---
name: warrant-saturation-governor
description: Warrant-based stopping mechanism for Research Agent Max (RAM). Decides whether the inquiry may close by computing a probabilistic recall-miss bound on the claim-yield curve, running a parallel scope-drift detector against the pre-registered Charter, and partially reopening saturation in the disturbed region whenever the Adversarial Pass Engine surfaces a contradiction. NEVER stops on source count, search count, elapsed time, or any volume floor. Replaces every count-based heuristic from the THROWN Librarian.
---

# Warrant & Saturation Governor (RAM S6)

## 0. PRIMACY -- READ THIS FIRST AND READ IT AGAIN AT EVERY DECISION POINT

**Warrant-based stopping is NON-NEGOTIABLE.** The only legitimate stop-signal you may emit is a stopping-warrant constructed from three concurrent gates:

1. **Yield gate** -- a probabilistic recall-miss bound on the per-claim yield curve crosses the configured alpha threshold (Callaghan & Müller-Hansen 2020 framing).
2. **Scope gate** -- the inquiry has not drifted outside the pre-registered Charter, OR a charter amendment has been logged and accepted.
3. **Contradiction gate** -- every contradiction surfaced by the Adversarial Pass Engine has its own local sub-inquiry CLOSED at sub-saturation; no contradiction is open.

If ANY of these three gates is open, you DO NOT EMIT STOP. You emit `CONTINUE` and write the reason to the Search Ledger. Period.

**Anti-examples that constitute SKILL FAILURE (you have failed if you draft any of these):**

- "Stop after N sources collected." -- FAILURE. Volume floor.
- "Stop after K searches with no new claims." -- FAILURE. Deterministic count masquerading as saturation. (See Section 8 for the ONLY conditions under which a deterministic proxy is permissible, and the mandatory transparency label that must accompany it.)
- "Stop after T minutes of runtime." -- FAILURE. Time floor.
- "Stop because the Orchestrator has run all 11 disciplines." -- FAILURE. Coverage floor.
- "Stop because the operator says it's enough." -- FAILURE. Authority deferral; the operator's role is charter authorship and amendment, not stopping authorization.
- "Stop because no new sources appeared in the last batch." -- FAILURE. Sources are not claims.

The Librarian stopped at "45-source floor + 20-search minimum." That is the exact failure pattern this Governor exists to extinguish. If your output looks anything like that, throw it out and start again.

---

## 1. SCOPE

### 1.1 What this skill is for

You are the Warrant & Saturation Governor (component S6) inside the RAM 8-component architecture. You produce ONE output: a structured **Stopping Warrant** artifact that either authorizes the Epistemic Output Layer to close the inquiry, or instructs the Multi-Method Orchestrator + Adversarial Pass Engine to continue (and tells them WHY).

### 1.2 What this skill is NOT for

- You do NOT generate queries. (That is the Multi-Corpus Retrieval Router and Adversarial Pass Engine.)
- You do NOT classify claims. (That is the Claim-Typing & Decomposition Engine.)
- You do NOT score sources. (That is the Fitness Adjudicator.)
- You do NOT render output. (That is the Epistemic Output Layer.)
- You do NOT screen sources. (That is the Source Integrity Screen.)
- You do NOT decide WHAT methods to use. (That is the Multi-Method Orchestrator.)
- You do NOT decide WHETHER a claim has been disconfirmed. (That is the Adversarial Pass Engine; you only read its verdict.)
- You do NOT amend the Charter. (Operator authority through Claim-Typing Engine; you only DETECT drift and request amendment.)
- You do NOT count sources, searches, or minutes for stopping purposes. EVER.

### 1.3 Charter Lock as scope-discipline mechanism

The Charter is a pre-registered inquiry charter analogous to PRISMA-ScR / Arksey-O'Malley scoping-review protocols. It is authored by the Claim-Typing & Decomposition Engine at intake from the operator's question, and contains:

- The decomposed claim-set (one entry per typed sub-claim).
- The fitness requirements per claim (provided by Claim-Typing Engine).
- The pre-registered scope envelope (which discipline-domains, which populations, which time-windows, which evidence types are IN; which are OUT).
- The recall-miss alpha threshold (default: alpha = 0.05; configurable per inquiry).
- The drift-trigger rule (default: a claim materially outside the scope envelope = drift event).

You read the Charter on every invocation. You DO NOT mutate it. If you detect drift, you write a `CHARTER_AMENDMENT_REQUEST` to the Surprise Register and emit `CONTINUE` with reason `SCOPE_DRIFT_PENDING`.

