contextualize

name	contextualize
description	Detect application-context mismatch after execution. Fires when correct output may not fit the actual context. Type: (ApplicationDecontextualized, AI, CONTEXTUALIZE, Result) → ContextualizedExecution

Epharmoge Protocol

Detect application-context mismatch after execution through AI-guided applicability verification, where correct results that may not fit the actual context are surfaced for user judgment. Type: (ApplicationDecontextualized, AI, CONTEXTUALIZE, Result) → ContextualizedExecution.

Definition

Epharmoge (ἐφαρμογή): A dialogical act of verifying that results fit the actual application context — from Aristotle's notion of practical application — resolving the gap between technical correctness and contextual appropriateness through structured mismatch surfacing and user-directed adaptation.

── FLOW ──
Epharmoge(R, X) → Eval(R, X) → Mᵢ? →
  Mᵢ = ∅: Qz(zero_mismatch_finding) → Stop → [AcceptNoMismatch: R_final := Some(Λ.R), deactivate (no aspect ¬warranted; execution stands as-is) | Reopen(aspect): reopen_focus := aspect, re-scan Eval focused on it (one attempt: any detection → the SAME Phase 0 pipeline as the Mᵢ ≠ ∅ arm below — bind_kind, split, absorb, certify, value space — and then whichever Phase 0 exit that pipeline reaches, Phase 1 where anything passed the certificate and trivial convergence where nothing did; still-∅ → relay finding, deactivate)]
  Mᵢ ≠ ∅: bind_kind each [split where non-atomic] → absorb into ∅ (same claim → merge, new → init_occurrence) → Mᵢ → ∀m ∈ Mᵢ: certify(m, local_claims) → [status = route: close m as Route(routed_deficit) | status = ambiguous: close m as Residual] with value_space := None on either non-pass leg, m never registering → keep(status = pass) → Mᵢ_passed → ∀m ∈ Mᵢ_passed: m.value_space := Some(bind_value_space(m)) →
    Mᵢ_passed = ∅ ∧ adjudicated(Λ.R, X) (every flagged aspect carries a certificate-assigned disposition — Route(routed_deficit) or Residual — via the typed disposed(a) predicate; an ambiguous certificate having closed its mismatch as Residual at registration, like a route): → emit routing recommendations + surface any Residual (each flagged aspect either handed to a local route claim's deficit or unattributable) → R_final := Some(Λ.R) → deactivate (trivial convergence: adjudicated by disposition, Λ.R unadapted)
    Mᵢ_passed ≠ ∅: AssessFit(R, X, Mᵢ_passed) → F → Λ.fit_map := F → Register(Mᵢ_passed) → Λ.carrier := Some(locator(C)) → SelectNext(pending, Λ.fit_map) → Mₛ → judgment_settled(Mₛ, Λ.fit_map)? →
      [Some(Overruled): judgment_relay_overruled → report the retraction + the cited fit evidence → close Mₛ as (Overruled, Keep), relay-assigned → NO Qc, no turn yielded, Λ.R untouched → next pending, or converge]
      [Some(Upheld): judgment_relay_upheld → judgment_state := Some((Upheld, basis)), Overruled/Keep dropped from the presented set]
      [None: judgment_state := None — the verdict is the user's this cycle, and the reset is what stops last cycle's relayed Upheld from being read onto this mismatch] →
      -- DISPOSITION HALF. The judgment half above has already run; what becomes of the result is always the user's:
      Qc(Mₛ scoped by the CURRENT Λ.fit_map, judgment_state) → Stop → A = (j, d) →
      [d = Adapt(direction)] adapt → R' → Λ.R := R' → close Mₛ (the act having happened, and ahead of the fold, which needs it out of pending) → Eval(Λ.R, X) → bind_kind each [split where non-atomic] → absorb into pending (same claim → merge, new → init_occurrence) → Mₑ (what the fold opened) → ∀m ∈ touched: certify(m, local_claims) → ∀m ∈ touched: m.value_space := Some(bind_value_space(m)) where status = pass, None otherwise (total on both outcomes, so a merged element that had a space and stopped passing does not keep it) → ∀m ∈ touched where status ≠ pass: route → close m as Route(routed_deficit); ambiguous → close m as Residual — and every such close completes the entry of an m registered before this fold, so it LEAVES pending, while an m that was not never enters → Mₑ_passed := the passing members of Mₑ (registration is for what the fold OPENED; an element registered before this fold has nothing to register) → record update(Λ.carrier: add Mₑ_passed AND bring into line the entry of every touched element ALREADY REGISTERED before this fold, whose reading, evidence, certificate, value space and stamp the fold moved — Register reaches only what the fold OPENED) → AssessFit(Λ.R, X, pending) → F' → Λ.fit_map := F' → (loop: back to Phase 1 above — judgment half, then disposition half — until control reaches a named terminal)
      [d = Keep] close Mₛ (nothing has to happen first) → no re-scan, no Mₑ; R_final is bound at convergence, not here → (pending non-empty: back to Phase 1 above; emptied by this close: the ordered terminal check)
      [d = Discard(replacement)] discard → close Mₛ as Discard (ahead of the sweep, or the mismatch the user actually withdrew is recorded Moot) → R_final := replacement, every mismatch REMAINING pending → unjudged Moot, no re-scan → deactivate (withdrawal convergence: the evaluated target is withdrawn; the replacement is carried, not adjudicated)

── MORPHISM ──
(R, X)
  → evaluate(result, context)          -- detect applicability mismatch
  → bind_kind(mismatch) [split where non-atomic] → absorb(detections, carried) → certify(element, local_claims) -- shared meta-backbone: bind each mismatch as a kind, fold the detections into what is already carried (same claim → merge, none → open one), then certify deficit fit (fail-closed) per ELEMENT against the claims inscribed in this SKILL.md, BEFORE it enters the pending/disposition flow
  → assess_fit(result, context, mismatches) -- sort applicability fit before user judgment
  → surface(fit_scoped_mismatch) -- present mismatch with fit basis and evidence
  → judge(mismatch) → dispose(result, judgment, disposition) -- TWO AXES: whether the flagged aspect stands, then what becomes of the result (adapt / keep / discard)
  → ContextualizedExecution
requires: mismatch_detected(R, X)       -- runtime checkpoint (Phase 0), and the AUTO-ACTIVATION condition ONLY (Layer 2). A user-invoked run
                                        -- (/contextualize, Layer 1) enters WITHOUT it: its Phase 0 may find Mᵢ = ∅, and that run then owes the
                                        -- zero-mismatch confirmation (Qz, `Zero-mismatch surfacing`) rather than declining to have started — which is why
                                        -- ContextualizedExecution's own guard names that confirmation as a conjunct
deficit:  ApplicationDecontextualized    -- the deficit this morphism takes, and the certificate's own_claim deficit for in-scope mismatches. It gates
                                        -- Layer 2 auto-activation; it does not gate Layer 1 invocation
preserves: X                             -- application context is fixed reference; morphism transforms R only
                                         -- WITHIN THE RUN. X is bound fresh at each activation off a session context that ACCUMULATES, so a later activation
                                         --   binds a moved X rather than the same one again — a result this run judged, and the judging itself, are among what it moved
                                         --   (Scan scope reads session context; Λ.X is bound once per activation). Reading `fixed` as `static in the world` gets a
                                         --   read-only run exactly backwards: it produces no artifact and still shifts the ground every later fit judgment is made on
invariant: Applicability over Correctness
invariant: certificate-before-registration  -- DeficitFitCertificate.status = pass strictly precedes registering a mismatch into pending, and STRICTLY PRECEDES ITS STAYING THERE where the registration already exists: an element whose evidence the fold grew is re-certified, and a status that stops passing keeps it out of pending — taking it out where it was registered before the fold, keeping it from entering where it was not. So nothing sits in pending on a certificate that does not currently pass AT ANY POINT pending IS READ, whether the element arrived by opening or by merging — not asserted mid-pass, since the re-scan writes the non-passing status and closes the element out of pending as steps of one uninterrupted pass and AssessFit, the first reader of pending after it, runs once both have happened (shared meta-backbone order, on both scans)
invariant: transformative revalidation (NON-MONOTONE) -- an Adapt disposition mutates the Eval(R, X) target into R', breeding emergent mismatches into Mₑ; re-scan mandatory; a run can have more left to settle after a disposition than before it
invariant: judgment-disposition separation -- the judgment (does the aspect stand?) and the disposition (what becomes of the result) are separate answers, the judgment relay-eligible on cited evidence, the disposition never relay-eligible on its own account — what becomes of the result is answered against the target in front of the user
invariant: relay closes only what leaves the artifact unchanged -- a relay may close a mismatch only where the close changes nothing about the result

── TYPES ──
R      = Result to be evaluated (source-agnostic: AI output, analysis conclusion, decision outcome, or any completed work product)
           -- Input type: morphism processes R uniformly; enumeration scopes the definition, not behavioral dispatch
X      = Application context (environment, constraints, user situation) — type name Context; Λ.X is its one binding, fixed at activation (preserves: X), which is why a bare X appears below rather than Λ.X. ContextChannel's Context member is an evidence source, not this type
Eval   = Applicability evaluation: (R, X) → Set(Mismatch)
MismatchId = a run-local handle naming ONE OCCURRENCE the protocol carries — assigned in ascending order at the moment the occurrence is kept
