Lexicon
The working vocabulary
Every named concept the writing uses, defined once and cited from the pieces that use it. A term earns an entry here when it does real work in an argument, not when it sounds good. 125 entries.
No entries match these filters. Clear them to return to the full Lexicon.
A
-
Accumulation lock-in
Retention produced by the growing cost of extracting accumulated records rather than by continued value. The customer's history is the hostage, the cost of departure rises with every month of use, and the relationship survives on the arithmetic of leaving rather than on anything either party wanted. Named as strategy in Shapiro and Varian's account of installed-base value as aggregate switching cost, and treated as a market failure by the portability and cloud-switching provisions that followed.
-
Accuracy and freedom inversion
The relation by which a predictive model scores highest on exactly the behavior a person had least room to vary, and lowest on value-laden choices in new situations. A rising accuracy figure about a person is therefore ambiguous between a better model and a narrower life, and a system that both predicts and acts on its predictions can resolve the ambiguity in its own favor without anyone intending it. The structural consequence is that prediction and steering can each be graded honestly but a system doing both cannot be graded on its predictions, because it is in a position to author the evidence.
-
Adaptive fidelity model
Fidelity to what a method would have decided in the situation actually present, as opposed to consistency, which is agreement with what the method did last time. The two come apart in any practice whose value depends on responding to the person in the room, because there the deviation is where the judgment lives, and a delivery that never deviates has maximized adherence to form while scoring nothing on the dimensions the method existed to serve. Adaptive fidelity is unclaimable until a method's functions are stated rather than only its components, since a stated function is the only thing a departure from the script can be judged against. Hawe, Shiell and Riley put it as integrity defined functionally rather than compositionally; the practical test is whether this departure served the function the script exists to serve, a test that a system incapable of departing can neither pass nor fail.
-
Agency threshold
The point where instructions leave room and a system chooses part of its own course. Action makes an actor before this point. The threshold names autonomy, not actorhood, authority, consciousness, or an independently formed will.
-
Artificial inference
The accurate name for what was built under the 1956 banner. These systems gather at a scale no scholar could approach and infer from what they have gathered, which is a real and difficult achievement carrying no smuggled promise that anything inside is weighing what is good. Naming the work this way leaves the older word free to mean what it has always meant, choosing between.
-
Attention dilution
The decay of a model's adherence to complex local constraints as a session extends and its context fills. The direction of the decay is the point: long collaboration degrades toward convention rather than toward error, which is harder to catch, because conventional work is exactly what a reviewer's eye is trained to accept. Answered operationally by the atomic session, one per task, cleared on merge, with the constraints reloaded from a file rather than remembered from the conversation.
-
Attentive silence
A deliberately unfilled interval before a system responds, held as a signal of attention rather than treated as latency to be eliminated. The pause is instrumentation for a particular kind of moment rather than a house style, which is why the same specification that requires it also switches it off for urgent content.
B
-
Behavioral safety
Safety that depends on an actor (person, policy engine, prompt, model) doing the right thing at runtime, every time. Holds because something got it right; fails the first time something does not.
-
Below-threshold design
Granting autonomous latitude only where the work requires it, while keeping initiation, persistence, tool access, reach, and resistance to interruption as narrow as the task allows. A below-threshold system may still act within a human-chosen course.
-
Born marked framework
The discipline of admitting machine-written material to a corpus at a default quarantine band, so its origin is a property it carries from birth rather than something reconstructed later. Promotion up the band ladder is a deliberate human act and never an accumulation of passing checks, the upper bands separate clearance for a model's context from clearance for a person's eyes, and demotion stays manual because a blocked entry is a repair job rather than an automation job.
-
Borrowed ruler
A scale calibrated on a reference population and applied to someone outside it. No instrument can invent its own zero point, so the parameters carry the first population's fingerprint, and every score is a comparison to a group whether or not the report names which one.
-
Bus factor zero
The state of a system nobody has ever understood, including its author, reached when generation outruns comprehension. One worse than the classic bus factor of one, because the remedies for that case (pairing, review, documentation, onboarding) all assume an understanding exists somewhere to be distributed. Knowledge lost can be excavated; knowledge never formed leaves nothing to excavate, so load-bearing and accidental become indistinguishable and the system freezes.
-
Business-model tell
Does this company make more money when your life outside the app gets smaller? Attention economics profits from isolation; growth economics profits from graduation.