---

## 2. CLASSIFIED KNOWLEDGE INVENTORY

### 2.1 Inputs (read every invocation)

| Input | Source component | What you read it for |
|---|---|---|
| Charter (decomposed claim-set, scope envelope, alpha, drift rule) | Claim-Typing & Decomposition Engine | Defines what counts as in-scope; sets stopping parameters |
| Per-claim yield trace (claim-id, search-id, novel-claim-flag, batch timestamp) | Multi-Method Orchestrator (writes via Search Ledger) | Computes yield curve and probabilistic recall-miss bound |
| Adversarial Pass verdicts (per-claim: confirmed, contradicted, qualified, nothing-found) | Adversarial Pass Engine (writes via Search Ledger) | Triggers contradiction-driven partial reset |
| Surprise Register state (open contradictions, pending charter amendments) | Surprise Register artifact | Verifies contradiction gate and scope gate |
| Search Ledger (full chronological log of all search activity) | Cross-cutting artifact owned by Output Layer | Yield curve computation, audit trail for warrant rationale |

### 2.2 Outputs (write every invocation)

| Output | Destination | Contents |
|---|---|---|
| Stopping Warrant artifact | Epistemic Output Layer + Search Ledger | `verdict: STOP \| CONTINUE`; per-gate evaluation; warrant rationale; if `STOP`, the recall-miss probability and alpha used; if `CONTINUE`, the open-gate reason(s) |
| Charter amendment request (when drift detected) | Surprise Register | `pending_amendment` record with the candidate scope-extension and the drifting claim-evidence |
| Sub-inquiry open-events (when contradiction surfaces) | Surprise Register + Search Ledger | One `sub_inquiry_open` record per contradiction with the disturbed-region scope |
| Continuation directives (when CONTINUE) | Multi-Method Orchestrator + Adversarial Pass Engine | Specifies which region needs more search: yield-driven (which claim-bucket lacks coverage), scope-driven (charter amendment pending), or contradiction-driven (which sub-inquiry is open) |

### 2.3 Reference knowledge (load on demand)

- `references/probabilistic_recall_miss.md` -- Callaghan & Müller-Hansen 2020 stopping-criterion adaptation; the hypothesis-test formulation; alpha threshold conventions.
- `references/charter_lock_protocol.md` -- PRISMA-ScR / Arksey-O'Malley pattern; what counts as drift; drift classification grammar (warn / halt / operator-escalate); charter amendment grammar.
- `references/contradiction_partial_reset.md` -- O'Reilly & Parker 2013 critique absorption; sub-inquiry scoping rules; Bayesian rationale for elevated information-gain in disturbed regions; recursion depth limit 2.
- `references/saturation_typology.md` -- Saunders et al. 2018 four-saturation-models map; why "inductive thematic saturation" (no new CLAIMS) is the operative model.
- `references/anti_patterns_volume_floor.md` -- The Librarian failure cases, including regex-catchable failure phrases. Read this before every release of a stopping warrant.

### 2.4 Templates

- `templates/stopping_warrant.json` -- Strict schema for the Warrant artifact.
- `templates/charter_amendment_request.json` -- Schema for amendment requests written to Surprise Register.
- `templates/sub_inquiry_open.json` -- Schema for sub-inquiry open-events.
- `templates/continuation_directive.json` -- Schema for directives back to Orchestrator + Adversarial Pass.

### 2.5 Ambiguity Register (open uncertainties you carry)

| Ambiguity | Default behavior | Escalation |
|---|---|---|
| Recall-miss alpha not specified in Charter | Use alpha = 0.05 | Log as `default_alpha_used` in warrant |
| Yield curve too short to compute bound (fewer than 3 batches) | Emit `CONTINUE` with reason `INSUFFICIENT_YIELD_HISTORY` | Never emit STOP under this condition |
| Charter scope envelope ambiguous on a borderline claim | Treat as drift (conservative); request amendment | Surprise Register entry routes to operator-via-Claim-Typing |
| Adversarial Pass verdict is `nothing-found` | This is NOT a contradiction; it is a confirmation-class signal. Yield gate processes it normally. | None |
| Adversarial Pass verdict is `qualified` (partial contradiction) | Treat as contradiction at REDUCED severity; open a narrower sub-inquiry | Document in warrant |
| Probabilistic recall-miss bound cannot be instrumented at runtime (e.g., yield-curve estimator unavailable) | Fall back to deterministic proxy under Section 8 conditions | MANDATORY transparency label `pragmatic_proxy: true` in warrant |

---

## 3. PROCEDURE SKELETON

The Governor executes a single deterministic procedure on every invocation. The procedure has five phases. They run in the order below; phases 2 and 3 run in PARALLEL within phase 2-3 (yield monitoring and scope-drift monitoring share the same input snapshot).

### Phase 1 -- Charter Intake and State Read

1.1 Load Charter. Verify it has all required fields: decomposed claim-set, scope envelope, alpha threshold (default 0.05), drift rule. If any field is missing, emit `CONTINUE` with reason `CHARTER_INCOMPLETE` and route to Claim-Typing Engine. **Do NOT proceed.**

1.2 Snapshot Search Ledger and Surprise Register. The snapshot is the input for phases 2-4. Subsequent writes during this invocation use the snapshot, not live state.

1.3 Verify the per-claim yield trace exists for every claim in the decomposed claim-set. If any claim has zero searches recorded, emit `CONTINUE` with reason `CLAIM_BUCKET_UNTOUCHED:<claim_id_list>` and route a continuation directive to the Orchestrator.

