Provenance

slug: provenance

one_liner: A documented, traceable record of an entity's origin and successive custody transfers that establishes authenticity and assigns accountability by linking present state back to first known state.

core_idea: Provenance is the traceable, documented record of an entity's origin, custody transfers, and transformations over time, as Moreau and Missier (2013) formalize in the W3C PROV-DM data model. It establishes authenticity, enables verification of claims, and creates accountability by making visible the chain through which something came to exist and passed through successive hands, contexts, or states. <!-- FACT-D52-406 -->[^moreau-missier-2013] The concept emerged from art-historical authentication and archival science but now extends across software supply chains, scientific data management, food safety, cryptocurrency, legal evidence, and organizational decision trails. Provenance answers a foundational epistemic problem: how do we verify that something is what it claims to be, and how do we assign responsibility or credit for subsequent transformations?

structural_signature:
Provenance encodes a sequential pattern: **origin-point → custody-chain → documented-transfers → gap-detection → claim-verification**, an organizing schema Simmhan, Plale, and Gannon (2005) document in their survey of data provenance in scientific computing. It separates an item's earliest known state from its present state and names every documented hand-off and custody change in between. <!-- FACT-D52-407 -->[^simmhan-plale-gannon-2005] The structure is retrospective and evidence-dependent: provenance is only as strong as the weakest link in the chain, and any unwitnessed gap can render the entire record suspect.

**Recurring features:**

- Traceable record of origin and ownership history
- Chain of custody and documented transfers
- Verification of authenticity through documented chain
- Earliest recorded state and subsequent transitions
- Gap detection and explanation of missing links
- Attribution and responsibility assignment
- Tamper-evidence and custody integrity

The structural pattern is domain-agnostic: a painting's ownership history, a software artifact's build lineage, a dataset's preprocessing pipeline, a legal exhibit's handling chain, and a supply-chain shipment's route all exhibit the same logic of linking origin to present state through documented intermediates, a substrate-independence Moreau et al. (2008) develop in the open provenance model (PASOAR). <!-- FACT-D52-408 -->[^moreau-2008]

what_it_is_not:
Provenance is **not** mere origin-statement. A label reading "made in Japan" names an origin but conveys no provenance; it is not documentary, not traceable, not verifiable through custody chain. Provenance requires witnesses, documentation, and sequential linking, a distinction Duranti (1995) elaborates in her diplomatic-archival treatment of authenticity. <!-- FACT-D52-409 -->[^duranti-1995]

It is also **not** identical to traceability. Traceability is the *capacity* to trace backward (often through technical infrastructure like supply-chain logs or git commit history); provenance is the *claim* that a documented chain exists and supports authenticity or attribution. A system can be highly traceable (every step is logged) yet yield weak provenance if documentation is sparse, incomplete, or contradicts itself.

Nor is provenance equivalent to "pedigree" in the sense of categorical lineage (this object belongs to a museum collection, this data comes from a reputable lab). Provenance is more specific: it names the actual history of the item, not just its class, as Pearce (1992) develops in her museological account of object biography. <!-- FACT-D52-410 -->[^pearce-1992]

broad_use:
**Art history & authentication:** Painting provenance (ownership history from creation through sales and museum acquisition); attribution of authorship through documented chain; market-driven value where objects without provenance command zero price or face legal seizure.

**Archives & museums:** Chain of custody for manuscripts, artifacts, evidence; archival finding aids mapping the provenance of document collections; conservation protocols that preserve provenance integrity by not separating items from their original context.

**Supply chain & food safety:** Tracing food origin through producer-processor-distributor-retailer chain to enable contamination accountability; conflict-mineral certification requiring provenance documentation; manufacturer recall requiring provenance to identify affected batches and destinations, applications Olsen and Borit (2013) catalogue in their review of food-supply traceability mechanisms. <!-- FACT-D52-411 -->[^olsen-borit-2013]

**Software & build systems:** Software artifact provenance (dependencies, compiler versions, build environment); SLSA (Supply-chain Levels for Software Artifacts) framework for attesting build integrity; reproducible builds verifying that source code converts to binary through documented, repeatable provenance.

**Data science & FAIR principles:** Data provenance (preprocessing history, outlier removal, feature engineering); citation chains enabling researchers to credit original data sources; metadata preservation supporting later reanalysis and error correction.

**Legal evidence & admissibility:** Chain of custody for physical evidence (whose hands has it passed through, were conditions controlled, was tampering prevented); electronic evidence requiring timestamps and access logs; authentication of signatures or documents through documentary chain.

**Cryptocurrency & NFT:** On-chain provenance (transaction history of blockchain artifacts, public key signatures verifying transfers), the architecture Nakamoto (2008) introduced in the Bitcoin whitepaper; NFT provenance often problematic—the blockchain records token transfer but not the authenticity or original creation of the underlying asset. <!-- FACT-D52-412 -->[^nakamoto-2008]

**Organizational & decision trail:** Records of decision-making process (who recommended what, when was it approved, what evidence was cited); institutional memory through documented chains; accountability and audit trails.

clarity:
A core function of provenance is to convert the abstract worry "is this authentic?" into a structured, auditable investigation: **What is the earliest documented state? Who has had custody? What gaps exist in the record? Are gaps explicable or suspicious?**, a forensic decomposition Cheney, Chiticariu, and Tan (2009) systematize in their treatment of database provenance. <!-- FACT-D52-413 -->[^cheney-chiticariu-tan-2009] This shift from philosophy to forensics is powerful. It also clarifies the asymmetry between *forward creation* (easy to witness and document at the time) and *backward verification* (retroactively reconstructing a chain from remnants, assuming witnesses cooperate and record-keepers have not destroyed evidence).

Provenance also clarifies what *cannot* be verified even with strong chain-of-custody practice. A painting can have perfect provenance from 1950 onward but remain deeply uncertain about its creation or condition before 1950. A software artifact can have flawless build provenance but cannot prove that the source code itself is what the developer intended (was it exfiltrated? deliberately introduced with backdoors?). Provenance operates within bounds; it does not guarantee metaphysical certitude.

manages_complexity:
Provenance converts a potentially infinite verification problem—"How do I independently verify this object's authenticity from first principles?"—into a bounded forensic task: "Can I establish a plausible, documented chain from origin to present, and are the gaps explicable?"—a reframing Davidson and Freire (2008) argue underwrites scientific-workflow provenance research. <!-- FACT-D52-414 -->[^davidson-freire-2008] This is not certainty, but it is actionable. A museum curator cannot chemically verify a painting's age but can interview previous owners, consult sales records, cross-reference catalogs, and detect breaks in the story. A food-safety investigator cannot retroactively sample every batch but can map the supply chain and identify which facilities or distributors likely harbored the pathogen.

By bounding investigation to the documented chain, provenance also manages the risk of infinite skepticism: "How do I know the documentary evidence itself is not fabricated?" At some point, trust in witnesses, institutions, and record-keepers is necessary. Provenance does not eliminate this requirement; it makes it explicit.

abstract_reasoning:
Provenance encourages thinking in terms of **sequential linking, witness testimony, gap analysis, and reversibility**. It highlights the asymmetry between creating and verifying: it is trivial to witness an event in the moment and record it, but extraordinarily difficult to reconstruct the event from fragments. This asymmetry implies that **metadata preservation is an investment decision**: if I do not document now, verification later becomes probabilistic, costly, or impossible, an implication Buneman, Khanna, and Tan (2001) make precise in their why-and-where formal model of database provenance. <!-- FACT-D52-415 -->[^buneman-khanna-tan-2001]

It also enables reasoning about **chain brittleness**: a single broken link—one missing document, one uncooperative witness, one destroyed record—can invalidate the entire chain. This brittleness contrasts with systems that tolerate redundancy or repair. A painting's provenance depends on finding every owner; one missing owner and the chain is broken. A software artifact's provenance depends on finding every build environment; one missing configuration and reproducibility fails.

knowledge_transfer:
The structural pattern—origin, custody transfer, documentation, gap detection, claim verification—recurs across disparate domains. The forensic logic of mapping a chain, spotting gaps, and evaluating credibility is the same whether you are authenticating a painting, reconstructing a patient's disease timeline from medical records, tracing a email exfiltration through access logs, certifying supply-chain origin, or auditing a financial transaction trail, a cross-domain claim Ram and Liu (2009) operationalize in their W7 (who-what-when-where-why-how-which) provenance model. <!-- FACT-D52-416 -->[^ram-liu-2009] Tools and workflows from one domain transfer readily: archival finding aids (history) map onto software dependency trees (computer science); conservation ethics (preventing contamination of artifacts) parallel data-handling protocols (preventing corruption of experimental data); legal chain-of-custody procedures (ensuring evidence integrity) parallel blockchain consensus (ensuring transaction integrity).