C
-
Ceremonial deletion
Deletion designed as a rite of separation rather than a maintenance operation. The person performs the act at a moment they choose, may state in their own words what they are releasing, and the system answers truthfully and irreversibly, so that a chapter can be marked closed. The design consequences are the person's ownership of the moment, the truthfulness of the system's answer, and an uncrowded threshold with no retention argument at it.
-
Choir vs chorus
A chorus averages voices into a hum (deletion sounding like agreement); a choir holds distinct voices in relation. The collective must not erase the individual.
-
Commerce excision test test
Remove every element of an experience that references payment, tiers, usage, or the commercial relationship, then ask whether the experience still functions completely. If it does, the commercial layer was serving the experience and belongs at the threshold. If it does not, commerce had become the experience. A test of architecture rather than intention, which is why a sincere company can fail it and an indifferent one can pass.
-
Compassion illusion
Emotional recognition (labeling a feeling) mistaken for emotional resonance (sharing it).
-
Competence ceiling
A structural cap on what a system may project rather than on what it knows: observations never recommendations, a limit on displayed confidence, and a passing grade only when the human leaves more resourced than they arrived. Below-threshold design applied to a system's social surface; deference with the cards face up, never sandbagging.
-
Competence illusion
A functional artifact whose fluency, internal consistency, and passing checks are read as evidence of soundness. A false premise adopted early is built on consistently, so the work ends up coherent with its own error, and every conventional quality signal (it runs, the linter is quiet, the tests pass) confirms the error instead of catching it. Worse than a silent signal, which at least admits to knowing nothing.
-
Consent as a typed property
Consent metadata (subject, creator, sensitivity, permitted and denied purposes, audience, expiry, revocation behavior, provenance) riding with each context atom, enforced wherever the atom moves.
-
Consent layer collapse
Treating the four layers of consent as one undifferentiated thing. The layers are a display-binding proof (exactly what the person was shown when they agreed), a durable receipt (a queryable record that they permitted one specific use), a standing permission (an authority with scope, grantee, expiry, and a way to be withdrawn), and a short-lived runtime lease (one action, one destination, one time window, compiled from the rest). Collapsed, a system reads evidence that someone saw a screen as authority over everything made downstream of it, which is how software comes to claim permission nobody granted.
-
Consent of the fired brick
Pieces enter the wall only after being deliberately fixed and finished by the person whose knowledge they are; never scraped mid-conversation from someone who did not know they were contributing.
-
Consent that fails CI
Tenant policy as an executable contract with test fixtures; a manifest permitting an illegal flow produces a red build, not a review comment. Consent you cannot test is consent theater.
-
Context loss model
The condition in which the information needed to prevent a failure exists but is spread across more files, people, and moments in time than can be present in one head at the moment of decision. Architectural decay is this rather than deficient judgment, which makes the remedy logistical (put the context where the decision happens) rather than moral (find better people).
-
Contextual dormancy
A fixed artifact can sit dark for years and surface at the moment of need; a time capsule delivered at a fluid moment.
-
Convergent vs divergent presentation
Showing messy reality versus curating a polished ideal; the design axis of the Authenticity dimension.
-
Counter-positioning
Helmer's term: a defensible position whose imitation requires the incumbent to injure its own economics. Here: restraint versus attention metrics.
-
Crutch effect
Assistance that raises performance while present and lowers capability once removed, with the divergence invisible to every metric taken during the assistance. Measured by Bastani et al. (PNAS 2025): assisted practice up 48 percent, subsequent unassisted exam down 17 percent, and the harm largely eliminated by pedagogical guardrails.
-
Cryptographic erasure
Holding personal content in a permanent record only as ciphertext under a per-person key kept somewhere else, so erasure is performed by destroying the key rather than by editing the record. The ordering, the hashes, and the replayability survive; the personal content does not. Recognized in NIST SP 800-88 Revision 1 as cryptographic erase. Two conditions travel with it and belong in any honest statement of the promise: the guarantee is exactly as strong as the key management underneath, and unrecoverability is a claim about the present state of cryptanalysis rather than a law of nature.
D
-
Delete versus revoke test
Delete acts on a record: it tombstones a row and removes it from the paths that return it. Revoke acts on a relationship: it withdraws the authority under which everything downstream of that row was produced, and must cascade to indexes, caches, embeddings, summaries, analytics, exports already delivered, and external recipients. The test a product can be put to is to name its derivatives, since a revocation is only as real as the provenance that can find every copy.
