications: the own claim → the boundary is defined here, the value space binds and the loop opens; each supported route claim → handed to that deficit, with the command hint this file inscribes for it, and this activation ends; none of these → the finding is relayed and this activation ends with no boundary defined. A deficit the user names outside the presented set is a Route(d) answer emitted bare. One turn, once: the user's attribution is written by attribute and read by every downstream reader of status(certificate). Constitution because the certificate has already said what the evidence settles, and what it does not settle is not the AI's to decide — `Ambiguity surfaces`)

- Phase 0b attribute (track) → Internal state update (writes the user's Attribution onto Λ.certificate — claimed_by rewritten to {BoundaryUndefined} / {d} / ∅ and attribution_by := user. Runs on the far side of Qa's Stop and nowhere else; the deactivation or binding that follows is the arm the attributed status selects)

- Phase 0b unattributable_deactivate (extension) → TextPresent+Proceed (conditional: Attribution = Unattributable → relay the finding — the captured kind, the claims its evidence supported, what the user saw as unresolved — and deactivate; no DefinedBoundary, no value space bound)

- Phase 0b bind_value_space (track) → Internal state update (extension — generate the uniform settlement disposition {UserSupplies, AIPropose, AIAutonomous, Dismiss} ONLY after status(certificate) = pass; same coproduct for every kind; relay / dead-signal test applied; freeze BoundaryClassification for the activation. On status(certificate) = route → route_away(routed_deficit), deactivate — reached also through the user's Route(d) attribution at Qa, with basis = that attribution; on KindBinding.atomicity = non-atomic → re-sync Phase 0b before binding; on status(certificate) = ambiguous → Qa, and binding only on an Own attribution)

- Phase 1 (track) → Internal state update (cycle 1 only: Λ.B_seed candidates (minus Λ.domains_touched) enter anchor selection alongside newly-surfaced domains; non-anchored remainder of the deduped seed → Λ.residual ∪ Λ.domains_touched — partition invariant preserved; Λ.B_seed := ∅, consumed once)

- Phase 2 Qc (constitution) → present (mandatory; per-cycle classification over BoundaryClassification + captured-kind label + essence-refinement preview (NOT the committed Δessence, which integrate produces at Phase 3 step 2) + cycle_n + current B_snapshot + current default_for_residual with count-distribution basis cite + cycle-1 certificate-fit basis + cycle-1 notice when Λ.B_prior non-empty (seed notice when kind-matched, advisory-only notice when kind-mismatched) + free-response termination affordance with implicit/explicit sub-signals)

- Phase 3 (track) → Internal state update (integrate(typed_A?, B, BoundaryEssence) → B', Δessence as the total current-cycle fold; a termination-only commitment returns B' = B, residualizes the anchor, and supplies the empty delta; crystallize applies to every delta with the empty delta as identity; ImplicitTermination executes the Phase 3 TERMINAL CARRIERS write; on loop continuation only — DefaultClassification(EssenceTrend(history', cycle_n)) → default' (kind-general, count-only); the B-snapshot refresh runs on EVERY fold, termination included, taking default' on continuation and the current default_for_residual on termination, so the completeness invariant leaves no gap for a terminal write to read)

- Phase 4 Qf (constitution) → present (residual bulk classification over FinalGateDisposition = {UserSupplies, AIAutonomous}, every kind; reached via ExplicitTermination or substrate exhaustion)

- Phase 4 (track) → Internal state update (bind the complete final_gate_answers map, then execute the Phase 4 TERMINAL CARRIERS write)

- converge (extension) → TextPresent+Proceed (captured-kind + DeficitFitCertificate basis + per-cycle trace + residual disposition trace + BoundaryEssence artifact; proceed with defined boundary)

- Seam transition to declared next protocol (extension) → TextPresent+Proceed (fires at deactivation/handoff: a user-declared chain naming the next protocol settles the next move — proceed directly to it, citing that settling source. This protocol declares no wired outbound continuation edge: a route claim fires when status(certificate) = route, a pre-loop out-of-scope route-away that deactivates before any DefinedBoundary, not a post-convergence handoff, so the second trigger is vacuously absent. Every Constitution gate inside this protocol and inside the next protocol fires unchanged)

- certificate: Optional(DeficitFitCertificate), -- fields: own_claim, route_claims[], claimed_by, evidence, attribution_by; fail-closed gate — status(certificate) must = pass before value_space binds; attribute rewrites claimed_by here on the far side of Qa's Stop

- value_space: Optional(ValueSpace), -- the uniform settlement disposition; frozen for the activation once status(certificate) = pass (UserSupplies / AIPropose / AIAutonomous / Dismiss, same for every kind)

- B_prior: Optional(SeededPrior), -- hermeneutic seed detected at Phase 0 (a SeededPrior — prior BoundaryMap plus the kind it was produced over); the carried kind (B_prior.kind) is what Phase 0b step 4 tests to gate seeding to same-kind only (kind-mismatched prior map → advisory, not seeded)

- B_seed: Set(Domain), -- = Bᵢ, the Phase 0 domain-signal seed (the singleton d on zero-signal Reopen(d)); carried across the Phase 0 → 0b transition (both Stops sit between production and consumption); kept separate from the classified map B — B_seed is a Set(Domain), B a Map — and consumed at Phase 1 cycle-1 anchor selection as unclassified candidates; the non-anchored remainder residualizes at the Phase 1 residualize (→ Λ.residual ∪ Λ.domains_touched) and B_seed clears after cycle 1

