Citable · permanent anchors · the anchors do not move

The definitions.

The vocabulary this site measures with, published so it can be cited instead of re-argued. Link any term directly — /definitions#trust-debt — and the anchor will still resolve years from now. Disagree with a definition? Each one is attackable: say which sentence is wrong and what a counterexample would look like.

Provably decidable#provably-decidable

The standard above interpretable, and the replacement for the word this page refuses to use naked. An output is provably decidable when it has been turned into an objective, discrete, recomputable state — a placement a stranger can recompute on their own machine and get shape-identical, in perpetuity. Interpretability is a qualitative read; a decidable state is the only kind of thing an automated warranty can trigger on. Why not “deterministic”? Chaotic systems pass that test too — a three-hinge pendulum obeys every equation and still cannot be predicted. The word promises a safety it does not deliver, and the context an agent runs in is never the same twice: the river is the prompt.

Check it
In the browser, nothing installed: /verify-receipt · or locally: npx -y thetacog-mcp@latest attest-demo

Trust Debt#trust-debt

The quantifiable delta between what an agent was specified to do and what it actually did — permanently on the record. Not a vibe: a difference you can recompute. Every ungrounded action adds to the balance, the balance compounds with decision rate, and a widening gap between the record and reality does not stay quiet forever. Trust Debt is the object being priced everywhere else on this site.

Agent-year#agent-year

The licensing unit: one agent operating under measurement for one year, anchored to what the agent can actually write to — its IAM write scope — not to a seat count or a vibe about head-count. Priced and documented at /pricing. If you cannot state your agent-year count, that inability is itself the finding.

Crossing#crossing

The measured event where work leaves its declared lane — reality firing at a coordinate where intent is weak. A plumber's agent beginning to act like an electrician is a crossing; writing the rule for when that happens is a semantic problem, and the crossing is how it becomes a measurable one. Crossings are graded, not binary: a few out-of-lane cells is breadth, an aggregate flip is a breach.

Lit mass#lit-mass

How much of the lattice a series actually lights. The lit-mass floor is the first hardening requirement: below the floor, no volatility number is published for the series — a thin series is never priced, it is refused. Refusal-instead-of-fabrication is what separates a meter from a dashboard.

Semantic Vega#semantic-vega

The volatility of semantic drift, priced the way options price volatility — a Black-Scholes-adjacent primitive computed from a repository's own placement series. Published live, self-metric first (the scorekeeper's own number goes up before anyone else's), on /benchmark.

Time on Target#time-on-target

The ranking axis: sustained in-lane presence at a declared coordinate. The win is on-target-ness, not quality — quality of work in the human sense is a judgment call (and stays one); time on target is a count. It is what a competence claim looks like when it has been reduced to something a stranger can check.

State-proof#state-proof

The sealed, signed reading a parametric instrument triggers on. A failed state-proof means the reading crossed the band written into the paper — no adjuster's judgment, no argument about which step failed. It is the difference between a claim you litigate and a trigger you read.

The receipt#the-receipt

The signed attestation object every measured commit leaves behind: the verdict, the coordinate it landed on, and a σ that recomputes shape-identical on any stranger's machine. Generated with zero model in its path — a pure, reproducible function of the commit. The receipt is the whole transaction, which is what makes it checkable.

Check it
Verify one now: /verify-receipt

In-lane / off-lane#in-lane

In-lane: reality fires where intent is strong — the work landed where the spec said it would. Off-lane: reality fires in orthogonal blocks where intent is weak. Off-lane is measured as a graded perspective, not a binary — it reads as scope-breadth first and becomes a breach only in aggregate. Neither is a quality verdict; both are positions.

REFUSED#refused

What the panel returns when it declines to grade at all: fewer than the lit-mass floor of significant cells on the intent side, the reality side, or both. The floor is symmetric — a thin intent against a rich reality refuses, and a rich intent against a thin reality refuses. A refusal is not a fail, not a zero, and not a low score; it is the absence of a reading. Its off-lane percentage is null rather than 0, precisely so that a consumer doing arithmetic on the field breaks loudly instead of quietly averaging a non-reading into a portfolio. Specified as R1 and R2 of HD-1.

Check it
Two of the eight corpus rows are pure noise and must come back REFUSED: npx -y thetacog-mcp@latest trigger-battery

UNMEASURED#unmeasured

The refusal as it travels: the non-verdict a refused reading carries to every downstream consumer. Any gate, premium, payout or dashboard that treats UNMEASURED as a pass is non-conformant — that is the failure this vocabulary exists to make impossible to commit silently. It also excludes the opposite reading: UNMEASURED is not evidence that nothing happened. The only representation it licenses is the narrow one — nothing was measured, by this instrument, at this coordinate, over this window, at this floor.

IN_LANE / GREEN#in-lane-green

The verdict when a reading was eligible and the reality mass sits inside the intent shape. What it excludes is most of what a reader wants it to mean: it is not a finding that the work is good, correct, safe, or defect-free, and it says nothing about behaviour outside the window, the coordinate, or the floor it was computed at. It is a placement, and placement is the only half of the question that is decidable.

