docs: recover the as-built computational model

[downwithbgp]

Design-recovery audit: the as-built computational model

Docs-only session. Reconstructs the computational model of inim as it actually exists at the pinned commit, using three explicitly separated passes (reconstruction → falsification → synthesis). No implementation, schema, evidence, policy, or case-study interpretation changed.

Starting commit

92f83d896faa3b4a205406ce618c7789a13c3789 (clean main, 1481 tests passing).

Maintained artifacts

• docs/computational-model.md — executive model, program equation, reading path, future design-checksum format
• docs/design/data-structures.md — 34 central + 16 supporting structures by computational role
• docs/design/algorithms.md — 23 named algorithms (A1–A23) + distributed/unnamed
• docs/design/invariants.md — invariant register (57 entries with status)
• docs/design/state-machines.md — 8 state machines recovered from implementation
• docs/design/algorithm-data-matrix.md — algorithm↔structure matrix with coupling observations
• docs/audits/2026-08-wirthian-design-recovery.md — dated historical audit
• Navigation: docs/README.md, docs/audits/README.md; inventory and documentation-inventory checked lists updated

Method

• Reconstruction: candidate model from code, tests, schemas, tracked artifacts (frozen report, SHA-256 0588a826…).
• Falsification: independent skeptical pass + bounded offline experiments (frozen report, SHA-256 dec7eeca…): demo init/verify, read-only server + DB-hash, answer-key determinism, scope/artifact audits, packaging.
• Synthesis: only claims that survived or are marked INFERRED/UNKNOWN entered normative docs.

Structures / algorithms / state machines recovered

Route identity (RouteKey, ADD-PATH-aware), cohort freeze, lifecycle, plans/archive plans, durable jobs, observed-result/assessment vocabulary, artifact publication, catalog projection; 23 algorithms; 8 state machines (job lifecycle, worker lease, run publication, readiness, observer-prefix lifecycle, scope recheck, etc.).

Invariants

33 enforced · 5 partially enforced · 1 assumed · 0 claimed-only · 2 contradicted/suppressed · 0 unknown.

Claims contradicted or narrowed

• Contradicted: "artifact listing and access share one resolver" (four resolvers exist); "unknown continuity always suppresses strong verdicts" (empty-transitions path returns NoObservableBgpImpact before the gate).
• Narrowed: cutoff provenance for open events, artifact path containment, scope enforcement on standalone analyze, expectation wording in stored/API verdict strings, WAL sidecars under read-only serving.

Unknowns

Whether the gaps+empty-transitions combination occurs on a real completed run; the source-extraction reuse predicate caveat at production scale. Both recorded with minimal resolving experiments.

Constraints honored

• No implementation changes, no evidence changes, no source snapshots changed, no analyses rerun.
• No source contacted (GRNOC, RouteViews, RIPE RIS, PeeringDB, RIR).
• No worker executed; no jobs queued.
• Zero external evaluation sessions (pilot registry untouched).
• No runtime files, screenshots, or databases committed.

CI note

The docs job currently fails on a pre-existing issue at the starting commit: scripts/audit-docs.sh flags CHANGELOG.md:3 "Session 55" narrative (the Session N heading format was introduced only by HEAD 92f83d8; main CI for 92f83d89 is already red). This branch adds no new audit failures — all new documentation passes the link, terminology, session-narrative, and inventory checks. The CHANGELOG issue is recorded as finding F-8 in the dated audit and intentionally left unfixed per this session's scope rules.