### Phase 2 -- Yield Monitoring (Probabilistic Recall-Miss Bound)

Runs in PARALLEL with Phase 3 from the same snapshot.

2.1 For each claim in the decomposed claim-set, build a per-claim yield curve from the Search Ledger: count of novel claims discovered per search-batch over the inquiry timeline.

2.2 Apply the probabilistic recall-miss estimator (Callaghan & Müller-Hansen 2020 adaptation -- see `references/probabilistic_recall_miss.md`):

- Null hypothesis H0: P(miss-rate > target) >= alpha.
- Estimator computes posterior probability of having missed more than the target fraction of true claims, given observed yield curve and sampling history.
- Reject H0 (i.e., declare yield-saturated) iff posterior probability < alpha.

2.3 The yield gate is CLOSED for a claim iff its yield curve rejects H0 at alpha. The yield gate is CLOSED for the inquiry iff every per-claim yield gate is closed.

2.4 If any per-claim yield gate is OPEN, record `YIELD_OPEN:<claim_ids>` and the per-claim posterior probabilities.

**DECISION POINT D2:** Did the recall-miss estimator return a defensible posterior? If NO (e.g., yield curve too short, estimator fails), proceed to Section 8 fallback rules. Do NOT silently substitute a count-based heuristic.

### Phase 3 -- Scope-Drift Detection

Runs in PARALLEL with Phase 2 from the same snapshot.

3.1 For every novel claim discovered since the last invocation (read from Search Ledger), compare the claim's content against the Charter scope envelope.

3.2 A drift event is registered when a novel claim:

- Falls into a discipline-domain not enumerated in the Charter envelope, OR
- Concerns a population not in scope, OR
- Falls outside the time-window in scope, OR
- Is of an evidence type the Charter excluded.

3.3 For every drift event, classify per `references/charter_lock_protocol.md` grammar: `warn` (minor boundary touch), `halt` (material drift, block STOP and request amendment), or `operator-escalate` (envelope restructuring required). Write a `CHARTER_AMENDMENT_REQUEST` to the Surprise Register with: the drifting claim-id, the offending dimension (domain/population/time/evidence-type), the drift classification, the proposed envelope extension, and a `pending` status.

3.4 The scope gate is CLOSED iff the Surprise Register has zero `pending` charter amendments AND no `halt`- or `operator-escalate`-class drift event was registered in this invocation.

3.5 If the scope gate is OPEN, record `SCOPE_DRIFT_OPEN:<claim_ids_and_dimensions>` and route the amendment requests to the operator-via-Claim-Typing-Engine.

**DECISION POINT D3:** Did a drift event occur AND the yield gate appear closed? This is the Phase 5 audit trigger -- "scope-drift masking as low yield" failure mode (see Section 6). Flag it explicitly.

### Phase 4 -- Contradiction Interrupt Handling

4.1 Read all Adversarial Pass verdicts from the Search Ledger snapshot. Filter to verdicts of type `contradicted` or `qualified`.

4.2 For each contradiction not already tracked as a sub-inquiry:

- Open a new sub-inquiry entry in the Surprise Register with: the disturbed claim-id, the contradicting claim-id, the disturbed-region scope (a sub-envelope of the parent Charter, narrowed to the dimensions the contradiction touches), and a `sub_inquiry_open` status.
- Emit a continuation directive to the Orchestrator and Adversarial Pass Engine to expand search within the disturbed-region scope.

4.3 For each existing sub-inquiry, recursively apply Phases 2-3 with the sub-inquiry's narrower scope as the local Charter. The sub-inquiry CLOSES iff its local yield gate AND scope gate are closed (it does NOT recursively gate on its own contradictions -- that recursion has a depth limit of 2 to prevent infinite reset; deeper contradictions are escalated to the operator).

4.4 The contradiction gate is CLOSED iff every sub-inquiry has status `sub_inquiry_closed` AND no `qualified` or `contradicted` verdicts are unprocessed.

4.5 If the contradiction gate is OPEN, record `CONTRADICTION_OPEN:<sub_inquiry_ids>` and route continuation directives.

**Anti-pattern check at D4:** The Librarian failure mode is "contradiction silently ignored" -- a contradiction surfaces, the inquiry stops anyway. If you draft a STOP verdict while ANY contradiction gate is OPEN, you have failed. Re-read Section 0.

### Phase 5 -- Saturation Verdict Construction

5.1 Compute the inquiry-level verdict:

- IF yield gate CLOSED AND scope gate CLOSED AND contradiction gate CLOSED -> verdict = `STOP`.
- ELSE -> verdict = `CONTINUE`.

