The same sentence in four rooms

Imagine a theatre built as four stacked stages. The lowest stage contains model activations and health metrics. Above it sits the running service, with queues, retries and end-to-end probes. The third stage contains business effects such as balances, bookings and fulfilled commitments. The highest stage contains policy, authority and release. The phrase “recovery complete” is projected onto every backdrop.

Nothing mysterious happens when the projection changes colour between stages. Each stage supplies a different truth condition. A model-health claim is true when specified measurements satisfy a rule. A business-effect claim is true when authoritative state confirms a promised change. A release claim is true only when evidence and permission satisfy a policy. These conditions can be related, but they are not interchangeable.

A useful discipline is to give every operational claim an address. Write the address as ⟨object, time, evidence rule, logic, authority⟩. The object says what the claim is about. Time fixes the valid state. The evidence rule says what counts as a witness. Logic says how missing or conflicting evidence is treated. Authority says who may turn the judgement into action.

For Aster-7, “recovery complete” at the model stage might have the address ⟨six services, 09:14, health threshold, Boolean test, monitor⟩. At the release stage it might be ⟨customer payment journey, 09:14, probe + effect receipt, constructive gate, release controller⟩. The lexical overlap is nearly total. The logical overlap is not.

Relativity without relativism

Three positions are easy to confuse. The first says that a sentence can have different meanings in different contexts. The second says that one proposition can be supported by different evidence. The third says that contradictory propositions are equally acceptable. Only the first two follow from internal logic. The third does not.

Consider “the customer is verified”. In an identity service, the object may be a credential holder and the witness a valid cryptographic challenge. In a fraud investigation, the object may be the legal person behind a network of accounts and the witness a body of corroborating records. In a payment flow, the same phrase may merely mean that a prior verification token has not expired. These claims can be related, but copying the sentence does not copy the proof obligation.

The address prevents a quiet slide between them. Object identity must be mapped. The decision cutoff must be preserved or deliberately changed. The source witness must be shown sufficient for the target predicate. The target logic must say what absence and contradiction mean. Finally, authority must be carried by a valid grant rather than inherited from linguistic confidence.

This resembles coordinate dependence in physics only in a limited sense. A coordinate value may vary with the frame while invariant relations permit comparison. Here the claim address identifies the frame, and a translation declares the proposed invariants. The analogy ends because operational contexts are not automatically related by reversible transformations. A release policy may intentionally discard a model’s confidence score, and a legal rule may forbid a fact from entering a decision even when the fact is true.

The decisive test is alignment. When two judgements have different addresses, diagnose a translation problem. When their addresses match and their witnesses oppose one another, diagnose a contradiction or provenance failure. Calling both cases “perspective” hides the difference that action depends upon.

This idea has a precise mathematical ancestry. Lawvere’s categorical programme represented theories and their models through structure-preserving mappings, then developed indexed accounts of predicates and quantification. Categorical logic later made the correspondence between logical syntax and categorical structure systematic. A topos, under appropriate conditions, supports an internal higher-order language whose logic need not be classical.[1][3][5][6]

The practical lesson is not that an incident platform should become a topos prover. It is that truth conditions belong to a framework, and movement between frameworks is an operation with obligations. The next question is what “internal” means without allowing each framework to invent whatever truth it prefers.

flowchart TD
  A["The same sentence in four rooms"] --> B["Truth needs a stage"]
  B --> C["Translations have paths"]
  C --> D["The scoped logic model"]
  D -. "re-test" .-> A
  classDef first fill:#0a1424,stroke:#D95545,stroke-width:2px,color:#e6f3ff
  classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff
  class A first
  class B,C,D step

Truth needs a stage

Suppose a technician asks whether a database write succeeded. Before any readback arrives, a classical completion policy may insist on two outcomes: succeeded or failed. A constructive evidence policy asks a different question: do we have a witness for success, or a witness that success is impossible? Until one appears, neither conclusion is licensed.

The physical write has not become vague. What changed is the rule for asserting a proposition. Framework-relative truth is a relation between a claim, a stage and a witness condition, not a licence for arbitrary belief.

A minimal Kripke model makes the distinction visible. Let w₀ be the current information state. It has two possible refinements. In w₁, a readback receipt proves p, where p means “the effect committed”. In w₂, a rollback receipt proves that the effect did not commit. Information only grows as we move from w₀ to a refinement.