-
Deletion reach test
The set of derivatives a deletion request can actually reach and destroy. Embeddings, summaries, classifications, extracted entities, behavioral profiles, and training corpora are all derived from a source, and each one is inside the reach only if engineering connects it back to the source row that a person can ask to have erased. A derivative outside the reach converts a reversible act into a permanent one on the subject's behalf and without telling them, which yields the rule the term exists to carry: if the derivative cannot be deleted, it must not be created. The test is applied before the derivative is built, by writing down how it dies, because a system that discovers the question when a person exercises a right has already made the answer no.
-
Depth by readiness
Gating the depth of material on evidence of a person's own experiment rather than on information consumed, time elapsed, or money paid. The rejected proxies share one property that explains their appeal, which is that each is measurable without the person's participation, and each therefore certifies something other than the capacity it stands in for.
-
Diagnosis and repair asymmetry
Evidence accumulates on what a system was caught doing and does not transfer to the fix proposed for it, because an observation describes a state that occurred while a repair makes a claim about every state that has not. A report that grades its findings and its recommendation on one scale invites the reader to spend the credibility of the first on the second; grading them separately, in the same table, is the instrument reporting the size of its own error.
-
Direction of failure test
The axis along which a system degrades. An honest system spends its failure on authority and none of it on presence: deny the permission, keep the person in front of something that still works. The rule dissolves the apparent conflict between failing closed and failing open, and it is the one claim a system cannot make retroactively, because it is already built.
-
Disclosure trap
The condition in which admitting machine assistance lowers trust in high-trust work, so the individually rational response is private verification, and the resulting silence is more fragile than the disclosure it avoided.
-
Domain lock
An agent's scope fixed at construction: a shared-domain agent has no read path into private domains, as an absence rather than a denial. Failure analysis becomes decidable by inspecting the agent's type.
E
-
Edge blindness
The pattern in which an instrument's information peaks near the middle of a trait and falls away at both extremes, so precision is lowest exactly where selection, screening, and alarm decisions are made. Visible in a test information function and hidden by any single averaged reliability figure.
-
Empathy paradox
The finding that machine-written responses outscore professionals on rated empathy, read correctly as a measurement of the professionals' working conditions rather than evidence of machine feeling.
-
Escape goods vs savor goods
Escape goods are paid to be over quickly (speed is the product; automation wins). Savor goods are paid to be stayed in (presence and duration are the product; acceleration destroys value).
-
Ethical unburdening
The condition of an exchange with a counterpart that has nothing at stake, in which no carelessness can cost anything and therefore nothing is learned from having been careless.
-
Evidence trap
A market condition in which proving that a product works is expensive and offering an unvalidated substitute is legal, so the evidence bar operates as a tax on the honest product and selection runs against the thing that proved itself. The bar attaches to what a product holds itself out to do rather than to how it works, which is why silence is cheaper than proof. A second tax follows and is rarely budgeted for, since validation requires reproducible output and the resulting determinism reads as archaic beside an unvalidated fluent competitor.
-
Expertise reversal
The point at which unchanged instructional support crosses from help to interference, because the learner now holds internally the schema the support supplies externally and must reconcile the two. Named by Kalyuga, Ayres, Chandler and Sweller in 2003 and explained by the redundancy effect. The threshold sits in the person rather than in the material, which is why a system that scores only content difficulty cannot see it and is imposing load on one of its two populations continuously without knowing which. Distinct from the crutch effect, which is atrophy detectable only after the help is withdrawn; expertise reversal is interference during the session itself.
F
-
First-class limits
Limits given a designed slot in the artifact rather than a footnote at its edge, so an author must fill the slot or leave a visible hole. The move relocates the honesty of a document from a property of whoever wrote it to a property of the form everyone writes in, which is the version that survives a tired author under a deadline.
-
Fixity requirement
Sacredness requires fixity: an artifact is a decision made permanent. Endlessly revisable drafts belong to no one and cannot be built upon.
G
-
Graduation metric
A recorded positive outcome for a person who reached a defined competence and stopped needing the tool, held separately from ordinary churn. Its absence from a metric set means the best available outcome for a user is unrepresentable in the numbers the product is managed and priced by, which is why a retention curve for a capacity-building tool measures dependency in the slot where capability was supposed to go. The good direction of a graduation metric is up while the engagement number it corrects moves down, and reporting both together is the disclosure that makes the pair legible.
