17–18 August 2026

The model was wrong. The compiler was not. The silent zero was the lie.

One day. Subject reduction failed in the Lean calculus. Refusal became an instrument and found two fabricating sites. By midnight four independent lanes had named the same absence on four surfaces.

  1. 01 Morning — EpistemicEffects.lean lost subject reduction. check.sio kept the payload type. The compiler was right.
  2. 02 Afternoon — a well-typed program returns a value or refuses. Used as an instrument, that statement found abs() + 1 still typed as i64, and an empty stub still readable as 0.
  3. 03 Night — pin_count, CALL, the visual state, and the reclamation wall: a plausible value where absence should have been declared.

Morning · the model

Subject reduction was false. That is a fact about the calculus, not about Madaros.

#1772 proved a preservation counterexample. #1779 recorded the ruling: measure collapsing its payload to Real is a defect in EpistemicEffects.lean, not a design choice in the language. The checker (`checker_check_measure_expr_inplace`) puts the argument’s own type into ty_knowledge — measure of a Nat is Knowledge<Nat>. CLAUDE.md already said measure() yields Knowledge<mg>. #1780 then gated the correspondence and left the refuted V1 model under a banner. Do not cite EpistemicEffects.lean as metatheory. It is a refuted model.

EffectLatticeBadge · why the compiler was right

fn measure (x: T) -> Knowledge<T> with Observe

checker_check_measure_expr_inplace keeps T. The refuted calculus typed every kraw as Knowledge<Real> and discarded the measured value. A unit type cannot survive that collapse.

EpistemicGateCard · #1779 · db750980b4

EpistemicEffects.lean has subject reduction

REFUSED

  1. E0Syntax
  2. E1HIR Type
  3. E2Effect Lattice
  4. E3GUM Variance Bounds
  5. E4Lean 4 Formal Proof
  6. E5Closed-form Theorem

Preservation is false for that calculus (#1772). measure collapsing the payload to Real contradicts the spec and check.sio. The nearest weakening also fails: the corruption propagates through application. This is a refuted model, not metatheory. E5 is unreached.

Afternoon · the instrument

A well-typed program refuses. The proof, used as a lamp, found two sites that still fabricated.

#1788 proved, in the E219 fragment and with no sorry, refusal_is_not_zero and well_typed_value_or_refuse. That file is a model. It does not prove check.sio implements the model — the gate stops at E4 and says so. The same afternoon the model was turned on the compiler: #1801 closed the two sites that still fabricated after a refusal. abs() + 1 is ty_error(), not i64. An empty IR stub emits ud2, not a fall-through 0. lean_single still has no E219. A vancomycin Cmin band that is not inside [10, 20] is PRE_REFUSE — the same thesis, on a dose.

EpistemicGateCard · #1788 · 31adf7b4bc

check.sio implements well_typed_value_or_refuse

UNBOUNDED

  1. E0Syntax
  2. E1HIR Type
  3. E2Effect Lattice
  4. E3GUM Variance Bounds
  5. E4Lean 4 Formal Proof
  6. E5Closed-form Theorem

SounioRefusalHonesty.lean proves the E219 fragment with no sorry. The file itself says that is a model, not a proof that check.sio implements the model. Citing the theorem as a compiler proof is empirical extrapolation. E5 is unreached.

EpistemicGateCard · #1801 · 2ab2de46cf

abs() + 1 is not i64; empty stub is ud2

TRUSTWORTHY

  1. E0Syntax
  2. E1HIR Type
  3. E2Effect Lattice
  4. E3GUM Variance Bounds
  5. E4Lean 4 Formal Proof
  6. E5Closed-form Theorem

The afternoon theorem, turned on the compiler, closed two sites of the same class. add_refuse_l: the checker returns ty_error() instead of the declared i64. Empty non-builtin stubs emit ud2. lean_single still has no E219. Two sites, not subject reduction for the whole compiler.

DiagnosticCodeBlock · E250 in full
tests/compile-fail/extern_c_unimplemented_builtin.sio
MadarosIOE250Refused
19extern "C" {
20    fn malloc(size: i64) -> i64;
21    fn abs(x: i64) -> i64;
22}
23
24fn main() -> i64 with IO {
25    let p = malloc(64)
26    print_int(p)
27    print_int(abs(0 - 7))
28    0
29}
E250--> tests/compile-fail/extern_c_unimplemented_builtin.sio:27:15

error[E250]: call to an `extern "C"` function the native backend does not implement

| = help: only these body-less names are implemented: print, print_int, print_char, print_f64, get_arg, get_arg_count, stcut 127r_len, str_char_at, str_eq, str_slice, starts_with, str_concat, str_from_bytes, read_file, write_file, file_size, sqrt, exp, log, sin, cos, assert, heap_alloc, heap_free, f64_to_bits, bits_to_f64, syscall6, malloc, free, getpid, getppid, exit, abort, system, read_i64, write_i64, read_f64, write_f64

= note: there is no dynamic linker in this backend; an unimplemented extern compiles to an empty stub whose calls read 0

Help literal 427 characters · pre-#1784 would keep 127 and drop 300

KnowledgeRefusalMeter · #1797 · PRE_REFUSE
cmin: Knowledge<mg/L>
pre-TDM · 78.5 kg · CrCl 65 · 1000 mg q12hε absent
[9.05, 24.30]var uncalibratedRefused
Refused

PRE_REFUSE. Fréchet support [9.05, 24.30] is not inside the therapeutic window. Refusal is the successful outcome — the same afternoon thesis, on a dose.