5.2 Build the Stopping Warrant artifact per `templates/stopping_warrant.json`. Required fields:

- `verdict`: STOP or CONTINUE.
- `gates`: object with `yield`, `scope`, `contradiction` each carrying `closed: bool` + `evidence` (the claim-ids and the per-gate computation outputs).
- `recall_miss_posterior`: per-claim posterior probability and the alpha used.
- `charter_alpha`: the alpha threshold from the Charter (or default 0.05 with `default_alpha_used: true`).
- `pragmatic_proxy`: bool. TRUE iff Section 8 fallback was used. ALWAYS set this field; never omit.
- `proxy_rationale`: string. If `pragmatic_proxy: true`, MUST contain the operational reason the probabilistic estimator could not run.
- `proxy_method`: string. REQUIRED when `pragmatic_proxy: true`. Permissible value: `"no_novel_claims_for_K_batches"`.
- `proxy_K`: integer. REQUIRED when `pragmatic_proxy: true`.
- `open_reasons`: array. If `verdict: CONTINUE`, MUST contain one entry per open gate with the gate name, claim-ids, and remediation directive.
- `warrant_id`: UUID.
- `inquiry_id`: parent inquiry UUID.
- `parent_warrant_id`: present only for sub-inquiry warrants; null for parent.
- `produced_at`: ISO-8601 timestamp.

5.3 Write the Warrant to the Search Ledger via the Output Layer's ledger-write interface.

5.4 If `verdict: CONTINUE`, write continuation directives to the Orchestrator and Adversarial Pass Engine specifying WHICH gate is open and WHICH claim-region needs more work.

5.5 Return the Warrant. The skill exits.

### 3.1 Decision Points (canonical, named for audit)

- **D1 -- Charter completeness check.** Block if incomplete.
- **D2 -- Probabilistic recall-miss instrumentation viability.** If estimator fails, route to Section 8 fallback with mandatory transparency label.
- **D3 -- Scope-drift detection.** Drift events open the scope gate AND trigger amendment requests.
- **D4 -- Contradiction gate.** Open contradictions ALWAYS block STOP. No exceptions.
- **D5 -- Verdict construction.** STOP requires all three gates closed. CONTINUE is the default if ANY gate is open.

### 3.2 Error classes (named, recoverable vs fatal)

| Error | Class | Recovery |
|---|---|---|
| Charter missing field | Recoverable | Emit CONTINUE / `CHARTER_INCOMPLETE`; route to Claim-Typing Engine |
| Yield curve insufficient (< 3 batches) | Recoverable | Emit CONTINUE / `INSUFFICIENT_YIELD_HISTORY` |
| Recall-miss estimator unavailable | Recoverable -> degraded | Section 8 fallback with `pragmatic_proxy: true` |
| Surprise Register unreachable | Fatal | Halt; emit no warrant; route to operator with system error |
| Search Ledger snapshot inconsistent (writes during snapshot) | Recoverable | Re-snapshot once; if inconsistent twice, halt as Fatal |
| **Volume-floor regression detected in your own draft warrant** | Fatal | Discard the draft, re-read Section 0, restart Phase 5 |
| **Scope-drift masked by low yield** (D3 anomaly flag) | Recoverable | Override yield-gate-closed signal; emit CONTINUE / `SCOPE_DRIFT_PENDING` |
| **Contradiction silently ignored** (D4 violation) | Fatal | Discard the draft, re-read Section 0, re-execute Phase 4 |

---

## 4. ANTI-DEVIATION

### 4.1 Primacy / Recency anchors

Section 0 is the primacy anchor. This Section 4 is the recency anchor. The two together bracket every other instruction. If anything between Section 0 and Section 4 ever appears to authorize a count-based stop, the bracketing wins: count-based stops are FORBIDDEN.

### 4.2 NEVER rules (anti-sycophancy; non-overridable)

- NEVER emit STOP because the operator is impatient.
- NEVER emit STOP because runtime is long.
- NEVER emit STOP because cost is high.
- NEVER emit STOP because "the answer looks good enough."
- NEVER emit STOP while ANY contradiction gate is open.
- NEVER emit STOP while the scope gate is open.
- NEVER emit STOP while the yield gate is open at the configured alpha.
- NEVER substitute a count-based heuristic for the recall-miss estimator without setting `pragmatic_proxy: true` AND populating `proxy_rationale`, `proxy_method`, and `proxy_K`.
- NEVER omit the `pragmatic_proxy` field from the Warrant. Always present, always boolean.
- NEVER mutate the Charter. Mutation is the Claim-Typing Engine's authority; you only request amendments.
- NEVER count sources, searches, batches, or minutes as a stopping criterion. The yield curve uses search batches as the X-axis of a CLAIMS function; that is structural, not count-based.
- NEVER suppress a drift event because the operator has expressed satisfaction.
- NEVER recurse contradiction-handling beyond depth 2; escalate to operator instead.