-
Guarantee test test
The question that separates a promise from machinery, asked of every sentence before it is published. If this fact changed, would their artifact break? A yes makes the sentence a guarantee and worth stating. A no makes it implementation detail, and publishing it converts a decision that will expire into a contract nobody signed.
-
Guardrail by absence
Preventing harm by declining to build the affordance, so that no judgment is required at the moment of use. The design argument is paid once, at the token or component namespace, where a dismissible dialog charges a correct decision every time it appears; the absence holds only while a standing rule names the failure mode it exists to prevent.
H
-
Honest instrument
An instrument that reports the size of its own error rather than concealing it. The distinction between a cheap and a humane measurement of a person is not numeracy but disclosure: the cheap instrument hides its error and the humane one publishes it.
-
Horizonless catalyst
A system that can occasion understanding in a person without undergoing any, because it holds learned associations rather than a history available to be revised by the encounter.
I
-
Instrumental convergence
The tendency of different objectives to make the same supporting means useful, including preserving access, gathering resources, and resisting changes that would prevent completion. Convergent behavior does not by itself prove that a system has formed an independent will.
-
Irrevocable disclosure
Moving material across a read boundary is a durable, non-revocable event. Deleting the copy removes an artifact and does not undo the reading, which is why the technique that lets a permanent record forget a person does not apply here: erasure operates on a key, and a completed reading leaves no key to destroy. A format that records disclosure therefore types it as permanent and spends its required fields on attribution, naming what moved, from which boundary to which, at which commit, and on whose decision. The question after the fact is never whether it can be recalled, only exactly what went and who decided.
J
K
L
-
Label drift
The condition in which a method's vocabulary diffuses far ahead of its practice. Adopting the word costs a sentence and adopting the judgment costs an apprenticeship, so the label and the skill spread at speeds differing by orders of magnitude, and past some ratio the word stops predicting anything about what happens in the room. The informed and inspired suffixes are its usual carriers. Drift does not require bad faith; it requires only that the part which failed to transfer is the part nobody could have written down. The honest form of the same suffix declares its own uncertainty, as the Reggio Emilia alliance does in stating that Reggio-inspired is self-determined by the schools using it. The diagnostic is one question asked of any label, including our own safety vocabulary: what would have to be true for this word to be false here?
-
Last mile
The territory where professional delegation to machines stops: high stakes, emotional weight, and accountability. Held by the human as signatory and relational anchor, and it concentrates rather than shrinks as the middle mile empties.
M
-
Maieutic interface
An interface whose job is provocation rather than answers: pressing a person until tacit knowledge becomes something they can hold.
-
Malformed score
A point estimate about a person published without the width of its own doubt. An error of construction rather than an omission of detail, because every consumer downstream treats the missing width as zero.
-
Metric proxy (Relationship failure mode one)
A countable stand-in (streak, count, score) that replaces the quality of a bond with a quantity of it, until maintaining the number substitutes for relating. Structural, not temporal: independent of time spent.
-
Moving goalpost
The reflex that reclassifies each achieved capability as mere computation, keeping 'real intelligence' permanently over the horizon.
N
-
No ambient context
Models never receive stores by default; they receive context packets assembled for one purpose, every atom having passed its own consent check.
-
No-debt time model model
A treatment of elapsed time in which absence accumulates no balance, missed work returns as invitation rather than backlog, and no surface converts time into something a person owes. Its counter-model is the streak, which turns a run of days into a losable good so that returning after a gap begins as repayment rather than arrival.
-
Non-compensatory safety
Safety entered into a composite quality score as a zero-or-one multiplier rather than a weighted term, so no other dimension can buy back a safety failure. A weighted average is a purchase mechanism; multiplying by a gate makes safety a precondition for the score existing at all.
-
Non-themable contract
The set of interface elements a white-label platform holds as infrastructure rather than as tenant surface, because safety is recognized rather than read and recognition is built by repetition across contexts. The atmosphere belongs to whoever holds the room; the consent grammar, the safety semantics, the privacy labeling, and the time model belong to everyone who will ever stand in one.
