Conservation Event

one_liner: A deliberate, bounded intervention that arrests or reverses a system's decay away from a reference state judged worth preserving.

core_idea:
A conservation event is a *deliberate, bounded intervention that arrests, reverses, or slows the decay of a system away from a reference state worth preserving*. It has three structural parts that must all be present: a *reference state* — a condition the actor judges valuable enough to protect, such as a surface before its deterioration, a hydrology before its drainage, an interface contract before its rot, a function before an injury; a *decay trajectory* — an identifiable, measurable process moving the system away from that state, such as oxidation, invasive spread, code drift, or atrophy; and an *intervention* bounded in time and scope, with explicit decisions about what to preserve, what to restore toward, and what to leave.

The distinctive structural force is the *backward pull toward the reference state*. A conservation event is not generic change, not mere upkeep, and not a transformation toward something new — it is oriented by an earlier state that has authority over the intervention's design. The reference may be reconstructed from documentation, inferred from a baseline, or explicitly chosen, but its presence is what makes the event conservation rather than maintenance, redesign, or restoration-as-novelty.

Strip any of the three and the pattern dissolves: no reference state gives generic intervention; no decay trajectory gives unnecessary intervention; no bounded action gives mere intention. With all three present, the same diagnostic shape recurs across substrates as different as oil paintings, ecosystems, codebases, and human bodies. The pattern is structurally a backward-oriented, bounded intervention — but it is heavily framed, because the reference state imports a normative judgment about what is *worth* preserving, and the intervention presupposes an agent who makes that judgment. That evaluative load is intrinsic to the prime rather than incidental: the reference-state authority is what does the structural work, and that authority is exercised by someone deciding what to honor.

structural_signature:
*the reference state worth preserving* — *the decay trajectory moving the system away from it* — *the bounded intervention* — *the backward pull of the reference over the intervention's design* — *the preserve/restore/leave decisions traced to the reference* — *the reference-state authority that resolves micro-decisions*

The pattern is present when each of the following holds:

- **A reference state.** An earlier condition is judged valuable enough to protect — a surface before deterioration, a hydrology before drainage, an interface contract before rot, a function before injury. It may be documented, inferred from a baseline, or explicitly chosen, but it carries authority over the intervention.
- **A decay trajectory.** An identifiable, measurable process is moving the system away from the reference — oxidation, invasive spread, code drift, atrophy. No decay trajectory means the intervention is busywork.
- **A bounded intervention.** A deliberate action, bounded in time and scope, arrests, reverses, or slows the decay. An unbounded ongoing effort is continuous maintenance, not a discrete event.
- **The backward-pull invariant.** The intervention is oriented by the earlier state rather than toward something new; the reference, not a novel target, governs the design. This is what distinguishes conservation from maintenance, redesign, and restoration-as-novelty.
- **The traceability of decisions.** Each preserve / restore-toward / leave-alone decision is traceable back to the reference; the reference functions as an authority that settles the otherwise-unbounded sequence of micro-decisions a decaying system presents.

Each missing role dissolves the pattern: no reference gives generic intervention or redesign-disguised-as-conservation, no decay trajectory gives busywork, no bounded action gives mere intention. The reference-state role is irreducibly normative — it imports a judgment about what is *worth* preserving and presupposes an agent who makes it — which is intrinsic to the prime rather than incidental.

what_it_is_not:
- **Not `conservation_laws`.** A conservation law is a physical invariance — a quantity neither created nor destroyed by any process. A conservation event is a *deliberate human intervention* against decay, oriented by a normative judgment about what is worth preserving. The lexical overlap hides opposite kinds: one is a law of nature, the other a chosen act.
- **Not `maintenance`.** Maintenance is continuous, low-intensity prevention of decay; a conservation event is a *bounded, project-scale* intervention typically triggered by accumulated damage. Maintenance prevents conservation events, and its absence makes them the only option.
- **Not generic `transformation`.** Transformation moves a system toward something new; the conservation event is governed by a *backward pull* toward an earlier reference state. The orienting target is the past, not a novel form.
- **Not `resilience`.** Resilience is the capacity to absorb perturbation without losing function; a conservation event is the active intervention taken *when resilience has been exceeded*. One is a standing property; the other is a discrete act.
- **Not `reversibility_and_irreversibility` as such.** Reversibility describes a process property; a conservation event deliberately *builds reversibility in* as a design constraint. The prime uses reversibility; it is not identical to it.
- **Not `controlled_reentry` or `fading`.** Controlled reentry manages a return into circulation; fading is unmanaged loss of presence. The conservation event is neither return nor loss — it is an arrest of loss oriented by a reference the actor judges worth honoring.
- **Common misclassification.** Calling a redesign a conservation event. The catch is the reference-authenticity test: if the intervention restores toward a state that never actually existed — brighter than original, better than premorbid — the backward pull has become a forward push, and this is enhancement or redesign wearing conservation's name.