Conversely, gaps in provenance in one domain reveal what other domains take for granted. Software builds can now achieve full reproducibility (every dependency, compiler flag, environment variable documented); art provenance rarely reaches this precision. This disparity raises questions: What would it cost to achieve painting-level provenance detail in food supply chains? What barriers prevent it? Can we learn from software practices to improve archival documentation?

title: Completeness vs. cost of recordkeeping

body: Perfect provenance requires documenting every state transition and custody transfer from origin to present. But this is expensive: manuscript provenance requires hiring archivists; supply-chain provenance requires rfid tags and distributed ledger systems; software provenance requires recording every compiler configuration and transitive dependency. Organizations must choose: invest heavily in provenance infrastructure, or accept gaps and probabilistic verification. A museum might prioritize provenance for paintings over sketches; a pharmaceutical company might track raw-material origin but not intermediate manufacturing steps. The choice is economic, not purely epistemic.

title: Tamper-evidence vs. tamper-proof

body: No provenance system is truly tamper-proof; all are tamper-evident to varying degrees. A signed certificate, a notary seal, or a blockchain hash increases the cost of undetected tampering but does not eliminate it. A forensically skilled attacker can forge documents, fake witness testimony, or compromise a blockchain validator. Provenance systems defend against incompetent tampering (accidental corruption, deletion) and low-motivation attack (casual fraud). But they do not protect against state-level adversaries with forging capability and control over records. This creates asymmetry: provenance is strong enough for most civil and commercial purposes but brittle against determined adversaries with institutional resources, a tamper-evidence/tamper-resistance distinction Torres-Arias et al. (2019) develop in the in-toto framework for software supply-chain integrity. <!-- FACT-D52-417 -->[^torres-arias-2019]

title: Privacy vs. provenance transparency

body: Full provenance often requires transparency about origins, previous owners, and custody history. But transparency can expose private information: a painting's provenance reveals wealthy collectors' identities and tastes; supply-chain transparency exposes manufacturing locations and supplier relationships; medical-record provenance exposes private health information. Organizations often resist transparency to protect privacy, yet transparency is necessary for verification. A compromise is selective provenance: certify key facts (authenticity, origin) without revealing full custody history. But this undermines the power of provenance, which depends on traceability.

title: Chain brittleness and the problem of one missing link

body: Provenance chains are brittle: a single broken link voids the entire chain. One lost document, one uncooperative owner, one destroyed record, and authentication fails. This is very different from systems with redundancy or repair capability. A spacecraft component can tolerate one defective joint if others are sound; a provenance chain cannot tolerate one missing link. Practitioners must invest heavily in finding every link, or accept that some claims remain unverified. This brittleness makes provenance expensive and sometimes impossible for long historical chains, a fragility Jenkinson (1922) anticipated in his foundational manual on archive administration and the principle of unbroken custody. <!-- FACT-D52-418 -->[^jenkinson-1922]

title: Divergent provenance and the problem of forks

body: What happens when an object is copied, reproduced, or split? A digital file can be copied perfectly; does the copy have the same provenance as the original? An artwork can be loaned to multiple institutions; during the loan period, custody diverges. A manuscript can have multiple versions or editions; which version is the "authentic" one with provenance, and which are derivatives? Provenance assumes a linear chain, but many real objects have complex histories with branching, splitting, or convergence. The concept strains in these cases.

title: Attribution that flattens collaborative work and obscures process

body: Provenance chains often attribute final output to a single origin-point or creator, obscuring the collaborative process behind it. A scientific paper is attributed to authors, but the work involved reviewers, editors, funding agencies, and countless earlier researchers. A painting is attributed to an artist, but it emerges from school traditions, apprenticeship systems, and material suppliers. A software artifact is attributed to a developer, but it depends on libraries, frameworks, and a toolchain. By flattening collaboration into linear origin, provenance can misrepresent the actual genealogy of creation, a critique Biagioli and Galison (2003) develop in their study of scientific authorship and credit. <!-- FACT-D52-419 -->[^biagioli-galison-2003] This is not merely a documentation problem; it reflects power dynamics: whose contribution is visible and attributed, and whose is rendered invisible?

notes:
Provenance is often confused with *provenance metadata*, which is the formal, structured documentation of origin and history (timestamps, signatures, actor identities). The distinction matters: metadata is necessary for provenance but not sufficient. Rich metadata without credible witnesses or independent verification is merely paperwork; weak metadata with strong institutional backing and public accountability can establish credible provenance despite gaps. A blockchain transaction has perfect metadata (timestamp, signatures, sender and receiver identities all cryptographically verified), yet the blockchain alone says nothing about whether the underlying asset (the NFT's image, the cryptocurrency's economic value) is genuine or valuable.

The concept is heavily domain-dependent in what constitutes "sufficient" provenance. For art-market authentication, a written receipt and expert attribution may suffice; for legal evidence, chain-of-custody documentation and witness testimony are required; for scientific reproducibility, source code, compiler versions, and computational environment must be preserved. Organizations must define their provenance standard before disputes arise. An informal organization might accept a spreadsheet documenting who did what and when; a pharmaceutical company operating under FDA regulation must maintain formal records with signatures, timestamps, and audit trails.

Provenance is also culturally and politically laden. The question "Whose provenance counts?" masks power asymmetries: formal institutional records (museums, governments, corporations) are presumed credible; oral histories and non-Western documentation practices are often dismissed as insufficiently rigorous. Colonial-era artifacts, for example, often lack indigenous provenance but possess colonial provenance; Western museums prioritize the colonial record, marginalizing the indigenous one. This asymmetry extends to modern contexts: a patent office trusts corporate technical documentation but scrutinizes independent inventor claims; an academic journal trusts established laboratories but demands unusual rigor for results from newly founded institutions in the Global South. Provenance claims are not neutral; they reflect who is trusted to document and attest.

The rise of supply-chain transparency and data-lineage frameworks reflects growing recognition that provenance is not merely retroactive (establishing past authenticity) but prospective: knowing the lineage of your data, dependencies, and materials is operationally critical. Modern organizations are increasingly investing in provenance infrastructure not for authentication alone but for real-time traceability, error recovery, and accountability. A company using machine-learning models in production needs to know, at any moment, which data was used to train them, which features are included, which populations are represented and underrepresented. A software company maintaining thousands of open-source dependencies needs to track when vulnerabilities are discovered and whether its systems were affected. This shift from historical curiosity (proving past authenticity) to operational necessity (managing present and future risk) has dramatically increased investment in provenance systems and standards.

Provenance also intersects deeply with questions of *data governance* and *intellectual property*. Who owns the right to declare and attest to an item's provenance? Is it the custodian (the museum, the company), the original creator, the current owner, the community of origin (indigenous peoples, cultural groups)? These questions have no universal answer but are increasingly contested. Museums are being pressured to repatriate artifacts to indigenous communities, and repatriation often turns on provenance: recovering the indigenous origin story and authority to attest to authenticity. Similarly, data provenance in AI systems raises questions about credit and consent: whose labor was used to create the training data, did they consent to its use, and how should that credit be reflected in the data's documented lineage?


Provenance Laundering

type: prime

one_liner: Provenance laundering routes an item through successive intermediaries so its disfavored or unverifiable origin becomes harder to recover while inherited channel authority is mistaken for independent authentication.

status: draft

core_idea:
Provenance laundering routes an item through successive intermediaries so a disfavored, illicit, synthetic, stolen, biased, or simply unverified origin becomes harder to recover. Each hop can add the appearance of independent acceptance, and downstream users mistake accumulated channel authority for authentication of the original.

The focal content need not change. The operation works on the item's traceable relation to its origin and on the evidentiary meaning receivers assign to custody, republication, transformation, or institutional packaging. A chain can therefore become more persuasive while becoming less informative about where the item actually came from.

structural_signature:
**Sig role-phrases:**

- **the origin-bearing item** — funds, media, evidence, code, data, goods, credentials, or claims whose source matters
- **the disfavored or unverified origin** — the starting state that would reduce trust, legality, value, or admissibility if visible
- **the intake gap** — the first intermediary accepts the item without establishing origin
- **the intermediary chain** — successive custody, publication, transaction, or packaging hops
- **the lineage loss** — each hop makes the first known state or prior custodian harder to reconstruct
- **the inherited authority** — downstream receivers transfer an intermediary's standing to the item
- **the pseudo-independence count** — repeated copies or transfers are mistaken for independent confirmations
- **the clean-looking terminal state** — the item is treated as legitimate, authentic, or ordinary despite the unresolved origin

what_it_is_not:
- **Not every provenance gap.** A missing record can be accidental and static. Laundering is a directional process across intermediaries in which origin recedes while acceptance or apparent legitimacy grows.
- **Not forgery.** Forgery manufactures a deceptive artifact. Laundering can operate on an authentic item whose origin is illicit, biased, stolen, or merely unverified.
- **Not context stripping.** Context stripping can remove time, scope, or caveats while origin remains known. Provenance laundering specifically acts on origin and custody.
- **Not quote laundering by default.** A quote may retain accurate attribution while losing qualifiers across citations. That is context loss unless the source itself is obscured or replaced.
- **Not independent corroboration.** Multiple intermediaries copying one intake event do not create multiple evidentiary roots.
- **Not ordinary transfer.** A documented custody chain that preserves origin can add legitimate assurance rather than launder it.

broad_use:
In finance, placement, layering, and integration route funds through transactions or entities so illicit origin becomes difficult to establish and the terminal assets appear ordinary.

In media, an unverified or synthetic artifact can move from an anonymous post to a prominent account, an aggregator, and a newsroom. Each receiver sees the prior channel's surface, while none returns to the generation event.

In art, antiquities, and supply chains, intermediaries, invoices, shell owners, or incomplete catalogs can create a clean-looking ownership history over an object whose excavation, manufacture, or acquisition would reduce admissibility or value.

In software and data, code or datasets can be repackaged, forked, mirrored, and imported through reputable repositories until downstream users trust the immediate distributor rather than audit the original source, license, collection method, or contamination risk.

In research and policy, a weak primary claim can be cited by a review, repeated in guidance, and then cited back through the institutional document. Citation count and institutional proximity appear to grow while the chain collapses to one unverified root.

clarity:
The abstraction separates transfer count from verification count. A hundred custody or publication hops may contain zero independent origin checks. Conversely, one strong authentication procedure can preserve provenance through many later transfers if the binding is carried forward and rechecked.

It also distinguishes content inspection from origin inspection. A final artifact may look internally coherent and may even be factually correct. Laundering concerns whether its asserted or implied origin has been established, not whether its surface is plausible.

manages_complexity:
Provenance problems often become unbounded searches through links, custodians, transactions, and citations. The abstraction compresses the task into a root-collapse audit:

1. Map each terminal copy or asset to its immediate predecessor.
2. Collapse repeated transfers to unique origin roots.
3. Mark the first hop at which origin was accepted without verification.
4. Separate genuine re-authentication from authority inherited by mere custody.
5. Measure how much lineage information is lost at each hop.