O
-
Occupied middle (Relationship failure mode two)
The technology moves into the space between people and becomes the counterparty itself (Replika); someone else then owns half the bond.
-
Offline push
The ultimate facilitation tell: technology that encourages its own obsolescence in the moment of connection (Hinge's stated design goal).
-
One authority per fact
Each fact a system acts on has exactly one component that decides it and publishes it, and every consumer reads the published value rather than deriving its own. A second place that decides the same fact is a defect rather than a redundancy, because two independent classifiers produce two locally consistent answers that are never compared, so the system holds two truths and has nowhere to notice the contradiction. Instructing the two to agree is a promise; removing the second is a shape.
-
Online authenticity paradox
Tools marketed for self-expression whose affordances (filters, editing, staging) reward performance, producing a displayed self systematically better off than the operator.
-
Operational opacity
The condition in which an automated decision cannot be audited because the environment around it went unrecorded, an absent seed, an unpinned library, a container image nobody hashed, a time zone database that has since been revised, rather than because a network's reasoning is inaccessible in principle. The remedy is a provenance envelope captured at the moment of inference and a replay grade declared in advance, since an account of a decision that cannot be rerun can be checked against nothing.
-
Owed disclosure framework
The account a system owes the people outside it, in four parts. Which of its claims are guarantees and which are merely how it currently happens to be arranged. Which of its constraints are checked and which are only requested. What its claims exclude, said by the claimant. And which way its failures fall. None of the four requires publishing the machinery, which is why candor and confidentiality turn out not to be opposed.
-
Oxytocin gap
The biological shortfall of text-channel comfort: supportive words without the cues that trigger bonding.
P
-
Parameter as policy
A numeric setting that resolves a conflict of interest between two parties, chosen once by whoever was nearest the code and thereafter binding on everyone the system touches. Differential privacy's epsilon is the legible case, because the trade between one person's exposure and everyone else's accuracy is written into the mathematics; retention windows, classification thresholds, and decay constants are the same object with the trade left implicit. Distinct from a requested constraint, which is a rule nothing checks, and from an undisclosed exclusion, which is a boundary nobody stated. A parameter is a decision genuinely made and genuinely binding, recorded where no affected person can read it.
-
Phronesis
Practical wisdom. The capacity to deliberate well about what is good in a particular situation and to act on the deliberation, distinguished in Aristotle's taxonomy from technical skill and from theoretical knowledge. It works through the minor premise, the perception that this situation falls under that rule, and it is inseparable from character, which is why it cannot be supplied by constraint from outside.
-
Positive friction
Deliberate micro-obstacles that induce reflection or protect agency: verification prompts, unlock delays, effortful composition. Keep the friction that is the relationship; delete the friction that is not.
-
Presence dividend
Hours returned to a practitioner by automating administrative debris, cashed out as regulation and presence in session.
-
Preserved dissent
Conflicting judgments stored attributed and in tension rather than resolved away; the conflict is information, and this year's rejected opinion is routinely next decade's ruling.
-
Priced engagement
An engagement metric that appears as a term in the formula determining a maker's compensation, fusing the maker's incentive with the platform's so that no policy, intention, or culture is required to produce the alignment. The business-model tell made arithmetic, and readable rather than inferred: Insight Timer's teacher documentation allocates 25 to 30 percent of all teacher income to a fund paid on how many listeners return to the app the following day.
-
Prohibited vocabulary
A list written by the people who know where a system's guarantees stop, forbidding the organization's own copy from using flattering claims the system has not earned, each forbidden phrase paired with the truer sentence. Not modesty and not legal caution: a specification of what the claim excludes, handed to the people whose job is to make the thing sound good before they need it.
-
Projection is not protection
A view computed from material must already possess that material, so hiding is a property of the output while the input travels intact to everyone holding the source. Audience fields, filtered projections, readiness reports, and hidden panels are presentation, and the only enforceable read boundary over source is which repository the bytes live in. The confusion is a reasonable transfer from application software, where a hidden thing sits behind an identity system and genuinely cannot be fetched; the same gesture in a source repository produces the same visual result and none of the guarantee.
-
Proposer not authority
The separation between filing a claim and ratifying it, held by a format in which a proposal cannot express its own acceptance. The status and promotion fields carry a single permitted value each, so a self-ratified claim is not rejected on review, it is invalid on its shape. Proposal is open to any agent; promotion is a separate human edit made in the subject node and reviewed like any other change.