At w₀, we cannot assert p. We also cannot assert ¬p, because one accessible refinement proves p. Therefore p ∨ ¬p is not forced at w₀. This is the smallest useful example of intuitionistic persistence. Kripke’s semantics formalised such monotone information states for intuitionistic logic.[9]

Categorical logic expresses a related idea more structurally. Contexts can be organised as objects. Predicates over a context form a fibre or internal universe of propositions. A map between contexts induces reindexing, analogous to substitution. Under suitable conditions, existential and universal quantifiers appear as adjoints to that reindexing. Lawvere’s hyperdoctrines made this indexing explicit, while Lambek and Scott, Jacobs, Mac Lane and Moerdijk developed the connection between type theory, logic and categorical structure.[2][3][4][8]

An elementary topos generally supports intuitionistic higher-order reasoning. Classical excluded middle becomes available only with additional Boolean structure. This is not a defect waiting to be fixed. It reflects a proof discipline in which assertions require construction, and local truth may vary with stage.[6][7]

Missing evidence and opposed evidence

A practical system often receives two independent signals about one proposition: a positive witness and a negative witness. This creates four information states. Positive only supports the claim. Negative only supports its negation. Neither records an evidence gap. Both records a conflict. The last two states are routinely collapsed into a single value called “unknown”, although they demand different responses.

When neither witness exists, the next action is usually acquisition. Retry a readback, wait for a bounded interval, or ask an independent source. When both exist, more acquisition may deepen the contradiction. The next action is provenance analysis: compare identifiers, versions, signatures, cutoffs and causal lineage. A system that treats both cases as low confidence loses the difference between ignorance and inconsistency.

Belnap’s four-valued logic was motivated by information that may be incomplete or inconsistent. It distinguishes true only, false only, neither and both, and prevents one contradiction from automatically licensing every conclusion.[10] That is useful for collection and containment. It does not decide which receipt describes the world, and it does not authorise action when opposed evidence affects the same governed claim.

Logic therefore belongs in the claim address because different tasks need different closure rules. A monitoring screen may use a total two-state display after a timeout. A recovery controller may require constructive positive evidence. An investigation store may retain both signed assertions without explosion. These are not competing metaphysical universes. They are distinct inference contracts whose consequences must be visible.

The monotonicity boundary

The Kripke example assumes that information grows. Once a proposition is forced at a stage, every accessible refinement preserves it. This is defensible for an append-only proof record with stable meanings. It is unsafe for a live system in which credentials expire, policies change or a source retracts a faulty receipt.

The repair is not to abandon staged truth. It is to make time and version part of the context. “Authorised at 09:14 under policy 7” need not remain authorised at 09:22 under policy 8. The earlier judgement can remain true at its historical address while becoming unavailable for the later action. A revocation creates a new context and a translation obligation, rather than erasing the audit trail.

This boundary matters for human and machine reasoning alike. A conclusion may be valid under the information and rules available when it was made, yet invalid as a present instruction. Framework-relative truth becomes disciplined only when historical validity, current entitlement and action authority are kept separate.

This is the first defence against “all views are equally true”. Internal logic constrains what follows from a framework’s objects and proof rules. The second defence is translation. A local truth may remain local because no structure-preserving route to another level exists.

Translations have paths

A category gives us objects and morphisms. For this paper, think of objects as contexts and morphisms as translations. A translation may map a model-health predicate into a service-availability predicate, or a service predicate into a business-effect predicate. Composition lets us travel through several contexts.

That still leaves an important question. What if two routes connect the same source and target? A direct dashboard mapping may translate model health straight into “release ready”. A governed route may pass through journey evidence, business readback and policy. Both end at the release context. Their endpoints match, but their evidential histories differ.

Higher structure supplies language for that comparison. In a 2-category, objects are contexts, 1-morphisms are translations and 2-morphisms relate translations. If F: M → S maps model claims to service claims, G: S → A maps service claims to authority claims, and H: M → A is a direct path, then a 2-cell α: G∘F ⇒ H records a specified comparison between the composite route and the direct route.

A 2-cell does not declare the routes identical. It may show that one refines the other, that they agree under a bounded condition, or that an invertible comparison exists. If no cell can be supplied, the diagram does not commute. The disagreement is not philosophical pluralism. It is missing coherence evidence.