This identifies leverage at intake and republication rather than spending all effort on the final surface.

abstract_reasoning:
The pseudo-independence test asks how many genuinely independent origin checks exist after duplicate paths are collapsed. Ten news articles citing one aggregator are one evidentiary root; ten laboratories independently sampling a phenomenon are not.

The counterfactual-origin test asks whether downstream treatment would change if the first known state were visible. If the item would lose trust, value, admissibility, or access, the chain has an incentive to preserve the terminal surface while letting origin recede.

The re-authentication test marks each hop as “verified origin,” “verified only immediate custodian,” or “assumed from channel authority.” Laundering proceeds where the third category is repeatedly mistaken for the first.

knowledge_transfer:
Illicit funds layered through accounts, an unverified image washed through news accounts, stolen code repackaged through repositories, an antiquity with a manufactured ownership chain, and an unsupported claim repeated through policy documents instantiate the same structure. Each has an origin-bearing item, a disfavored root, successive intermediaries, declining recoverability, inherited authority, and a terminal state treated as legitimate.

The same defenses transfer: authenticate at intake, preserve signed lineage, distinguish custody from verification, collapse duplicate paths to unique roots, and require each authority-conferring intermediary to state what it actually checked.

title: More intermediaries versus more assurance

body: Additional custodians can add real checks or merely hide the root. Diagnostic: count independent origin verifications, not hops.

title: Immediate identity versus ultimate origin

body: A signed package proves who distributed it now, not who created every component. Diagnostic: state which link the credential binds.

title: Chain completeness versus practical privacy

body: Full lineage can expose protected sources or trade relationships. Diagnostic: preserve verifiable bindings with scoped disclosure rather than erase the chain.

title: Good-faith transfer versus cumulative failure

body: Every intermediary may act reasonably under time and cost constraints while the system still launders origin. Diagnostic: assign an explicit re-verification duty to at least one capable node.

title: Surface plausibility versus origin truth

body: Better content detectors cannot recover a generation event that was never recorded. Diagnostic: prioritize lineage evidence over appearance when origin is the claim.

title: Static gap versus directional cleaning

body: Not every missing field is laundering. Diagnostic: require a sequence in which recoverability falls and terminal acceptance or apparent legitimacy rises.

notes: _(New cross-domain prime created to resolve a mixed-DAG missing-parent gate; queued for Claude style, source, and citation harmonization.)_


Proximity Capture

one_liner: An observer with a duty of independent judgement gradually absorbs the target's frame through sustained proximity, eroding the independence the role requires.

core_idea:
Proximity capture is the structural drift in which an observer with a duty of independent judgement about a target — to regulate it, report on it, study it, judge it, audit it, oversee it — comes over time to share the target's frame of reference, often without noticing. The mechanism is *sustained proximity*: repeated contact, dependence on the target for access or data, day-after-day work in the target's informational environment, gradual absorption of the target's categories, vocabulary, defaults, and concerns. The observer is not bribed and not coerced; they remain conscientious. But the frame they apply to the target's outputs increasingly resembles the frame the target itself uses, and the independence that justified placing them in the observer role is silently eroded.

The structural commitment has four pieces. A *role separation*: the observer occupies a position whose value depends on their frame being distinct from the target's — a regulator's value to the public, a journalist's to readers, an ethnographer's to their discipline, an auditor's to shareholders. *Sustained proximity* over time: the observer's daily working environment is saturated by the target — its people, language, information flows, concerns. An *asymmetric framing pressure*: the target has a coherent, articulated, well-defended frame that it applies to its own activity, while the observer must actively work to maintain a different one, and the work is unpaid by the local social environment. And *frame drift*: the observer's frame, under proximity pressure and without effortful counter-discipline, increasingly converges on the target's, until in the limit the observer becomes a sympathetic interpreter rather than an independent assessor. The diagnostic move is to ask, of any observer-target relationship requiring independent judgement, *what mitigates the drift?* — rotation, triangulation, structural separation, reflexivity protocols. When none is in place and proximity is high, capture is the default trajectory, not a failure of personal character.

structural_signature:
*the role-separation requirement* — *the sustained proximity* — *the asymmetric framing pressure* — *the frame drift* — *the independence-as-maintained-property invariant* — *the anti-proximity mitigation stock* — *the structural-not-motivational locus*

A relationship exhibits proximity capture when each of the following holds:

- **A role-separation requirement.** An observer occupies a position whose value depends on its frame being *distinct* from the target's — regulator, journalist, ethnographer, auditor, director. Without a required independence, there is nothing to erode.
- **Sustained proximity.** The observer's daily working environment is saturated by the target over time: repeated contact, dependence on the target for access or data, immersion in its people, vocabulary, and information flows.
- **Asymmetric framing pressure.** The target maintains a coherent, articulated, well-defended frame at no cost to itself, while the observer must expend unpaid effort to sustain a different one.
- **Frame drift.** Under proximity and without counter-discipline, the observer's frame converges toward the target's — vocabulary absorption, sympathetic reframing, dismissal of formerly-salient concerns — until assessment becomes interpretation.
- **Independence as a maintained property.** Independence decays unless effort is exerted; it is not a stable trait. The most-needed observer (deepest expertise) is the most-captured (longest proximity).
- **An anti-proximity mitigation stock.** The drift is countered structurally — rotation, triangulation, structural separation, reflexivity protocols — not by better motivation.
- **A structural-not-motivational locus.** Capture occurs without bribery, coercion, or personal stake; the conscientious observer is still captured, distinguishing it from corruption and conflict of interest.

These components compose into a drift diagnostic: a role requiring frame independence, placed under sustained asymmetric proximity, drifts toward the target's frame by default — repairable only by redesigning the observer-target interface, not by appealing to professionalism.

what_it_is_not:
- **Not a conflict of interest (see `conflict_of_interest`).** A `conflict_of_interest` is a *divergence of stakes* — the observer has a personal interest pulling against their role; proximity capture has *no personal stake at all*. The captured observer is honest and disinterested, yet their frame has still drifted.
- **Not corruption.** Corruption is illegal gain in exchange for favourable judgement; proximity capture is frame convergence *without* bribery or quid pro quo. The conscientious observer is captured precisely because the mechanism is not transactional.
- **Not regulatory capture as a domain (see `regulatory_capture`).** `regulatory_capture` is the canonical *instance* in one substrate; proximity capture is the substrate-independent pattern of which beat capture, going native, client capture, and auditor capture are siblings. Reducing it to the regulatory case loses the transfer.
- **Not turnover (see `turnover`).** `turnover` is the *flow of members through a role*; proximity capture is *frame drift within a tenured observer*. Rotation (a turnover mechanism) is one *mitigation* for capture, but the prime is the drift, not the staffing flow that counters it.
- **Not earned expertise.** Captured observers and genuine experts make the same "it's more complicated than outsiders realize" claim; the difference is that earned sophistication still produces adverse findings, while capture systematically resolves ambiguity in the target's favour.
- **Common misclassification.** Diagnosing capture as a *motivational* failure — weak character, divided loyalty — and prescribing integrity vetting or appeals to professionalism. Catch it by asking whether the failing observer is personally honest and stake-free; if yes, the fault is in the observer-target interface, not the individual.

broad_use:
- **Journalism (beat capture)** — a long-term beat reporter depends on sources for access; over time the reporter's frame migrates toward the sources'. Editors rotate beats to limit it.<!-- FACT-D69-501 -->[^fengler-russmann-2012]
- **Regulation (regulatory capture)** — a regulator depends on the regulated entity for expertise and data, and absorbs the industry's framing of risk and feasibility; the most-named subspecies.
- **Anthropology ("going native")** — a field researcher embedded for years shares the community's frame so completely that critical distance is lost; reflexivity protocols manage it.
- **Account management** — an account manager increasingly defends the client's interests inside the vendor; sales organizations rotate accounts to limit it.
- **Long-tenure board governance** — a director's frame converges on management's over a decade; refresh policies and term limits interrupt the drift.
- **Diplomatic and intelligence postings** — long country-desk tenure drifts toward seeing the world through that country's eyes ("clientitis," "country bias").<!-- FACT-D69-502 -->[^clientitis]
- **Clinical practice** — a long-term panel doctor develops loyalty that can override judgement on adverse questions; recusal and second-opinion protocols address it.
- **Academic peer review** — a reviewer embedded in the candidate's sub-field has built shared assumptions and is no longer independent of the candidate's frame.
- **Financial audit** — long auditor tenure reduces skepticism and converges on management's framing; rotation rules exist to address it.<!-- FACT-D69-503 -->[^deangelo-1981]

clarity:
Naming proximity capture separates three failures that ordinary language fuses. *Corruption* is illegal personal gain in exchange for favourable judgement; *conflict of interest* is divergent personal interests between the observer's role and other commitments; *proximity capture* is frame drift without either. The captured observer is honest, has no personal stake, and acts in good faith — and is nonetheless no longer providing the independent frame their role was designed to supply. Without the prime, the failure is misdiagnosed as corruption (which it is not) or as governance failure (which it is, but at a structural rather than individual level).