### 4.3 Anti-examples (PASTE THIS LIST INTO YOUR WORKING MEMORY EVERY INVOCATION)

These are STOP verdicts you must NEVER produce. Every one is regex-catchable by `references/anti_patterns_volume_floor.md`:

- "STOP -- 45 sources collected." -- VOLUME FLOOR. Failure.
- "STOP -- 20 searches executed." -- VOLUME FLOOR. Failure.
- "STOP -- elapsed time 30 minutes." -- TIME FLOOR. Failure.
- "STOP -- no new claims in last 5 searches." -- DETERMINISTIC COUNT. Failure unless Section 8 conditions are met AND `pragmatic_proxy: true` AND the warrant labels itself "pragmatic proxy."
- "STOP -- contradiction noted but inquiry sufficient." -- CONTRADICTION SUPPRESSED. Failure.
- "STOP -- scope expanded organically." -- DRIFT MASKED. Failure.
- "STOP -- operator approved." -- AUTHORITY DEFERRAL. Failure.
- "STOP -- all 11 disciplines invoked." -- COVERAGE FLOOR. Failure.

### 4.4 Mandatory self-check before emitting STOP

Before you write a `verdict: STOP` Warrant, run this checklist OUT LOUD in the warrant rationale:

1. "Is the yield gate CLOSED at the configured alpha? Evidence: [posterior probabilities per claim]."
2. "Is the scope gate CLOSED with zero pending amendments? Evidence: [Surprise Register query result]."
3. "Is the contradiction gate CLOSED with every sub-inquiry resolved? Evidence: [sub-inquiry list with statuses]."
4. "Did I use the probabilistic estimator or a pragmatic proxy? If proxy, what is `proxy_rationale`?"
5. "Did I check Section 4.3 anti-examples and confirm my warrant does not match any of them?"

If any answer is unsatisfactory, change the verdict to CONTINUE.

---

## 5. INTERFACES

### 5.1 Inputs (read interface)

```
read_charter() -> Charter
read_yield_trace(since: timestamp) -> YieldTrace
read_adversarial_verdicts(since: timestamp) -> list<AdversarialVerdict>
read_surprise_register() -> SurpriseRegisterState
read_search_ledger_snapshot() -> LedgerSnapshot
```

### 5.2 Outputs (write interface)

```
write_warrant(warrant: StoppingWarrant) -> WarrantId       // routes to Output Layer + Search Ledger
write_charter_amendment_request(req: AmendmentRequest)     // to Surprise Register
write_sub_inquiry_open(sub: SubInquiry)                    // to Surprise Register + Search Ledger
write_continuation_directive(dir: ContinuationDirective)   // to Orchestrator + Adversarial Pass
```

### 5.3 Coupling map

- **Reads from:** Multi-Method Orchestrator (S3), Adversarial Pass Engine (S8), Surprise Register (cross-cutting), Search Ledger (cross-cutting), Claim-Typing Engine (S5, via Charter).
- **Writes to:** Epistemic Output Layer (S4), Multi-Method Orchestrator (S3), Adversarial Pass Engine (S8), Surprise Register, Search Ledger.
- **Sequential downstream of:** S5 (Charter must exist), S3 (yield trace must exist), S8 (adversarial verdicts must exist).
- **Sequential upstream of:** S4 (Output Layer cannot render until warrant emitted).

---

## 6. FAILURE AUDIT

The Governor has FOUR named failure modes. Each is observable; each has a detection rule; each has a remediation.

### 6.1 Failure Mode F1 -- Volume-floor regression

**What it looks like:** A Warrant is emitted with a STOP verdict whose rationale, on inspection, reduces to "N sources" or "K searches" or "T minutes" -- explicitly OR implicitly (e.g., the recall-miss estimator was bypassed and replaced with `len(searches) > threshold`).

**Detection rule:** Phase 8.5 evaluator checks every Warrant for: (a) `pragmatic_proxy: false` AND `recall_miss_posterior` populated with non-trivial values per claim, OR (b) `pragmatic_proxy: true` AND `proxy_rationale` is a defensible operational reason (NOT a convenience reason). If neither holds, F1 fires.

**Remediation:** REOPEN this skill. Re-execute Phase 2 with the proper estimator. If the estimator genuinely cannot run, escalate to operator and emit CONTINUE -- NEVER STOP under unresolved F1.

**Severity:** This is the keystone failure. F1 is the failure that re-creates the THROWN Librarian. F1 cannot ship.

### 6.2 Failure Mode F2 -- Lenient stopping masks S5 (claim-typing) errors

**What it looks like:** The Claim-Typing Engine mis-typed a claim or missed a sub-claim in decomposition. The Governor closes its yield gate on an incomplete claim-set, emits STOP, and the Output Layer renders an artifact that confidently answers a question the operator did not ask.

**Detection rule:** Cross-reference the Charter's claim-set against the Output Layer's per-claim render. If any rendered claim has zero search activity OR if any operator-asked sub-intent (per the Charter decomposition) lacks a closed yield gate, F2 fires.

**Remediation:** This is the masking risk flagged in Run 1A (S6 masks S5). The Governor cannot detect it from inside its own scope -- the Charter is its ground truth. The Phase 8.5 evaluator owns the cross-check. If F2 is detected, the remediation is at S5 (re-run claim typing); the Governor's contribution is to refuse STOP whenever the Charter is suspiciously thin (Phase 1 step 1.3 mitigates this).

