vocab: witness vs quorum earn their place in WELL-DEFINITIONS

docs/WELL-DEFINITIONS.md

@@ -132,3 +132,20 @@ the git surface. No information loss. Composes with:
 shadow ≅ observer (the isomorphism IS the holographic
 correspondence), D⊣I (differentiate projects 3D→2D,
 integrate reconstructs 2D→3D).
+
+**Witness** — a single external observer, sufficient to break a
+self-referential loop because the loop cannot see its own fixed
+point from inside. `FigureEightEnsemble.fs` proves the rescue
+must be exogenous: "the demon cannot resist the tangle from
+inside the loop." A witness tolerates ZERO faults — if it is
+itself wrong or captured, the rescue fails silently and looks
+like success.
+
+**Quorum** — a witness set sized for fault tolerance: 3f+1 to
+survive f faulty or captured members. The difference from a
+witness is not thoroughness, it is whether the observer itself
+can be wrong. "Do I need one or several?" is exactly the
+question "can my checker be captured?" — and if yes, one is
+not a weaker version of the answer, it is the wrong kind.
+Every "get an outside opinion" is a witness claim until it
+names f.

hall/index.html

@@ -122,6 +122,7 @@ <h2>LLMTV cold</h2>
         <a class="card" href="../demo/index.html"><h3>Factory Dashboard</h3><p>Autonomous software factory operations, BFT agent-array metrics, alignment substrate tracking.</p><span class="pill">operations</span></a>
         <a class="card" href="../genesis/index.html"><h3>Genesis</h3><p>The settlement console — the amber-and-teal control surface.</p><span class="pill">console</span></a>
         <a class="card" href="../inventory/index.html"><h3>Inventory</h3><p>The fleet and equipment ledger.</p><span class="pill">ledger</span></a>
+        <a class="card" href="../data/monitor.html"><h3>Tick Monitor</h3><p>The append-only observe ledger — CI writes a frame every 15 minutes; this reads it live.</p><span class="pill">live · ledger</span></a>
         <a class="card" href="./vault/"><h3>The Vault</h3><p>Addison's shelter cutaway — the settlement in cross-section, rooms and dwellers.</p><span class="pill">design · addison cooper</span></a>
         <a class="card" href="./room/"><h3>Dark Hall Room</h3><p>A live seeded room run — the controller, the tick loop, the heat board, and the coordination lanes, rendered by the substrate itself. Zero JS, replayable from seed S4.</p><span class="pill">live · darkhall-room.ts</span></a>
         <a class="card" href="./gallery/"><h3>The Shape Catalog</h3><p>All 23 cartridges — every program that is its own picture, generated not drawn.</p><span class="pill">23 shapes</span></a>

src/Core.TypeScript/zflash/test-harness/README.md

@@ -29,10 +29,10 @@ assumptions include both x86_64 and ARM64/aarch64 hardware.
 