                 — on absorb's not-same arm, the same arm on either scan — and never reassigned or reused within the run
                 -- NOTHING DISPATCHES ON IT: no phase branches on its value, no convergence predicate reads it, and it never decides whether two
                 --   mismatches are the same claim — that stays identity(m). It is a handle for pointing, and pointing only (`Identity, occurrence, and reading stay distinct`)
                 -- A detection that MERGES into an element already carried is not a new occurrence and takes no id; that element keeps its own (absorb)
absorb = HOW A SCAN'S DETECTIONS BECOME WHAT THE PROTOCOL CARRIES: Set(Mismatch) × Set(Mismatch) → Set(Mismatch), folding the detections into the carried set ONE AT A
                 TIME. FIXED POSITION, and every block that scans states it at that position: AFTER bind_kind + split (so the fold ranges over atomic claims and each
                 side of the judgment below is one claim) and BEFORE certify (so whatever the fold yields is already a complete Mismatch when a certificate-assigned
                 close — Route, Residual — or a later Moot inherits one). Each detection takes one of two arms, and WHAT IS JUDGED IS WHICH CARRIED ELEMENT, IF ANY, STATES THIS
                 CLAIM — not whether some element does. The judgment yields the element itself, because that is what the merge below needs; a yes/no would
                 leave the target to be invented wherever more than one carried element reads plausibly, which uniqueness and transitivity being
                 disclaimed above makes a live possibility rather than a corner. HOW the run reaches that element is its own; THAT it names one is the
                 contract's:
                 --   an element → merge(carried, d) on the element the judgment named: it absorbs the detection and stays the element. THE MERGED ELEMENT IS WHAT THE NEXT DETECTION
                 --                MEETS, so several detections of one claim fold to one and nothing a detection carried is overwritten by a later one — merge
                 --                combines, and there is no last write to win. What that does NOT buy is order-independence: whichever detection opens the
                 --                element is the one whose id and whose STATEMENT of the claim it keeps — not its whole binding, since the evidence takes in every later detection's and the certificate and value space are re-derived over the result (merge) — and a judgment of sameness need not be transitive, so a different arrival
                 --                order can partition the same detections differently. That follows from sameness being judged, not from the fold
                 --   none      → init_occurrence(d): it enters the set as an element of its own
                 -- THE STAMP RIDES EVERY DETECTION, ahead of both arms: match_identity decides unrepaired for each one by the single rule (does it read as the
                 --   same claim as Mₛ, off identity), and absorb only routes where that answer lands — onto the element the new arm opens, or into the carried
                 --   element through merge's disjunction. NEITHER ARM DECIDES IT, which is what lets a detection reading as Mₛ's claim AND as one already
                 --   carried record both facts instead of losing the first to the second
                 -- THE SET FOLDED INTO IS WHATEVER THE PROTOCOL ALREADY CARRIES: ∅ at Phase 0, pending at the Phase 2 re-scan. "Already pending" is therefore NOT a
                 --   case this step handles apart — it is the accumulator having survived an earlier scan, and a detection meeting it takes the same two arms as one
                 --   meeting an element opened a moment ago. One operation, stated once, is what every scan path runs
                 -- ONE ELEMENT PER CLAIM is what the fold is directed to reach, not a property the contract can guarantee: sameness is judged, and a judgment carries
                 --   no invariant. What the type layer contributes is the narrowing identity(m) ranges over, which is what raises the odds the judgment lands right
merge  = Mismatch × Mismatch → Mismatch, combining two readings of ONE claim. The carried element is the left side and stays the element
                 --   id : the carried element's, untouched — the same occurrence taking on more of what is known about it
                 --   aspect, description, evidence, severity : the CURRENT READING, combined. What the combination comes out as is read at that turn from what the
                 --                two sides actually say; the protocol fixes THAT they are combined, never what the combination is
                 --   unrepaired : the disjunction of the two, the detection's side being the value match_identity decided for it (absorb, above) — a
                 --                set-only stamp, so a claim stamped on either side stays stamped
                 --   kind_binding : positive_predicate is the carried element's — it is ONE claim and this arm was taken because the run read the detection
                 --                as that claim, so it is stated once — while evidence is the UNION. The claim now stands on what both sides found it standing
                 --                on, which is the whole of what a second detection of one claim contributes to identity
                 --   certificate, value_space : RE-DERIVED from the merged binding, by the same certify and bind_value_space steps that derive them anywhere,
                 --                and never carried across unchanged. THE REPLACEMENT IS TOTAL ON BOTH PATHS: a re-derived pass writes the new space,
                 --                and a re-derived route or ambiguous close writes value_space := None, since a mismatch closed by certificate carries
                 --                none (below) — an element that had a space before the merge must not keep it after one. The reason is that status is not fitted from the predicate alone: claimed_by collects the
                 --                claims THE EVIDENCE supports and ambiguous is "none holds on the evidence at hand", so evidence moving can move pass → route
                 --                or → ambiguous. Carrying the earlier certificate would let a stale pass route into adaptation a mismatch that now belongs to
                 --                a sibling deficit, which is the fail-closed invariant going out through the merge arm. Where the re-derived certificate no
                 --                longer passes, the element is closed by its certificate exactly as any other is, and LEAVES pending if it was in it
                 -- SO IDENTITY DOES MOVE UNDER MERGING, in its evidence component: the claim is the same claim and stands on more. The certificate follows it
                 --   because the certificate was always fitted to the binding, and the binding is what grew
                 -- The field list is TOTAL: merge names every field of Mismatch and leaves none to the caller
init_occurrence = the step that turns a detection the fold judged NEW into an occurrence the protocol carries: Mismatch → Mismatch, producing every field no earlier
                 step could produce. Reached on absorb's not-same arm alone, so a detection that folds into an element already carried never passes through it. It
                 writes exactly two fields:
                 --   id        := the next handle in this run's order
                 --   unrepaired := the value match_identity already decided for this detection (absorb) — false on a Phase 0 scan for want of an Mₛ, by that same rule rather than by a separate default
Mismatch = { id: MismatchId, aspect: String, description: String, evidence: String, severity: Severity, unrepaired: Bool, kind_binding: KindBinding, certificate: DeficitFitCertificate, value_space: Option(ValueSpace) }
                 -- ASSEMBLED ACROSS THE REGISTRATION PIPELINE, not built by the scan: Eval detects an aspect and its reading, and bind_kind,
                 --   absorb (whose not-same arm runs init_occurrence), certify and bind_value_space each add what only they can produce, in the
                 --   order `Certificate before registration; revalidate after adaptation` fixes. So the whole
                 --   form is what a REGISTERED mismatch carries, and a detection on its way through has only what its stage has reached
                 -- object_ref: the per-mismatch anchor the certificate evaluates and the value-space binds over (epharmoge-local instantiation of the shared backbone's object_ref)
                 -- the mismatch's kind/domain is carried by kind_binding.label (Axis = String, emergent) — the single source of the kind label,
                 --   and a DISPLAY NAME only: which registration a mismatch IS is settled by identity(m) below, never by this label
                 -- Mismatch.evidence is the human-facing indicator shown at surfacing (a String). The typed set the certificate and identity(m)
                 --   range over is kind_binding.evidence (Set(Evidence)) — two different fields, and only the second one decides anything
                 -- THE FIELDS SPLIT FIVE WAYS, and merge (above) treats each accordingly: id is PRESERVED, the carried element's and
                 --   untouched; aspect, description, evidence and severity are the CURRENT READING and are combined; kind_binding is
                 --   IDENTITY, whose predicate cannot move while its evidence unions; unrepaired is a monotone stamp that merge takes the
                 --   disjunction of; certificate and value_space are DERIVED and are re-run over the merged binding rather than carried
                 -- value_space is Option-valued: a mismatch closed by certificate (Route, Residual) is complete with None — never having had a space where the close came at its first certification, and having had its space replaced by None where a re-derived certificate stopped passing.