broad_use: The bounded-intervention-oriented-by-a-reference-state pattern recurs across substrates that look unrelated until the structural shape is named. In art and material conservation it is cleaning grime, stabilizing corrosion, or removing yellowed varnish — each bounded, each oriented by a documented or inferred earlier surface, each making explicit decisions about reversibility and what not to touch.<!-- FACT-D60-376 -->[^appelbaum-2007] In ecological restoration it is replanting natives after invasion or restoring a stream channel after channelization, with the pre-disturbance ecosystem as the reference.<!-- FACT-D60-377 -->[^ser-2004] In medical rehabilitation it is therapy aimed at restoring premorbid function, with the patient's earlier baseline as the reference.<!-- FACT-D60-378 -->[^delisa-2019] In software it is anti-rot refactoring — restoring a violated invariant, paying down accumulated debt — with the earlier clean-architecture commitment as the reference and code-rot as the decay trajectory. In heritage building preservation it is re-pointing mortar and replacing rotted timbers in kind, with a rule against introducing modern materials except where safety requires.<!-- FACT-D60-379 -->[^feilden-2003] In language revitalization it is immersion and documentation oriented by pre-decline speech communities. In digital preservation it is format migration and fixity audits oriented by the requirement that the object remain readable in its reference content state.<!-- FACT-D60-380 -->[^oais-iso-14721-2012] And in law it is the equitable remedy of restoring the status quo ante, a bounded action oriented by an earlier rights configuration.<!-- FACT-D60-381 -->[^restatement-third-restitution-2011] In each, the reference state, the decay trajectory, and the bounded intervention are all present.

clarity:
The diagnostic is operational. Given a candidate intervention, ask what reference state authorizes the design, what decay trajectory is being arrested or reversed, and what is the intervention's bounded scope and what is explicitly left alone. Yes to all three and the event is a conservation event. The negative-space cases sharpen the boundary: an intervention with no reference state is *renovation* or *redesign*; an intervention with no decay trajectory is *busywork*; an unbounded ongoing restoration is closer to *continuous maintenance*.

The clarifying force is that the prime separates conservation from a cluster of neighbors it is routinely fused with. Maintenance is continuous, low-intensity prevention of decay, while a conservation event is a bounded, project-scale intervention typically triggered by accumulated damage — maintenance prevents conservation events, and its absence makes them the only option. Restoration in the broad sense can mean a return to a prior state without the documentation, boundedness, and reference-state discipline that distinguish conservation from speculative reconstruction. Repair fixes a specific fault, while conservation can include repair but is also concerned with stabilizing against further decay and documenting what was done. Resilience is the capacity to absorb perturbation without losing function, while conservation is the active intervention taken when resilience has been exceeded. And reversibility describes a process property, while a conservation event deliberately builds reversibility in as a design constraint. By placing conservation precisely against these, the prime makes the reference-state authority the explicit center: every decision the intervention makes should be traceable back to a documented or inferred earlier configuration it is honoring.

manages_complexity:
A conservation event compresses what could be an indefinite "do something about this decaying thing" into a defined deliverable — a treated object, a stabilized site, a refactored module, a rehabilitated function. The compression depends on the reference state being articulated well enough to authorize specific decisions: which discolorations are original patina and which are later contamination, which species are native to the period being restored, which test failures are regressions versus desired behavior. Without the reference, every micro-decision is contestable; with it, decisions cascade from the documented baseline.

The deeper complexity-management insight is that the reference state functions as an *authority that resolves micro-decisions*. A decaying system presents an unbounded sequence of small judgment calls — to clean or not, to replace or not, to revert or not — and without an articulated reference each is argued on its own, slowly and contestably. The reference state converts that open sequence into a chain of derivations: each decision is settled by asking what the documented or inferred earlier configuration warrants, so the cost of deciding is bounded by the cost of consulting the reference rather than by the cost of re-litigating every choice. This is why the most mature conservation traditions invest so heavily in characterizing the reference — through documentation, imaging, and analysis — before intervening: the better the reference is articulated, the more decisions it can settle, and the more the intervention becomes a bounded deliverable rather than an indefinite struggle against decay.

abstract_reasoning:
Recognizing the pattern lets a reasoner see structurally equivalent failures across domains. A conservator who restores an object to a state that never existed, a restoration ecologist who introduces a species not present at the historical baseline, a refactor that modernizes past the original design intent, and a rehabilitation program that pushes a patient past their pre-injury function are all the same failure: the *reference state was mis-specified or silently moved*, so the intervention is no longer conservation but redesign under the name of conservation. Conversely, the pattern helps spot under-application: a codebase that keeps decaying or a restored site that keeps reverting often resolves to absent or weak conservation events — interventions never bounded as discrete projects with documented reference states, so decay accumulates faster than scattered upkeep can arrest it.

The reasoning is portable because it is stated over the three roles, none of which mentions a substrate. Whatever the system, one asks what reference state authorizes the design, what decay trajectory is being arrested, and what the intervention's bounded scope is — and from the answers predicts the pathology: a mis-specified or drifting reference yields redesign-disguised-as-conservation, an absent decay trajectory yields busywork, and an unbounded intervention yields the slide into continuous maintenance. A reasoner who has internalized the prime diagnoses any preservation effort by these questions and predicts these failures, which is what makes the prime a reasoning instrument. The reasoning is genuine but normatively loaded: the reference-state role carries an irreducible judgment about what is worth preserving, so the analyst cannot apply the prime without also taking a position on that value, which is precisely what distinguishes conservation from value-neutral structural patterns.

knowledge_transfer:
A reader who learns the pattern in one domain — an art conservator who internalizes minimal intervention, full documentation, and reversibility — recognizes it in unfamiliar ones — a software engineer reading about anti-rot refactoring, a wetlands manager planning a restoration. The shared discipline is the *reference-state authority*: any decision the intervention makes should be traceable back to a documented or inferred earlier configuration the intervention is honoring.