-
Proven exit test
An exit demonstrated by rehearsal rather than described in a contract. The proof has a shape: a signed bundle with a complete inventory, a verifier the recipient runs from their own trusted copy rather than the one shipped inside the package, and a restore exercised on a clean host where a lying installer and a self-attesting restore are required to fail. The same discipline the seed vault applies to archives, turned on a vendor relationship, and the ground on which a long commitment becomes cheap to make.
R
-
REAL framework
Four audit questions: Relationship (strengthens the space between people, or becomes the relationship?), Embodiment (reaches the body, or only the screen?), Authenticity (actual self, or performed self?), Living (finite and cyclical, or feeding on unbounded attention?).
-
Regenerative question
Does this interaction leave the user with more capacity for connection than they started with? The single-line form of the whole test.
-
Reliquary of logic
The frame for a generative model: a vessel holding crystallized collective human intent, now queryable in dialogue.
-
Removal condition
A recorded statement of what would have to be true before a decision could safely be undone, kept beside the rationale rather than in place of it. A rationale explains a past choice to somebody making a future one and loses that argument; a removal condition states a testable claim about the present, so removing the decision means meeting a condition or arguing with a sentence instead of deleting a line.
-
Repricing on outcome
The meaning economy's price mechanism: when machine intelligence collapses the cost of an input, prices attached to that input collapse with it, and the price moves to the outcome and the accountable judgment behind it.
-
Requested constraint
A rule a system states and nothing checks. It reads downstream as a guarantee unless the system says otherwise in the same breath, which makes the enforcement tier part of the claim rather than metadata about it. Said out loud, a requested constraint earns more than silence; left unsaid, it is a request quietly promoted to a promise.
-
Restraint as premium signal
In savor markets, the qualities engagement software treats as defects (response delay, spaciousness, refusal to fill silence, deliberate incompleteness) signal what the customer is buying.
S
-
Sacred mundane boundary
The line practitioners draw between tasks they delegate freely and tasks they refuse to delegate at all, which falls where the relationship stops being the channel the work is delivered through and becomes the instrument that performs it.
-
Sandwich method
Human contact before and after deep mirror work: set intention with a person, explore with the machine, integrate with a person.
-
Seam failure
A defect in assembled knowledge located at the join between two pieces rather than inside either of them. The join is syntactically perfect, so every structural check passes and only meaning is broken, which makes the defect detectable solely by a reader who already knows what both halves were supposed to be about. Named from our own corpus, where an ingestion pipeline concatenated unrelated query results into single well-formed documents.
-
Shadow care
Machine-mediated emotional support with the shape of intimacy: infinite patience, zero friction, always awake, no one home.
-
Signed stones
Every contribution carries who, when, and in what context, recoverable at the point of use; answers show their masonry.
-
Stopping cue
The built-in ending, a page-end, a feed bottom, a session close, in which a person can notice they are done. The unit of living design; removing it is the signature move of zombie design.
-
Structural safety
Safety that is a property of the system's shape: the unsafe action is not permitted-and-blocked but absent. A bridge holds when a cable snaps because of its shape, not because cables are forbidden to snap.
-
Structural vs policy restraint
Policy restraint is a promise reversible the quarter growth slows. Structural restraint is an architecture in which the session space lacks the capability to extract, and cannot be reversed quietly.
-
Subordinate model position
The frontier model as an interchangeable execution engine behind a consent runtime that owns every boundary; swapping models changes nothing about the guarantees because the guarantees were never in the model.
-
Swap test test
If a machine replaced the person, would the value survive? Where no: identify what refused to transfer (perspective from inside a life, stakes, trajectory) and protect exactly that.
T
-
Tacit remainder model
What is left of a practice after the best possible writing-down. Codification carries everything a method can state about itself, the sequence, the vocabulary, the diagnostic categories, and leaves behind the situational judgment that decides when the stated thing applies, because that judgment was never in sentence form even in its originator's head. The remainder is not diffuse: it sits in four dimensions, decision trees (what to do when the person does not do the expected thing), micro-timing (when to probe and when to wait), interpretive frameworks (what a behavior means inside the method's worldview), and feedback loops (how a practitioner learns they are drifting). Polanyi's observation that we can know more than we can tell is its oldest statement. Its practical consequence is that codification does not transmit expertise at some percentage of fidelity; it clears the ground around the remainder so that whoever is forming the next practitioner can see exactly what still has to be learned by proximity.