                 --   The invariant readers depend on is narrower than the field — a mismatch IN pending always carries Some wherever pending is READ. Registration
                 --   follows bind_value_space on both scans, and on the re-scan the None and the close that takes the element out of pending are
                 --   steps of ONE pass with no reader between them. A re-derived ambiguous closes the element exactly as a route does, so both non-pass
                 --   arms take the same exit and neither leaves anything standing in pending on a None
                 -- unrepaired: Bool is a STAMP, not a derived flag (CONVERGENCE, unrepaired(m)). ONE RULE PRODUCES IT ON EVERY PATH, which is what
                 --   makes the field total: unrepaired := (m reads as the same claim as Mₛ, off identity) against the Mₛ this cycle's dispose closed by adapting; at
                 --   Phase 0 there is no Mₛ, so every initial mismatch takes false from that same rule rather than from a default no step writes
                 --   THE FOLD CARRIES IT (absorb): a detection opening an element takes the stamp there, one merging into an element contributes it
                 --   through merge's disjunction. Set-only, never cleared: what it records happened
Severity ∈ {Critical, Significant, Minor}                      -- Significant requires demonstrable behavioral impact (current-session task graph / downstream protocol activations)

-- Shared meta-backbone (KIND dispatch, registration-time / cycle-emergent). One canonical schema; epharmoge-local instantiation ONLY for object_ref (= Mismatch), local_value_space (= the two-axis answer space Judgment × Disposition under well_formed), the label field's type (Axis), the own claim, and the local route claims.
KindBinding    = { label: Axis, positive_predicate: String, evidence: Set(Evidence), origin ∈ {seed, emergent}, atomicity ∈ {atomic, non-atomic} }
                 -- origin is ALWAYS emergent here, and that is the whole of what epharmoge has to say about it: this protocol declares no seed
                 --   kinds (Axis = String, open), so nothing local branches on the field. It stays in the schema because the schema is shared;
                 --   a sibling protocol that does carry seeds reads it there. Naming example seeds to give it work would close a taxonomy this
                 --   protocol deliberately leaves open. label is the same case: no predicate here reads it, it is shown, and it is carried
                 --   because the schema is shared
                 -- captures the mismatch as a kind; if atomicity = non-atomic (the mismatch bundles two distinct aspects) → split BEFORE certify (no registration, no surfacing on a compound mismatch)
                 -- atomicity IS THE BACKBONE'S QUESTION AND CARRIES THE BACKBONE'S MEANING: how many distinct claims this binding bundles —
                 --   the same question the sibling protocols sharing this schema ask of it. It never asks WHERE a repair would land. Repair locus
                 --   is RepairSite (below), which is projected from a disposition already answered and types no mismatch (`Kind → resolution form → repair locus`)
                 -- an empty evidence set fails closed downstream — certify finds no claim it supports and lands ambiguous, which closes it Residual, so
                 --   nothing registers on no evidence
identity(m: Mismatch) = (m.kind_binding.positive_predicate, m.kind_binding.evidence)
                 -- WHAT TO LOOK AT when judging whether a re-detected mismatch is the claim a record already closed, and the only thing to
                 --   look at: the claim ITSELF rather than a name for it, together with what that claim stands on. Never the label, which is a
                 --   display name and is written afresh at every detection
                 -- NARROWING IS THE WHOLE OF WHAT THE TYPE LAYER DOES HERE. Each side is cut to ONE claim (atomicity splits a binding carrying
                 --   two) and its evidence is typed by channel (Evidence.source), so two of these can be set beside each other and an overlap
                 --   between them means something. That is what raises the odds the judgment lands right. It does not make the judgment.
                 -- JUDGE WHETHER IT IS THE SAME CLAIM — that reading is the turn's, made on the accumulated context and what the user has said
                 --   this run. Semantic sameness is not decidable, so no comparison here settles it and no case split stands in for it
                 -- WHO READS IT: match_identity, which settles both readings taken on it — absorb's arm, and whether unrepaired is stamped (TYPES, TOOL GROUNDING) — and the
                 --   trace's RETURNED and CIRCLING rows, which judge the ledger by it at their own turn (CONVERGENCE). unrepaired(m) is NOT a reader: it reads the stamp
                 -- WHAT IT DOES NOT DO: transfer that record's close. A record answers for the registration it closed and for no other, so a match
                 --   locates a predecessor and never completes a new registration's entry (status↔ledger equivalence, pending)
OwnClaim       = { deficit: ApplicationDecontextualized, resolution: ContextualizedExecution, in_scope_if: String }
                 -- the claim epharmoge makes, stated as the WHOLE local morphism: the deficit it takes AND the resolution it produces. A mismatch is claimed here when its positive_predicate instantiates ApplicationDecontextualized AND the local value-space can carry it to ContextualizedExecution — the bare deficit label is a name, the morphism is the predicate
DeficitFitCertificate = { own_claim: OwnClaim, route_claims: List<RouteClaim>, claimed_by: Set(Deficit), evidence: Set(Evidence), status ∈ {pass, route, ambiguous} }
                 -- fail-closed: status ≠ pass BLOCKS registration into pending AND surfacing this mismatch for answer. Generated for every element the fold touched, whose binding it opened or grew — at registration where the element was not registered before this fold, re-derived over the existing registration where it was — by fitting KindBinding.positive_predicate against own_claim and every route_claim inscribed below — the certificate reads nothing outside this SKILL.md
                 -- claimed_by collects every claim the evidence supports; a SET, so "no claim holds" is the value ∅ rather than a hole in the type
                 -- status = pass: claimed_by = {ApplicationDecontextualized} — the own claim holds alone → eligible for registration
                 -- status = route: claimed_by = {d} for a single route_claim's routed_deficit d (backward misfit) → emit d as the typed handoff, drop the mismatch from registration (it never enters pending — or, where the element was registered already, its entry is completed and it leaves pending)
                 -- status = ambiguous: |claimed_by| ≠ 1 — several claims hold, or none holds on the evidence at hand → close the mismatch as Residual, unattributable on the evidence at hand; never register/surface under ambiguous fit
                 -- NO SECOND LOOK, AND THE REASON IS THE GROUND RATHER THAN THE BUDGET: the certificate reads a detection state this phase has already
                 --   fixed — (R, X) at Phase 0, (R', X) at the re-scan — and both phases are silent, so there is no channel through which anything new
                 --   could arrive between a first read and a second. A re-read of unchanged ground yields whatever it yields, and a step whose answer can
                 --   move with no new evidence behind it is a case machine standing where a judgment belongs: it would admit or dismiss a mismatch
                 --   arbitrarily. Residual is not a weaker outcome than a resolved one — it is the true report that attribution did not settle here, and it
                 --   is surfaced rather than swallowed, so the user sees the unattributable claim instead of a coin-flip about it
                 -- what a pass certifies is LOCAL ADMISSIBILITY: epharmoge's own gate governing epharmoge's own activation, not the absence of a claim anywhere in the wider protocol set. Where two protocols' scopes both reach a situation, each protocol's own gate governs
RouteClaim     = (route_if_predicate: String, routed_deficit: Deficit)
                 -- epharmoge-local route claims — BACKWARD misfit the loop routes away rather than adapting in-place. routed_deficit is the BINDING field; the command in parentheses is a non-binding hint for the user, not the relation this guard composes on:
                 --   an unnoticed decision gap rather than a context-fit question        → GapUnnoticed        (hint: /gap)
                 --   a missing pre-execution fact (no observable value, requires supply)  → ContextInsufficient (hint: /inquire)
                 --   undefined convention/dependency ownership for the decision           → BoundaryUndefined   (hint: /bound)
Evidence       = { source: ContextChannel, content: String }
ContextChannel ∈ {Result, Context, Convention, Environment, Session}  -- observable sources for the certificate's deficit-fit basis (R itself + observable X)
V              = bind_value_space : Mismatch → ValueSpace       -- the mismatch's answer constructors; generated ONLY after certificate.status = pass, and generated WHENEVER that pass arrives — including the re-derivation over a merged element, which replaces the None a non-pass leg wrote along with the status that wrote it, on both scans; frozen for the cycle (relay / dead-signal test applied)
                 -- PRODUCED on both scans between the pass filter and Register, for every element the fold touched — the third leg of `Certificate before registration; revalidate after adaptation`'s strict order (KindBinding, certificate,
                 --   value space) — and written to that mismatch's own value_space field, never at selection: every reader downstream needs it to already exist —
                 --   the Phase 1 relay close reasons about which pairings well_formed leaves, and Qc draws A ∈ V from it
ValueSpace     = the mismatch's answer space (local_value_space; epharmoge-local instantiation point) = { (j, d) : j ∈ Judgment, d ∈ {Adapt(direction), Keep, Discard(replacement)}, well_formed(j, d) }
                 -- a two-axis PRODUCT: whether the flagged aspect stands and what becomes of the result are separate answers, so a judgment can be settled without settling the repair