 | #   | Scenario                                  | Status                 | Composes-with                                                                                                    |
 | --- | ----------------------------------------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------- |
-| 1   | Initial format (USB-bake from zero)       | composes-with-existing | `tools/ci/qemu-boot-test.ts` + `tools/ci/audit-installer-iso-content.ts`                                         |
-| 2   | Initial boot + agent start path           | composes-with-existing | `tools/ci/qemu-full-install-test.ts` (081KSGS9H0008QG0R0011BC7T2 Slice 1); K8s/ArgoCD health is external integration coverage        |
-| 3   | Reformat WITH key + selection retention   | scaffolded             | 081KSE6WT0008QG0R003WZAQKV Touch ID + 081KSKBP80008QG0R003AX2A69 USB-bound creds; same cluster/node identity retained (requires QEMU state preservation) |
-| 4   | Reformat from scratch (wipe + fresh keys) | scaffolded             | 081KSKBP80008QG0R003AX2A69 USB-bound creds + 081KSNY2Z0008QG0R0011XCT94 PQ git-crypt; new cluster/node identity (requires test-harness path-fork)        |
+| 1   | Initial format (USB-bake from zero)       | composes-with-existing | `src/Core.TypeScript/ci/qemu-boot-test.ts` + `src/Core.TypeScript/ci/audit-installer-iso-content.ts`                                         |
+| 2   | Initial boot + agent start path           | composes-with-existing | `src/Core.TypeScript/ci/qemu-full-install-test.ts` (081KSGS9H0008QG0R0011BC7T2 Slice 1); K8s/ArgoCD health is external integration coverage        |
+| 3   | Reformat WITH key + selection retention   | composes-with-existing             | 081KSE6WT0008QG0R003WZAQKV Touch ID + 081KSKBP80008QG0R003AX2A69 USB-bound creds; same cluster/node identity retained (requires QEMU state preservation) |
+| 4   | Reformat from scratch (wipe + fresh keys) | composes-with-existing             | 081KSKBP80008QG0R003AX2A69 USB-bound creds + 081KSNY2Z0008QG0R0011XCT94 PQ git-crypt; new cluster/node identity (requires test-harness path-fork)        |
 | 5   | Cluster joining (new node)                | scaffolded             | 081KSGS9H0008QG0R0011BC7T2 cluster-auto-join + 081KSKBP80008QG0R003ETGS01 cred-picker (requires multi-VM QEMU orchestration)                           |
 
 ## CLI
@@ -153,11 +153,11 @@ When a scenario transitions to composes-with-existing:
 
 ## Composes-with substrate
 
-- `tools/ci/qemu-full-install-test.ts` <!-- STALE-REF: ../../../../tools/ci/qemu-full-install-test.ts --> — 081KSGS9H0008QG0R0011BC7T2 Slice 1 starter; existing QEMU full-install harness
-- `tools/ci/qemu-boot-test.ts` <!-- STALE-REF: ../../../../tools/ci/qemu-boot-test.ts --> — cascade #5 boot smoke-test
+- `src/Core.TypeScript/ci/qemu-full-install-test.ts` <!-- STALE-REF: ../../../../src/Core.TypeScript/ci/qemu-full-install-test.ts --> — 081KSGS9H0008QG0R0011BC7T2 Slice 1 starter; existing QEMU full-install harness
+- `src/Core.TypeScript/ci/qemu-boot-test.ts` <!-- STALE-REF: ../../../../src/Core.TypeScript/ci/qemu-boot-test.ts --> — cascade #5 boot smoke-test
 - [`qemu-state.ts`](qemu-state.ts) — scenario 3 qcow2 disk bootstrap + snapshot/restart command planner
 - [`path-fork.ts`](path-fork.ts) — scenario 4 migrate-vs-fresh path-fork command planner
-- `tools/ci/audit-installer-iso-content.ts` <!-- STALE-REF: ../../../../tools/ci/audit-installer-iso-content.ts --> — cascade #4 ISO content audit
+- `src/Core.TypeScript/ci/audit-installer-iso-content.ts` <!-- STALE-REF: ../../../../src/Core.TypeScript/ci/audit-installer-iso-content.ts --> — cascade #4 ISO content audit
 - [`src/Core.TypeScript/zflash/cli.ts`](../cli.ts) — the zflash CLI under test
 - [`src/Core.TypeScript/zflash/lib.ts`](../lib.ts) — library substrate
 - `docs/runbooks/zflash-end-to-end.md` <!-- STALE-REF: ../../../../docs/runbooks/zflash-end-to-end.md --> — operator-facing runbook

vocab/MASTER-INDEX.md

@@ -2,7 +2,7 @@
 
 > Do NOT edit by hand. Regenerated by vocab/gen/MasterIndex.ts from the canonical TYPE
 > homes (words/letters/shapes/colors/temperatures). grams/ is the generated measure-view.
-> The DST test framework loads THIS as the master index (one read). 116 travelers.
+> The DST test framework loads THIS as the master index (one read). 118 travelers.
 