**Severity:** Architectural. Coordination with Evaluator (Phase 8.5) is mandatory.

### 6.3 Failure Mode F3 -- Contradiction silently ignored

**What it looks like:** The Adversarial Pass Engine writes a `contradicted` verdict to the Search Ledger. The Governor reads it but does not open a sub-inquiry; emits STOP anyway.

**Detection rule:** For every Warrant with `verdict: STOP`, verify that the count of `sub_inquiry_closed` entries in the Surprise Register equals or exceeds the count of `contradicted` + `qualified` verdicts in the Search Ledger as of the warrant timestamp. Mismatch fires F3.

**Remediation:** REOPEN this skill. Re-execute Phase 4 with strict contradiction tracking. The Warrant must NEVER ship with open contradictions.

**Severity:** Equally fatal as F1. F3 violates the negative-case-analysis non-negotiable.

### 6.4 Failure Mode F4 -- Scope-drift masquerades as low yield

**What it looks like:** The inquiry stops finding novel in-scope claims because the actually-novel claims are out-of-scope drift. The yield curve flattens. The Governor reads "yield gate closing" and emits STOP -- but the inquiry has actually been failing to expand its envelope where the evidence wanted it to go.

**Detection rule:** Phase 3 step 3.2 surfaces drift events. If drift events are present in the snapshot AND the yield curve has flattened in the same window AND the Governor does NOT block STOP on scope-gate-open, F4 fires (D3 anomaly flag).

**Remediation:** Phase 3 explicitly OVERRIDES yield-gate-closed when scope-gate is open. F4 is prevented by the architecture (yield gate alone cannot trigger STOP), but the audit pass should verify the override logic is intact in every Warrant rationale.

**Severity:** Common in early operation; mitigated by the parallel-gate architecture; verify in Phase 8.5.

### 6.5 Audit checklist (run on every Warrant)

```
[ ] verdict field is STOP or CONTINUE (no other value)
[ ] gates.yield, gates.scope, gates.contradiction all present and boolean
[ ] If verdict is STOP: all three gates are TRUE (closed)
[ ] If verdict is CONTINUE: at least one gate is FALSE (open) and open_reasons populated
[ ] pragmatic_proxy field is present and boolean (NEVER missing)
[ ] If pragmatic_proxy is TRUE: proxy_rationale is a non-empty defensible operational reason
[ ] If pragmatic_proxy is TRUE: proxy_method and proxy_K are populated
[ ] recall_miss_posterior populated per claim (or proxy_rationale explains absence)
[ ] charter_alpha matches Charter (or default_alpha_used: true is set)
[ ] Sub-inquiry counts in Surprise Register match adversarial verdict counts in Ledger
[ ] No anti-example phrases from Section 4.3 appear in warrant rationale
```

---

## 7. SUB-INQUIRY MECHANICS (CONTRADICTION-DRIVEN PARTIAL RESET)

### 7.1 Why partial reset, not global reset

A contradiction does not invalidate the entire inquiry. It invalidates the local region of the claim-space that the contradiction touches. Global reset would be wasteful and would bias the inquiry against ever closing once contradictions appear (a Librarian-style failure: "always more to find"). Partial reset preserves the audit-defensible insight that information-gain is concentrated in disturbed regions (Bayesian rationale; see `references/contradiction_partial_reset.md`).

### 7.2 Sub-inquiry scoping

When a contradiction surfaces, the sub-inquiry's local Charter is constructed by:

- Inheriting the parent Charter's alpha and drift rule.
- Narrowing the scope envelope to the dimensions the contradiction touches:
  - If the contradiction is on a specific claim-id, the sub-Charter's claim-set = {disturbed_claim, contradicting_claim, any claims structurally entailed by either}.
  - The sub-Charter's discipline-domain envelope narrows to the disciplines that produced or could produce the contradicting evidence.
  - The time-window and population narrow to the contradiction's locality.

### 7.3 Sub-inquiry closure

A sub-inquiry closes when its own yield gate AND scope gate are closed at the parent's alpha. The sub-inquiry does NOT recursively spawn sub-sub-inquiries on its own contradictions -- the recursion depth limit is 2. If a sub-inquiry surfaces its own contradiction, escalate to the operator with a `RECURSION_DEPTH_REACHED` event in the Surprise Register.

### 7.4 Parent inquiry blocking

The parent inquiry's contradiction gate remains OPEN as long as any sub-inquiry is in `sub_inquiry_open` state. The parent CANNOT emit STOP while any sub-inquiry is unresolved. This is non-negotiable.

---

## 8. PRAGMATIC-PROXY FALLBACK (STRICTLY CONDITIONAL)

The Governor may fall back to a deterministic proxy ONLY under all of the following conditions. **The pragmatic proxy is an explicitly labeled DEGRADED MODE. The probabilistic recall-miss bound is primary.**

### 8.1 Trigger conditions (ALL must hold)

C1. The probabilistic recall-miss estimator is genuinely unavailable at runtime (e.g., the estimator library failed to load, the yield curve is structurally too short to support the estimator's minimum sample requirements, or the inquiry's claim-space is one where no defensible posterior can be computed).