- domains_touched: Set(Domain), -- accumulated across cycles (Phase 1 surfacing union)

- D_history: List<Sub-D>, -- per-cycle dimension projections

- essence_history: List<Δessence>, -- per-cycle delta accumulation

- boundary_essence: BoundaryEssence, -- accumulated essence text

- default_for_residual: BoundaryClassification member, -- provisional residual disposition surfaced each Phase 2 (a member of the uniform disposition); DefaultClassification(EssenceTrend(history, cycle_n)) re-derived each cycle, every kind

- context_resolved: Set(Domain), -- Phase 1 auto-resolved (Bᵣ-equivalent, per-cycle) ∪ B_prior-seeded domains (Phase 0b step 4 init; basis: "prior classification" — entries mutable across cycles, may be re-surfaced by Phase 1 if a stale-prior signal is detected)

- user_responded: Set(Domain), -- Phase 2 BoundaryClassification classification completed (the uniform 4-value disposition)

- final_gate_classified: Set(Domain), -- Phase 4 bulk classification completed

- dismissed: Set(Domain),

- residual: Set(Domain), -- unclassified subset of domains_touched (implicit-delegation candidates; provisionally mapped to default_for_residual in boundary_map snapshot)

- boundary_map: BoundaryMap, -- always-complete after each Phase 3: classified entries ∪ (residual ↦ default_for_residual)

- history: List<(Domain, BoundaryClassification)>,

- -- Invariant: domains_touched = context_resolved ∪ user_responded ∪ final_gate_classified ∪ dismissed ∪ residual (pairwise disjoint)

- -- Scope: holds at every cycle boundary — after each Phase 3 and at every Phase 1 entry. The one transient exception is the cycle's own anchor between the Phase 1 domains_touched write (which commits it there) and Phase 3 step 2 (which files it into a partition member): across the Phase 2 Stop the anchor is in domains_touched and in no member, by construction, since the member it belongs to is what Phase 2 is asking. Every path out of Phase 2 — typed answer or termination-only — reaches a step that files it.

- -- Invariant: boundary_map = classified_entries(context_resolved ∪ user_responded ∪ dismissed ∪ final_gate_classified) ∪ (residual ↦ default_for_residual) — round-local completeness

- Hermeneutic carry-over (kind-aware): an optional B_prior input (prior BoundaryMap detected in session context, together with the kind it was produced over) seeds the new invocation ONLY when its kind matches the captured kind (same-kind — same boundary question). Every kind shares the uniform disposition, so a mismatched prior's values are type-compatible; the guard is SEMANTIC: a kind-mismatched prior answers a DIFFERENT boundary question, so it is surfaced as advisory context, NOT seeded into boundary_map (seeding it would commit a wrong-question disposition into the multi-consumer signal). Seed entries are mutable in subsequent cycles and BoundaryEssence is re-crystallized from the current task scope. The seed enables a feedback loop where a downstream observation refines a prior BoundaryMap through re-invocation.

- Round-local BoundaryMap composition: each Phase 2 cycle produces a complete BoundaryMap (classified entries ∪ residual ↦ default_for_residual). The complete snapshot is citable as scope text for a realization-layer turn-condition primitive — the AIAutonomous and AIPropose entries delineate an Extension-progression scope whose exhaustion is a natural completion condition orthogonal to the in-protocol satisfaction signal that emits DefinedBoundary.

- At kind dispatch, render each viable seed as a positive hypothesis with its cited evidence, differential future, and route-away condition, while keeping an open naming path for an emergent kind. On the single-dominant relay, present the captured kind and basis without a turn yield; when the user's wording itself names an emergent kind, carry that wording verbatim. A non-passing deficit-fit certificate remains visible as the reason for routing or re-synchronizing. When the certificate cannot say whose the kind is, put it to the user before anything binds: show the kind, its evidence, and which of the inscribed claims that evidence supports — or that none does — then ask whose it is, one option per supported claim (define the boundary here / hand it to that protocol, with its command hint where one exists / none of these, recorded and this activation ends). An answer here says whose the kind is and nothing about how its domains classify. Do not re-synchronize on ambiguity alone and do not drop an ambiguous kind without this question — a kind the certificate could not place is the user's to place.

- At each classification round, use everyday language to place the anchor domain beside its evidence, the current BoundaryEssence, the complete BoundaryMap snapshot, and the residual default with its derivation. Materialize the uniform dispositions for the captured kind as:

- A same-kind prior BoundaryMap is identified as a mutable seed with its basis. A kind-mismatched prior and cross-session recall are advisory evidence only; say so when they are surfaced. At the final residual review, render the two typed dispositions in the same domain-specific language and keep downstream value provision lazy.

- - **Prior-map provenance**: Structural seeding requires a same-session Horismos result with the same captured kind. Other remembered classifications remain advisory and never silently populate the map.

- - **Default visibility**: Surface the residual default and its derivation before every classification gate. An implicit finish commits the value that was displayed in that round; an override remains reachable in the same response.

- - **Ambiguity surfaces**: An ambiguous certificate is put to the user at `Qa` with the claims its evidence supports, before any value space binds. The user's attribution — define it here, hand it to a named deficit, or none of these — is what settles pass, route, or the unattributable exit; the certificate never binds or drops a kind it could not place, the AI takes no second look at ground that has not moved, and ambiguity alone never re-synchronizes the dispatch.