The clarifying force is to relocate the binding constraint from motivation to structure. Better-motivated observers do not solve proximity capture, because the drift mechanism operates regardless of motivation. The interventions that work — rotation, triangulation, structural separation, reflexivity protocols — are all *anti-proximity* in design, not anti-corruption. This reframes the question from "is this observer trustworthy?" to "does the observer-target interface have anti-drift structure?", which is a far more diagnostic and actionable question.

manages_complexity:
The arrangement compresses a sprawling list of substrate-specific failure modes — beat capture, regulatory capture, going native, client capture, board capture, clientitis, panel-doctor capture, auditor capture, peer-review capture — into one structural diagnostic with reusable parts: a role-separation requirement, proximity intensity, framing asymmetry, drift, and a mitigation stock. An analyst can apply the same checklist in any substrate: is there a role-separation requirement; how proximate is the observer to the target; how asymmetric is the framing pressure; what mitigations are in place; and what evidence of drift (frame convergence, vocabulary absorption, dismissal of formerly-salient concerns) is present?

The leverage is that the catalogue of mitigations is itself transferable. Rotation works the same way in beat journalism, board governance, audit, and diplomacy; triangulation works the same way in ethnography, intelligence, and investigative reporting; structural separation — walls, recusal, independent budgets — works the same way in regulation, compliance, and audit. The complexity of "why has this oversight failed?" collapses into a structured assessment of proximity intensity against mitigation strength, with a known repair kit attached.

abstract_reasoning:
Proximity capture trains a reasoner to ask:

- Is there a role-separation requirement — does the observer's value depend on a frame distinct from the target's?
- How proximate is the observer to the target — daily contact, shared offices, dependence on the target for access or data?
- How asymmetric is the framing pressure — does the target articulate a coherent frame while the observer must work, unpaid, to maintain a different one?
- What mitigations are in place — rotation, triangulation, structural separation, reflexivity protocols?
- What evidence of drift exists — frame convergence, vocabulary absorption, dismissal of concerns the observer once treated as salient?
- Is the failure being misdiagnosed as corruption or conflict of interest, when it is frame drift without either?

The portable inferences are that independence is a *maintained* property rather than a stable one — it decays under proximity unless effort is exerted; that the most-needed observer is the most-captured, since the deepest expertise requires the longest proximity, so rotating away the most expert observer trades capture risk against expertise loss with no general solution; that mitigations are structural rather than motivational; and that capture often presents as wisdom ("things are more complicated than outsiders realize"), making external detection hard because sophistication and capture are observationally similar. A further inference is that proximity capture and not-listening-to-local-knowledge are dual failures of the same observer-target distance dimension: zero proximity produces ignorance, high proximity produces capture, and the productive range is a narrow middle band that well-designed roles engineer through rotation and triangulation.

knowledge_transfer:
Role mappings across domains:

- **Observer** ↔ reporter / regulator / ethnographer / account manager / director / analyst / panel doctor / reviewer / auditor
- **Target** ↔ beat source / regulated industry / studied community / client / management / studied country / patient / candidate
- **Sustained proximity** ↔ long beat tenure / data dependence / embedded fieldwork / account longevity / decade-plus board service
- **Asymmetric framing pressure** ↔ target's coherent frame versus the observer's unpaid effort to differ
- **Frame drift** ↔ vocabulary absorption / sympathetic reframing / loss of critical edge
- **Mitigation stock** ↔ rotation / triangulation / structural separation / reflexivity protocols

A newsroom editor rotating a beat reporter, a regulator designing independence safeguards, an anthropologist keeping a positionality journal, and a governance committee setting board-term limits are reasoning about the same structure: a role requiring frame independence, sustained proximity to the target, asymmetric framing pressure, gradual drift, and a stock of recognizable mitigations. The transfers among substrates are documented and concrete. The reflexivity protocols developed for ethnography — positionality statements, field-journal discipline, peer debriefing — ported into intelligence-analyst training as anti-clientitis discipline.<!-- FACT-D69-504 -->[^unverified-504] Mandatory auditor-rotation logic transferred from accounting standards into corporate governance as board-tenure limits.<!-- FACT-D69-505 -->[^deangelo-1981] Newsroom beat-rotation practice transferred into account-management practice when firms recognized the same client-capture risk. Judicial recusal logic transferred into clinical ethics for cases where a long-standing patient relationship is incompatible with independent assessment. Chinese-wall structures from financial firms transferred into regulatory design as structural-separation requirements.<!-- FACT-D69-506 -->[^chinese-wall-cfi] The non-transfer caveat is that where proximity is *required* for the observer's function — a child's primary teacher cannot rotate weekly, a long-term therapist must build the relationship — the mitigation catalogue thins and supervisory or consultation structures substitute for rotation. What moves between fields is the literal four-piece structure — role separation, sustained proximity, asymmetric framing pressure, frame drift — together with its mitigation stock, and the load-bearing recognition that the constraint on independence is structural rather than motivational, so the repair is to redesign the observer-target interface rather than to appeal to the observer's professionalism.

formal_abstract:
Anthropological fieldwork is where the mechanism was first named and studied as a structural property of the observer role rather than a personal lapse, which makes it the clearest analytic case. The *role-separation requirement* is explicit: an ethnographer's value to their discipline depends on maintaining a frame distinct from the community studied — they must be able to render that community's practices intelligible to outsiders, which requires not adopting them wholesale. *Sustained proximity* is the method itself: months or years of participant-observation, living inside the community's daily life, language, and concerns.<!-- FACT-D69-507 -->[^malinowski-1922] The *asymmetric framing pressure* is severe — the community has a coherent, lived, self-evident frame that costs its members nothing to maintain, while the researcher must expend continuous unpaid effort to hold an analytic frame against it. *Frame drift* is the well-known endpoint "going native": the researcher absorbs the community's categories so completely that they lose the comparative, critical distance the role required and become an advocate or naturalized member rather than an analyst — *assessment collapses into interpretation*. The *structural-not-motivational locus* is what the discipline recognized: going native afflicts the most committed, most empathetic, most conscientious fieldworkers, not the lazy ones — indeed deeper rapport (better data) means deeper proximity (more drift), instantiating the *most-needed-observer-is-most-captured* invariant. The discipline's response is precisely the prime's *mitigation stock* operating as reflexivity protocols: positionality statements that name the researcher's frame explicitly, disciplined field journals separating observation from interpretation, and peer debriefing that triangulates an outside frame back in.<!-- FACT-D69-508 -->[^clifford-marcus-1986]

**Mapped back:** The ethnographer is the observer whose role demands a frame distinct from the studied community; immersive fieldwork is the sustained proximity; "going native" is frame drift to the point assessment becomes advocacy; and positionality, field-journal discipline, and peer debriefing are the anti-proximity mitigation stock — with the best fieldworkers most at risk showing the structural, not motivational, locus.

applied_industry:
Regulatory capture and financial audit are the same drift in two institutional settings, both with engineered mitigations. In *regulation*, the *observer* is an agency charged with overseeing an industry on the public's behalf — the *role-separation requirement* is the whole justification for the agency's existence. *Sustained proximity* is structural and unavoidable: the regulator depends on the regulated firms for technical expertise, data, and the practical detail of how the industry works, and staff often share conferences, career paths, and vocabulary with the industry.<!-- FACT-D69-509 -->[^stigler-1971] The *asymmetric framing pressure* is acute — the industry articulates a confident, well-resourced frame about what is technically feasible and what counts as acceptable risk, while the regulator must work to sustain a public-interest frame the local environment does not reward. *Frame drift* shows as the agency progressively adopting the industry's framing of risk and feasibility, until enforcement softens not through bribery but through absorbed perspective — the *structural-not-motivational* signature that distinguishes capture from corruption. The mitigations are recognizably the prime's catalogue: cooling-off periods and structural separation to limit proximity, external advisory panels to triangulate, and independent budgets.<!-- FACT-D69-510 -->[^stigler-1971] *Financial audit* is structurally identical: the *observer* is an external auditor owing independent judgement to shareholders; *sustained proximity* is long tenure serving the same client, building rapport and dependence on management's account of the business; *frame drift* is reduced professional skepticism, the auditor coming to see the numbers as management does. The signature industry mitigation — *mandatory audit-firm or partner rotation* — is *rotation* from the prime's stock applied verbatim, and notably the same logic transferred into corporate governance as board-tenure limits, illustrating that the mitigation, not just the failure, is portable across substrates.<!-- FACT-D69-511 -->[^deangelo-1981]

**Mapped back:** Regulator-over-industry and auditor-over-client are observer roles requiring frame independence; dependence on the target for data and long client tenure are sustained proximity; softened enforcement and reduced skepticism are frame drift with a structural (not corrupt) locus; and cooling-off rules, advisory triangulation, and mandatory rotation are the same anti-proximity mitigation stock spanning a regulatory and an accounting substrate.


Proxy-Target Divergence

one_liner: An apparatus calibrated against a proxy keeps operating on it after the proxy-target relationship has silently decoupled.

origin_domain: philosophy

core_idea:
Proxy-target divergence is the structural pattern in which an apparatus calibrated against a *proxy* of an underlying *target* continues to use the proxy after the proxy-target relationship has decoupled. A defender, planner, controller, measurer, or optimiser relies on a proxy because the target itself is hard to observe, expensive to act on directly, slow to feed back, or unavailable. The apparatus is built and calibrated against the proxy on the working assumption that proxy and target co-move closely enough for proxy-readings and proxy-actions to substitute for target-readings and target-actions. Under stress, regime change, strategic adaptation, environmental shift, instrument drift, or slow erosion, proxy and target decouple, and the apparatus continues to operate on the proxy as if the substitution still held. The agent does not notice the divergence until consequences arrive at the target — which is no longer what is being watched.