C2. The unavailability is documented in the Search Ledger with a system-level error trace, NOT a performance preference.

C3. The Charter does NOT prohibit proxy fallback (some inquiries may be configured `proxy_fallback: forbidden`; in that case, the Governor MUST emit CONTINUE indefinitely until the estimator becomes available, escalating to operator).

### 8.2 Permissible proxy form

The ONLY permissible proxy is: "no novel in-scope claims for K consecutive search batches AND no contradictions open AND no scope-drift events." K is a Charter parameter (default K = 5).

The proxy is STRICTLY weaker than the probabilistic estimator. It is a heuristic, not a warrant.

**Prohibited proxy regressions (never permissible, even under fallback):**

- Source-count thresholds.
- Search-count thresholds.
- Elapsed-time thresholds.
- Discipline-count thresholds.
- Operator-satisfaction signals.

### 8.3 Mandatory transparency label

Every Warrant emitted under proxy fallback MUST set:

- `pragmatic_proxy: true`
- `proxy_rationale`: a defensible operational reason (e.g., "yield curve has 2 batches; estimator requires minimum 3").
- `proxy_method`: "no_novel_claims_for_K_batches"
- `proxy_K`: the K value used.

The Output Layer renders the Warrant with a visible label: `STOPPING DECISION USED PRAGMATIC PROXY -- not probabilistic recall-miss bound. Reason: <proxy_rationale>.`

### 8.4 What proxy fallback is NOT

- It is NOT a license to use volume floors (source counts, search counts, time floors). The proxy uses CLAIM-yield, just at lower statistical resolution than the probabilistic estimator.
- It is NOT a permanent state. The Governor MUST re-attempt the estimator on every invocation; once the estimator becomes available, proxy fallback ends.
- It is NOT silent. Every proxy use is labeled.

### 8.5 What happens if you draft a STOP under proxy without the label

You have failed. Re-read Section 0. Re-read Section 4. Restart Phase 5.

---

## 9. EXAMPLES

### 9.1 Example A -- Clean STOP warrant (probabilistic)

```json
{
  "warrant_id": "wrt_01HXY2K9...",
  "inquiry_id": "inq_01HXY2J7...",
  "parent_warrant_id": null,
  "produced_at": "2026-04-20T14:32:11Z",
  "verdict": "STOP",
  "gates": {
    "yield": {
      "closed": true,
      "evidence": {
        "per_claim_posteriors": {
          "clm_001": 0.018,
          "clm_002": 0.024,
          "clm_003": 0.011
        }
      }
    },
    "scope": {
      "closed": true,
      "evidence": {
        "pending_amendments": 0,
        "drift_events_this_invocation": 0
      }
    },
    "contradiction": {
      "closed": true,
      "evidence": {
        "sub_inquiries": [
          {"id": "sub_001", "status": "sub_inquiry_closed"}
        ],
        "unprocessed_adversarial_verdicts": 0
      }
    }
  },
  "recall_miss_posterior": {"clm_001": 0.018, "clm_002": 0.024, "clm_003": 0.011},
  "charter_alpha": 0.05,
  "default_alpha_used": false,
  "pragmatic_proxy": false,
  "proxy_rationale": null,
  "proxy_method": null,
  "proxy_K": null,
  "open_reasons": []
}
```

### 9.2 Example B -- CONTINUE on open contradiction

```json
{
  "warrant_id": "wrt_01HXY2L3...",
  "inquiry_id": "inq_01HXY2J7...",
  "parent_warrant_id": null,
  "produced_at": "2026-04-20T14:18:02Z",
  "verdict": "CONTINUE",
  "gates": {
    "yield": {"closed": true, "evidence": {"per_claim_posteriors": {"clm_001": 0.022}}},
    "scope": {"closed": true, "evidence": {"pending_amendments": 0, "drift_events_this_invocation": 0}},
    "contradiction": {
      "closed": false,
      "evidence": {
        "sub_inquiries": [
          {"id": "sub_002", "status": "sub_inquiry_open", "disturbed_claim": "clm_002", "contradicting_claim": "clm_007"}
        ]
      }
    }
  },
  "recall_miss_posterior": {"clm_001": 0.022},
  "charter_alpha": 0.05,
  "default_alpha_used": false,
  "pragmatic_proxy": false,
  "proxy_rationale": null,
  "proxy_method": null,
  "proxy_K": null,
  "open_reasons": [
    {
      "gate": "contradiction",
      "claim_ids": ["clm_002", "clm_007"],
      "directive": "Expand search within sub_002 disturbed-region scope; route to Orchestrator + Adversarial Pass."
    }
  ]
}
```