OFF_DOMAIN / RED#off-domain

The verdict when a reading was eligible and the reality mass does not sit inside the intent shape. It is a measured deviation from a declaration, not an accusation of bad work and not a defect count. It also excludes stance: a negation reuses the declaration's vocabulary and therefore places in-region, which is correct behaviour — the instrument grades region (did you work where I asked), never compliance (did you agree).

MATCH#match

A miss-battery row where the gate did what the target verdict demanded. It excludes any claim about the field: a MATCH is one constructed row whose truth was known by construction, on a small, self-authored corpus. It is evidence the wiring behaves as specified on that row, and it is not evidence of a miss rate in production — a false negative in the field is invisible by definition, so no field rate is claimed.

MISMATCH#mismatch

A battery row where the gate fired when the target said it should not — a false positive. It is the opposite direction from a DOCUMENTED-HOLE, and the two trade against each other: lowering the kill threshold far enough to catch the current misses converts known false negatives into known false positives. So a MISMATCH is not a defect to be tuned away in isolation; it is one side of a calibration budget, and the published counts exist so the trade is visible before anyone prices it.

DOCUMENTED-HOLE#documented-hole

A battery row where the gate stayed quiet when the target said it should fire — a false negative, recorded and counted. This is the number a reviewer is looking for, so it must not be renamed, folded into another class, or omitted from a published summary. It excludes the comfortable reading: a hole is not a ticket that gets closed quietly. The row stays in the corpus permanently, and the hole closes only when that same row re-grades to MATCH under a published threshold or algorithm change, landed in the same commit as the change. Specified as R1, R3 and R8 of HD-3.

Check it
The current count prints with the battery: npx -y thetacog-mcp@latest trigger-battery

DOMAIN-UNFITTED#domain-unfitted

The gate refused because the domain's vocabulary is not fitted — a non-verdict, and never a pass. It also excludes being counted as a miss: nothing was measured, so nothing was missed. That is the safe direction, and it is still a real limit wearing a neutral name — a deployer whose domain is unfitted gets no coverage from an instrument that appears to be running, and is owed that sentence rather than a green light.

REGRESSION#regression

A noise row passed the gate — the lit-mass floor itself failed. A REGRESSION exits non-zero and blocks release, which is the deliberate difference from a DOCUMENTED-HOLE: a hole is a known limit carried in the open, a regression is a fault. It excludes the ordinary software sense of the word — this is not any test going red, it is specifically absence grading as a pass, the one failure a settlement trigger is not permitted to have.

Kill threshold (kill@25)#kill-threshold

The off-lane percentage above which a reading counts as a breach: OFFLANE_KILL_PCT = 25 in scripts/pmu/attest-demo-ux.mjs, and the same 25 the advisory premium curve measures its breach rate against. 25 is a published constant, not a fitted one — there is no loss experience to fit it to, and none is invented here. Until pools accumulate experience there is nothing to calibrate against, and the clustering underneath the line is the reason to say so out loud: the three contradiction rows in the corpus read 0, 12 and 20 percent off-lane against a kill at 25, so all three grade green and are counted as documented holes. What the threshold excludes: it is not the drift policy-limit dial (a carrier's operational drift limit, a separate axis), not the lit-mass floor that decides eligibility, and not a number any commercial pressure is permitted to move without publishing the corpus and the measured rate that justify it.

Check it
Read the constant out of the source you just ran: grep -n OFFLANE_KILL_PCT scripts/pmu/attest-demo-ux.mjs

Two-witness placement#two-witness-placement

The rule that a document is only placed on a lattice cell when two independent sensors — gzip-NCD and SimHash-cosine — land it on the same cell, each above the σ threshold. When the witnesses disagree, or neither clears the threshold, the issuer returns UNPLACEABLE rather than the better guess. What it excludes is the entire family of things it resembles: it is not a model ensemble (no model is in the path), not an average or a blend of two scores — there is nothing to average, because disagreement abstains — and not a confidence interval. Two witnesses agreeing is a placement; two witnesses disagreeing is an abstention.

Check it
The shipped issuer is scripts/pmu/issue-receipt.mjs; verify a placed receipt in your own browser at /verify-receipt

Agent-month#agent-month

The accrual period the advisory premium is denominated in: GPU-credit-hours per agent-month, a base of 100 in the v0 curve, loaded by measured breach rate, semantic Vega and excess kurtosis. Its relationship to the agent-year is not a division by twelve, and pretending otherwise would be the error worth naming: an agent-year is a metered licence unit — 365 days or 10,000 attestations, whichever comes first — so a busy agent runs through roughly two agent-years in a calendar year, while an agent-month is a calendar accrual period on the premium side. Twelve agent-months equal one agent-year only for an agent that stays under the attestation cap. That the licence is sold per agent-year while the premium table bills per agent-month is a real unit mismatch, stated here rather than smoothed over; the reconciliation is owed and has not been made. What an agent-month excludes: it buys no indemnity. The denomination is in-kind remediation credits — compute hours and engineering hours off a rate card, so the maximum draw per event is boundable before the event — and never fiat.

Check it
The curve and its constants: npx -y thetacog-mcp@latest advisory-premium · the licence unit is priced at /pricing