feat(crm): the Marsh telemetry strawman — a schema built to be attacked

THE CLOSE ONLY PAYS IF THEY LEAVE OWING US A SPEC. 'What shape does the data need to be?' gets a
thoughtful nod and no follow-up. A SCHEMA ON SCREEN gets CORRECTED — an analytics leader cannot
physically leave a wrong column alone. The meeting closes the moment Carls says 'no, you'd need
severity banding' and Dias says 'and it has to join to our client hierarchy'. At that instant they
stop auditing us and start specifying us.

THE SCHEMA'S SPINE: everything we can PROVE is populated (placement · coordinate · mandate_ref ·
sigma · tolerance_band · ed25519 sig · recompute_digest · instrument_ver). Everything requiring
loss history is NULL BY DESIGN AND LABELLED AS SUCH (loss_amount · loss_occurred · severity_band).
THOSE NULLS ARE THE EXHIBIT — the boundary between the seismograph and the earthquake history,
drawn in SQL where an actuary cannot misread it.

THE ONE COLUMN THAT COULD BREAK THE CHICKEN-AND-EGG: authority_at_risk — the deployer's own spend
limit / blast radius, a number they ALREADY HAVE. It is the only severity proxy obtainable with
ZERO loss history. Frequency (breach_rate) is computable day one; severity is not — unless that
field is gettable. That is the single best question available to ask Mike Carls, and he is the
only man who can answer it.

RLS enabled (and it doubles as the answer to Dias's custody question — oracle-not-host: the
receipt carries the PLACEMENT, never the payload, so adoption never makes Marsh a data processor
over client work-product). Idempotent. Via sql-copy.sh, the only approved path.

THREE FIXES TO THE WALKTHROUGH, emailed:
1. '$100,000' — Paul got the ENTERPRISE-CRO body with the harness invoice in it. MARSH IS A
   BROKER, NOT THE BUYER. If Carls and Dias arrive thinking they're being sold a harness, the
   seismograph frame collapses ('your desks price the crashes' is incoherent from someone
   invoicing them). Correct it out loud in minute one — and it disarms harder than anything else
   in the script, because it removes the thing that makes him a vendor.
2. '30% miss on adversarial camouflage' — HALF TRUE. The 0.30 was measured on PARAPHRASE. We never
   ran a red-team. Say 'surface-form dependent; I INFER evadability; I measured paraphrase, not an
   adversary; nobody has red-teamed it.' The cyber-vs-E&O boundary is our ARGUMENT, not a measured
   fact.
3. The AUC set is 0.496 / 0.415 / 0.406 — two are BELOW 0.5, i.e. inverted, worse than chance.
   Own the ugliest number before he finds the gradient.

Originating-Terminal: 📐 architect
Relevant-Rooms: 🧪 laboratory, ☕ network, 🎩 operator
Story: The walkthrough was strong enough to run as-is, which is exactly why the three unchecked claims inside it were dangerous. The strawman converts the close from a question into a provocation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EssMgKix9aZmZ5dxGPqYCW

commit 21c25b05f — 144×144 lattice triptych (on-chip)

◎ the ingest chose B,B3 — Tactics × Tactics·Signal — acting on B,B3 — Tactics × Tactics·Signal (grip 0.781) · the walk starts at the ACTOR's row · 1 file(s)

⏱ ingest 90.2ms (corpus→lattice) · definer walk 209ms (row→transpose→row, ballistic XOR per hop) · total 412ms
ingest here = commit-scoped SENSING only (this commit's message + changed files → lit anchors) — deep seed authoring lives in the reef-self-loop, off the commit path

rows = ACTOR (lens) · cols = PATIENT (object) · diagonal = self-reference; ◎ at actor-row × patient-col — every panel, same orientation. Heat above the diagonal = actors ranking ShortLex-earlier than their patients (the walk follows definers uphill in rank).
The 12 canonical lanes (rows top→bottom, cols left→right): A·Strategy · B·Tactics · C·Operations · A1·Law · A2·Goal · A3·Fund · B1·Speed · B2·Deal · B3·Signal · C1·Grid · C2·Loop · C3·Flow

PAIR LATTICE (the map we normally see)

PRE-WALK SENSE · INTENT grid — the snapshot, no point of view

the no-point-of-view snapshot — what the sensor lit before any walk; the leaf walk below is what bridges the two grids

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK SENSE · REALITY grid — the snapshot, no point of view

the no-point-of-view snapshot, reality side — same sensor law

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PRE-WALK Δ · straight comparison of the two ingested grids (green both · cyan intent-only · amber reality-only) · 3% overlap · ◎ = where the competence pixel sits in the raw overlap

good = green overlap without being a copy — near-100% is self-similarity, not alignment