Deficit        = a deficit label a mismatch may be claimed by — epharmoge's own ApplicationDecontextualized, or one of the sibling deficits named in the route claims above. Every label this certificate can assign is inscribed in THIS SKILL.md; nothing outside this file supplies one
Axis           = String                                        -- emergent kind label; examples: "convention", "environment", "audience", "dependency"
Mᵢ_passed = { m ∈ Mᵢ : certificate(m).status = pass }          -- initial mismatches that passed the fail-closed certificate at registration
Mₑ_passed = { m ∈ Mₑ : certificate(m).status = pass }          -- emerged mismatches that passed the fail-closed certificate at re-scan registration
AssessFit = Applicability fit assessment: R × X × Set(Mismatch) → F
           -- classifier over input_mismatches; does not generate new Mismatch objects
F      = ApplicabilityFitMap { fit_justifications, conflicts, depends, adaptation_options, open }
fit_justifications = Set(AspectFit) — for each input mismatch the assessment finds warranted in X after all, the evidence that warrants it
AspectFit = { target: Mismatch, evidence: String }
           -- invariant: target ∈ input_mismatches
           -- keyed to the mismatch, not to its aspect label: one aspect can carry several registrations at once (entry(m) already turns on the
           --   same distinction), so an entry found by label could hand judgment_relay_overruled another registration's fit evidence — and that
           --   relay closes without a gate, leaving a retraction whose cited basis answers for a mismatch the user was never shown
conflicts = Set(Mismatch) where evidence shows result behavior or meaning conflicts with X
           -- invariant: conflicts ⊆ input_mismatches
depends = Set(ContextCondition) where fitness hinges on an observable but unverified condition that could change which disposition is chosen
ContextCondition = { target: Mismatch, condition: String, evidence: String, consequence: String }
                 -- invariant: target ∈ input_mismatches
adaptation_options = Set(AdaptationOption) where each option is tied to a conflict or dependency
AdaptationOption = { target: Mismatch ∪ ContextCondition, direction: String, effect: String }
open   = Set(ApplicabilityQuestion) where the answer could materially change the next adaptation judgment
ApplicabilityQuestion = { target: Mismatch, condition: String, reason: String, evidence_needed: String }
                       -- invariant: target ∈ input_mismatches
fit_category(m, F) =
  Conflict if m ∈ F.conflicts
  Dependent if ∃d ∈ F.depends : d.target = m
  Open if ∃q ∈ F.open : q.target = m
  Supported otherwise
FitRank = Conflict > Dependent > Open > Supported
SelectNext = pending × F → Mₛ
           -- priority: severity(Critical > Significant > Minor), then FitRank, then oldest registered mismatch — READ OFF THE CARRIER, whose entry is one line per registration in registration order. Not off MismatchId, which is assigned when the fold keeps an occurrence and not when the element registers, so an element the fold opened early and registered late carries an id earlier than elements registered before it
Mₛ     = Selected mismatch
Mᵢ     = What Phase 0 carries: Eval(R, X) bound, split, and absorbed  -- one element per claim as far as the fold's judgment reached, which is what it is directed to and not an invariant it can hold (absorb); each certified at registration. Eval(R, X) = ∅ ⟺ Mᵢ = ∅, the fold neither creating nor emptying
Mₑ     = What the Phase 2 fold OPENED — the elements absorb entered on their own rather than merged into something carried. OPENING IS NOT ENTERING pending: only Register puts an element there, and only the passing members reach it  -- the REGISTRATION set, and membership turns on having been opened this fold, not on having escaped merging: an element opened here and merged into later this same scan is still one of these: a detection that merged carries no separate member, its content being in the element it merged into
touched = the elements this fold OPENED OR MERGED INTO                 -- what certify and bind_value_space range over on either scan; at Phase 0 it coincides with Mᵢ, the accumulator having started empty, and only at the re-scan is it wider than what the fold opened. THE TWO ARE NOT DISJOINT: a detection can open an element that a later detection this same scan merges into, so nothing downstream may branch on which of the two it was. What every downstream clause turns on instead is registered(e) — whether this element was in pending BEFORE this fold ran — which is a property of the element, settled before the fold and unmoved by how many detections landed on it. An element opened this scan is not registered however often it was merged into; one carried in from an earlier scan is. What puts a merged element in touched at all is that its binding grew, leaving its earlier fit stale until re-run (merge). An element pending but untouched by this fold kept its binding, so nothing re-fits it. Register still ranges over the passing members of Mₑ alone — an element registered before this fold has its entry, and re-registering it would open the second entry the fold exists to prevent
Register = { m ∈ Set(Mismatch) : certificate(m).status = pass } → C [Tool: record] -- registration of ONLY certificate-passing mismatches into the ONE carrier; status ≠ pass blocks registration (fail-closed)
C          = MismatchCarrier: the ONE durable entry every registered mismatch is written into — a single dereferenceable record, so one read reconstructs the whole registered set rather than reassembling it from scattered records or from session memory
Entry      = the record C carries for one registered mismatch  -- distinct from DispositionRecord, which is the ledger's own member; the equivalence below relates the two
EntryLocator = whatever a host needs in order to reach C again later  -- an OPAQUE handle: this contract requires that the carrier stay reachable after the run and says nothing about the handle's shape, because what makes a record findable again is the host's to settle and differs between them. Held at Λ.carrier, which is what every amendment names
locator(C) = the handle the carrier-creating call handed back  -- the value Λ.carrier holds, taken as opaque; which call creates the carrier is named in TOOL GROUNDING, so a host without that capability still types this
registered = the mismatches C carries  -- certificate-passing only; a Route/Residual close on an element not yet registered fires before registration and never enters C, while the same close on a registered one lands on an entry C already carries and completes it
entry(m)   = the Entry C carries for m's CURRENT registration, reached by reading C at Λ.carrier when the durable record itself is wanted  -- keyed by the registration, not by the aspect: a mismatch re-registering after an Adapt appends a FRESH entry rather than reusing its closed one, which is what stops pending from reading a stale completed status off a target the run has moved past (the same reason disposed(a) treats re-registration as un-disposing)  -- within a run the status↔ledger equivalence below settles its status from Σ.dispositions, so no read is owed per cycle; there is no per-mismatch entry and no per-mismatch LOCATOR to hold, Λ.carrier naming the whole carrier at once. That is a statement about locators and not about MismatchId: every carried occurrence keeps its id, which is what the trace heads its rows by and what Phase 1 points with
pending    = Set(Mismatch) where entry(m).status ≠ completed  -- a view over the carrier C, reached at Λ.carrier, which is where registration status lives; Σ holds the ledger and the scan count and never held this. A routed/ambiguous mismatch never enters pending, or leaves it where the element was registered before this fold and its re-derived certificate no longer passes; only certificate-passing mismatches are registered
             -- every disposition completes its entry, so `completed` is the single resolved status; there is no separate dismissed state (a Keep is a disposition, not a discard of the entry)
             -- status↔ledger equivalence, SCOPED TO REGISTERED MISMATCHES AND TO THE REGISTRATION AT HAND: ∀ m registered, entry(m).status = completed ⟺ Σ.dispositions holds the record that CLOSED THIS REGISTRATION of m. Every close of a REGISTERED mismatch writes the disposition and completes its entry as ONE action — the Phase 2 dispose step (TOOL GROUNDING dispose), the Phase 1 judgment_relay_overruled close alike — and that single action is what binds a record to the one registration it answers for
             -- NOT keyed on identity, and this is the load-bearing half: identity(m) (TYPES) matches a re-detected mismatch to the registration it SUCCEEDS, and a match discharges nothing. A re-registration always opens its own entry and sits in pending until its own close — whether the return reads as the claim that record closed (unrepaired(m): the repair did not land) or as a claim of its own (owed its own surfacing).
             -- a certificate-assigned close (Route, Residual) on an element not yet registered fires BEFORE registration, so its mismatch has a ledger entry and no tracked entry to complete, and the unscoped statement that holds for it is the Ledger invariant under MODE STATE. On a registered element whose re-derived certificate no longer passes, that close lands on a registration that does exist: it completes that entry and the element leaves pending, exactly as a disposition-assigned close does
Q      = Applicability inquiry (gate interaction) — the family the two concrete gates below instantiate
Qc     = Q at Phase 1: the MISMATCH gate. Presents the selected mismatch scoped by the CURRENT Λ.fit_map — the evidence, fit basis, and adaptation options the user weighs are read at presentation time, so after an Adapt they describe the advanced target and not the one it replaced; answer type A = (Judgment, Disposition)
Qz     = Q at Phase 0: the ZERO-MISMATCH gate. Presents that the scan found no unwarranted aspect AND what the scan reached to say so — both read off the scan that just ran, since an empty Set(Mismatch) says what was found and never how far the looking went; answer type ZeroMismatchConfirmation
Judgment    ∈ {Upheld, Overruled}                              -- EPISTEMIC axis: does the flagged aspect genuinely fail to fit X?