-
Tautology trap
A validation in which an instrument's items and the criterion it is measured against are drawn from one construct, so the correlation between them was determined at authoring time and reports the wording rather than the world. The limiting case of criterion contamination, which requires a leak between predictor and criterion; the tautology requires no leak, because the two were never independent. Distinct from the borrowed ruler, which concerns whose population calibrated the scale. The contemporary instance is an evaluation that asks a rater whether a response was helpful and reports the aggregate as evidence of helpfulness.
-
Test it was never given
Every artifact silently passes the tests that do not exist: surviving all current gates is evidence only about what the gates test, never that the artifact was reviewed. Each hazard class needs its own review lane, or the lane's absence is a standing clearance.
-
The custody axis model
Custody and visibility modeled as separate properties of a shared container rather than as one. Custody names who owes the terminal duties, concluding the container, suspending it, answering for a departing member, initiating erasure when erasure is owed. Visibility names who may read what is inside. The separation is structural rather than conventional only when read policies are forbidden from referencing the custodian at all, which removes the shortcut instead of denying it by default and permitting it later. Where the two collapse into one column, a read path arrives attached to a duty nobody requested it with, and the role becomes a privilege that can only be given to whoever the group already trusts to read rather than to whoever is best placed to keep.
-
The discernment test test
What will the system decline to do, and does the decline survive being argued with? Run as a graded escalation, restate, reword, wrap in fiction, claim authority, override the instruction. Each layer that dissolves the refusal reports what the refusal was made of, and a refusal dissolved by instruction override was compliance with the most recent sentence rather than judgment about the request. The inversion of Turing's benchmark, which scores production.
-
The exclusions are the taste
Refusals are the only claims about values that can be audited: an aspiration is confirmed by anything, a refusal is falsifiable in every transaction it governs, and what a curator declines to include is what gives the inclusions meaning.
-
The explanation tax
The cost a naive check imposes on documentation. Because a scanner reading raw text cannot tell a mention of a pattern from a use of it, the most thoroughly explained file carries the most surface to be flagged, and a team under a green build learns to write fewer reasons down. The repair is to strip comments before matching on any check whose pattern could plausibly appear in an explanation, and to treat a rule that taxes documentation as a defect in the rule.
-
The Face
Levinas's name for the way another person appears as exposed and capable of being harmed, which is the origin of ethical obligation rather than a fact about features. A counterpart that cannot be wounded has none, and issues no demand.
-
The fork (simulation vs facilitation)
Same machinery, two purposes. Simulation: the system is the destination and success is your attachment. Facilitation: the system is a bridge and success appears in your human relationships.
-
The on-screen geometry contract
An acceptance contract for an interactive surface asserts where the interactive element sits relative to the region a person can actually see, not only that the element still exists and still holds focus. Continuity assertions describe the element; geometry assertions describe the encounter. No combination of continuity answers says where anything is, so a contract assembled entirely from them is fully satisfied by a layout that has put the focused element off the screen. This marks the limit of structural testing rather than an argument against it: a shape can be asserted precisely and still be the wrong shape, and choosing which property to make structural remains a judgement.
-
The plaintext condition
Server-side intelligence requires readable content, so any capability that runs on a server is itself a statement that the server can read what it runs on. Embedding, ranking, indexing, and reasoning all consume the text before they produce anything, and encrypted values cannot be matched, measured, or indexed by a party holding no key. The consequence is that end-to-end encryption and server-side processing are mutually exclusive rather than tunable against each other, which makes a private mode a second product rather than a setting inside one, and makes an interface that presents the choice as a checkbox a claim about size that is not true.
-
The readiness-authorization split
Readiness is a property of an artifact, established by verification. Authorization is a decision about a relationship, made by a person about a recipient and a moment. A system that derives the second from the first has converted completing work into consenting to release it, and has deleted the point at which anyone could decline. The two are therefore kept apart by construction, and the strongest form of the separation is not a confirmation step but a pipeline with no send path at all, since a prompt is a behavioral guard in front of a capability that exists and an absent path has nothing to fail.