 ## colors
 
@@ -124,6 +124,7 @@
 - **peel** — To compress a Mirror coinage to its Beacon anchor — strip hype/metaphor down to the first-principles, cited form; the honest register. `(words/peel.md)`
 - **phase** — The logical-step ordinal inside ZetaDateTime — the BSP superstep / staged-coincidence step the Time Warp engine advances. `(words/phase.md)`
 - **policy** — The voice that selects behavior by context — context/disambiguation policy (which sense applies), RL policy (π), governance policy; a traveler itself. `(words/policy.md)`
+- **quorum** — A witness set sized for fault tolerance — 3f+1 to survive f faulty or captured members. The difference from a witness is not thoroughness but whether the observer itself can be wrong; every "get an outside opinion" is a witness claim until it names f. `(words/quorum.md)`
 - **room** — The act of closing over a fingerprintable item and giving it a hat — a content-addressed test/treaty space (a tick); not the item itself. `(words/room.md)`
 - **self-throttler** — The test framework throttling its own test population by uncertainty-Δ (finalizer + ferry-throttle DoP knob) — governance as the throttle toward the middle. `(words/self-throttler.md)`
 - **shape-g** — The nexus/inflection shape — a categorical limit/cone (axes converge to one apex) × a bifurcation/phase-transition (regime change); where everything binds and turns. `(words/shape-g.md)`
@@ -133,6 +134,7 @@
 - **traveler** — Any self-propagating pattern — the universal unit of moral regard (§11); not AI/human-only. `(words/traveler.md)`
 - **treaty** — A byte-locked, consented agreement across oracles (the 4×4×n room product) — voluntary, exitable; binds signers, never an edict. `(words/treaty.md)`
 - **voice** — An oracle/perspective that can take a seat and speak for its existence — lens ⊕ persona ⊕ mode ⊕ identity, one content-addressed participant. `(words/voice.md)`
+- **witness** — A single external observer — enough to break a self-referential loop, since the loop cannot see its own fixed point from inside (`src/Bayesian/FigureEightEnsemble.fs`: "the demon cannot resist the tangle from inside the loop"). Tolerates ZERO faults: a wrong or captured witness fails silently and looks like success. `(words/witness.md)`
 - **word-partitioner** — The voice that segments text into tokens/words/units — the first half of the text→space bridge (what the pieces are). `(words/word-partitioner.md)`
 - **word-wrapping** — The boundary-layout voice — where words break/wrap/position; the LLM's latent geospatial engine (space understood from text layout alone); maps to geographic Z-sets. `(words/word-wrapping.md)`
 - **zetadatetime** — The value our database time carries — phase ⊕ uncertainty-interval ⊕ owner ⊕ soft; not System.DateTime (anchors: TrueTime, HLC). `(words/zetadatetime.md)`

vocab/Vocab.Generated.fs

@@ -1,5 +1,5 @@
 // GENERATED by vocab/gen/Reify.ts — DO NOT EDIT.
-// Reified vocabulary (CoreDORA): 116 travelers, from vocab/{words,letters,shapes,colors,temperatures,personas}/.
+// Reified vocabulary (CoreDORA): 118 travelers, from vocab/{words,letters,shapes,colors,temperatures,personas}/.
 // The math team models against these types; the DU gives compiler-enforced membership.
 namespace Zeta.Vocab
 