                                                               -- an ESTABLISHED verdict only: reachable via a user answer at Qc or via either judgment_relay arm's cited basis
judgment_settled : Mismatch × F → Option((Judgment, basis: String))   -- judgment-level entropy → 0 with a citable basis (`Judgment-only relay`); evaluated against the EVALUATED TARGET Λ.R
              -- the basis comes back WITH the verdict: record well-formedness requires judgment_basis ≠ "" wherever judgment_by = relay, and both
              --   relay arms report it before writing, so a bare verdict would leave that citation with no producer
              Some((Upheld, basis))    when the evidence admits no reading under which aspect(m) stands warranted in Λ.R
              Some((Overruled, basis)) when it admits no reading under which aspect(m) FAILS to stand — read off m's own AspectFit entry in
                              Λ.fit_map.fit_justifications, whose own definition is "warranted in X"; basis = that entry's evidence. Membership
                              locates the evidence; the bar above is the condition — an entry whose evidence still admits a reading under which the
                              aspect fails to stand yields None and the judgment stays the user's
              None                     otherwise: the evidence admits more than one reading, so the judgment is the user's
judgment_state = Option((Judgment, basis: String))             -- CYCLE-LOCAL: the relayed judgment for this cycle's Mₛ together with its cited basis
              -- HOLDS A FIELD IN Λ (MODE STATE): cycle-local is not turn-local. It is written at Phase 1, Qc then STOPS and yields the turn, and
              --   the close that follows reads it on the far side of that boundary — so it has to be somewhere in between
              -- written by the Phase 1 judgment dispatch on both arms, so every cycle binds it before its disposition half runs
Disposition ∈ {Adapt(direction: String), Keep, Discard(replacement: Option(Result)), Route(routed_deficit: Deficit), Residual, Moot}
              -- REPAIR axis: what becomes of the result, and how this mismatch is closed
              -- Discard's payload is Option(Result): Some(r) when something takes the withdrawn result's place, None when the withdrawal leaves nothing behind
              --   user-answered at Phase 1        : Adapt(direction), Keep, Discard(replacement)
              --   relay-assigned at Phase 1       : Keep — and ONLY Keep, from its one producer, which edits nothing:
              --     judgment_relay_overruled — well_formed forces the pairing once the evidence settles Overruled
              --   certificate-assigned at registration (never surfaced for answer): Route(routed_deficit), Residual
              --   loop-assigned                   : Moot (a Discard withdrew the Eval target while this mismatch was still pending)
              -- Route/Residual live on THIS axis, so the convergence predicate quantifies over one disposition ledger
ResolutionForm = the axis Disposition ranges over — the SHAPE a resolution takes, answering what becomes of the result. Kind (kind_binding.label
                 and the predicate under it) says what sort of misfit this is; ResolutionForm says what is done about it; RepairSite below says
                 where that lands. THREE ORDERED AXES, and the order is the point (`Kind → resolution form → repair locus`)
RepairSite     = THE NAME OF THE THIRD AXIS — where a resolution lands on Λ.R when adapt or discard executes it. A NAME AND NOT A CARRIER:
                 nothing produces it as a value, stores it, or reads it. The locus is settled by the executing tool call and seen by the user in
                 the edit, so a field for it would be state with no reader
                 -- what the axis forbids is upstream use: it does not individuate a mismatch, does not decide how many mismatches there are,
                 --   does not gate registration, and appears in no convergence predicate. Asking it first is the failure `Kind → resolution form → repair locus` names
A      = Answer = (j: Judgment, d: Disposition) where d ∈ {Adapt(direction), Keep, Discard(replacement)}
         -- A ∈ V; drawn from the mismatch's value-space (local_value_space = the two-axis space above)
         -- PRODUCED AT Qc ONLY. The one Phase 1 relay close that closes a mismatch (judgment_relay_overruled) writes its DispositionRecord straight to the ledger and produces no A; judgment_relay_upheld closes nothing, settling the judgment half and handing the disposition half to Qc
well_formed(j, d) =                                            -- governs the ANSWER space (what Qc may present, and which pairings a relay close may write); an unjudged close has no pair to check here and is governed by the ledger constraint below
    (j = Overruled ⟹ d = Keep)                                 -- an overruled aspect leaves R untouched: nothing to repair
  -- Upheld × Keep is a REACHABLE and distinct state: the mismatch stands and the user accepts the result anyway (an accepted residual)
  -- Route/Residual/Moot are never user answers; their judgment status is constrained at the record level
ZeroMismatchConfirmation = user's answer to a zero-mismatch finding ∈ {AcceptNoMismatch, Reopen(aspect)}
         -- AcceptNoMismatch accepts that no aspect is unwarranted (`Zero-mismatch surfacing`); Reopen names an aspect the Phase 0 scan missed, re-entering Eval focused on it
R'     = Result after an Adapt disposition -- temporal succession of R; the Eval target the non-monotone re-scan re-aims at. Λ.R is re-bound to it (MODE STATE), so the EVALUATED TARGET is always Λ.R
R_final : Option(Result) = the verdict's target field — what the user is left with. Some(Λ.R) on every non-withdrawal path (the evaluated target, adapted or not), or the Discard's replacement payload on the withdrawal path (None when that withdrawal left nothing in its place). Option-valued because "no result survives" is a reachable success state, not an error
         -- DISTINCT from the evaluated target Λ.R, and only on the withdrawal path do the two come apart
DispositionRecord = { mismatch: Mismatch, judgment: Option(Judgment), judgment_by ∈ {user, relay, unjudged},
                      disposition: Disposition, assigned_by ∈ {user, certificate, loop, relay},
                      judgment_basis: String, disposition_basis: String }
         -- ONE ledger entry per closed mismatch. routed / residual / moot are VIEWS over the ledger
         -- judgment is Option-valued: a mismatch can be CLOSED without ever being JUDGED
         -- ONE GROUND PER AXIS: why the aspect stands or fails, and why it is disposed of this way, are different claims with different
         --   producers — the verdict's ground is cited by whoever settled the verdict, the disposition's by whoever assigned it. A single
         --   fused ground would silently drop one of the two wherever the axes were settled separately, and every later reader of a carried
         --   record wants the DISPOSITION half specifically. They coincide only where one follows from the other (judgment_relay_overruled)
         -- record well-formedness:
         --   judgment_by = user      ⟹ judgment = Some(_)                                  -- answered at Qc
         --   judgment_by = relay     ⟹ judgment = Some(_) ∧ judgment_basis ≠ ""            -- either judgment_relay arm; the cited basis is what makes the verdict checkable
         --     Some(Upheld)   from judgment_relay_upheld — the disposition beside it is still whatever the user then answered
         --     Some(Overruled) from judgment_relay_overruled — necessarily paired with Keep, and with assigned_by = relay
         --   judgment_by = unjudged  ⟹ judgment = None ∧ judgment_basis = ""               -- no verdict was reached, so there is no verdict to ground
         --   disposition ∈ {Route(_), Residual, Moot} ⟹ judgment_by = unjudged
         --   assigned_by = user      ⟹ disposition ∈ {Adapt(_), Keep, Discard(_)}          -- answered at Qc, on the mismatch the gate presented
         --   assigned_by = relay     ⟹ disposition = Keep ∧ disposition_basis ≠ ""           -- ONE producer, reporting before it writes:
         --     judgment_relay_overruled — judgment_by = relay ∧ judgment = Some(Overruled); reports the retraction and its basis
         --   assigned_by = certificate ⟹ disposition ∈ {Route(_), Residual}
         --   assigned_by = loop      ⟹ disposition = Moot                                   -- withdrawal fallout
ApplicabilityVerdict = { target: R_final, dispositions: List(DispositionRecord), scan_count: Nat, carrier: Option(EntryLocator) }
         -- the protocol's terminal object: the result TOGETHER WITH how every flagged aspect was closed.
