Kindynos Consequence Chain — Technical Formalism (FINAL, 2026-08-18)

Canonical successor to Kindynos_Consequence_Chain_Operator_Formalism_Note_2026-08-18.md (the predecessor is historical input, not authority). This note adopts the final v2.2 specification semantics in full. Status labels used below: Verified = verified in current implementation on a named path; Specified = designed here/in the spec, not verified as implemented; Research direction = exploratory. The architecture-status crosswalk (04_CONSEQUENCE_CHAIN_ARCHITECTURE_STATUS_CROSSWALK.md) maps each element to the estate.

1. The chain object

C = (V, E, τ, π, μ, κ)

• V — typed nodes: observations, events, states, decisions, valuations, settlements and other represented objects;
• E — typed relations between nodes;
• τ — temporal ordering and as-of semantics;
• π — provenance/evidence state: whether required evidence for an otherwise defined mechanism is present, and where each value came from;
• μ — model / rule / contract / metadata identity (name + version per link);
• κ — declared specification/coverage boundary: which consequences the represented world determines, under which conditions — and which it does not.

Estate instantiation (Verified, named path): one engine10 firing receipt materializes a concrete C: channel rows are V/E (event → asset revaluation → stakeholder consequence), fire_date/valuation_date and as-of inputs are τ, per-row inputs_provenance + inputs/outputs hashes are π, per-row valuation_model+model_version+implementation_id are μ, and the loaded F7/F8 binding sets with their explicit UNVALUED declarations are κ. Receipt: the chiller case, run engine10::1536120982797318b09363be82411391.

2. The π / κ distinction (load-bearing; never collapse)

• UNRESOLVED is a π state. The mechanism exists in the represented world, but required evidence/state is missing or insufficient. Remedy: obtain/validate evidence. Verified estate form: UNRESOLVED_INPUTS rows carrying missing_fields + sources_tried (named receipts: flood case INSURER_PROPERTY, TENANT_CORPORATE).
• REFUSED is a κ state. The represented world contains no authorized rule, model or contract mechanism determining the requested consequence under the stated conditions. Remedy: author/extend the specification, then validate the extension. Verified estate form: the chiller case's credit branch — the lender/CMBS stakeholders are declared and bound on other events, but no mechanism is authored for this event (loader-verified binding set).

π asks: do we have the evidence a defined mechanism needs? κ asks: does the represented world define this consequence at all?

Other governed states: COMPUTED (mechanism + evidence + result), OBSERVED (directly evidenced), CANDIDATE (consistent but not uniquely established — never rendered as REFUSED), SUPERSEDED (remains in history; no longer authoritative).

3. Coverage-aware operation typing

Trace:     C × V × V          -> Path | PartialPath(boundary_type, reason)
Intervene: C × V × U          -> C' | UNRESOLVED_INTERVENTION(reason) | REFUSED_INTERVENTION(reason)
Invert:    C × Y × SearchScope-> CandidateSet(paths, search_status, exclusions)
Attest:    C × Scope          -> EvidencePackage(exclusions)
Slice:     C × Ω              -> Projection(C)
Branch:    C × V × Θ          -> C_θ | REFUSED_BRANCH(reason)
Aggregate: P(C)               -> SystemView | PartialSystemView(exclusions)

boundary_type ∈ {π, κ} everywhere a boundary can interrupt an operation: an operation meeting missing evidence returns the π form; one leaving declared coverage returns the κ form. No operation may silently continue past either boundary.

Invert semantics (mandatory):

• returns candidate upstream paths consistent with the observed outcome under the represented world and the declared SearchScope;
• search_status distinguishes COMPLETE_WITHIN_SCOPE (an empty set means no candidate path exists within that represented scope) from SEARCH_INCOMPLETE (an empty set is not evidence of absence);
• exclusions declares every π or κ boundary omitted from the search;
• Invert never returns "the cause"; unique-cause identification requires separate justification outside this operation's contract.

Estate status: Trace/Attest — Verified in the concrete-receipt sense (the receipt exposes the full path and constitutes the evidence package; explain_run reads stored runs). Intervene — Specified for this case (counterfactual surfaces exist on other named paths). Invert — Specified. Slice/Branch/Compare/Replay/Aggregate — corpus operations per spec Appendix A; Replay claims require verified version-pinning on the claimed path before use.

4. Join semantics (not "same key")

J(C1, C2 | identity, time, semantics, provenance) -> C* | UNRESOLVED_JOIN(reason) | REFUSED_JOIN(reason)

A join is valid only under ALL of:

1. Identity compatibility — same asset/contract/stakeholder/issuer at the required identity level;
2. Temporal alignment — compatible as-of times, effective periods, event ordering;
3. Semantic/unit compatibility — units, economic meaning, contractual status and state definitions not silently changed at the boundary;
4. Provenance continuity — source and transformation of the joined value remain inspectable;
5. Coverage/evidence discipline — an upstream REFUSED value is never promoted to a determined downstream output; an upstream UNRESOLVED gap is never treated as satisfied.

UNRESOLVED_JOIN = join mechanism defined, required evidence/identity resolution missing (π). REFUSED_JOIN = the represented specifications cannot be joined consistently (κ/semantic gap).

Estate status: Specified as a formal operator. The practice is Verified on named paths: within one firing, event→asset→stakeholder rows join under one run identity with shared provenance; cross-system identity/timing discipline is enforced by frozen dates and typed inputs (e.g. the documented day-count sensitivity making frozen dates mandatory).

5. Integrity threat model (claims hierarchy — do not skip levels)

A locally controlled hash chain supports levels 1–2 only. Public copy stays at the strongest level with evidence — currently level 2, with an explicit internal-scope qualifier. The words immutable / tamper-proof / unforgeable / permanent record / blockchain / distributed ledger are prohibited on the public page.

6. Correction and supersession

Correction never silently erases. Requirements: (1) an authorized corrector; (2) evidence supporting the correction; (3) the prior link remains historically visible; (4) the corrected link is marked; (5) downstream derived values are identifiable as stale/superseded; (6) each is recomputed, refused pending recomputation, or explicitly retained as historical; (7) a reviewer can see the succession. Public sentence (mandatory, funded in page Section 6): Corrections supersede prior results without silently erasing the history that produced them. Estate status: Verified as evidence-pack practice (superseded materials retained under labeled history/ with pointers to current authority); automated downstream-propagation flags — Specified.

7. Feedback

Feedback is representable as authored conditions that couple consequence back into event probability: the chiller case's maintenance_backlog_score (sensitivity 0.4) and regional_heat_stress_index (0.1) conditions raise the authored failure probability, and its cascade triggers include the financial-pressure event. Compact public compression: financial pressure -> deferred maintenance -> higher failure risk. Verified as authored, loader-loaded mechanism; multi-cycle closed-loop simulation receipts — not produced, not claimed.

8. Construction cost (bounded authoring)

A bounded consequence chain requires: a defined represented world; typed entities/relations; events/actions; state-transition rules; models or deterministic calculations; contracts/rules; stakeholder/position definitions; evidence sources and as-of times; explicit coverage boundaries; validation/governance. This is the cost of refusing to improvise — the κ boundary in the public example is that discipline made visible.