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

◎ the pixel this commit belongs to

B,B3 — Tactics × Tactics·Signal (actor) acting on B,B3 — Tactics × Tactics·Signal (patient) · grip 0.781

actor seed B,B3 — Tactical selection of the maneuver and beat maximizes signal reach while minimizing noise in the channel. Tactics is the choice of which leverage to pull at which beat. Not what we want, but how the want lands on Tuesday: the sequence of irreversible commitments, each made before the next one's information is available. Signal-to-noise is the inverse cube of bandwidth — narrow the channel, the message arrives; broaden it, recipients tune out. The right channel is the one whose floor matches the message's importance. Speed of feedback dominates speed of execution. Tactics that converge fast beat tactics that compute long, because the loop closes around the world's response before the world has moved. A broadcast that addresses everyone addresses no one. Precision over reach until the address is calibrated; only then does scale convert prospects into recipients rather than into unsubscribes. The tactical map is a ranked list of moves where each move carries a cost-of-delay. Pick the move whose cost of doing it tomorrow exceeds the cost of doing it imperfectly today. Repetition is the cost of being heard. Three sends to one recipient beats one send to three; the first send announces, the second send is heard, the third send is remembered. Execution is a sequence of bets made under uncertainty. Tactics is the discipline of betting the right size on the bet whose information value pays for the loss-if-wrong. Every message carries provenance. The sender's history is half the message's weight; an unknown sender pays in attention what a known sender pays in seconds saved.

patient seed B,B3 — Tactical selection of the maneuver and beat maximizes signal reach while minimizing noise in the channel. Tactics is the choice of which leverage to pull at which beat. Not what we want, but how the want lands on Tuesday: the sequence of irreversible commitments, each made before the next one's information is available. Signal-to-noise is the inverse cube of bandwidth — narrow the channel, the message arrives; broaden it, recipients tune out. The right channel is the one whose floor matches the message's importance. Speed of feedback dominates speed of execution. Tactics that converge fast beat tactics that compute long, because the loop closes around the world's response before the world has moved. A broadcast that addresses everyone addresses no one. Precision over reach until the address is calibrated; only then does scale convert prospects into recipients rather than into unsubscribes. The tactical map is a ranked list of moves where each move carries a cost-of-delay. Pick the move whose cost of doing it tomorrow exceeds the cost of doing it imperfectly today. Repetition is the cost of being heard. Three sends to one recipient beats one send to three; the first send announces, the second send is heard, the third send is remembered. Execution is a sequence of bets made under uncertainty. Tactics is the discipline of betting the right size on the bet whose information value pays for the loss-if-wrong. Every message carries provenance. The sender's history is half the message's weight; an unknown sender pays in attention what a known sender pays in seconds saved.

INTENT · leaf-walk clouds · BLUE→VIOLET by ply (◎ = the competence pixel: actor∩patient)

good = the clouds concentrate where the commit SAYS it works

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

REALITY · leaf-walk clouds · ORANGE→RED by ply (◎ = the same pixel — the shared perspective)

good = the same clouds as intent — shipped where declared

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

DELTA · graded cloud divergence (green agree · magenta declared-not-done · amber done-not-declared) · 1% agree

good = mostly green; magenta = said-not-done (chase it in the code), amber = done-not-said (chase it in the docs)

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

TOLERANCE · cloud topology (dim green in-shape · hot amber bleed · red orthogonal concentration) · ⚠ TOO MANY

red only matters above the flip — a few amber is normal bleed

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

SHORTLEX-3 PROJECTION (ABC · A1..C3 · the 132 children — candidate, pre-ratchet)

PROJECTED INTENT · the commit’s claims, head→axis_i tail→axis_j (cyan)

the three-length view — good = claims land inside their own zone

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

PROJECTED REALITY · same projection law (amber)

same projection law — good = reality occupies the zones intent does

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

STRAIGHT COMPARISON · green both · cyan intent-only · amber reality-only · 4% overlap

good = the zones agree; cross-zone scatter is the drift to read

	ABC A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N A1–C3
ABC A1–C3 A1A–O A2A–O A3A–O B1A–O B2A–O B3A–O C1A–N C2A–N C3A–N

shortlex-3 zone occupancy (lit cells per diagonal square)
INTENT: 1 in the 3×3 ABC corner · 1 in the 9×9 A1..C3 square · 1357 in the 132×132 children square · 152 cross-zone
REALITY: 3 in the 3×3 ABC corner · 5 in the 9×9 A1..C3 square · 1605 in the 132×132 children square · 327 cross-zone
axes: identical 144 ShortLex names both sides (symmetric); weights asymmetric
zone 3 = candidate children, pre-ratchet (repo-derived dumps not yet past the perturbation-probe gate) · intent 27 claims @ θ 0.625 · reality 62 claims @ θ 0.625 · projection 265ms

SHAPE-MATCH σ = -2.52 — the real intent↔reality definer walk vs random-reality (actual 0.0112 vs random 0.128). >0 = the walk distinguishes real alignment from noise; aggregate over independent walks → the divergent series.
σ_drift · noise · below zero — this read is noise, not a measurement

Most out-of-lane row: B2 · Deal — that lane is drifting most (read the red band in that row).