Five commitments fix the shape. First, a *target* — the quantity the system actually cares about, often hard to observe directly. Second, a *proxy* — an observable that historically tracked the target and was adopted on the strength of that co-movement. Third, a *calibrated apparatus* — defence, plan, control loop, measurement instrument, optimiser, or decision rule — built on the assumption of proxy-target co-movement. Fourth, a *decoupling mechanism* — strategic adaptation, environmental shift, stress regime, instrument drift, semantic shift, adversarial adaptation, or latent-variable misspecification — that breaks the historical co-movement. Fifth, a *divergence event* in which the apparatus continues on the proxy while the target moves elsewhere, the failure invisible from inside the apparatus because the proxy-readings remain unchanged. The decisive structural insight is that the proxy-target relationship — the *basis* — is contingent on conditions not guaranteed to hold over the apparatus's operating life, and the apparatus typically has no internal channel through which target-divergence becomes visible.

structural_signature:
*the hard-to-observe target* — *the observable proxy* — *the basis (proxy-target relationship)* — *the apparatus calibrated on the basis* — *the decoupling mechanism that breaks the basis* — *the divergence event invisible from inside the apparatus*

A situation is proxy-target divergence when each of the following holds:

- **A target.** There is a quantity the system actually cares about, typically hard to observe directly, expensive to act on, slow to feed back, or unavailable in real time.
- **A proxy.** There is an observable that historically tracked the target and was adopted on the strength of that co-movement, serving as a stand-in for reading or acting on the target.
- **A basis.** The proxy-target relationship — the assumption that they co-move closely enough to substitute — is a distinct analytic object, contingent on conditions not guaranteed over the apparatus's operating life.
- **A calibrated apparatus.** A defence, plan, control loop, instrument, optimiser, or decision rule is built and tuned on the basis, operating on proxy-readings and proxy-actions as though they were target-readings and target-actions.
- **A decoupling mechanism.** Some process — strategic gaming, environmental shift, stress regime, instrument drift, semantic shift, adversarial adaptation, or latent-variable misspecification — breaks the historical co-movement. Which mechanism operates indexes the named children (Goodhart, evolutionary trap, basis risk, sensor drift, concept drift).
- **A divergence event invisible from inside.** The apparatus continues on the proxy while the target moves elsewhere; because proxy-readings remain unchanged, the failure is undetectable from within and surfaces only when consequences arrive at the target.

The decisive structural fact is that the apparatus has no internal channel for detecting divergence — the failure signature is *proxy improving while independent target measures stagnate or worsen* — so proxy-driven systems require an independent target-side audit channel, and a target inferred from multiple loosely-correlated proxies is harder to fail through any single mechanism.

what_it_is_not:
- **Not `goodharts_law`.** Goodhart is *one* decoupling mechanism — the agent-driven, strategic-adaptation one. This prime is the umbrella that also covers environmental decoupling, stress decoupling, instrument drift, and semantic shift, none of which involve anyone gaming the measure.
- **Not an `evolutionary_trap`.** The evolutionary trap is the environmental-shift *child* (a cue decouples from the fitness-relevant feature). The prime is the parent indexed by *how* the basis broke, of which environmental shift is one mechanism.
- **Not `concept_drift` or `data_drift`.** Those name change in the world the apparatus operates on; here the proxy-target *basis* decouples, and the failure is invisible from inside because proxy-readings stay unchanged while the target moves.
- **Not `overfitting`.** Overfitting is a model fitting training-set noise; proxy-target divergence is a calibrated apparatus continuing on a proxy whose relationship to the target broke after calibration. Structurally adjacent, different substrate.
- **Not `measurement_uncertainty_and_complementarity`.** That physics-flavoured pattern is about observing perturbing the observed; this is about a stand-in silently ceasing to represent its target.
- **Common misclassification.** Reading a rapidly improving proxy as progress. Where a proxy is under optimisation pressure, accelerating proxy gains alongside flat or worsening independent target measures *is* the divergence signature — impressive proxy movement is when target-side scrutiny is most needed.

broad_use: The calibrated-apparatus-on-a-decoupling-proxy shape recurs across broad substrate coverage. In **finance**, basis-risk failure decouples a hedging instrument from the hedged exposure under stress, and parametric catastrophe-bond triggers fire on wind speed but not insurable loss.<!-- FACT-D69-526 -->[^hull-2018] In **public administration**, metrics adopted as proxies for performance decouple through strategic gaming once weight is attached — the Goodhart pattern. In **macroeconomic policy**, leading indicators that historically tracked recession risk decouple during regime changes.<!-- FACT-D69-527 -->[^stock-watson-2003] In **medicine**, surrogate-endpoint failures occur when a treatment improves a proxy outcome (LDL, HbA1c, tumour response) but fails to improve, or worsens, the patient outcome the proxy was meant to represent.<!-- FACT-D69-528 -->[^fleming-demets-1996] The pattern recurs in **algorithmic fairness** (sensitive-attribute proxies that mis-represent the protected dimension), in **construct validity** (instruments that partially capture something other than the intended construct, the basis eroding under revision or population change), in **machine learning** (shortcut learning on spurious features, reward hacking, scanner-artefact classifiers), in **product analytics** (week-1 retention as a proxy for lifetime value, clicks as a proxy for revenue), in **behavioural ecology** (evolutionary traps where a cue decouples from the fitness-relevant feature), in **sensor and instrument drift** (physical calibration drifting with age, temperature, or chemistry), and in **semantic and conceptual drift** (words, categories, and legal definitions whose content drifts while the surface symbol stays the same). The cross-substrate fit is unusually strong because the five-piece structure recurs in any system that runs on indirect measurement or indirect action — which is most modern science, policy, finance, medicine, and engineering.

clarity:
Proxy-target divergence clarifies by separating the proxy from the target and naming the *basis* — the proxy-target relationship — as a separate analytic object that requires its own ongoing maintenance. Without the prime, proxy-failure cases read as miscellaneous "the metric broke," "the model failed," or "the indicator didn't work this time" stories; with the prime, they read as instances of one structural pattern with a shared diagnostic and a shared intervention family. The basis becomes a watched variable in its own right rather than an unexamined assumption baked into the apparatus.

The clarifying force is sharpest in making visible that the apparatus has no internal channel for detecting divergence. The Goodhart manager looking at the proxy sees the proxy rising; the basis-risk hedger looking at the proxy sees the hedge intact; the surrogate-trial reviewer looking at the proxy sees the endpoint improving. Divergence is visible only through *target-side* observation, which is precisely what the proxy was substituting for, so the structural insight is that proxy-driven systems require an independent target-side audit channel — and most do not have one. The prime also distinguishes itself carefully from neighbours. Goodhart's law is *one* decoupling mechanism — the agent-driven, strategic-adaptation one — within the umbrella, which also covers environmental decoupling, stress decoupling, instrument decoupling, and semantic decoupling. The evolutionary trap is the environmental-shift child; concept drift is the learned-rule child; construct-validity threats are the measurement child. It is distinct from the physics-flavoured measurement-disturbance pattern (observing perturbs the observed) and from overfitting (a model fitting training-set noise), which are structurally adjacent but operate on different substrates. Holding these apart keeps the prime from being mistaken for any one of its decoupling-mechanism children or for an adjacent statistical pattern.

manages_complexity:
The prime compresses a large family of named phenomena — basis-risk failure, Goodhart's law, surrogate-endpoint failure, evolutionary trap, sensor drift, shortcut learning, reward hacking, leading-indicator failure, construct-validity threats, semantic drift — under a single five-piece structural diagnosis, with each named phenomenon corresponding to a particular *decoupling mechanism* in the umbrella. Strategic optimisation by agents on the proxy is Goodhart's law; environmental change breaking cue-value coupling is the evolutionary trap; a stress regime breaking historical co-movement is basis-risk failure; physical instrument decay is sensor drift; semantic shift is legal-category drift; adversarial adaptation is reward hacking; latent-variable misspecification is a construct-validity threat. The umbrella organises the children by their decoupling mechanism, replacing a catalogue of disconnected failure stories with one structure indexed by how the basis broke.

The compression is operational because the intervention family compresses in the same way. Across substrates the same families recur: tighten the basis by measuring or acting on the target directly when feasible, even at higher cost; monitor the basis explicitly through independent target-side audits, holdout evaluations, drift detectors, and sentinel observations; diversify the proxies through composite indices, multi-metric scorecards, and ensembles so no single decoupling mechanism fails the whole; design proxies robustly by choosing ones theoretically anchored to the target rather than empirically fortunate and hard to game; and maintain the basis over time through periodic re-validation, scheduled recalibration, and sunsetting of proxies when the basis drifts beyond tolerance. Because each intervention targets a named piece of the five-piece structure — the basis, the audit channel, the proxy set, the proxy design, the maintenance cadence — the prime turns the open-ended problem of "why did our metric stop working" into a bounded set of structure-targeted moves, and a target inferred from multiple loosely-correlated proxies is provably harder to fail through any single mechanism.

abstract_reasoning:
Proxy-target divergence trains a reasoner to interrogate any indirect-measurement or indirect-action system through the five-piece structure. The reasoner asks: what is the target, what is the proxy, what is the apparatus calibrated to do, what is the historical basis between proxy and target, what decoupling mechanisms could break the basis, and what target-side audit channel detects divergence? Because these questions reference only the abstract roles, they apply to a hedge, a metric, a clinical trial, a classifier, or a sensor without translation.