         -- Keep, Discard, Route, Residual and Moot are terminal exactly as Adapt is; adaptation is ONE disposition among them
         -- ASSEMBLY — every field has a producing step, and they are not the same step:
         --   target      := R_final, bound by whichever terminal fires (the LOOP convergence step, Phase 2 → withdraw,
         --                  Phase 0 → confirm_no_mismatch / deactivate)
         --   dispositions := Σ.dispositions      -- the ledger as it stands at that terminal, whole; the trace ranges over this same list
         --   scan_count   := Σ.scan_count        -- the re-scan counter Phase 2's Adapt arm increments; this binding is its only reader
         --   carrier      := Λ.carrier           -- the locator the Phase 1 registration bound, carried out so the durable record stays reachable after the run; None wherever nothing registered. Emitting it is the whole of what this protocol does across a session boundary: Σ is bound fresh at activation BY DESIGN — nothing this run closed governs a later one, and re-entry returning a mismatch to the gate is a stated property — so no step here dereferences a locator and none is owed
         -- The last three are bound identically at EVERY terminal, so a terminal states only its own R_final and assembles the rest: dispositions and scan_count from Σ, carrier from Λ
ContextualizedExecution = ApplicabilityVerdict where adjudicated(Λ.R, X) ∧ (∀ m ∈ registered: entry(m).status = completed) ∧ (Mᵢ = ∅ ⟹ zero-mismatch confirmation obtained: ZeroMismatchConfirmation = AcceptNoMismatch, or Reopen(aspect) whose focused re-scan still yields Mᵢ = ∅ → relay(finding) — `Zero-mismatch surfacing`)
                 -- registered = certificate-passing mismatches only; Route/Residual mismatches are closed by disposition, not adapted in-place
                 -- adjudicated is what the terminal rests on, and the registered half does NOT carry it: registered ranges over certificate-PASSING mismatches, so a run whose every detection certified route or ambiguous has registered = ∅ and satisfies that half with nothing in it while its flagged aspects went unclosed. adjudicated quantifies over every FLAGGED aspect and discharges each through disposed(a), which demands the DispositionRecord exist — so the closes those certificates assign are a condition of the terminal rather than something the type takes on trust

── PHASE TRANSITIONS ──
Phase 0: R → Eval(R, X) → Mᵢ? → bind_kind each [split where non-atomic] → absorb into ∅ [TYPES: the fold every scan path runs — a detection judged the same claim as one already folded in merges into it, one judged new takes init_occurrence's id and unrepaired = false; before certify either way, so a route/Residual close holds a complete Mismatch] → Mᵢ → ∀m ∈ Mᵢ: certify(m, local_claims) → (status = pass) → Mᵢ_passed → ∀m ∈ Mᵢ_passed: m.value_space := Some(bind_value_space(m)) [the third leg of the registration pipeline `Certificate before registration; revalidate after adaptation` fixes in strict order — KindBinding, then the passing certificate, then the value space — so it runs on the pass filter's own output and ahead of the Phase 1 registration, never at selection: every reader downstream needs it to already exist. The Phase 1 relay close reasons about which pairings well_formed leaves, and Qc draws A ∈ V from it] → [Mᵢ_passed ≠ ∅] AssessFit(R, X, Mᵢ_passed) → F → Λ.fit_map := F  -- applicability checkpoint + registration-time KIND dispatch (fail-closed) + value-space binding + fit map (silent); certify runs WITHIN Phase 0, at registration, not as a separate phase
Phase 0 → confirm_no_mismatch: Mᵢ = ∅ → Qz(zero_mismatch_finding) → Stop → ZeroMismatchConfirmation  -- true zero-mismatch case (distinct from the Mᵢ≠∅∧Mᵢ_passed=∅ trivial-convergence-by-routing case below); AcceptNoMismatch → R_final := Some(Λ.R), deactivate (execution stands as-is, `Zero-mismatch surfacing`); Reopen(aspect) → reopen_focus := aspect → re-scan Eval focused on that aspect → reopen_focus := None (cleared after the focused re-scan, either arm); [Mᵢ ≠ ∅] re-enter the Phase 0 pipeline above at bind_kind, this path having already run its own focused Eval, and run it through the rest of that pipeline with nothing added or dropped for it, then take whichever Phase 0 exit it reaches — Phase 1 where Mᵢ_passed ≠ ∅, the trivial-convergence transition below where the focused scan's detections all routed or landed Residual, since pending is empty on this path and Phase 1 would have nothing to select; [Mᵢ still ∅] relay(finding) → R_final := Some(Λ.R), deactivate (one attempt per aspect) [Tool]
Phase 0 → route_away (mismatch-local): certify(m).status = route        -- a local route claim holds the mismatch (backward misfit) → emit that claim's routed_deficit (GapUnnoticed, ContextInsufficient, BoundaryUndefined — with its command hint), close m with DispositionRecord { judgment = None, judgment_by = unjudged, disposition = Route(routed_deficit), assigned_by = certificate, judgment_basis = "", disposition_basis = the matched local route claim } and value_space := None on the same non-pass leg, this being where a Mismatch that never passes gets that field at all (bind_value_space runs only after a pass), drop m from registration — m never enters pending, this fold having found nothing registered to take back out; scan continues with remaining mismatches
Phase 0 → residual (mismatch-local): certify(m).status = ambiguous  -- |claimed_by| ≠ 1, several claims holding or none: attribution does not settle on the evidence at hand → close m with DispositionRecord { judgment = None, judgment_by = unjudged, disposition = Residual, assigned_by = certificate, judgment_basis = "", disposition_basis = the unresolved attribution as this certification found it — several claims standing, or none } and value_space := None on the same non-pass leg, which is where a Mismatch that never passes gets that field at all (bind_value_space runs only after a pass), drop m from registration — m never enters pending, this fold having found nothing registered to take back out; scan continues with remaining mismatches. NO SECOND LOOK: this phase is silent and the detection state (R, X) is already fixed, so nothing new can arrive between one certification and another, and an answer that could move without new evidence behind it would admit or dismiss a mismatch arbitrarily. Residual is the true report and it is surfaced, not swallowed
Phase 0 → split (pre-certify): KindBinding.atomicity = non-atomic  -- a compound mismatch bundles two distinct aspects → split into atomic sub-mismatches and re-run bind_kind → absorb → certify on each (same Phase 0 pass, before any pass/route/Residual decision) — each child is folded in on its own and is a distinct occurrence where the fold opens one, while the compound never is, absorb running after the split for exactly that reason; recursive until atomic, and terminating because each split strictly decreases the number of bundled aspects. A non-atomic mismatch is split pre-registration, never registered as a compound. WHAT IT SPLITS ON is claim multiplicity and nothing else: one claim standing on evidence that lies in several places is ONE mismatch and is not split here, because how far a repair must reach is a question for the disposition and not for registration (`Kind → resolution form → repair locus`)
Phase 0 → deactivate (no in-scope mismatch): Mᵢ ≠ ∅ ∧ Mᵢ_passed = ∅ ∧ adjudicated(Λ.R, X) ∧ pending = ∅  -- mismatches WERE detected but EVERY one carries a certificate-assigned disposition, Route(routed_deficit) or Residual (discharged via disposed(a), CONVERGENCE) — no mismatch the own claim holds enters the disposition loop → trivial convergence: R_final := Some(Λ.R), emit the routed deficits with their command hints (/gap, /inquire, /bound) and deactivate without adapting Λ.R. An ambiguous certificate is not an exception to this path: it closes its mismatch as Residual at registration, exactly as a route does, so the aspect is disposed and nothing is left waiting
Phase 1: Mᵢ_passed → record[C ← all certificate-passing initial mismatches, each carrying its id] → Λ.carrier := Some(locator(C)) → pending → SelectNext(pending, Λ.fit_map) → Mₛ → judgment_settled(Mₛ, Λ.fit_map)? →  -- register all certificate-passing initial mismatches, surface selected mismatch with fit basis [Tool]; reached only when Mᵢ_passed ≠ ∅, every element arriving with the value space Phase 0 bound (`Certificate before registration; revalidate after adaptation`'s strict order). TWO-LEVEL DISPATCH — the JUDGMENT half resolves first, then the DISPOSITION half; the gate is where the disposition half always lands:
         JUDGMENT HALF, off judgment_settled(Mₛ, Λ.fit_map) — always computed against the CURRENT Λ.R and Λ.fit_map:
         [Some(Overruled)] judgment_relay_overruled (below) closes BOTH halves — NO Qc, no Stop, no turn yielded; control returns to SelectNext over the remaining pending
         [Some(Upheld)]    judgment_relay_upheld (below) settles the judgment half: judgment_state := Some((Upheld, basis)) → DISPOSITION HALF
         [None]            no judgment settles; judgment_state := None → DISPOSITION HALF
         DISPOSITION HALF, reached from either arm above and having ONE arm: Qc(Mₛ scoped by the CURRENT Λ.fit_map, evidence, judgment_state) → Stop → A = (j, d)
                                -- the disposition is user-answered, and the judgment half with it when judgment_state = None. NO RELAY REACHES THIS HALF
                                -- on its own account: what becomes of the result turns on what the user weighs, and no evidence collapses that
