Skip to content

Declared / v2 / 2026-07-30

What this claims, and what would prove it wrong

Principle 4 of this work says a system that states no expectations cannot be caught missing. That applies to the work itself, so here is what it expects, before you read it.

The load-bearing claim

A miss is the moment the set of options still open to a system stops containing one that avoids the harm: the irreversible exhaustion of recoverable margin. This is the ground truth, signed by physics and needing no agreement about ends. The declared-expectation gap, what a system said would happen against what did, is kept as the operational proxy for use where margin cannot be measured directly, with its two failure modes named in the text.

What five reviewers found

Before publishing this draft I put it through a structured adversarial review. Five research agents were each assigned a different specialism, told to find a real authority in that field, and instructed to attack this essay from that authority's documented published positions: frontline safety reporting, independent accident investigation, safety-case and requirements critique, incident analysis in the resilience engineering tradition, and the design of oversight institutions.

I want to be exact about what that is and is not. These are not endorsements. No living person has read this essay and signed off on any of it, and I am not going to imply otherwise by borrowing anyone's name. What the method produced was sourced, checkable objections drawn from real published work, several of which corrected outright factual errors in an earlier version of this text. The findings below rest on their own evidence and on nobody's authority, which is how they should be read.

The verdict was that the architecture survives and this draft does not yet. The objections are unresolved in this version.

  1. The proxy misses undeclared harm. The declared-expectation proxy catches violations of what was promised and not harm nobody thought to promise against, which in most working lives is the larger category. The margin definition does catch it, because the option set can close whether or not a declaration was violated (a vehicle with no category for the hazard declares the path clear, truthfully, and a person still dies), but in a human system the proxy is what actually runs, so the floor is real and partial.
  2. The proxy is gameable. The party being graded authors the declarations, so under pressure the honest move and the profitable move diverge: declare less, later, narrower, and measured performance improves while the system degrades. The margin definition is the check the proxy cannot supply on its own, but only where margin can be measured; the proxy is auditable rather than neutral, and only while a custodian other than the declarer holds an unalterable register.
  3. The independence objection is answered at the definition, not the proxy. Two parties reading one declaration set share categories, and shared categories are correlated failures, which principle 7 forbids. The resolution is that declarations are the proxy and the floor is physical margin, which no party authors; but where margin is not yet operational, as in most organisations, the practical checkers are still partly correlated.
  4. The architecture is closed. Nothing in it requires findings to reach anyone outside the loop, so a deciding layer can simply decline to act and no principle does anything. A missing thirteenth principle.
  5. Nothing in it says to exercise it. An untested channel and an unused stop authority are indistinguishable from healthy ones from the inside, which is this essay's own thesis, unapplied to its own architecture.
  6. Principle 8 is underspecified. Biology enforces limits of scope, not limits of power: an immune cell destroys the target it convicts. A catcher that cannot compel evidence is a suggestion box, and reviewers disagreed about whether the power to compel buys effectiveness or invites elimination. Both are probably right about different institutions.
  7. The confidence labels on the principles are wrong in both directions. The one graded weakest has substantial literature behind it and the one graded adequate is the least defensible in the set.
  8. The essay asserts that one primitive holds across ten orders of magnitude and does not argue it. A fast reflex loop and a slow interpretive reporting loop have opposite requirements, and the human sections run on the second while borrowing authority from the first.
  9. Principles 2 and 9 are in tension, and 2 and 10 more so. Minimisation is optimised for the adjudicator and starves the learner: what changes another team's behaviour is the context that de-identification strips.
  10. No cost figures, no funding instrument, no host organisation, and no answer to what stops a catching layer being folded back into the operating division in year three.
  11. The definition is not yet operational for human systems. Recoverable margin is concrete for a machine, being reachable states and time to a terminal one, and I cannot yet measure it inside an organisation. Until I can, the declared-expectation proxy is the runnable stand-in, with the failure modes above. This is the real open problem the fix exposes rather than hides.
  12. This essay asserts that we are in the last few steps of a difficult crossing. That is a claim about the present condition of societies and I cannot support it with the rigour I demand everywhere else here. It is a reading, offered as one. The architecture does not depend on it: if the urgency is wrong, the two-layer argument is unaffected. It is also the most quotable line in the work and the least defended, which is why it belongs on this page.

What would falsify the whole thing

A domain where a catching layer is demonstrably independent of its deciding layer, receives protected reports, and still fails at the rate of a system with neither. Or a working definition of a miss that does not reduce to a declared expectation and does not require agreement about ends. Either one would take the argument apart rather than dent it.

What this does not claim