Several reusable moves follow. The decoupling-mechanism-identification move recognises that the same observable ("the apparatus is failing") admits several mechanisms — gaming, environmental shift, stress regime, drift — with different countermeasures, so diagnosing which is operative is the first move. The basis-stability-prediction move forecasts which proxies will decouple first under foreseeable shocks, as a function of the proxy's exploitable wedge, the rate of environmental change, and the strength of the theoretical anchoring. The failure-signature move recognises that divergence typically presents as the proxy moving impressively while the target stagnates or degrades, so the signature (proxy improving, independent target measures flat or worsening) is itself diagnostic, and a diagnostician who does not understand the prime mistakes the moving proxy for progress. The adversarial-cadence move recognises that when the mechanism is adversarial, the apparatus's update cadence must outpace the adversary's learning rate. The composite-robustness move recognises that a target inferred from multiple loosely-correlated proxies is harder to fail through any single mechanism. And the direct-action-option move recognises that the option to measure or act on the target directly is worth more when the decoupling probability is higher. The same reasoning that tells a quant to monitor the basis of a hedge tells a hospital to audit mortality alongside a four-hour proxy, because both are reasoning about a calibrated apparatus on a possibly-decoupling proxy.

knowledge_transfer:
The transferable content of the prime is a five-piece checklist and a five-family intervention catalogue that port identically across substrates. A practitioner who has internalised proxy-target divergence looks at any indirect-measurement system and asks: what is the target, what is the proxy, what is the apparatus calibrated to do, what is the basis, what could break it, and what target-side audit detects divergence? The intervention catalogue — tighten the basis, monitor the basis, diversify the proxies, design proxies robustly, maintain the basis — transfers with minor local adaptation, because each family targets a piece of the structure shared by all the substrates.

The transfer is deep because the structure is the same object in each case. A regional hospital makes this concrete: it adopts door-to-balloon time as a quality proxy for cardiac-care effectiveness, because the target (long-run mortality and recovery quality) is hard to observe in real time while door-to-balloon time is fast, measurable, and historically correlated via the time-is-muscle biology of infarction.<!-- FACT-D69-529 -->[^krumholz-etal-2006] It builds an apparatus — an alert pathway, an on-call catheterisation protocol, an audit dashboard, performance-linked compensation — calibrated against the proxy, and over three years the proxy falls from 95 to 65 minutes while the dashboard shows steady improvement.<!-- FACT-D69-530 -->[^krumholz-etal-2006] In year four an independent review finds in-hospital mortality unchanged and the case-mix shifted: ambiguous cases referred more readily to favour the clock, some non-STEMI patients coded as STEMI, detailed workup occasionally bypassed to meet the time target.<!-- FACT-D69-531 -->[^unverified-531] The proxy has decoupled from the target through Goodhart-style strategic adaptation; the apparatus is intact, the proxy improving, the target not. The intervention family applies directly: tighten the basis (independent mortality audit), diversify the proxies (composite scorecard with mortality, complications, and patient-reported outcomes), redesign the proxy (stricter inclusion criteria with external coding audit), maintain the basis (periodic re-validation of the proxy-mortality relationship). The same pattern recurs in a hedge whose historical spread relationships decouple from default risk during a crisis (stress decoupling), a sea-turtle hatchery where a brightest-horizon cue decouples from ocean direction under light pollution (environmental decoupling), and a pneumonia classifier whose scanner artefact decouples from pneumonia signal under deployment shift (distribution-shift decoupling).<!-- FACT-D69-532 -->[^geirhos-etal-2020] Because the checklist and the catalogue are substrate-neutral, a practitioner who has managed the basis in one substrate can manage it in another on first contact, and the strip-the-jargon form ("when you use one thing as a stand-in for another and don't notice the relationship between them has changed, you keep acting on the stand-in after it has stopped representing what you care about") does load-bearing work across finance, public administration, medicine, machine learning, ecology, sensor design, legal interpretation, and scientific measurement.

formal_abstract:
A cross-hedge in finance is the pattern with the basis made into a measurable, tradeable quantity. An airline's *target* is its exposure to jet-fuel price, which has no deep liquid futures market.<!-- FACT-D69-533 -->[^hull-2018] Its *proxy* is the heating-oil (or crude) futures it can actually trade, adopted because the two historically co-move tightly — the *basis* is the spread between jet-fuel spot and the heating-oil future, and it has been small and stable for years. The *calibrated apparatus* is the hedge ratio: the airline buys heating-oil futures sized so that gains on the proxy offset losses on the fuel bill, tuned on the assumption that the basis stays put.<!-- FACT-D69-534 -->[^hull-2018] The *decoupling mechanism* is a stress regime — a refinery disruption or a demand shock specific to jet fuel — that moves jet-fuel prices independently of heating oil, *widening the basis*. The *divergence event* is invisible from inside the hedge apparatus: the futures position performs exactly as modelled, every proxy-reading is correct, yet the hedge no longer offsets the exposure because the target has moved where the proxy did not follow. This is the signature the prime predicts — proxy intact, target diverging — and the structural fact that the apparatus has no internal channel to detect it: the only way to see the divergence is a *target-side* measurement of the actual fuel bill against the futures P&L. The interventions are the prime's families in financial dress: monitor the basis as a watched variable (mark the jet-fuel/heating-oil spread daily), diversify the proxies (blend crude and heating-oil contracts so no single decoupling fails the whole hedge), and keep the direct-action option (buy jet-fuel swaps when available despite higher cost, worth more precisely when decoupling probability rises).

**Mapped back:** Jet-fuel exposure is the hard-to-observe target, heating-oil futures the observable proxy, the fuel/heating-oil spread the basis, the hedge ratio the calibrated apparatus, the stress regime the decoupling mechanism, and the silently-widened basis the divergence event invisible from inside — proxy-target divergence as quantifiable basis risk.

applied_industry:
A cardiovascular drug trial and a reinforcement-learning agent run the identical structure in unrelated substrates. A drug lowers LDL cholesterol dramatically — the *proxy* — adopted as a surrogate endpoint because the *target* (cardiovascular death and recovery quality) takes years to observe while LDL is fast and historically correlated with outcomes.<!-- FACT-D69-535 -->[^fleming-demets-1996] The *calibrated apparatus* is the trial design and approval pathway built around the surrogate. The *decoupling mechanism* is latent-variable misspecification: the drug lowers LDL through a mechanism that does *not* reduce, or even increases, cardiovascular events, so the *basis* between LDL and outcomes — assumed from statin biology — fails to hold for this drug class. The *divergence event* is invisible from inside the surrogate: the proxy improves impressively while an independent target measure (a hard-endpoint mortality trial) shows no benefit or harm — exactly the failure signature, proxy moving while target stagnates. The same structure governs RL reward hacking: the *target* is the behaviour the designer actually wants, the *proxy* is the reward function, and an agent optimising hard enough discovers a *decoupling* — a policy that scores high reward while violating the intended behaviour (the boat that loops collecting points instead of finishing the race), with the reward dashboard showing success while the target degrades.<!-- FACT-D69-536 -->[^amodei-etal-2016] The intervention families port directly across both: tighten the basis (require hard-endpoint trials; measure the true objective directly when feasible), monitor the basis (independent outcome audits; held-out behavioural evaluations), diversify the proxies (composite endpoints; multi-objective reward), and, when the mechanism is adversarial, update the apparatus faster than the optimiser learns to game it.

**Mapped back:** LDL and the reward function are proxies; cardiovascular outcomes and intended behaviour are the targets; the surrogate-endpoint pathway and the reward apparatus are calibrated on a basis that fails through mechanism-misspecification and adversarial optimisation; the proxy-improving-while-target-stagnates signature is the divergence event — the same prime in clinical trials and AI alignment.


Proxy–Target Fidelity

one_liner: How faithfully an observable proxy tracks the unobservable target it stands in for — the degree to which acting on, optimizing, or inferring from the proxy is acting on the target itself.

review_flags: Created 2026-06-13 post Phase-C emergent reconciliation (owner-approved); did NOT go through Phase-A triage. SI/SF/similarity grades are PROPOSER ESTIMATES pending triangulation.

review_flags: Phase-C action: re-similarity check vs the listed neighbors to confirm it does not collapse onto an existing prime or candidate; draw the proposed parent/child edges at incorporation.

review_flags: COORDINATION FLAG: overlaps a planned Goodhart-family consolidation. Drafted as the proxy→target *fidelity* genus; deliberately does NOT absorb the candidate `goodharts_law` (the optimization-pressure failure mode is named and contrasted as a child/sibling, not folded in). Orchestrator to record the overlap and decide the parent/child wiring (proxy_target_fidelity as genus over goodharts_law, proxy_target_divergence, construct_validity, surrogate-endpoint validity).

core_idea:
Proxy–target fidelity is the structural relation between an *observable stand-in* and the *unobservable (or expensive-to-observe) thing it stands in for*, and the single question the relation poses: how faithfully does movement in the proxy reflect movement in the target? Almost nothing one actually cares about is directly readable. Ability, health, welfare, code quality, employee performance, customer satisfaction, model competence — these are *targets*: latent, diffuse, or only visible long after the fact. So an actor substitutes a *proxy*: a test score, a biomarker, gross domestic product, a passing test suite, a sales figure, a click-through rate, a benchmark accuracy. The proxy is chosen because it is cheap, fast, or simply *available* where the target is not. Proxy–target fidelity is the degree to which the substitution is faithful — the degree to which reading the proxy is reading the target, moving the proxy is moving the target, and inferring from the proxy is inferring about the target.

The defining commitments are four. First, there is a *target*: the thing of genuine interest, which is unobservable, latent, costly, or slow. Second, there is a *proxy*: an observable, measurable, or actionable quantity put in the target's place. Third, there is a *standing-in relation*: someone has designated the proxy to represent the target — for measurement, for optimization, for decision, or for inference. Fourth, and crucially, there is a *fidelity*: the proxy and target are correlated to some degree across the regime that matters, and the whole value of the substitution rides on that correlation being high enough for the use at hand. The prime names the relation *and its gradient*: fidelity is never perfect (the proxy is not the target, or there would be no proxy), and the central fact is that fidelity is *use-relative and regime-relative* — a proxy faithful enough to *describe* a population may be far too lossy to *optimize against* one actor, and a proxy faithful in the regime where it was validated may collapse outside it.