Phase 1 → judgment_relay_upheld (mismatch-local): judgment_settled(Mₛ, Λ.fit_map) = Some(Upheld) — the evidence for ¬warranted(aspect(Mₛ), Λ.R, X) admits no reading under which the aspect stands warranted; judgment-level entropy → 0 with a citable basis (`Judgment-only relay`)  -- relay j := Upheld with the basis cited: judgment_state := Some((Upheld, basis)), which the close downstream reads as judgment_by = relay. Drop the Overruled/Keep pairing from the presented set and hand to the DISPOSITION HALF: Qc fires and yields turn. The turn is not yielded for the judgment half. When judgment_settled(Mₛ, Λ.fit_map) = None, judgment_state := None, the full two-axis set is presented, and j is user-answered (judgment_by = user)
Phase 1 → judgment_relay_overruled (mismatch-local, CLOSES the mismatch): judgment_settled(Mₛ, Λ.fit_map) = Some(Overruled) — the evidence admits no reading under which aspect(Mₛ) FAILS to stand, read off that aspect's own AspectFit entry in Λ.fit_map.fit_justifications and the evidence it cites (the membership/condition distinction: TYPES). well_formed(Overruled, d) leaves d = Keep as the sole pairing, so the answer set has collapsed to one and no gate is owed (`Judgment-only relay`)  -- REQUIRED FIRST: report the flagged aspect, that it is being retracted, and the cited fit evidence, as text. THEN close Mₛ with DispositionRecord { judgment = Some(Overruled), judgment_by = relay, disposition = Keep, assigned_by = relay, judgment_basis = the cited fit evidence, disposition_basis = that same evidence — the ONE close where the two grounds coincide, because Keep is what well_formed leaves once the verdict is Overruled } AND record update(Λ.carrier, entry(Mₛ).status := completed) as ONE step, so Mₛ leaves pending before anything else runs. Λ.R is untouched, no Mₑ, no re-scan; the turn is NOT yielded. Continue to SelectNext over the remaining pending — or, when this close empties it, to convergence (CONVERGENCE: gateless convergence) [Tool]
Phase 2: A = (j, d) → [ORDER: dispose appends DispositionRecord{ mismatch = Mₛ, judgment = Some(j), judgment_by = relay when judgment_state = Some((Upheld, _)) for this cycle else user, disposition = d, assigned_by = user, judgment_basis = that relayed basis when the verdict was relayed, else the ground the user gave for the VERDICT, disposition_basis = the ground the user gave for the DISPOSITION } to Σ.dispositions AND record update(Λ.carrier, entry(Mₛ).status := completed) as ONE step. WHEN that step runs depends on what d is, and the reason is that a record asserts what happened: on d = Keep it runs here, nothing being owed before it; on d = Adapt or Discard it runs AFTER the arm below has performed the act, as that act's postcondition — appending it first would leave a ledger reading "adapted" or "withdrawn" at a state where nothing had been, and the trace would report an act no step took. Where the arm below reads pending — the Adapt re-scan's fold does — the close still precedes that read, and WHAT THAT PROTECTS is the recurrence accounting: the fold matches a detection against pending and against Mₛ separately, and with Mₛ already out of pending a detection reading as Mₛ's claim can no longer merge into it — it goes to whichever pending element states that claim, or opens on its own carrying unrepaired, and either way the adaptation that failed is visible as a claim that came back. Close after the fold instead and that detection lands in Mₛ's still-open entry, where nothing marks a return at all. Order: adapt, then close Mₛ, then Eval. Reached only from Qc; the relay-assigned close is written by judgment_relay_overruled at Phase 1] →
         [d = Adapt(direction)] adapt(direction, Λ.R) → R' [mutating — transformative revalidation] → Λ.R := R' [TARGET SUCCESSION] → dispose's close of Mₛ lands HERE, the act having happened, and before the fold below reads pending → Eval(Λ.R, X) → ∀ detected m: bind_kind(m) [split where non-atomic] → match_identity(m) against pending and against Mₛ → absorb into pending [TYPES: the SAME fold Phase 0 runs, the only difference being that the set folded into is non-empty here. A detection judged the same claim as an element already carried merges into it — that element keeps its id and its statement of the claim while its evidence takes in the detection's, takes the combined current reading, and takes the detection's stamp through merge's disjunction; the detection itself registers nothing, and whether the element it merged into registers turns on registered(e): one carried in from an earlier scan has its entry already, while one this same fold opened does not and still registers as a member of Mₑ_passed. Every detection carries a stamp decided before either arm, unrepaired := (m reads as the same claim as Mₛ, off identity) — Mₛ being the mismatch THIS cycle's dispose just closed by adapting, and no other record (CONVERGENCE, unrepaired(m)); a detection judged new takes init_occurrence's id and carries its stamp onto the element it opens, one judged the same contributes its stamp through merge's disjunction. Merging rather than leaving the carried element on its earlier reading is REQUIRED, not cosmetic: disposed(a) is aspect-keyed, so an element left holding a superseded aspect can never be discharged] → Mₑ := what the fold opened → [BEFORE certify: every m ∈ Mₑ is closed one way or another, so the stamp is not gated on the certificate filter] → ∀m ∈ touched: certify(m, local_claims) → ∀m ∈ touched: m.value_space := Some(bind_value_space(m)) where status = pass, None otherwise — total on both outcomes, since a merged element that carried a space and stopped passing must not keep it [same registration leg as Phase 0, `Certificate before registration; revalidate after adaptation`] → Mₑ_passed := the passing members of Mₑ — registration is for what the fold OPENED, an element already registered before this fold having nothing to register → record update(Λ.carrier, add all Mₑ_passed AND bring into line the entry of every touched element that was ALREADY REGISTERED before this fold — registered(e), never "was merged into", since an element opened and then merged into this same scan has no prior entry to bring into line and is added as one of Mₑ_passed instead) [Tool] — one write, because a carrier entry is a separate copy outside Σ and an element left behind would show a superseded target on a durable record, which disposed(a) being aspect-keyed would then never discharge → pending   -- Λ.carrier is Some here by construction: this arm is reached only through a Qc answer, and Qc is reached only after the Phase 1 registration that binds it → AssessFit(Λ.R, X, pending) → F' → Λ.fit_map := F' → Σ.scan_count += 1
         [d = Keep] non-mutating adjudication — no adapt, no Mₑ, no re-scan; Λ.R stands as whatever earlier Adapt dispositions left it as
         [d = Discard(replacement)] → Phase 2 → withdraw (below), whose own step is what the close of Mₛ follows
         -- Adapt alone advances the evaluated target as a succession of it (Λ.R := R'), which is what triggers the re-scan + registration-time certify of emerged mismatches; the re-scan table is LOOP's [Tool]
Phase 2 → withdraw (run-terminal): d = Discard(replacement) ∧ j = Upheld  -- the user upholds the mismatch and WITHDRAWS the evaluated result instead of adapting it. discard(replacement, Λ.R) [mutating, TOOL GROUNDING discard → artifact write: the artifact is actually withdrawn and the replacement put in its place, or removed outright when replacement = None] → THEN R_final := replacement (already Option(Result): None when the withdrawal leaves nothing in its place); Λ.withdrawn := Some((Mₛ, replacement)); then EVERY mismatch REMAINING in pending — Mₛ already left it at the dispose step above, so it cannot be closed twice — is closed with DispositionRecord { judgment = None, judgment_by = unjudged, disposition = Moot, assigned_by = loop, judgment_basis = "", disposition_basis = the withdrawal record } and record update(Λ.carrier, entry(m).status := completed for each). NO re-scan; deactivate. The adjudication claim stays on Λ.R (the object actually evaluated): every flagged aspect of it carries a ledger entry, and NO claim is made about the replacement
Phase 2 → route_away (mismatch-local): certify(m).status = route        -- an emerged mismatch a local route claim holds → emit that claim's routed_deficit, close m with disposition Route(routed_deficit) (assigned_by = certificate); where m is not yet registered it is dropped before registration, and where it is, the close completes that entry and m leaves pending; re-scan continues
Phase 2 → residual (mismatch-local): certify(m).status = ambiguous  -- an emerged or re-certified element whose claims do not resolve to one → close m as Residual with the same record shape as the Phase 0 arm (assigned_by = certificate); where m is not yet registered it is dropped before registration, and where it IS registered — a merged element whose grown evidence moved its status — the close completes that entry and m leaves pending, its value_space having been set to None on the same non-pass leg; re-scan continues. Same silent-phase ground as Phase 0: (R', X) is fixed at this re-scan, so there is nothing a second certification could read that the first did not
Phase 2 → split (pre-certify): KindBinding.atomicity = non-atomic  -- emerged compound mismatch → split into atomic sub-mismatches, then re-bind_kind → absorb → certify each (same re-scan pass); never registered as a compound. The split runs BEFORE absorb, which reads identity(m)

── LOOP ──
Transformative revalidation (NON-MONOTONE): this loop mutates the very object its detector evaluates. An Adapt disposition produces R', and Eval(R', X) re-targets the detector at the mutated result — so an adaptation can BREED new mismatches Mₑ that did not exist before. "Transformative revalidation" labels the ADAPT disposition; the table below gives each disposition's re-scan behavior.