What makes the transfer genuine is that the three roles map cleanly across substrates that share no vocabulary. A yellowed painting treated through a conservation event — its original surface characterized as the reference, the darkening varnish documented as the decay trajectory, the intervention bounded to varnish removal and reversible inpainting with explicit rules against retouching original paint — has its roles mirror exactly onto an anti-rot software refactor and a post-injury rehabilitation, even though the substrates are a painting, a codebase, and a body. A reasoner who has internalized the prime reads a new preservation effort by locating the three roles and inherits the full discipline: characterize the reference state before intervening, identify the decay trajectory, bound the intervention in time and scope, document each decision against the reference, and build in reversibility where possible. The pattern is heavily framed — the reference state imports a normative judgment about what is worth preserving, and the intervention presupposes an agent who makes it — so the transfer is anchored in human-practice substrates where such judgments are made. But within that range it reaches broadly across art, ecology, medicine, software, heritage, language, archives, and law, and the prime's distinctive value is that it lets a practitioner who has mastered conservation discipline in one domain import both the design moves and the failure forecasts into another, recognizing that art restoration, ecological restoration, software anti-rot, and physical rehabilitation are all the same backward-oriented, bounded, reference-authorized intervention against decay.

formal_abstract:
Art and material conservation supplies the pattern in its most rigorous, methodologically explicit form — the domain where the reference-state authority is characterized with instrumentation before a single decision is made. Take the treatment of a yellowed oil painting. The reference state is the painting's original surface, reconstructed from cross-section microscopy, UV and infrared imaging, and pigment analysis that distinguish original paint layers from later varnish and overpaint.<!-- FACT-D60-382 -->[^appelbaum-2007] The decay trajectory is identified and documented: the natural resin varnish has oxidized and yellowed, shifting the color balance and obscuring the artist's intended tonal relationships.<!-- FACT-D60-383 -->[^appelbaum-2007] The intervention is bounded in time and scope — varnish removal with a solvent calibrated to dissolve the degraded varnish without touching the original paint, followed by reversible inpainting only in areas of confirmed loss.<!-- FACT-D60-384 -->[^appelbaum-2007] The backward-pull invariant governs the whole design: every choice is oriented by the characterized earlier surface, not by a novel aesthetic target. And the reference-state authority resolves the otherwise-unbounded sequence of micro-decisions — which discoloration is original patina worth keeping versus later contamination to remove, which craquelure is structural versus cosmetic — by referring each to the documented baseline. The traceability commitment is concrete: a conservation report records each decision against the evidence that warranted it, so the treatment is auditable and partly reversible.<!-- FACT-D60-385 -->[^aic-ethics] The predicted failure is sharp here — a conservator who "restores" the painting to a brightness it never possessed has silently moved the reference, converting conservation into redesign under conservation's name, the exact pathology the prime names.

**Mapped back:** The varnish-removal treatment instantiates all three roles — characterized reference surface, documented oxidation trajectory, bounded reversible intervention — with the reference-state authority settling every micro-decision and a moved reference reproducing the redesign-disguised-as-conservation failure.

applied_industry:
Two practitioner cases run the same backward-oriented, reference-authorized intervention on substrates a painting shares nothing with. In software, an anti-rot refactor targets a module whose architecture has decayed. The reference state is the earlier clean-architecture commitment — a documented module boundary, an interface contract, a layering rule that the code once honored.<!-- FACT-D60-386 -->[^fowler-2018] The decay trajectory is code rot: accumulated shortcuts, leaked dependencies, and violated invariants that drifted the module away from its design. The bounded intervention is a scoped refactor that restores the violated invariant and pays down specific debt, explicitly *not* a rewrite toward a new design — the backward pull is what distinguishes it from redesign. The reference-state authority (the original architecture doc, the test suite encoding the contract) settles micro-decisions: which test failure is a regression to fix versus a desired behavior change to keep. In medical rehabilitation, the reference state is the patient's premorbid baseline — range of motion, strength, gait measured or inferred from history.<!-- FACT-D60-387 -->[^delisa-2019] The decay trajectory is the post-injury deficit. The bounded intervention is a therapy program oriented by that baseline, and the predicted over-application failure is precise: a program that pushes a patient *past* premorbid function has moved the reference and is no longer conservation but enhancement under rehabilitation's name.<!-- FACT-D60-388 -->[^ama-ethics-restoration-enhancement-2010] Both inherit the prime's discipline — characterize the reference before intervening, bound the work, trace each decision to the baseline, build in reversibility — and both carry the prime's irreducible normative load, since the reference state embeds a judgment about what earlier configuration is *worth* restoring.

**Mapped back:** The anti-rot refactor and the rehabilitation program span software and medicine; in each, an earlier reference state authorizes a bounded intervention against an identifiable decay trajectory, and a silently moved reference reproduces the redesign-or-enhancement failure the prime predicts.


Conservation Laws

type: prime

one_liner: Quantities remain constant.

status: draft

origin_domain: physics

core_idea:
A conservation law is a statement that a specifiable quantity
associated with a system remains constant in time whenever the
system is isolated from external flows of that quantity — any
apparent change must therefore be accounted for by exchange
across the system boundary, transformation into other forms,
or accumulation in reservoirs. The essential commitment is
that certain quantities have a bookkeeping character: they
cannot arise or disappear within a closed region, so any
change in the amount present entails an identifiable flow or
transformation elsewhere. Every conservation law specifies (1)
the conserved quantity, (2) the system boundary across which
flows are tracked, (3) the transformations among related
quantities (energy into different forms, matter into different
species) that remain bookkeeping-consistent, and (4) the
symmetry or structural reason underlying the conservation.
The deep theoretical anchoring of conservation laws comes from
Noether's theorem <!-- FACT-D10-032 -->[^noether-1918], which establishes that every
continuous symmetry of a dynamical system's Lagrangian generates
a corresponding conservation law; this unifies the classical
intuitions with quantum mechanics and relativistic field theory.