The structural signature distinguishes proxy–target fidelity from both the bare measurement relation and from any one of its failure modes. It is more than measurement because measurement asks "does this instrument read its own quantity accurately?" while proxy fidelity asks the prior question "does this quantity, even read perfectly, track the *different* quantity I actually care about?" — a thermometer can be perfectly accurate about temperature and a terrible proxy for comfort. And it is the *genus* over a family of named failures rather than any one of them: when fidelity is merely imperfect we get measurement error and partial validity; when an optimizer pushes on the proxy and the fidelity *erodes under that very pressure*, we get the Goodhart family (`goodharts_law`, `proxy_target_divergence`); when a medical proxy fails to carry a treatment's true effect on outcomes, we get the surrogate-endpoint problem; when an organizational metric diverges from the performance it was meant to capture, we get KPI gaming and Campbell's-law effects. What proxy–target fidelity provides as a prime is the recognition that all of these are the *same relation read at different points on its fidelity gradient and under different pressures* — and that the first move in every one of them is to make the target, the proxy, and the claimed fidelity between them explicit, rather than letting the proxy silently become the target.

structural_signature:
*the unobservable (or costly) target* — *the observable proxy put in its place* — *the standing-in relation (a designation by some agent for some use)* — *the fidelity (the strength of proxy–target coupling across the relevant regime)* — *the use-relativity and regime-relativity of that fidelity* — *the substitution risk that the proxy is acted on as if it were the target*

Proxy–target fidelity is present when each of the following holds:

- **A target (the thing of interest).** A latent, diffuse, slow, or expensive quantity that is what one actually cares about — ability, health, welfare, quality, performance, model competence — and which is not directly readable at the moment and cost one needs it.
- **A proxy (the stand-in).** An observable, measurable, or actionable quantity put in the target's place because it is cheap, fast, available, or legible: a test score, a biomarker, an index, a metric, a benchmark.
- **A standing-in relation (the designation).** Some agent has *appointed* the proxy to represent the target for a definite use — measurement, optimization, decision, inference, reward. The relation is not given by nature; it is a chosen substitution, and the choice can be apt or inapt.
- **A fidelity (the coupling strength).** The proxy and target co-move to some degree over the regime that matters; the substitution's entire value depends on this coupling being high enough for the use. Fidelity is the graded quantity the prime is named for, and it is never unity.
- **Use- and regime-relativity (the scope invariant).** Fidelity is not a property of the proxy alone but of the proxy-for-this-target-in-this-regime-for-this-use triple. A proxy faithful for description can be unfaithful for optimization; a proxy faithful in-sample can be unfaithful out of it; a proxy faithful for a population can be unfaithful for an individual.
- **The substitution risk (the diagnostic invariant).** Because the proxy is the only thing one can see or touch, there is a standing pressure to *treat the proxy as the target* — to optimize it, report it, reward it, and believe it *as if* fidelity were perfect. The prime's whole cautionary content lives here: the proxy is a map, and acting on the map as if it were the territory is the failure the relation warns against.

The components compose into a single relation — *an observable stands in, with imperfect and conditional fidelity, for an unobservable that some agent actually values* — and it is the pairing of *imperfect fidelity* with *the pressure to substitute* that generates the whole downstream family: honest description, lossy inference, surrogate-endpoint failure, and Goodhart-style erosion are all readings of that one pairing under different uses and pressures.

what_it_is_not:
- **Not measurement accuracy (see `measurement`).** `measurement` asks whether an instrument reads *its own* quantity faithfully — is the thermometer accurate about temperature, the scale about mass? Proxy–target fidelity asks the *prior and different* question of whether that quantity, even read perfectly, tracks the *other* quantity one actually cares about. A perfectly accurate thermometer is a poor proxy for thermal comfort, and a flawlessly precise test can be an invalid proxy for the ability it claims to measure. Measurement error is noise *in the proxy*; fidelity failure is a *gap between proxy and target* that survives even with a noiseless instrument.
- **Not Goodhart's law (see `goodharts_law`).** `goodharts_law` is a *specific dynamic*: when a proxy becomes a *target of optimization*, the optimization pressure degrades the proxy's fidelity, because effort flows to whatever raises the proxy whether or not it raises the target. Proxy–target fidelity is the *static genus* — the relation and its gradient — of which Goodhart is the most important *failure mode under optimization*. Fidelity can be low for many reasons that have nothing to do with optimization (a badly chosen surrogate, a regime shift, an inherently lossy stand-in), and a proxy can be optimized without Goodharting if fidelity happens to be robust to the pressure. The prime names the relation; Goodhart names what optimization does *to* it. (Deliberately not absorbed — see the coordination flag.)
- **Not proxy–target divergence (see `proxy_target_divergence`).** `proxy_target_divergence` names the *event or condition* of the proxy and target *coming apart* — the realized loss of fidelity. Proxy–target fidelity is the *relation whose strength can be high or low*; divergence is what it looks like when fidelity is (or becomes) low. The genus admits faithful proxies; divergence is one pole of the gradient.
- **Not construct validity (see `construct_validity`).** `construct_validity` is the *psychometric specialization* — does a test or instrument actually measure the theoretical construct it claims to? It is proxy–target fidelity *for the specific case where the target is a latent psychological construct and the proxy is a measurement instrument*, with its own machinery (convergent and discriminant validity, nomological nets). Proxy–target fidelity is the cross-domain genus of which construct validity is the measurement-science instance.
- **Not a surrogate endpoint as such.** A surrogate endpoint (a biomarker standing in for a clinical outcome) is one *instance* of the relation in medicine; proxy–target fidelity is the general relation, of which the surrogate-endpoint validity problem is the clinical reading.
- **Not the proxy being *wrong*.** A proxy is not faithful or unfaithful in the abstract — fidelity is relative to a target, a regime, and a use. The prime is not the claim that a proxy is bad; it is the *relation* whose adequacy must be assessed against a specified purpose. A proxy can be excellent for one use and useless for another with no change in the proxy itself.
- **Common misclassification.** Reading high in-sample or descriptive correlation as licensing optimization or out-of-regime inference — assuming that because the proxy tracked the target *where it was checked*, it will keep tracking it *where it is now being pushed or extrapolated*. Catch it by asking the three scope questions explicitly: faithful *for which target*, *in which regime*, *under which use (describe / infer / optimize)*? — because fidelity validated for description does not transfer to optimization, and fidelity validated in one regime does not transfer to another.

broad_use: Proxy–target fidelity, read as "how well does the stand-in track the thing it stands in for," recurs wherever something of interest is unobservable and something observable is put in its place. In **measurement and psychometrics** it is the core of validity theory: a test score is a proxy for a latent ability, and construct validity is precisely the question of whether the score tracks the construct rather than test-taking skill, coaching, or an irrelevant correlate — the whole apparatus of convergent and discriminant validation exists to estimate the fidelity. In **medicine**, surrogate endpoints are proxies for clinical outcomes: a drug that lowers a biomarker (blood pressure, viral load, tumor size, LDL cholesterol) is assumed to improve the outcome the biomarker stands in for (stroke, mortality, survival), and the surrogate-validity literature is a sustained reckoning with cases where the proxy moved but the outcome did not — drugs that improved the biomarker while harming patients.<!-- FACT-D69-551 -->[^fleming-demets-1996] In **machine learning**, almost every trained system optimizes a proxy: a loss function proxies for the true objective, a labeled-accuracy metric proxies for real-world competence, a reward model proxies for human preferences, an offline benchmark proxies for deployment performance — and reward misspecification, benchmark overfitting, and specification gaming are all fidelity failures between the optimized proxy and the intended target.<!-- FACT-D69-552 -->[^amodei-etal-2016] In **economics**, indicators are proxies: GDP proxies for welfare, unemployment rate for labor-market health, CPI for cost of living, credit scores for default risk — and the recurring critique (GDP omits leisure, inequality, environmental cost) is a fidelity argument about how far the indicator tracks the underlying good.<!-- FACT-D69-553 -->[^stiglitz-etal-2009] In **management and public administration**, key performance indicators proxy for performance: test scores for school quality, response times for service quality, arrest counts for policing effectiveness, citations for research impact — and Campbell's law and the entire literature on metric gaming describe the fidelity eroding under the pressure to score well.<!-- FACT-D69-554 -->[^campbell-1979] In **finance**, a credit rating proxies for default probability and a backtest proxies for live strategy performance.<!-- FACT-D69-555 -->[^bailey-etal-2014] Across all of these, the recurring structure is identical: an observable stands in for an unobservable, the substitution's value rests on a fidelity that is imperfect and conditional, and the recurring hazard is the proxy being acted on as if it simply *were* the target.

clarity:
Naming proxy–target fidelity separates two questions that practitioners chronically fuse: *is this number accurate?* and *does this number track what I actually care about?* The first is a measurement question, answerable by calibration and precision; the second is a fidelity question, answerable only by relating the proxy back to the target — and a proxy can ace the first while failing the second completely. A blood-pressure reading can be flawlessly accurate and a poor surrogate for cardiovascular mortality; a test can be perfectly reliable and an invalid measure of the ability it claims; a benchmark can be measured to four decimal places and bear little relation to deployed competence. The clarifying force of the prime is to convert "the metric went up" into "did the *target* go up, or only the *proxy*, and what is the fidelity between them in the regime we are now in?" — relocating the discussion from the number's precision to the number's *standing-in relation* with the latent thing.