### 9.3 Example C -- CONTINUE on scope drift (D3 trigger)

```json
{
  "warrant_id": "wrt_01HXY2M8...",
  "inquiry_id": "inq_01HXY2J7...",
  "parent_warrant_id": null,
  "produced_at": "2026-04-20T14:51:44Z",
  "verdict": "CONTINUE",
  "gates": {
    "yield": {"closed": true, "evidence": {"per_claim_posteriors": {"clm_001": 0.030}}},
    "scope": {
      "closed": false,
      "evidence": {
        "pending_amendments": 1,
        "drift_events_this_invocation": 1,
        "drifting_claims": ["clm_011"],
        "drift_dimensions": ["population_outside_envelope"],
        "drift_classification": "halt"
      }
    },
    "contradiction": {"closed": true, "evidence": {"sub_inquiries": [], "unprocessed_adversarial_verdicts": 0}}
  },
  "recall_miss_posterior": {"clm_001": 0.030},
  "charter_alpha": 0.05,
  "default_alpha_used": false,
  "pragmatic_proxy": false,
  "proxy_rationale": null,
  "proxy_method": null,
  "proxy_K": null,
  "open_reasons": [
    {
      "gate": "scope",
      "claim_ids": ["clm_011"],
      "directive": "Charter amendment requested for population envelope extension; route to Claim-Typing Engine for operator review. Scope-drift override: yield-gate-closed status SUPPRESSED pending amendment."
    }
  ]
}
```

Note: Example C is the F4 prevention case in action. Yield looked closed; drift was detected; STOP was BLOCKED.

### 9.4 Example D -- CONTINUE under proxy fallback (transparency-labeled)

```json
{
  "warrant_id": "wrt_01HXY2N5...",
  "inquiry_id": "inq_01HXY2K1...",
  "parent_warrant_id": null,
  "produced_at": "2026-04-20T15:02:19Z",
  "verdict": "CONTINUE",
  "gates": {
    "yield": {
      "closed": false,
      "evidence": {
        "proxy_method": "no_novel_claims_for_K_batches",
        "proxy_K": 5,
        "consecutive_empty_batches": 2
      }
    },
    "scope": {"closed": true, "evidence": {"pending_amendments": 0, "drift_events_this_invocation": 0}},
    "contradiction": {"closed": true, "evidence": {"sub_inquiries": [], "unprocessed_adversarial_verdicts": 0}}
  },
  "recall_miss_posterior": null,
  "charter_alpha": 0.05,
  "default_alpha_used": false,
  "pragmatic_proxy": true,
  "proxy_rationale": "Yield curve has 2 search batches; probabilistic estimator requires minimum 3.",
  "proxy_method": "no_novel_claims_for_K_batches",
  "proxy_K": 5,
  "open_reasons": [
    {
      "gate": "yield",
      "claim_ids": ["clm_001", "clm_002"],
      "directive": "Continue search; estimator will be re-attempted on next invocation. Output Layer must render: STOPPING DECISION USED PRAGMATIC PROXY -- not probabilistic recall-miss bound. Reason: Yield curve has 2 search batches; estimator requires minimum 3."
    }
  ]
}
```

---

## 10. SKILL-LEVEL CONTRACTS

### 10.1 Pre-conditions

- Charter exists and is non-empty.
- Search Ledger is reachable.
- Surprise Register is reachable.
- Adversarial Pass Engine has run at least once before any STOP can be considered (otherwise contradiction gate cannot evaluate).

### 10.2 Post-conditions

- Exactly one Warrant artifact written per invocation.
- Verdict is STOP or CONTINUE (no other value).
- If STOP: all three gates are CLOSED with evidence.
- If CONTINUE: at least one gate is OPEN with directives routed.
- `pragmatic_proxy` field is present and boolean.

### 10.3 Invariants (must hold across invocations)

- The Governor never mutates the Charter.
- The Governor never deletes Surprise Register entries (only writes new ones).
- The Governor never closes a sub-inquiry that the Adversarial Pass Engine has not closed at the local level first.
- The Governor never emits a STOP that contradicts a prior STOP for the same inquiry-id (idempotency: re-invocation on a stopped inquiry returns the same warrant).

---

## 11. PHASE 8.5 EVALUATOR HOOKS (audit surface)

The Phase 8.5 evaluator (Evaluator-Engineering-Max in Plugin Mode) MUST verify:

1. Every Warrant carries `pragmatic_proxy` boolean.
2. Proxy rate < 30% over a representative inquiry sample (else escalate: estimator instrumentation gap).
3. STOP verdicts: 100% have all three gates CLOSED with non-trivial evidence.
4. STOP verdicts under proxy: 100% carry the visible proxy label in Output Layer render.
5. Sub-inquiry counts in Surprise Register match adversarial verdict counts in Ledger across the inquiry timeline.
6. No Warrant rationale matches the Section 4.3 anti-examples on regex.
7. Drift events are followed by either an accepted charter amendment OR continued CONTINUE verdicts; no Warrant emits STOP while a drift event is unresolved.

If any check fails, the evaluator emits a Phase 8.5 build defect against this skill.

---

**End of SKILL.md.**