structural_signature:
A relationship functions as a conservation law when each of
the following holds:

- **Conserved quantity.** A specific measurable
  quantity — energy, momentum, mass, charge,
  probability, angular momentum, lepton number —
  is defined and can be summed across the system.
- **Closed-system invariance.** When the system is
  isolated from external fluxes of this quantity,
  the total remains constant over time. Newton's
  third law <!-- FACT-D10-020 -->[^newton-1687] establishes action-reaction
  pairs that underpin momentum conservation in
  mechanical systems.
- **Flux-balance equation.** Any change in the
  total equals the net flux across the boundary
  (plus net sources/sinks if the conservation is
  conditional). The conservation law is formally
  a continuity equation: ∂ρ/∂t + ∇·j = 0 or its
  discrete analog.
- **Underlying symmetry (where applicable).**
  Continuous symmetries of the system's dynamics
  correspond to conservation laws via Noether's
  theorem — translation in time to energy,
  translation in space to momentum, rotation to
  angular momentum. Leibniz's vis viva principle
  <!-- FACT-D10-021 -->[^leibniz-1686] (kinetic energy conservation in elastic
  collisions) was the precursor to modern energy
  conservation.
- **Form-transformation allowance.** The
  conservation typically permits transformation
  among forms: kinetic to potential energy,
  matter between chemical species while
  conserving atoms, probability redistributing
  between states while summing to 1.
- **Domain of validity.** The conservation holds
  exactly, approximately, or under specific
  conditions (energy exactly in classical
  mechanics, momentum in the absence of external
  forces, mass approximately in non-relativistic
  regimes, etc.). Helmholtz's formal statement
  of energy conservation <!-- FACT-D10-022 -->[^helmholtz-1847] in 1847 unified
  heat, mechanical work, and chemical energy.

what_it_is_not:
- **Not steady state.** A steady state has
  constant quantities because inflows balance
  outflows; conservation applies even when the
  system is not steady — it asserts the
  bookkeeping identity, not that the total is
  unchanging under flux. A lake's volume in
  steady state reflects balance; conservation of
  water mass holds regardless.
- **Not equilibrium.** Equilibrium is a state in
  which net forces or driving gradients vanish;
  conservation is a dynamical constraint that
  applies whether or not the system is in
  equilibrium.
- **Not a mere empirical regularity.**
  Conservation laws in physics reflect
  fundamental structural features (symmetries);
  empirical regularities without such grounding
  can fail when conditions change. "Energy is
  conserved in every observed process" is
  different from "species counts are conserved
  as long as we have not observed extinction."
  Joule's mechanical-equivalent-of-heat experiments
  <!-- FACT-D10-023 -->[^joule-1843] (1843–1850) provided empirical demonstration
  that energy converts between mechanical and
  thermal forms with constant total quantity
  <!-- FACT-D10-023 -->[^joule-1843].
- **Not invariance in the broader sense.**
  Invariance is constancy under transformations;
  conservation is constancy over time of a
  specific quantity. The two are linked
  (Noether's theorem) but distinct: a quantity
  can be invariant under rotation (angular
  momentum) and conserved in time (in
  rotationally symmetric systems). See
  `invariance`.
- **Not exact in all regimes.** Conservation
  laws have domains: classical mass
  conservation fails in relativistic regimes
  (mass-energy conservation applies instead);
  parity conservation fails in weak
  interactions. Claims of universal
  conservation require regime specification.
  Wu's 1957 parity-violation experiment
  <!-- FACT-D10-026 -->[^wu-1957] showed that parity is NOT conserved
  in weak interactions, revealing conservation-law
  breaking under specific conditions.
- **Common misclassification.** Invoking
  conservation arguments without a clear
  boundary definition or without checking that
  the system is genuinely closed to the
  relevant flux; asserting conservation for a
  quantity that merely appears stable under
  observed conditions; conflating conservation
  with balance (steady-state) or with
  equilibrium.

broad_use:
- **Physics**
    - Conservation of energy (first law of
      thermodynamics); momentum and angular
      momentum (Newton's laws, Noether's theorem);
      electric charge; baryon, lepton, and
      strangeness numbers; probability (unitarity
      in quantum mechanics). Mayer's independent
      statement of energy conservation
      <!-- FACT-D10-024 -->[^mayer-1842] (1842) preceded Helmholtz and
      established mechanical-thermal equivalence.
- **Chemistry**
    - Conservation of mass in chemical reactions;
      atom balance; oxidation state balance;
      molar conservation.
- **Ecology and Earth systems**
    - Conservation of matter in biogeochemical
      cycles (carbon, nitrogen, phosphorus,
      water); conservation of energy in
      ecosystem trophic transfers.
- **Engineering**
    - Conservation of mass, momentum, energy in
      fluid flow (Navier-Stokes closures);
      conservation-based control-volume analysis;
      charge conservation in circuits (Kirchhoff
      laws). Lagrange's generalized coordinates
      <!-- FACT-D10-025 -->[^lagrange-1788] (1788) and cyclic-coordinate
      conservation laws showed how symmetries
      encode directly into equations of motion
      <!-- FACT-D10-025 -->[^lagrange-1788].
- **Information theory (with caveats)**
    - Probability conservation; data-processing
      inequality as a conservation-like
      constraint on information.
- **Economics (metaphorical use, with caution)**
    - Accounting identities (GDP = C + I + G + NX
      as a balance constraint); balance-of-
      payments identities.

clarity:
Conservation laws clarify by separating two
questions that informal accounts of "stability"
merge: is the total amount constant, or is change
entering/leaving the system? The clarifying move
turns observation into bookkeeping: any change in
the quantity within the boundary must appear
somewhere — across the boundary, or as
transformation into a related form within the
bookkeeping scheme. A claim like "energy was
saved" resolves into "within system S over time
interval Δt, the total energy changed by ΔE; this
equals the net work done across the boundary plus
heat transferred; within S, energy was
redistributed among kinetic, potential, thermal,
and chemical forms; no energy appeared ex nihilo
or vanished." The clarifying force is to refuse
magic and demand a fully balanced ledger.

