Skip to content
Paula Livingstone writing · projects · tools

Attestable Design & Artefact

Incomplete Records: The Third Verdict, and What It Makes Possible

Real plant data will not produce complete records, so the artefact has to say what happens then. Absence in a record is not silence in a demand: silence is permission, but a missing field read as permission would make an empty record admissible for everything, and read as failure would refuse every claim a plant can currently produce. So the verdict is three-valued, adding undetermined, which names the axis that could not be evaluated and what the record would need to carry. That is more information than a refusal, and it keeps an instrumentation gap distinct from an inadequate basis. The enforcement point decides how to treat undetermined, per act and recorded, not inside the library. This makes the artefact usable before record construction is solved: a run over real data maps which acts a plant can adjudicate today, and makes the value of instrumenting a missing field measurable in acts. Costs: the evaluation must report decided and undetermined cases separately, and admitting on undetermined is a way to appear to run the discipline while avoiding it.

The method as drafted compares a complete record against a demand. Real plant data will not produce complete records, and the artefact has to say what happens then, because a discipline that requires a record no existing system can supply is not a discipline anyone can use. This section fixes the treatment of absence, and it turns out to make the artefact useful earlier than the record problem is solved rather than later.

Absence in a record is not silence in a demand

The admissibility method already fixes that a demand silent on an axis does not constrain, because a demand that quietly required what it did not state would refuse claims for reasons its author never gave. Absence in a record is the opposite case and takes the opposite treatment. If a missing field were read as permission, an empty record would satisfy every demand and the discipline would admit everything it was built to refuse. If it were read as failure, the artefact would refuse every claim any real plant can currently produce.

Neither is right, and the reason is that absence is a third thing. A record that does not state its established scope is not a record whose scope is unbounded, nor one whose scope is empty. It is a record that cannot answer the question. So the method returns three verdicts rather than two: admit, refuse, and undetermined, the last carrying which axis could not be evaluated and why.

The conjunction is unchanged in shape. A claim is admitted when every axis the demand constrains is satisfied. It is refused when any constrained axis is unsatisfied. It is undetermined when no axis is unsatisfied but at least one constrained axis cannot be evaluated because the record does not carry it. Refusal takes precedence over undetermined, because a claim that fails an axis fails whatever else is unknown.

Why the third verdict is not a weakening

A three-valued verdict looks like a retreat from a mechanical decision and is the opposite. Undetermined is a determinate outcome: it says the comparison could not be completed, names the axis, and says what the record would have to carry for it to complete. That is more information than a refusal, and it is exactly what an engineer needs to know, because it identifies which field their systems would have to start producing to bring a class of acts under the discipline.

It also keeps the failure modes apart. Refusing an unknown record and refusing an inadequate one are different events with different remedies, and a two-valued verdict conflates them: the first is a gap in instrumentation and the second is a claim that should not be acted on. A discipline that reported both as refusal would be unusable for the ordinary reason that its output could not be acted on differently.

What the enforcement point does with it

The library returns the verdict; it does not decide what happens next, and undetermined makes that division sharper. An enforcement point may treat undetermined as refusal, which is the conservative configuration and the right default where the act is consequential. It may treat it as admit for acts whose demand is weak enough that the missing axis was never load-bearing. What it must not do is treat it silently as either, because the whole value of the third verdict is that the gap is visible.

That choice is configuration and belongs outside the library, recorded per act rather than embedded in the comparison. Placing it inside would make the artefact's behaviour depend on a policy it did not state, which is the failure the discipline exists to prevent.

What this makes possible now

Three things become available before the record construction problem is solved.

A plant can be run against the discipline using the fields it already has. Acquisition and establishment time are usually recoverable from the source that produced a value. Scope, authority and origin identity often are not. A run over real data therefore produces a map of which acts can be adjudicated today and which are undetermined and on which axis, which is a finding about the plant rather than about the artefact.

The value of a missing field becomes measurable. If instrumenting established scope would move a large class of acts from undetermined to decided, that is an argument for instrumenting it, expressed in acts rather than in principle. If it would move nothing, the field is not worth the cost in that plant.

And the artefact acquires a use that does not depend on refusing anything. A discipline whose first delivery is a statement of what a plant cannot currently adjudicate is useful to an engineer on the day it is installed, which a discipline that only refuses is not.

What this costs

Two things, stated because the standard requires it.

The verdict is no longer binary, so everything downstream that reads it has to handle three cases, including the evaluation. The coverage and risk relationship is computed over decisions, and undetermined is not a decision; the evaluation must therefore report coverage over decided cases and undetermined cases separately, or it will read instrumentation gaps as discrimination.

And the third verdict creates a way to avoid the discipline. An enforcement point configured to admit on undetermined, over a plant whose records are mostly incomplete, would pass almost everything while appearing to run the discipline. That configuration is legitimate for weak demands and dangerous everywhere else, and the artefact cannot prevent it. What it can do is make it visible, since the verdict names the axis it could not evaluate and the enforcement point's treatment of undetermined is recorded rather than assumed.