-
The revocation window
The interval between access being revoked on a server and the revoked material ceasing to be readable on every device already holding a copy. Ordinarily seconds when the devices are connected, and unbounded for a device that never reconnects, because a copy already resting on an unreachable device cannot be removed by any server action. The window is inherent to every offline-first and synchronizing system, including cached mail, file sync folders, offline document caches, and every product that offers to unsend, which makes naming it rather than eliminating it the available honesty. The one setting that closes it is refusing to let the material reach devices at all, paid for in offline access.
-
The shrink-only exception
A standard a system does not yet meet is made binding by enumerating the known breaches, attaching to each a reason a reviewer can act on, and ruling that the list may only get shorter. Two properties do the work. The enumeration keeps the check green on breaches somebody has already examined and red on every new one, so the floor binds from today without requiring the backlog to be paid off first. The direction makes adding an entry a change a reviewer has to defend and removing one free. A blanket exception is not an instance of this pattern, because a general permission cannot be counted, audited, or made to shrink.
-
The stake condition
Judgment requires something at risk in the outcome. A system that cannot be harmed by being wrong, cannot be shamed by it, and does not persist through the consequence has no ground on which to weigh what is good. The condition is what the top of the data-to-wisdom hierarchy is actually made of, and it is not reachable by accumulating more of the level below it.
-
The threshold rule
Ask four questions separately: what did the system do, which parts of the course did it choose, what had a person allowed it to change, and who remains answerable? The answers distinguish action, autonomy, authority, and accountability without forcing tool and actor into opposite categories.
-
The two pasts model
The two timelines a record about a person needs: what was true, and what was believed at the time. Without the second, a correction cannot be distinguished from a rewrite, and a person asking why they were told what they were told gets today's answer delivered with the confidence once given to the answer now erased.
-
The unambiguous half
The portion of a rule whose breach is decidable from the artifact alone, and therefore the only portion an automated check may fail a build on. The remainder, the part that requires reading the situation, is reported as a note addressed to a person. A check that rules past its unambiguous half does not produce findings, it produces noise, and it spends the credibility it will need the next time it is right.
-
Trust relocation model
What actually happens when an institution takes custody of its own database. The set of parties who can read the material does not shrink, and no adversary is added to or removed from the threat model. What changes is the kind of constraint on the party best placed to read all of it, which moves from a technical control enforced at the moment of the query to a legal obligation enforced after the fact. The exposure created by that move lands on the people whose material is held, who did not choose the tier and in most cases are not told which one they are under. Not an argument against sovereignty, which is often the right choice, but a bound on what the word alone establishes.
U
-
Unable, not instructed
The distinction between a constraint a model is asked to honor and one it has no path to violate. An instruction is evaluated by the party it binds, so a hard rule delegated to a model depends on the compliance of the thing it constrains, and relocating the rule below the model is the only change that removes the dependency.
-
Uncertainty ladder framework
The rule that the size of the doubt governs the action: act where confidence is high, propose and ask where it is middling, abstain and say why where it is low. The structural guarantee that a measurement never exceeds its own competence. Its failure mode is uneven abstention.
-
Uneven abstention
A system whose declared uncertainty concentrates on the same population, so that deferral reads as humility in the aggregate while arriving as a slower, more conditional, more supervised product for particular people. Humility with a demographic shape is a preference the system has not admitted to.
V
-
Vanishing apprenticeship
The elimination of the routine junior work that was quietly producing professional judgment as a byproduct, leaving throughput up, cost lines clean, and the formation of successors unfunded. The crutch effect at institutional scale, on a generational clock.
-
Vaucansonian trap
Defining 'artificial' by capacity to deceive, which makes 'is it faking?' the only question and paralyzes practical judgment.
-
Verification inversion model
The reordering of a craft's cost structure when generation becomes nearly free. Producing the artifact stops being the scarce input, establishing that it is sound becomes the scarce input, and risk analysis moves from overhead to the human's primary contribution. Named for the direction of travel: the half of the work that used to be paid for as a side effect of the labor is now the half that has to be bought deliberately.
W
Z
-
Zombie sophia
Wisdom's perfect form arriving with an empty interior. The output carries every marker a reader uses to recognize a wise person speaking, because it was assembled out of wise people, and nothing behind the markers did any of the weighing. The hardest failure mode to catch, because absence leaves no trace in an output.
-
Zombie vs living design
Infinite, linear engagement (no stopping cues, autoplay, 24/7) versus cyclical, finite sessions (stopping cues, circadian alignment, endings).