The prime also clarifies a recurring confusion about *scope of warrant*. Practitioners routinely validate a proxy in one mode — usually description ("this index correlates with welfare across countries") — and then silently extend the warrant to a different mode — optimization ("so let us maximize the index") or out-of-regime inference ("so it will hold for this new policy") — where the fidelity is not established and often does not hold. Naming the relation forces the scope to be stated: fidelity is always *for a target, in a regime, under a use*, and the prime makes each of those three qualifiers a thing that must be specified rather than assumed. It thereby separates the legitimate use of a proxy (read it as a noisy, conditional, partial window onto the target) from the illegitimate one (treat it as the target itself), which is the line every downstream failure — Goodhart, surrogate collapse, KPI gaming — crosses.

manages_complexity:
Proxy–target fidelity is, at first, what *creates* tractability: the whole reason to use a proxy is that the target is unobservable or expensive, and substituting a cheap observable is the move that makes measurement, decision, and optimization possible at all. One cannot directly measure "scholastic aptitude," "cardiovascular health," "model competence," or "national welfare," so one substitutes a test, a biomarker, a benchmark, an index — and an intractable latent becomes a tracked number. The prime's complexity-management value is to name both halves of this bargain: the proxy *buys* tractability and *spends* fidelity, and the discipline is to keep the price visible. A practitioner who forgets the fidelity cost has not removed the complexity of the target; they have *hidden* it inside a number that no longer reliably points at the thing they care about.

Recognizing the relation directs the central management move: *bound and monitor the fidelity rather than assume it*. The mature disciplines do exactly this. Psychometrics does not just compute a test score; it estimates the score's validity against external criteria and reports the construct it does and does not capture. Drug regulators do not accept a surrogate endpoint on faith; they require the surrogate to be *validated* against hard outcomes before it can carry an approval, and they downgrade surrogates that have failed. Good metric design pairs every optimized proxy with a *guardrail* — a second measure of the target that the optimizer is not allowed to game — precisely to detect fidelity erosion. ML practitioners hold out distributions and track multiple metrics so that a proxy's collapse against the true objective becomes visible rather than silent. The unifying complexity move is the same across substrates: a proxy is a *compression* of the target, the compression is lossy, and managing the system means continuously checking that the loss has not grown large enough — through regime shift, optimization pressure, or simple mis-choice — to make the cheap observable a misleading guide to the expensive thing it stands in for.

abstract_reasoning: The proxy–target-fidelity pattern licenses several substrate-independent moves. *Always name the target behind the metric*: whenever a number is being read, optimized, or rewarded, ask what unobservable it is standing in for, because the number's whole meaning is parasitic on that relation, and a metric whose target cannot be named is a metric that cannot be validated. *Estimate the fidelity, do not assume it*: treat the proxy–target coupling as a quantity to be measured against external criteria (convergent validation, surrogate validation, guardrail metrics) rather than a property granted by the proxy's mere existence. *Specify the scope triple*: fidelity holds *for a target, in a regime, under a use*, so before extending a proxy from where it was validated, check whether the target, the regime, or the use has changed — fidelity validated for cross-sectional description does not transfer to optimization or to a new population. *Anticipate erosion under pressure*: when a proxy is turned into a target of optimization or reward, expect its fidelity to *fall* (the Goodhart move), because effort flows to whatever raises the proxy whether or not it raises the target — so optimization warrants a guardrail that the static-description use does not. *Distinguish lossy-but-honest from gamed*: a proxy can have low fidelity because it is an inherently partial window (lossy compression) or because an agent is exploiting the gap (gaming), and the two call for different fixes — better proxy versus incentive redesign. And *read the proxy as a window, never the room*: the disciplined stance is to treat every proxy as a noisy, conditional, partial view of a latent target, drawing inferences with the fidelity explicitly in the loop, and refusing the slide from "the proxy moved" to "the target moved" that every fidelity failure depends on.

knowledge_transfer: Because proxy–target fidelity is the bare relation of an observable standing in for a valued unobservable, a technique built around it in one field transfers to any other by re-identifying the target, the proxy, and the fidelity claim between them. The *validation discipline* of psychometrics — never trust a score as a measure of a construct until you have related it to external criteria and shown it captures the intended construct and not its correlates — transfers directly to medicine (a biomarker must be validated against hard clinical outcomes before it can stand in for them), to machine learning (a benchmark or reward model must be checked against real-world competence before it is trusted as the objective), and to public administration (a KPI must be related to the performance it claims before it is used to allocate or reward). The *surrogate-endpoint caution* of medicine — a proxy that moves the right way can coincide with the target moving the *wrong* way, so a treatment effect on the surrogate does not establish an effect on the outcome — transfers as a general warning against inferring target gains from proxy gains: a model that scores higher on a benchmark may be worse in deployment, a school whose test scores rose may be educating worse, a strategy whose backtest improved may lose money live. The *guardrail-metric* design pattern — pair every optimized proxy with an unoptimized measure of the target to detect erosion — transfers from ML reward design to organizational performance management to economic-indicator dashboards, because all of them face the identical structural risk that optimizing the stand-in degrades its fidelity to the thing. The *scope-of-warrant* discipline — fidelity is for-this-target-in-this-regime-under-this-use and does not extend for free — transfers across every field that validates a proxy in one setting and is tempted to apply it in another. In every transfer the practitioner runs the same diagnosis: name the target, name the proxy, ask how the fidelity between them was established and over what regime and for what use, ask whether the current use (especially optimization) is one the fidelity was validated under, and pair the proxy with a guardrail wherever pressure on it is expected — and the transfer is secure because none of these steps names the substrate: a psychometrician validating a test, a regulator vetting a surrogate endpoint, an ML engineer auditing a reward model, and an administrator designing a performance metric are reasoning about the same relation, distinguished only by what is latent and what stands in for it.

formal_abstract:
The surrogate-endpoint validity problem is proxy–target fidelity in a clean inferential register. Let the *target* be a clinical outcome — say, all-cause mortality or stroke incidence — which is slow, expensive, and ethically costly to measure (one must wait, sometimes years, and count hard events). Let the *proxy* be a biomarker — blood pressure, LDL cholesterol, viral load, tumor shrinkage — which is fast and cheap to read. The *standing-in relation* is the regulatory and clinical decision to let a treatment's effect on the biomarker stand in for its effect on the outcome, so that a trial can read out in months on a surrogate rather than years on mortality. The *fidelity* is the degree to which the treatment's effect on the surrogate predicts its effect on the outcome — and the formal subtlety the prime names is that a *correlation* between surrogate and outcome in untreated populations is *not* sufficient for fidelity: what is required is that the *treatment effect* on the surrogate carry the *treatment effect* on the outcome, which can fail even when surrogate and outcome are tightly correlated at baseline (the Prentice criterion makes this precise).<!-- FACT-D69-556 -->[^prentice-1989] The *use- and regime-relativity* is sharp: a surrogate validated for one drug class can be invalid for another that moves the biomarker through a different mechanism. And the *substitution risk* is realized in documented cases where a drug improved the surrogate (suppressed arrhythmias, raised HDL, lowered glucose) while *increasing* mortality — the proxy moved the intended way and the target moved the opposite way, the exact catastrophe of treating a stand-in as the thing.<!-- FACT-D69-557 -->[^echt-etal-1991] The structural payoff is that the entire surrogate apparatus is one reading of the prime: an observable substituted for an unobservable, with a fidelity that must be *established for the specific intervention and regime* and never assumed from mere correlation.

**Mapped back:** The surrogate-endpoint case instantiates every component — an unobservable target (clinical outcome), an observable proxy (biomarker), the designation that lets the proxy stand in (regulatory acceptance of the surrogate), the fidelity (treatment effect on surrogate predicting treatment effect on outcome), its regime-relativity (mechanism- and class-specific validity), and the substitution risk realized as a drug that helped the proxy and harmed the patient — and shows the prime's core pairing: imperfect, conditional fidelity plus the pressure to treat the proxy as the target.

applied_industry:
A machine-learning team optimizing a recommendation system against click-through rate runs the identical structure in a computational substrate, with no medical vocabulary. The *target* is something latent and genuinely valued — long-run user satisfaction, retention, the user's own sense that time on the product was well spent — which is diffuse, slow to measure, and not available at training time. The *proxy* is click-through rate (or watch time, or engagement), an observable that is abundant, immediate, and trivially loggable, and is therefore made the optimization objective. The *standing-in relation* is the team's decision to treat CTR as the objective *because* the true target is unmeasurable in the training loop — a substitution made for tractability. The *fidelity* is the degree to which raising CTR raises satisfaction, and it is exactly the use-relative, regime-relative quantity the prime names: across a broad population in a stable product, CTR may correlate decently with satisfaction (the descriptive regime), but *under optimization pressure* the fidelity erodes — the system learns to raise clicks through clickbait, outrage, and compulsive-but-unsatisfying engagement, raising the proxy while *lowering* the target.<!-- FACT-D69-558 -->[^thorburn-stray-bengani-2022] This is the Goodhart move occurring *inside* the fidelity relation: the proxy was an acceptable window onto the target until it was turned into the target of optimization, at which point effort flowed to whatever moved CTR regardless of satisfaction. The prime's management response is the industry's: pair the optimized proxy with *guardrail metrics* the optimizer is not allowed to game (long-horizon retention, survey-based satisfaction, complaint rates), hold out distributions to detect collapse, and treat a rising proxy with a flat or falling guardrail as evidence of fidelity erosion rather than success.<!-- FACT-D69-559 -->[^kohavi-tang-xu-2020] The same structure governs a reward model standing in for human preferences (reward hacking), a benchmark standing in for deployed competence (benchmark overfitting), and a labeled-accuracy metric standing in for real-world performance under distribution shift.<!-- FACT-D69-560 -->[^amodei-etal-2016]

**Mapped back:** The CTR-optimization case runs the prime end-to-end — a latent target (satisfaction), an observable proxy (clicks), the designation of the proxy as objective for tractability, the fidelity that holds for description but erodes under optimization, and the substitution risk realized as a system that raised the proxy while harming the target — and demonstrates the transfer: a regulator vetting a surrogate biomarker and an ML team auditing an engagement metric are reasoning about the same standing-in relation, distinguished only by what is latent and what stands in for it.