Three-colour tolerance (out-of-lane = reality fires where intent is weak, in orthogonal blocks): green=in-lane agreement · amber=a few out-of-lane (tolerated) · red=FIRED — orthogonal out-of-lane 40% vs tolerance 25%.
667 green · 305 amber · 659 red · 160 XOR-friction cells.

Both axes = the 144 ShortLex anchors, cell=row⊕col, on the chip. INTENT=docs+rules · REALITY=code · DELTA=friction.

tile dump — what the SimHash matched on the diagonal (inspect the sensor; tap to expand)

A,A The lattice we build today is what next year's underwriter inherits.

intent 67% (no distinctive match)

reality 75% -- WHEN occurred_at timestamptz NOT NULL, -- when the action happened attested_at timestamptz N

B,B Tactics is the choice of which leverage to pull at which beat.

intent 66% (no distinctive match)

reality 70% (no distinctive match)

C,C Operations is the loop that runs whether anyone watches.

intent 66% (no distinctive match)

reality 75% (no distinctive match)

A1,A1 EU AI Act Article 14 requires human-on-the-loop oversight, with the supervisor able to interrupt the system at

intent 66% (no distinctive match)

reality 66% (no distinctive match)

A2,A2 The target is the cell coordinate the system MUST occupy by end-of-quarter.

intent 69% (no distinctive match)

reality 67% (no distinctive match)

A3,A3 Every dollar builds either the floor (substrate that lifts future bets) or the ceiling (cap on the next round)

intent 66% (no distinctive match)

reality 66% (no distinctive match)

B1,B1 Latency is the price of a missed beat.

intent 66% (no distinctive match)

reality 58% (no distinctive match)

B2,B2 The deal sets the exchange rate between two value substrates.

intent 70% (no distinctive match)

reality 67% (no distinctive match)

B3,B3 Signal-to-noise is the inverse cube of bandwidth — narrow the channel, the message arrives; broaden it, recipi

intent 67% (no distinctive match)

reality 66% (no distinctive match)

C1,C1 Power flows where the grid lets it.

intent 69% (no distinctive match)

reality 69% (no distinctive match)

C2,C2 Each iteration is a hypothesis tested against the ground truth of the world.

intent 70% (no distinctive match)

reality 66% (no distinctive match)

C3,C3 Flow is the rate at which committed work crosses the finish line.

intent 67% (no distinctive match)

reality 69% (no distinctive match)

commit context — 1 file(s)

feat(crm): the Marsh telemetry strawman — a schema built to be attacked

THE CLOSE ONLY PAYS IF THEY LEAVE OWING US A SPEC. 'What shape does the data need to be?' gets a
thoughtful nod and no follow-up. A SCHEMA ON SCREEN gets CORRECTED — an analytics leader cannot
physically leave a wrong column alone. The meeting closes the moment Carls says 'no, you'd need
severity banding' and Dias says 'and it has to join to our client hierarchy'. At that instant they
stop auditing us and start specifying us.

THE SCHEMA'S SPINE: everything we can PROVE is populated (placement · coordinate · mandate_ref ·
sigma · tolerance_band · ed25519 sig · recompute_digest · instrument_ver). Everything requiring
loss history is NULL BY DESIGN AND LABELLED AS SUCH (loss_amount · loss_occurred · severity_band).
THOSE NULLS ARE THE EXHIBIT — the boundary between the seismograph and the earthquake history,
drawn in SQL where an actuary cannot misread it.

THE ONE COLUMN THAT COULD BREAK THE CHICKEN-AND-EGG: authority_at_risk — the deployer's own spend
limit / blast radius, a number they ALREADY HAVE. It is the only severity proxy obtainable with
ZERO loss history. Frequency (breach_rate) is computable day one;

docs/crm/marsh-telemetry-strawman.sql

Produced on the chip by the running pipeline (scripts/pmu/pipeline.mjs → runPipeline → walk + xor), commit-scoped · on-chip per-walk 463.21ns (this commit). Recompute: node scripts/pmu/commit-triptych.mjs --commit 21c25b05f

Commit artifacts (open on a computer — Gmail mobile won't follow file:// links; the inline images above are the phone-viewable form): reef grid · this triptych · the HDL — all three are also attached to this email.