Night · the same absence

Four lanes. One class. A plausible value where a declared absence belonged.

By 01:00 UTC on 18 August, #1830, #1825, #1829 and #1823 had landed from four lanes that did not share a write-set. pin_count was read as 0 live pins; the emitter never increments it — the sentinel is now −1, UNWIRED. CALL was refused only as an unknown opcode; it now has a name, MLI_I_CALL_UNSPECIFIED, and has_value=false. FabricatedDatum gave the fifth epistemic state a face. The reclamation wall shipped its witness before the fix: the gate is intentionally red at 4,194,304 allocations (rc=182). #1792 remains open on the dissertation surface. The class is not closed. It is finally visible.

FabricatedDatum · #1830 · pin_count
runtime_context.pin_countFabricated

Read as zero live pins

Printed as given

0

Sentinel UNWIRED

The other reading

-1

The live x86_linux emitter never increments pin_count. Readers treated 0 as a measurement. #1830 writes −1 (runtime_context_pin_count_unwired) and pin_registry_ready: false. Same class as var=0.000000. Does not implement reclaim.

EpistemicGateCard · #1825 · CALL named

An unspecified CALL is an unknown opcode

TRUSTWORTHY

  1. E0Syntax
  2. E1HIR Type
  3. E2Effect Lattice
  4. E3GUM Variance Bounds
  5. E4Lean 4 Formal Proof
  6. E5Closed-form Theorem

CALL was refused only by the unknown-op catch-all, so a specified-but-unpinned ABI looked like a missing case — the #1801 empty-stub class. Interp now returns MLI_I_CALL_UNSPECIFIED (14) and has_value=false. A genuinely unknown opcode stays I5.

EpistemicGateCard · #1823 · witness before the fix

Handle reclamation at 2^22 allocations

REFUSED

  1. E0Syntax
  2. E1HIR Type
  3. E2Effect Lattice
  4. E3GUM Variance Bounds
  5. E4Lean 4 Formal Proof
  6. E5Closed-form Theorem

The product is the before-state. At 1,000,000 allocations the control holds. At 4,194,304 the fixture fail-closes with rc=182 (POSITIVE_CONTROL_FIRED). A reclamation patch is accepted only when the same gate prints HANDLE_RECLAMATION_OK. Absence declared, not a silent green.

Νύχτα · η κλάση, σχισμένη

Αυτά τα τρία πρόσωπα είναι γιατί τέσσερις lanes αναγνωρίστηκαν.

Τρεις μετρημένες περιπτώσεις. Το #1792 παραμένει ανοιχτό στις δύο πρώτες.

0.000000 #1792 4604219396932172800 #1792 33 > 127 #1794

var(blood): Knowledge<f64>Fabricated

Madaros

Printed as given

0.000000

lean_single

The other reading

~1e-5

rapamycin_epistemic_adaptive. Madaros printed var(blood/brain/periph)=0.000000. lean_single shows ~1e-5 / ~1e-9. A calibrated zero would be a measurement. This zero is the stub. #1792 is open: fail-closed detection, not a compiler ABI fix.

auc.ε: Knowledge<f64>Fabricated

Madaros TEST 6

Printed as given

4604219396932172800

lean_single ε

The other reading

0.671038

epistemic_pbpk28 TEST 6 printed AUC confidence 4604219396932172800.000000 — documented as the IEEE-bit-pattern-as-decimal of lean_single 0.671038. The integer exceeds JS 2^53; this control keeps it as text. It is not a unit-interval ε. #1792 remains open.

historical E219 help · 127-char capFabricated

Pre-#1784 print

Printed as given

   |
   = help: only these body-less names are implemented: print, print_int, print_char, print_f64, get_arg, get_arg_count, st

Dropped · 206 chars

Dropped after 127

r_len, str_char_at, str_eq, str_slice, starts_with, str_concat, str_from_bytes, read_file, write_file, file_size, sqrt, exp, log, sin, cos, assert, heap_alloc, heap_free, f64_to_bits, bits_to_f64, syscall6

#1794 counted 33 user-facing diagnostics over the old 127-character print cap. Every one was cut. E219 help is 333 characters; 206 were dropped mid-word. The historical CI logs that quote them are incomplete in the tails. #1784 closed the path. This card is the census, not the fix.