After Phase 2, re-scan is disposition-keyed, not answer-keyed:
  Adapt(direction)      → re-scan R' against X for remaining AND newly emerged mismatches (mandatory)
  Keep                  → non-mutating; breeds no Mₑ; no re-scan
  Discard(replacement)  → the Eval target is gone; no re-scan is possible or meaningful; run terminates via Phase 2 → withdraw
  Route / Residual      → certificate-assigned, never surfaced for answer; the scan continues with the remaining mismatches
A relay-assigned Keep never reaches Phase 2 at all: judgment_relay_overruled closes its mismatch inside Phase 1, non-mutating, breeding no Mₑ and triggering no re-scan, and control returns directly to SelectNext over the remaining pending.
ONE ELEMENT PER CLAIM IN pending is what every scan is directed to reach, not a property the contract can guarantee — sameness is judged, and a judgment carries no invariant.
Mₑ is what the fold OPENED. Eval's output is bound and split FIRST, since everything below reads the binding, then absorbed one detection at a time into what this pass carries — the set starting as pending and growing by whatever the fold opens (TYPES, absorb): a detection judged the same claim as an element already carried merges into it and opens nothing, one judged new enters on its own and is a member of Mₑ. A merge is not a drop — the detection carries this target's reading of a claim registered against an earlier one, and merge combines that reading into the element rather than discarding it, field by field (TYPES, merge, whose field list is total). Because each merge feeds the element the next detection meets, two detections of one claim cannot race to overwrite each other. A mismatch CLOSED earlier in this run is not excluded from the fold either, and which arm it takes is judged like any other detection's: where it opens an element it re-registers, which un-disposes its aspect (disposed(a), CONVERGENCE) so no record written for an earlier registration can carry a terminal; where it instead reads as a claim already pending it merges, opening nothing, and that element was never disposed to begin with. Re-registration follows the open arm and is not owed by a return as such. The ledger match locates the record a return succeeds and discharges nothing (status↔ledger equivalence, pending); what it settles is whether unrepaired is stamped — where m reads as the same claim as Mₛ. A re-registration reaches Qc like any other pending mismatch, whatever the user answered for an earlier one: the target has moved, so the question is new.
Bind + certify each element the fold TOUCHED (fail-closed) — whatever it opened or merged into, the two overlapping rather than dividing, and a merged element's evidence having grown so its earlier fit no longer answers for it: only certificate-passing members of what the fold OPENED (Mₑ_passed) are registered into pending, an element carried in already registered having nothing to register; a routed mismatch is closed with Route(routed_deficit) and handed to that deficit (GapUnnoticed, ContextInsufficient, BoundaryUndefined — command hints /gap, /inquire, /bound); a non-atomic compound mismatch is split into atomic sub-mismatches and re-certified; an atomic ambiguous mismatch is closed as Residual, before registration. AssessFit classifies tracked mismatches but never suppresses them.
Recompute the fit map over pending and re-bind Λ.fit_map to it before selecting the next surfaced mismatch, even when Mₑ_passed = ∅. FIT-MAP SUCCESSION, the counterpart of TARGET SUCCESSION: every reader takes Λ.fit_map at the moment it reads, never a fit map computed against an earlier Λ.R.
CHECKED IN THIS ORDER:
  1. If pending non-empty: return to Phase 1 (SelectNext by severity, then FitRank, then oldest registered mismatch).
  2. Otherwise, if adjudicated(Λ.R, X): every flagged aspect carries a DispositionRecord → [Λ.withdrawn = None] R_final := Some(Λ.R) → assemble the verdict (below) → convergence.
Step 1 runs first so a re-registered aspect can never be read past. Step 2 is the SOLE R_final binding on the ordinary path — a Keep answered mid-loop leaves it unbound, since a later Adapt still advances Λ.R; the withdrawal path is excluded because Phase 2 → withdraw already bound R_final to the replacement
THE LOOP DOES NOT ONLY SHRINK: a re-scan over a mutated R' can register newly certified mismatches, so a run can have more left to settle after a disposition than before it — expected, not an error, and the reason nothing here counts down.
Continue until control REACHES a named terminal — the ordered check above, Phase 0's two exits, the gateless close, Phase 2 → withdraw. Convergence is read where one of those fires and nowhere else: `ContextualizedExecution` is the condition the emitted verdict must satisfy, not a state to test the run against between two steps. The Adapt arm is why that distinction is load-bearing — it closes Mₛ before the re-scan, so a run polled there would find pending empty with revalidation still owed.
Mode remains active until convergence.
Convergence evidence: At adjudicated(Λ.R, X), present the transformation trace ranging over Σ.dispositions — ONE ledger, since every close writes a record there whoever assigned it. ONE ROW PER DispositionRecord, GROUPED UNDER THE ASPECT, EACH ROW HEADED BY ITS id — the range and the row unit are the same thing, so a certificate-assigned close (Route, Residual) takes a row like any other, whether or not it ever registered — it may close an element registered before that fold, completing that element's entry — since absorb ran before certify and every element it yields carries an id — taken at init_occurrence or inherited through a merge — so there is one to head the row. An aspect closed more than once across TARGET SUCCESSION carries a record per close, and each keeps its own row in close order under that aspect rather than collapsing into the last one. Where consecutive rows under one aspect stand on different evidence, each says what its own close rested on, since that is what separates them — the aspect name does not. The id is what a reader points AT: it is the one thing on the row that is unique to it, so a decision taken about a row (carry this one on, split it out, leave it) survives being written down away from the trace.
  Each row also carries two readings the ledger supports and a label cannot. RETURNED: where this row's identity matches an occurrence already closed, the row names the MOST RECENTLY CLOSED such occurrence — one id, chosen by close order, so the reading stays decidable when several share that identity. CIRCLING: where one identity has accumulated several occurrences across the run, the count is stated once beside them — A FRAMING SIGNAL AND NOT A SCORE, saying the run keeps returning to this claim and nothing about how near convergence is (`Identity, occurrence, and reading stay distinct`).
  Each row still notes whether the occurrence it closed was stamped unrepaired — an adaptation the user asked for that did not take is the one thing a converged run must not report as simply resolved; the stamp answers only for the occurrence it was written on. For each row show (id → aspect → judgment → disposition) at its close, reading:
  Upheld → Adapt(direction)     : in-scope, adapted in place — ApplicationDecontextualized(m) resolved by adaptation
  Upheld → Keep                 : in-scope and accepted as-is — an ACCEPTED RESIDUAL, distinct from Overruled → Keep
  Overruled → Keep              : the aspect did not stand; nothing to repair — the user's own retraction, answered at Qc
  Overruled → Keep (relayed)    : the same close reached without a gate, because the fit evidence admitted no other reading (judgment_by = relay, assigned_by = relay, basis cited). Printed apart from the row above so the user can tell which retractions were theirs and which the protocol made on cited evidence
  Upheld → Discard(replacement) : the evaluated result was withdrawn rather than adapted; the replacement is what the user is left with (not itself adjudicated)
  (unjudged) → Route(routed_deficit) : a local route claim holds m — an attribution finding, not a verdict on fit
  (unjudged) → Residual         : unattributable on the evidence at hand, closed by its certificate; surfaced as a non-blocking residual
  (unjudged) → Moot             : still pending when a Discard withdrew the target; never judged
Convergence is demonstrated, not asserted.

── CONVERGENCE ──
-- DOMAIN NOTE: applicable / warranted / adjudicated / contextualized all range over the EVALUATED TARGET Λ.R — always a Result, never
--   Option-valued — and never over ApplicabilityVerdict.target. The two coincide on every path except withdrawal, where target is the
--   replacement and Λ.R is the withdrawn result. The protocol claims fit only for the object it actually evaluated.
applicable(Λ.R, X) = ∀ aspect(a, Λ.R, X) : warranted(a, Λ.R, X)
warranted(a, R, X) = fits(a, R, X)                          -- the per-aspect fit judgment, and NOTHING ELSE. Correctness is not a conjunct here
                     -- WHY THERE IS NO correct(R) HALF: every reader of this predicate substitutes the CURRENT target — adjudicated(Λ.R, X) does,
                     -- and Λ.R advances at every Adapt — so a correct(R) conjunct would read correct(R') after an adaptation. Nothing in the run
                     -- can produce that: Eval reports applicability mismatch and never correctness. Convergence would then rest on a fact no step
                     -- discharges, and a run whose adaptation broke the result would stall with pending empty and no terminal reachable. Worse in
                     -- the ordinary case, converging would ASSERT correct(Λ.R) for every aspect never flagged — the exact claim the adapted verdict
                     -- below declines to make. The conjunct did two wrong things at once and neither survives its removal
                     -- WHERE CORRECTNESS ACTUALLY LIVES: in the deficit and the activation guard, both read at ENTRY of the result this protocol
                     -- received, and both already carry their own correct(R) conjunct (decontextualized, Core Principle, Gate specificity). It is a
                     -- PRESUPPOSITION of activation — a result that is not correct is not this protocol's case — and target succession neither
                     -- re-opens it nor re-asserts it. What an adaptation did to correctness is OUTSIDE WHAT THIS PROTOCOL ESTABLISHES