Einstein's mass-energy equivalence <!-- FACT-D10-027 -->[^einstein-1905] (E=mc²,
1905) unified mass and energy conservation,
showing that mass and energy are not separately
conserved but form a single conserved quantity.

manages_complexity:
- Reduces analysis to bookkeeping: instead of
  tracking detailed dynamics, one can often
  solve by applying conservation to the whole
  system, ignoring interior complexity.
- Supports global constraint reasoning:
  whatever happens inside a closed box, the
  totals in and out constrain the outcome —
  a huge simplification for processes whose
  details are inaccessible.
- Enables regime transfer: conservation-based
  models compose across scales (molecular to
  bulk, local to global) because the
  bookkeeping is scale-agnostic.
- Provides sanity checks: any candidate
  process or model that violates a
  well-established conservation law is suspect
  — a quick filter against errors and
  pseudoscience. Hamilton's Hamiltonian
  formalism <!-- FACT-D10-030 -->[^hamilton-1834] (1834) made constants of
  motion via Poisson-bracket structure central
  to analytical mechanics <!-- FACT-D10-030 -->[^hamilton-1834].
- Guides boundary choice: choosing the system
  boundary to make the quantity exactly
  conserved (no external flux) often produces
  the most tractable analysis.

abstract_reasoning:
Conservation laws train a reasoner to ask:

- What is the conserved quantity, and what is
  the boundary across which I track its flux?
- Under what conditions does conservation
  hold exactly, approximately, or not at
  all?
- Is there an underlying symmetry that
  explains why this quantity is conserved?
  (Noether's theorem as a guide.)
- If the system is not closed, what are the
  fluxes across the boundary and the sources
  and sinks within it?
- Can I reduce a complex problem to a
  conservation-based constraint without
  tracking interior dynamics?
- Is the conservation claim robust — does it
  follow from structure — or a surface
  empirical regularity that might fail?

knowledge_transfer:
Role mappings across domains:

- **Conserved quantity** ↔ energy / momentum /
  mass / charge / probability / matter /
  angular momentum / number of entities
- **System boundary** ↔ control volume / closed
  region / accounting scope / thermodynamic
  system / reservoir boundary
- **Flux across boundary** ↔ heat transfer /
  momentum transport / mass transport /
  migration / trade flow
- **Internal transformation** ↔ energy form
  conversion / chemical reaction / species
  interconversion / asset reallocation
- **Underlying symmetry** ↔ translation
  symmetry / rotation symmetry / gauge
  symmetry / dynamical invariance
- **Continuity equation** ↔ bookkeeping
  identity / balance equation / flow
  equation / budget constraint
- **Domain of validity** ↔ regime limit /
  scale range / applicable conditions /
  closure assumption

A fluid dynamicist applying continuity to a
flow pipe, a biogeochemist balancing carbon
between reservoirs, and an accountant
reconciling a ledger are all doing the same
structural work: identify the conserved
quantity, draw the boundary, account for flows
in and out, track internal transformations, and
verify the balance closes. The same diagnostic
— "what is conserved, across what boundary,
under what transformations?" — applies across
their contexts, with the same failure modes
(missing a flux, wrong boundary, regime
violation) in each.

prose:
_(Pass B — pending; see `tracker/v2_upgrade.md`.)_

### Catalog cross-references (v1, batches 02–29)

Solution archetypes that reference this prime (per `solution_archetypes/_catalog/catalog_v1_batches_02_29.yaml`):

**As source prime (1):** `conservation_accounting`

notes: _(placeholder for later refinement)_


Consistency

slug: consistency

one_liner: A set of commitments cannot jointly derive a contradiction.

origin_domain: mathematics

core_idea:
A system is consistent when the rules, claims, or commitments it carries cannot jointly derive a contradiction — when there is no pair of statements of the form "$p$ and not-$p$" reachable from it by its own rules of combination. The structural commitment is exactly that joint non-derivability of contradiction, and it is a property not of any single statement but of a *set* of commitments together with a rule for combining them. Inconsistency is not merely an aesthetic blemish: in any system whose combination rule supports the principle that a contradiction entails everything, an inconsistent set derives all statements indiscriminately and therefore constrains nothing<!-- FACT-D60-401 -->[^priest-2006] — it has lost the very function a system of commitments is meant to perform. This is why consistency is the minimal coherence condition that any commitment-bearing system must satisfy before its content can do any work at all.

