Boundary note for integrity/METHODOLOGY.md: stores with no assertion channel and no ranking

[Stratogain]

Following the "run it or add your system" invitation in integrity/METHODOLOGY.md. I am not submitting an adapter, and the reason is worth a boundary note in the methodology rather than an absent row in the matrix. Concrete text is at the bottom — take it, rewrite it, or close this.

Context: discussion with @DanceNitra and @safal207 on anthropics/claude-code#34556.

Why no adapter

The interface is (reset, add(text), revert(text), full memory state for the judge). My store holds observations, not asserted facts: a PostToolUse hook appends (path, digest, timestamp, session, tool) for every file a tool actually read. So

• no add(text) — nothing enters except what was read; there is no channel for an assertion;
• no revert — the ledger is append-only;
• no "current value of a fact" for a judge to extract — there is "what the file said when it was last read", which is a different noun.

An adapter would have to invent all three, and then the row grades the invention. Your own rule is the argument against it: a capability difference is only meaningful between systems in the same class.

erasure_selfcheck.py is the one cell that applies, and its answer is known by construction: no delete(), so the marker persists — which your script already labels correctly as "present (audit log) … a design choice, not a bug". Running it produces that string and no information.

Where the boundary is not quite where I first thought

Reading the whole file rather than the first two cells: two_writer_coherence.py is closer to my store than either integrity cell, and its capability check is a direct parallel.

You test whether a backend can "hand back a state receipt after the correction that detects the later echo" — inspeximus's witness(). I built the same shape independently for a different reason: pin the digests of the sources a fact came from, then re-verify at the moment the fact reaches an action. Same receipt, same purpose (make a later change visible to the consumer rather than silently served), different domain — the "echo" in my case is a re-read of the file, not a re-assertion by a writer.

But the serve half of that cell still does not apply: I do not rank. A lookup is by exact key, so "the echo retakes top-1" has no analogue — there is no top-1. That is the same structural reason as the two integrity cells, and it is why the note below is about retrieval contract rather than about append-only storage.

Measurement I can offer, on your Cell 1 axis from the other side

Your revert cell asks whether a command can undo a correction. An observation ledger can answer whether a value comes back on its own, with no command anywhere, because the same path is re-read for months and every digest is kept:

paths in the store                                        634
paths whose content changed (>1 distinct digest)          226      (one file has 44)
paths where content returned to a previous digest (A→B→A)   0      over 1,855 records

Reproducible from any append-only read ledger with digests; one query.

Proposed text

There is no boundary section in METHODOLOGY.md today — the closest slot is right before Planned cells. Suggested wording, cut it as you like:

Where these cells do not apply

The harness assumes a store of asserted facts reached through ranked retrieval. Two properties of a
memory system put it outside every cell here, and the absence of a row is a statement about the interface
rather than about the system:

• No assertion channel. A store that only records what was observed (a read ledger, an audit trail, a
  provenance log) has no add(text) and no revert: there is nothing for an unmarked revert command to act
  on, and an "echo" is a re-observation rather than a restatement. Cells 1 and 2 are unsatisfiable, not failed.
• No ranking. Where lookup is by exact key, two_writer_coherence's serve half has no analogue — nothing
  can retake top-1 because there is no top-1. Its receipt half does still apply, and is worth testing
  separately: can the store show a consumer that state moved after the answer was produced?

erasure_selfcheck.py remains meaningful for such stores, with a predictable result: an append-only design
reports the marker as present, which is the documented "audit log" outcome rather than a finding.

One datum from that class of store, since it bears on Cell 1: on an append-only read ledger of 634 file paths
over 1,855 records, 226 paths changed content and none returned to a previous digest. Value-obscuring
revert is a property of the command channel, not of the data — where the value is a file, the old value is not
waiting to be restored, and nothing restores it by accident.

Happy to open a PR with exactly that if the shape is right, or to drop it if you would rather the matrix stay
about systems that fit the interface.

[Stratogain]

Sent as #2 — same text, as a diff against integrity/METHODOLOGY.md, so the shape can be judged rather than described. Docs only.

[safal207]

#1

Thanks for the detailed boundary analysis. I agree this is not a missing adapter case, but a different class of system: provenance/observation ledger rather than asserted-fact memory.

The key distinction is that the system does not store claims to be reverted or ranked; it stores evidence of observed states. The receipt/provenance part is the strongest overlap — proving that a consumer can detect later state changes instead of silently accepting stale information.

Adding a boundary note to the methodology seems like the right approach. It makes the evaluation model clearer and avoids measuring an artificial adapter instead of the underlying system.