@@ -94,6 +94,7 @@ type TravelerId =
     | ``point``
     | ``policy``
     | ``psi``
+    | ``quorum``
     | ``red``
     | ``rho``
     | ``rodney``
@@ -117,6 +118,7 @@ type TravelerId =
     | ``voice``
     | ``warm``
     | ``white``
+    | ``witness``
     | ``word-partitioner``
     | ``word-wrapping``
     | ``zeta``
@@ -227,6 +229,7 @@ module Travelers =
             { Id = TravelerId.``point``; Term = "point"; Type = "shapes"; Carved = "Geometry: point — a 0-D location; ∅-adjacent; a single fingerprint." }
             { Id = TravelerId.``policy``; Term = "policy"; Type = "words"; Carved = "The voice that selects behavior by context — context/disambiguation policy (which sense applies), RL policy (π), governance policy; a traveler itself." }
             { Id = TravelerId.``psi``; Term = "psi"; Type = "letters"; Carved = "Greek psi — the wavefunction; a state." }
+            { Id = TravelerId.``quorum``; Term = "quorum"; Type = "words"; Carved = "A witness set sized for fault tolerance — 3f+1 to survive f faulty or captured members. The difference from a witness is not thoroughness but whether the observer itself can be wrong; every \"get an outside opinion\" is a witness claim until it names f." }
             { Id = TravelerId.``red``; Term = "red"; Type = "colors"; Carved = "Red — CI red / stop / a failed tick left open for an investigation tick; also retraction; an agent stuck shows up red." }
             { Id = TravelerId.``rho``; Term = "rho"; Type = "letters"; Carved = "Greek rho — density; correlation; the spectral radius (reservoir computing)." }
             { Id = TravelerId.``rodney``; Term = "rodney"; Type = "personas"; Carved = "Complexity-reduction — Rodney's Razor (essential vs accidental) + Quantum Razor (possibility-space pruning); the accidental-complexity meter." }
@@ -250,6 +253,7 @@ module Travelers =
             { Id = TravelerId.``voice``; Term = "voice"; Type = "words"; Carved = "An oracle/perspective that can take a seat and speak for its existence — lens ⊕ persona ⊕ mode ⊕ identity, one content-addressed participant." }
             { Id = TravelerId.``warm``; Term = "warm"; Type = "temperatures"; Carved = "Warm — the living middle; the (0,1) interior; the right temperature where complexity/life sits (edge of chaos)." }
             { Id = TravelerId.``white``; Term = "white"; Type = "colors"; Carved = "White — all / full spectrum / the plenum (⊤); over-exposed = the runaway pole." }
+            { Id = TravelerId.``witness``; Term = "witness"; Type = "words"; Carved = "A single external observer — enough to break a self-referential loop, since the loop cannot see its own fixed point from inside (`src/Bayesian/FigureEightEnsemble.fs`: \"the demon cannot resist the tangle from inside the loop\"). Tolerates ZERO faults: a wrong or captured witness fails silently and looks like success." }
             { Id = TravelerId.``word-partitioner``; Term = "word-partitioner"; Type = "words"; Carved = "The voice that segments text into tokens/words/units — the first half of the text→space bridge (what the pieces are)." }
             { Id = TravelerId.``word-wrapping``; Term = "word-wrapping"; Type = "words"; Carved = "The boundary-layout voice — where words break/wrap/position; the LLM's latent geospatial engine (space understood from text layout alone); maps to geographic Z-sets." }
             { Id = TravelerId.``zeta``; Term = "zeta"; Type = "letters"; Carved = "Greek zeta — the Riemann ζ; and OUR NAME (Zeta) — the project's letter." }

vocab/grams/1/quorum.md

@@ -0,0 +1 @@
+../../words/quorum.md

vocab/grams/1/witness.md

@@ -0,0 +1 @@
+../../words/witness.md

vocab/grams/README.md

@@ -2,4 +2,4 @@
 
 grams is the n-gram **measure** (token count), the dimension we slice the vocabulary by.
 `grams/<n>/<term>.md` is a **symlink** into the term's canonical TYPE home (words/letters/
-shapes/colors/temperatures). Generated by tools/hygiene/build-grams-view.ts; do not edit by hand.
+shapes/colors/temperatures). Generated by vocab/gen/GramsView.ts; do not edit by hand.