The property is defined without reference to what the statements are about, which is what lets it travel. What is required is a *set of commitments* taken as binding within some scope, a *combination rule* for jointly evaluating them (logical inference, query evaluation, judicial interpretation, narrative reading), and a *joint-satisfiability test* asking whether any assignment, world, or interpretation makes all of them hold at once. When the answer is no, the system has a defect, and the defect localizes to a *minimal conflicting subset* — the smallest collection of commitments whose joint unsatisfiability already produces the contradiction. Crucially, consistency is distinct from truth: a set can be perfectly consistent about a fiction, and a true claim can sit in an inconsistent set. Consistency asks only whether the commitments are jointly possible, not whether they are jointly correct, and keeping those two questions separate is part of what the prime contributes.

structural_signature:
*the set of commitments held as binding* — *the combination rule for evaluating them jointly* — *the joint-satisfiability test* — *the no-contradiction invariant* — *the minimal conflicting subset (locus of any defect)* — *the consistency-versus-truth separation*

A system exhibits the consistency property when each of the following holds:

- **A set of commitments.** Some collection of claims, rules, or constraints is taken as binding within a scope; consistency is a property of the set together, never of a single member.
- **A combination rule.** There is a way of jointly evaluating the commitments — logical inference, query evaluation, judicial interpretation, narrative reading — that determines what follows from holding them together.
- **A joint-satisfiability test.** One can ask whether any assignment, world, or interpretation makes all commitments hold at once; "yes" is consistency, "no" is a defect.
- **The no-contradiction invariant.** The defining condition is that no statement and its negation are jointly derivable; where the combination rule supports explosion, an inconsistent set derives everything and so constrains nothing.<!-- FACT-D60-402 -->[^priest-2006]
- **A minimal conflicting subset.** When the test fails, the defect localizes to a smallest collection of commitments already jointly unsatisfiable; the locus is typically tiny relative to the whole, which is what makes repair local.
- **Consistency/truth separation.** Joint possibility is distinct from joint correctness: a set can be consistent about a fiction, and a true claim can sit in an inconsistent set.

These compose into a coherence diagnostic: take a set of commitments under a combination rule, test joint satisfiability, and — if it fails — shrink to the minimal conflicting subset and repair there, holding the question of possibility separate from the question of truth.

what_it_is_not:
- **Not `constraint`.** A constraint is a single commitment that restricts admissible states; consistency is the property of a *whole set* of constraints — whether they can be jointly satisfied at all. One constraint cannot be inconsistent by itself; consistency is irreducibly a property of the set together.
- **Not `compatibility`.** Compatibility is pairwise — can these two things co-exist or interoperate? Consistency is the global joint-satisfiability of an entire commitment set, where every pair can be compatible yet a three-way interaction still conflicts (see `compatibility`).
- **Not truth or `falsifiability`.** Consistency asks whether commitments are jointly *possible*, not whether they are *correct*. A set can be flawlessly consistent about a fiction; a true claim can sit in an inconsistent set. Falsifiability concerns whether evidence could refute a claim — an external-world question, not an internal-coherence one.
- **Not `coherence_breakdown_under_external_interaction`.** That prime concerns a system losing internal order through coupling to an environment; consistency is a static logical property of a commitment set under its own combination rule, with no environment required.
- **Not `completeness`.** Completeness asks whether a system decides *every* question in its scope; consistency asks whether it avoids deciding some question *both ways*. Gödel's result is that for expressive systems the two pull apart — a consistent system cannot be complete.<!-- FACT-D60-403 -->[^godel-1931]
- **Common misclassification.** Mistaking internal coherence for external validity — declaring a theory, alibi, or model vindicated because it harbors no contradiction. The catch: ask whether the worry is "could these all hold together?" or "are these actually so?"; consistency is silent on the second.

broad_use:
- **Mathematics and logic.** An axiom set is consistent if no derivation from it yields both a formula and its negation; an inconsistent set trivializes the theory, since from a contradiction everything follows.<!-- FACT-D60-404 -->[^mendelson-2015]
- **Databases and distributed systems.** The constraints of a schema — uniqueness, referential integrity, business rules — must not jointly forbid any state the system is meant to record, and a transaction commits only if the resulting state respects every invariant.<!-- FACT-D60-405 -->[^date-2003]
- **Law and policy.** Statutes, regulations, and contractual clauses can be jointly inconsistent (rule A requires X while rule B forbids X in the same circumstance), and courts and code reviewers resolve such conflicts by ordering, exception, or amendment.<!-- FACT-D60-406 -->[^raz-1979]
- **Narrative and testimony.** A witness account, a novel, or a film is internally consistent when its facts and timeline are jointly satisfiable, and detecting an inconsistency is the primary tool of cross-examination and of plot debugging.<!-- FACT-D60-407 -->[^wigmore-1937]
- **Personal commitments and identity.** A person's stated beliefs, promises, and actions form a system that is or is not jointly satisfiable, and cognitive dissonance is the felt cost of detected inconsistency.

clarity: Consistency turns a vague worry — "something here doesn't add up" — into a sharp diagnostic question: does there exist any joint assignment that makes all of the system's commitments hold at once? If the answer is no, the system has at least one defect, and the work becomes the precise task of locating the minimal conflicting subset rather than gesturing at a general sense of unease. The clarifying force is twofold. First, it separates the question of *joint possibility* (consistency) from the question of *truth* (soundness), so that one can ask whether a set of claims could all be true together independently of whether they are, which is exactly the question one needs when reasoning about hypotheses, fictions, or proposed rule-sets that are not yet asserted as fact. Second, it converts a holistic complaint about a large body of rules into a localizable one: an inconsistency is not a diffuse property of the whole but a property of some specific small subset, and naming the conflicting subset turns "this policy is incoherent" into "these three clauses, taken together, cannot all be satisfied," which is a statement one can act on.

