Collection

Naming yourself a laboratory earns nothing

The table above turns an actor into a class ceiling, so the obvious attack is to pick a good-looking name. Two things stop it, and both are worth seeing.

A record has to come in through the door. One that has not been through the engine's own intake is refused before it can decide anything:

TIRESIAS_RECORD_NOT_AUTHENTICATED

And with no signed register of who is who, nobody exceeds “an interested party said so”. Under that setting the self-named laboratory and the honest small supplier land in exactly the same place — which is the right answer, because nothing has told the system they are different:

An operator who really does control their own intake can say so, and that choice is stamped on every record it admits, so a receipt says years later what its classes rested on. What earns a class properly is enrolment in a signed register — then a laboratory is a laboratory because somebody signed for it, not because of how it spelled its name.

Priority orders collection. It is never a weight.

Priority decides what a contributor is asked for first. It does not reach the engine and it never touches a confidence. Every claim marked binds binds equally, whatever the operator ranked it, because the confidence is the weakest required claim and not an average of all of them.

The task this spec compiles to is {"exposureUSD":250000,"critical":[{"key":"supplier:VOLTCORE|custody"},{"key":"supplier:VOLTCORE|purity","min_class":"VERIFIED","max_age_days":30}]}. There is no priority in it, no stage, and no weight — because the engine has nowhere to put them, and a value handed to a function that discards it is a lie told to the next reader.

The administrator sets the rules and accepts nothing

This looks upside down until you ask what an administrator who could also accept would be: one person who can lower a requirement and then approve the thing the requirement was protecting against, with two signatures that are the same signature. An auditor asking “who could have done this alone?” is asking exactly that, and the answer here is nobody.

Three more separations hold at every level:

• Nobody signs off on their own observation. Not the line user who typed it, and not a manager who happened to type one.
• Whoever sealed the spec may not accept under it, even at a role that otherwise could.
• Nobody grants their own level or above. A role that can promote a peer can promote itself through one.

There is no waiver, at any level, including the administrator. A required claim cannot be excused. When a decision cannot be supported there are two honest moves: supply the missing evidence, or have a named person with authority for the exposure accept the residual risk. A waiver edits the record so the gap stops appearing; an acceptance leaves the gap where it is and puts a name beside it. Only the second is still true a year later.

The spec is enforced before anything is priced

A contribution measured against a decision the operator configured is first checked against that configuration. Here is a purity reading in the wrong units and outside the declared range, offered against the spec above:

TIRESIAS_CANDIDATE_DOES_NOT_CONFORM_TO_THE_SPEC — tiresias: this contribution does not conform to the collection spec in force (WRONG_UNIT). The spec declares different units for this claim. It declares ppm; this says brix. A number without its unit is not a measurement, and two numbers in different units are not comparable however good either one is. A contribution is measured against the decision the operator configured, so one the configuration does not ask for is not measured and not priced.

It is refused at the door, with a reason its supplier can act on, and it is never measured or priced. The same claim is also floored at the gate, because the spec's own minimum class and maximum age are compiled into the task — so a record that reached the pool by some other route still cannot hold the decision up.

Why this replaces a weighted score rather than wrapping one

As originally filed, this product ranked a contribution with a formula of the shape 0.4·V + 0.3·H + 0.2·U + 0.1·T. A weighted sum lets a strong input compensate for a weak one. Four excellent fields and one absent field average to “good”, and the absent field is the one the decision turns on. The whole engine underneath this console exists so that cannot happen, so the formula is replaced here, not carried forward.

Concretely: strengthening a claim that is already strong earns nothing, because the decision is bounded somewhere else. A weighted sum would pay for it whenever that claim carried the larger coefficient.

Why this scope is complete, rather than merely thorough

Most lineage systems have to ask, at every hop, whether a downstream lot somehow became trustworthy again — because in most systems blending, re-testing or selling can raise a record's standing. So the answer is either "recall everything that ever touched it" or a judgement somebody has to defend, hop by hop.

Here it rests on arithmetic, and the scope is COMPLETE BY CONSTRUCTION rather than by search effort. Nothing in this product can raise a class or refresh a date. A blend takes the weakest of its parts and the age of the oldest; a transfer changes custody and nothing else. So no descendant of a bad lot can have out-classed the problem, and there is no hop at which one could have escaped.

That is a property of the combining rule, not of the recall — so a test asserts it against the combining rule itself. The day blending stops flooring is the day that test fails, rather than the day somebody discovers a recall came up short.