Higher category theory extends this recursively. There can be morphisms between 2-morphisms, recording coherence among comparisons. In weak higher categories, associativity and identity may hold up to specified higher equivalence rather than literal equality. Lurie’s higher topos theory and Riehl and Verity’s account of infinity-categories develop rigorous versions of this idea. Homotopy type theory similarly treats identity proofs as paths that can themselves have higher paths.[11][12][13][14][16]

Riehl and Shulman’s synthetic approach defines Segal types whose composites are unique up to homotopy, making coherent associativity part of the structure rather than an afterthought. Recent work has continued this programme by constructing substantial higher-categorical objects inside simplicial type theory.[15][17]

For an operational decision tool, we do not need an infinity-category implementation. We need the discipline it suggests: retain the route, retain the comparison, and distinguish literal equality from bounded agreement.

Equality is only one kind of agreement

A dashboard usually stores a final value and discards the path that produced it. Higher structure asks us to keep more distinctions. Two routes may be literally the same sequence. They may be different sequences with equal outputs. One may refine the other by adding evidence. They may be reversibly translatable over a limited domain. Or they may agree on the current case while diverging under the next intervention.

These are not stylistic variants. They license different decisions. Literal equality permits substitution without further work. A reversible equivalence permits substitution only while the inverse and preservation conditions remain available. Refinement permits a stronger route to replace a weaker one, but not necessarily the reverse. One observed agreement permits almost nothing beyond the observation.

In the Aster-7 case, the direct route and governed route both say “release” at 09:21. The direct route uses model health. The governed route uses journey success, effect readback and authority. Their outputs coincide, yet the direct route cannot replace the governed one. Under a delayed-effect fault, the first still says release while the second blocks. The intervention identifies a break condition for the apparent agreement.

The commuting update test

A small square captures a common coherence obligation. Let f update a source context, such as moving a service from configuration 7 to configuration 8. Let g update the target policy context. Let τ₇ translate claims before the update and τ₈ translate them afterwards.

There are now two routes. Update the source, then translate: τ₈ ∘ f. Or translate first, then update the target judgement: g ∘ τ₇. A strict commuting square requires equality. An operational comparison can use the weaker relation τ₈ ∘ f ≈ g ∘ τ₇, provided the meaning of ≈ is specified.

Suppose configuration 8 changes the health threshold while policy 8 adds an independent effect receipt. Translating after the source update yields “healthy under the new threshold”. Updating the old release judgement cannot add the missing receipt by itself. The square fails. That failure tells us that the policy update is not a relabelling of the model update. It introduces a new proof obligation.

A comparison cell can record this precisely. It names the two routes, the test domain, preserved fields, known exceptions and the evidence used to compare them. In software, this may be a signed test result or a typed transformation receipt. In mathematics, the comparison has stricter laws. In both cases, agreement becomes an object that can be inspected rather than a feeling produced by matching endpoints.

This limit is especially important in comparisons among scientific theories, contemplative traditions and machine architectures. Two frameworks may support a carefully defined correspondence without sharing ontology. A higher cell can document a relation between translations. It cannot turn awareness into computation, a proof rule into a psychological mechanism, or a bounded analogy into equivalence.

This route demonstrates why higher structure is not a doctrine of universal equivalence. The mathematics becomes useful precisely because it distinguishes identity, equivalence, transformation, refinement and failed comparison. A framework can be internally coherent yet unable to support a target claim. Another can be richer for one decision and irrelevant for another.

stateDiagram-v2
  [*] --> Claim
  state "Figure 1. The layered theatre<br/>of “recovery complete”" as Claim
  state "Relativity without relativism" as Test
  state "Figure 2. The five-field<br/>address of a claim" as Revision
  Claim --> Test: expose mechanism
  Test --> Decision: evidence survives
  Test --> Revision: rival survives
  Revision --> Claim: narrow or rebuild
  Decision --> [*]

The scoped logic model

The preceding ideas can be compressed into an operational instrument. Call it the Scoped Logic Model, or SLM. It is not a formal replacement for categorical logic. It is a typed decision record inspired by indexing, reindexing and higher coherence.

An SLM contains five things. C is a set of contexts. P is a set of addressed propositions. J records local positive and negative witnesses. T contains typed translations with preservation obligations. K contains comparison cells between routes. Write the whole model as S = (C, P, J, T, K).

Each translation lists the dimensions it must preserve. A model-to-service translation may need object identity, time alignment and a relation between metric health and service behaviour. A business-to-authority translation additionally needs policy version, purpose and authorised signer. If any required dimension is absent, the translation is blocked even when its output sounds plausible.