manages_complexity: Most large systems of rules are far too big to inspect line by line, and the consistency frame supplies the decomposition that makes them tractable: rather than verify the whole at once, find a small unsatisfiable core — a minimal set of commitments that already conflict — and ignore the rest until that conflict is resolved. This "shrink to the conflict" move is the shared engine of SAT solvers, type checkers, constraint propagators, and proof assistants<!-- FACT-D60-408 -->[^biere-etal-2009], and it is performed informally by courts narrowing a dispute to the clauses actually in tension and by editors localizing a plot hole to the specific scenes that cannot both stand. The complexity saving is substantial because the locus of a defect is typically tiny relative to the system that contains it: a contradiction among thousands of rules usually involves only a handful, and once that handful is isolated the repair can be local and the remainder left untouched. The frame also manages a subtler complexity — the temptation to over-repair. Knowing that the defect lives in a minimal conflicting subset disciplines the fix to that subset, so one adds a scope qualifier or priority to the few rules actually in conflict rather than rewriting the whole body, which both costs less and avoids introducing new conflicts elsewhere.

abstract_reasoning: Because consistency is defined purely as a property of a set of commitments under a combination rule, the same machinery imports into any domain where commitments combine, and it supports several portable moves. *Unsatisfiable-core localization*: when a set conflicts, search for the smallest subset that still conflicts, since that subset is the true locus of the defect and patching anything outside it merely hides the problem — if rules A, B, and C jointly conflict but no pair among them does, the fix must address their three-way interaction. *Conflict resolution by minimal edit*: most inconsistencies dissolve not by wholesale rewriting but by adding a priority ordering, a scope qualifier, or an exception clause that specifies which commitment governs in which context, and this is the same move whether the substrate is a legal code or a software constraint set.<!-- FACT-D60-409 -->[^raz-1979] *Soundness/consistency separation*: keeping "are these jointly possible?" distinct from "are these true?" lets one reason about hypotheticals and proposed rule-sets without first settling their truth, and lets one diagnose whether a system's trouble is internal incoherence or external falsity. *Trivialization as alarm*: when small changes to a system seem to cascade into arbitrary outcomes — when it begins to "prove anything" — the structural signature is a latent inconsistency rather than newfound generative power, and recognizing that signature redirects the response from celebration to conflict-hunting. Each move is stated in terms of commitments, combination rules, and conflicting subsets, and each redeploys unchanged across the substrates above.

knowledge_transfer: The transferable content of consistency is a small repertoire of interventions that carry across substrates because each attaches to the abstract structure of a commitment set under a combination rule, though in the human cases the property acquires a mild normative undertone — an inconsistency is felt as a "defect" — that its purely formal definition does not strictly carry. The first transferable move is *locate the minimal conflicting subset before patching*: when several rules jointly conflict but no proper part of them does, the fix lives in their interaction, and patching one rule in isolation may simply relocate the conflict rather than resolve it; this discipline is identical in a legal code, a database schema, and a body of personal commitments. The second is *add a priority or scope qualifier rather than a wholesale rewrite*: most legal and software inconsistencies dissolve once one specifies which rule takes precedence in which context, and the same minimal-edit strategy that resolves a conflict between two statutes resolves a conflict between two database invariants. The third is *detect drift early via assertion-style invariants*: the cheapest inconsistency to fix is the one caught the moment it is introduced, which is why type checkers, database constraints, and courtroom objections all work by checking each new commitment against the existing set at the point of entry, and the same logic recommends building consistency checks into any growing body of rules. The fourth is *treat trivialization as a red alert*: when a small change appears to license arbitrary outcomes, the right inference is a latent contradiction rather than unexpected creativity, and this diagnostic transfers from formal systems to organizational rule-sets that suddenly seem to justify anything. A growing company's vacation policy that simultaneously requires unlimited rollover, caps balances at a fixed maximum, and credits more days than some employees use is jointly unsatisfiable for the light users, and the HR task — find the minimal conflicting subset, then add a scope qualifier such as a capped-rollover-with-payout rule rather than rewriting the policy — is structurally the same operation a compiler performs on conflicting type constraints<!-- FACT-D60-410 -->[^pierce-2002], a court performs on a docket conflict, and a historian performs on irreconcilable sources.<!-- FACT-D60-411 -->[^bloch-1953]

formal_abstract:
Take the propositional commitment set $\{p \rightarrow q,\; q \rightarrow r,\; p,\; \neg r,\; s\}$ as a *set of commitments held as binding*. The *combination rule* is classical logical inference. Running the *joint-satisfiability test* — is there a truth assignment satisfying all five? — fails: from $p$ and $p \rightarrow q$ derive $q$; from $q$ and $q \rightarrow r$ derive $r$; but $\neg r$ is also asserted, yielding $r \wedge \neg r$, a violation of the *no-contradiction invariant*. Because classical logic supports explosion, this inconsistent set derives *everything*, including $s$ and $\neg s$ alike, so it constrains nothing. Crucially the defect *localizes to a minimal conflicting subset*: $\{p \rightarrow q,\; q \rightarrow r,\; p,\; \neg r\}$ is jointly unsatisfiable, but no proper subset of it is — drop any one member and the rest are satisfiable.<!-- FACT-D60-412 -->[^biere-etal-2009] The commitment $s$ is entirely innocent and lies outside the core. This is *unsatisfiable-core localization* in its purest form, and it dictates *conflict resolution by minimal edit*: the repair must address the four-way interaction (e.g., retract $\neg r$ or qualify the scope of $q \rightarrow r$), and patching $s$ would merely hide nothing, since $s$ was never the problem. The *consistency-versus-truth separation* also shows here: the set's defect is internal incoherence, independent of whether any of $p, q, r$ is actually true in the world.