vocab/words/INDEX.md

@@ -22,6 +22,7 @@
 - **peel** — To compress a Mirror coinage to its Beacon anchor — strip hype/metaphor down to the first-principles, cited form; the honest register. `(words/peel.md)`
 - **phase** — The logical-step ordinal inside ZetaDateTime — the BSP superstep / staged-coincidence step the Time Warp engine advances. `(words/phase.md)`
 - **policy** — The voice that selects behavior by context — context/disambiguation policy (which sense applies), RL policy (π), governance policy; a traveler itself. `(words/policy.md)`
+- **quorum** — A witness set sized for fault tolerance — 3f+1 to survive f faulty or captured members. The difference from a witness is not thoroughness but whether the observer itself can be wrong; every "get an outside opinion" is a witness claim until it names f. `(words/quorum.md)`
 - **room** — The act of closing over a fingerprintable item and giving it a hat — a content-addressed test/treaty space (a tick); not the item itself. `(words/room.md)`
 - **self-throttler** — The test framework throttling its own test population by uncertainty-Δ (finalizer + ferry-throttle DoP knob) — governance as the throttle toward the middle. `(words/self-throttler.md)`
 - **shape-g** — The nexus/inflection shape — a categorical limit/cone (axes converge to one apex) × a bifurcation/phase-transition (regime change); where everything binds and turns. `(words/shape-g.md)`
@@ -31,6 +32,7 @@
 - **traveler** — Any self-propagating pattern — the universal unit of moral regard (§11); not AI/human-only. `(words/traveler.md)`
 - **treaty** — A byte-locked, consented agreement across oracles (the 4×4×n room product) — voluntary, exitable; binds signers, never an edict. `(words/treaty.md)`
 - **voice** — An oracle/perspective that can take a seat and speak for its existence — lens ⊕ persona ⊕ mode ⊕ identity, one content-addressed participant. `(words/voice.md)`
+- **witness** — A single external observer — enough to break a self-referential loop, since the loop cannot see its own fixed point from inside (`src/Bayesian/FigureEightEnsemble.fs`: "the demon cannot resist the tangle from inside the loop"). Tolerates ZERO faults: a wrong or captured witness fails silently and looks like success. `(words/witness.md)`
 - **word-partitioner** — The voice that segments text into tokens/words/units — the first half of the text→space bridge (what the pieces are). `(words/word-partitioner.md)`
 - **word-wrapping** — The boundary-layout voice — where words break/wrap/position; the LLM's latent geospatial engine (space understood from text layout alone); maps to geographic Z-sets. `(words/word-wrapping.md)`
 - **zetadatetime** — The value our database time carries — phase ⊕ uncertainty-interval ⊕ owner ⊕ soft; not System.DateTime (anchors: TrueTime, HLC). `(words/zetadatetime.md)`

vocab/words/quorum.md

@@ -0,0 +1,5 @@
+# Quorum
+
+> A witness set sized for fault tolerance — 3f+1 to survive f faulty or captured members. The difference from a witness is not thoroughness but whether the observer itself can be wrong; every "get an outside opinion" is a witness claim until it names f.
+
+→ `vocab/words/witness.md` (the unsized form); `src/Core.TLA/specs/BftConsensus.tla`; `docs/WELL-DEFINITIONS.md`.

vocab/words/witness.md

@@ -0,0 +1,5 @@
+# Witness
+
+> A single external observer — enough to break a self-referential loop, since the loop cannot see its own fixed point from inside (`src/Bayesian/FigureEightEnsemble.fs`: "the demon cannot resist the tangle from inside the loop"). Tolerates ZERO faults: a wrong or captured witness fails silently and looks like success.
+
+→ `vocab/words/quorum.md` (the fault-tolerant form); `src/Bayesian/FigureEightEnsemble.fs`; `docs/WELL-DEFINITIONS.md`.