Five invariants for a scoped decision

Address completeness. Every proposition used in a consequential decision names its object, cutoff, witness rule, logic and authority. A human-readable label may be shorter, but the decision record cannot be. Missing fields produce a blocked status rather than an inferred default.

Witness polarity. Absence of a positive witness is not a negative witness. A timeout can trigger a safe operational default, but the receipt must say “defaulted after timeout”, not “proved false”. This preserves the difference between a fact, an inference and a control response.

No untyped promotion. A claim can leave its source context only through a named translation. The translation declares its source and target predicates, the dimensions it preserves and the evidence that justifies the bridge. A copied string, shared embedding or high semantic similarity is not a translation receipt.

Scoped coherence. A comparison between routes names the cases and interventions over which agreement was tested. “The routes agree” is incomplete unless the record states where they agree and which failure changes the result. New configurations invalidate a comparison when they alter a preservation obligation.

Authority non-inheritance. Factual transport does not carry permission by default. A model can transport a supported proposal into a policy context while the policy still denies the action. Authority has its own source, scope, expiry and revocation path.

The four-pass evaluator

The SLM evaluates a decision in four passes. The local pass computes positive and negative evidence for each addressed proposition. The transport pass attempts each declared route and returns either a transported judgement or a list of missing obligations. The comparison pass checks rival routes and records coherent agreement, conflict or uncovered cases. The action pass applies authority to the strongest supported target claim.

This order matters. If authority is checked before the target proposition is established, a valid permission can be mistaken for evidence. If route comparison happens after action, disagreement becomes an audit finding instead of a control. If local evidence is compressed into one confidence number, missing and conflicting witnesses become hard to reconstruct.

A final readback creates a new addressed proposition about the realised effect. The action receipt says what was attempted under which authority. The effect receipt says what the environment became. These are different witnesses. A successful API response can prove acceptance of a request while leaving the business outcome undecided.

The evaluator deliberately produces blocked and undecided states. Those outputs are not failures of intelligence. They are evidence that the system has preserved the boundary between what is supported and what would merely be convenient to say.

How to apply the lab

Start with “Green model only”. The shortcut produces a local positive signal, but its translation is blocked because business effect and authority are not preserved. Add a journey witness. The service route becomes transported, yet release remains blocked. Add a positive business receipt and sign-off. The governed route becomes coherent.

Then choose “Conflicting receipts”. The target now has both positive and negative business evidence. The lab returns conflict even though the model remains green. This result means “contain and reconcile”, not “average the evidence”.

A positive coherent result permits a bounded statement: the tested paths support the same release judgement for the represented scenario and preservation obligations. A blocked result means the claim must remain local or gather missing evidence. A conflict means the target scope contains opposed evidence. The lab cannot establish metaphysical truth, complete formal equivalence or safety outside the declared scenario.

function evidenceState(positive, negative) {
  if (positive && negative) return "conflict";
  if (positive) return "true";
  if (negative) return "false";
  return "undecided";
}

function transport(path, requiredDimensions) {
  const missing = requiredDimensions.filter(
    dimension => !path.preserves.includes(dimension)
  );
  if (missing.length) {
    return { status: "blocked", missing };
  }
  return { status: "transported", value: path.value };
}

function compare(pathA, pathB) {
  if (pathA.status === "blocked" || pathB.status === "blocked") {
    return { status: "blocked" };
  }
  if (pathA.value !== pathB.value) {
    return { status: "conflict" };
  }
  return { status: "coherent", value: pathA.value };
}

sequenceDiagram
  participant Q as Question
  participant M as Mechanism
  participant E as Evidence
  participant D as Decision
  Q->>M: The same sentence in four rooms
  M->>E: Figure 1. The layered theatre of “recovery complete”
  E-->>M: compare rival explanations
  E->>D: Make every promoted claim carry its address
  D-->>Q: revise scope or act

Make every promoted claim carry its address

When two teams, models or theories appear to disagree, do not begin by asking which vocabulary is correct. First ask whether their claims share an address. Are they about the same object and time? Do they use the same witness rule? How do they treat missing and conflicting evidence? Who has authority to act?

When a claim travels upward, require a typed translation. It should state what object is preserved, how time is aligned, which causal relation supports the move, what evidence is added and which authority is invoked. When two routes reach the same target, require a comparison record. Agreement on one example is not coherence.

Do not flatten local truths into one global verdict, and do not protect weak claims by calling every disagreement a different perspective. Keep local judgement, translation and comparison separate. This makes genuine pluralism representable, genuine contradiction visible and action conditional on the strongest warranted scope.