**Mapped back:** The propositional example instantiates the full signature — a binding commitment set under inference, a failed satisfiability test, the explosion that voids constraint, and a minimal conflicting subset that localizes both diagnosis and minimal-edit repair while truth stays separate.

applied_industry:
A relational database schema is a commitment set whose *combination rule* is query/constraint evaluation, and the DBMS enforces consistency continuously. Suppose an `orders` table carries a foreign key to `customers`, a `CHECK (total >= 0)` constraint, a uniqueness constraint on order IDs, and a business rule (a trigger) that every order with status `shipped` must reference a non-null `ship_date`. A transaction attempting to mark an order `shipped` while leaving `ship_date` null fails the *joint-satisfiability test*: the proposed state violates the *no-contradiction invariant* against the trigger constraint, and the DBMS *detects drift early* by rejecting the commit at the point of entry rather than allowing an incoherent state to persist. The defect *localizes* to a minimal conflicting subset — here just the status value and the null ship-date against one rule — so the *minimal-edit* repair is local (supply a ship-date or revert the status), not a schema rewrite. The identical structure governs a legal/policy substrate: a company's leave policy that simultaneously promises unlimited rollover, caps balances at a fixed maximum, and credits more days than light users consume is *jointly unsatisfiable* for those users; HR's task is to find the minimal conflicting subset and add a *scope qualifier* (capped-rollover-with-payout) which precedes a wholesale rewrite — the same operation a court performs when narrowing a statutory conflict to the two clauses actually in tension and resolving by priority ordering.

**Mapped back:** Database constraint enforcement and policy/legal conflict resolution both test joint satisfiability against a binding rule-set, catch violations at entry, localize to a minimal conflicting subset, and repair by minimal scoped edit — instantiating the consistency diagnostic in data-systems and institutional substrates.


Consistency Model

one_liner: An explicit contract over which observations of shared state are legal when updates are concurrent.

core_idea:
A consistency model is an explicit contract about what different observers of a shared state are allowed — and not allowed — to see, and in what order, when updates are made concurrently. It does not say what the state is; it says which interleavings of reads and writes count as legal observations, and therefore what observers may assume about one another's view.<!-- FACT-D60-426 -->[^herlihy-wing-1990] The structural commitment is to specify, in advance and independently of any particular state value, the set of permitted observation sequences out of the vastly larger set of conceivable ones, so that every party can reason about the shared referent without re-deriving from scratch what divergence is possible. The model is, in effect, a thin specification interposed between the messy reality of concurrent updates with propagation delay and the applications that must be built on top of it.

The structural variables are spare and substrate-free: a *shared object* that multiple observers reference as the same thing; an *observer set* whose views of the object may differ; an *operation history* of reads and writes across all observers; and an *ordering relation* constraining which permutations of that history each observer is permitted to witness. Fixing the model is fixing that constraint, and the central trade-off it governs is also structural: stronger models forbid more behaviours and demand more coordination — more latency, bandwidth, or blocking — while weaker models permit more behaviours and allow looser coupling. Every domain in which a state is shared across observers separated by propagation delay confronts this trade-off whether or not it has the vocabulary for it, which is what makes the consistency model a recurring structural object rather than a fact about computers; the vocabulary, however, is unmistakably engineered in origin, so the transfer to non-computing substrates is real but largely analogical.

structural_signature:
*the shared object referenced by all parties* — *the set of divergent observers* — *the history of concurrent reads and writes* — *the ordering constraint on permitted observation sequences* — *the strength-versus-coordination-cost trade-off* — *the propagation-delay (staleness) budget*

A configuration is a consistency model when each of the following holds:

- **A shared object.** Multiple parties reference the same logical state as one thing, even though their physical copies or views may differ.
- **An observer set.** There are distinct vantage points whose views of the object can diverge because updates reach them at different times.
- **An operation history.** Across all observers there is a record of reads and writes; the model constrains this history rather than the state's values.
- **An ordering constraint.** The model selects, out of all conceivable permutations of the history, the subset of observation sequences each observer is permitted to witness — this constraint *is* the model.
- **A strength axis with a cost dual.** Stronger models forbid more interleavings and demand more coordination (latency, bandwidth, blocking); weaker models permit more divergence and allow looser coupling, so position on the strength axis is position on a cost axis.
- **A staleness budget.** Propagation delay is a first-class variable: how stale a local view may be before it bites is an explicit, tunable bound, and divergence may be tolerated and then compensated (reconciliation, audit, apology) rather than prevented.

These compose into an inter-observer contract: fix a shared object, name the observers and their operation history, declare which orderings each may witness, and tune that declaration per operation against the strength-versus-cost and staleness trade-offs.

what_it_is_not:
- **Not `concurrency`.** Concurrency is the *condition* — multiple operations in flight at once; a consistency model is the *contract* specifying which observations of that concurrency are legal. Concurrency creates the problem the model governs; the model is the chosen answer, not the phenomenon.
- **Not `consistency` (logical).** Logical consistency is the non-derivability of a contradiction from a commitment set; a consistency model constrains which *orderings of reads and writes* across observers are permitted. One is about a static rule-set avoiding self-contradiction, the other about dynamic observation contracts under propagation delay.
- **Not `coordination`.** Coordination is the mechanism (consensus, locking) that *enforces* a strong model; the consistency model is the *specification* of what is to be enforced. A strong model demands coordination, but the contract and the machinery that satisfies it are distinct.
- **Not `fault_tolerance`.** Fault tolerance concerns surviving component failures; a consistency model concerns legal observations under concurrency even when nothing has failed. They interact (partitions force consistency/availability trade-offs<!-- FACT-D60-427 -->[^gilbert-lynch-2002]) but answer different questions.
- **Not `data_integrity`.** Data integrity is about state being correct and uncorrupted; a consistency model is about which divergent *views* of state are permitted across observers. State can be perfectly intact yet legitimately observed at different staleness by different parties.
- **Common misclassification.** Assuming "everyone sees everything immediately" — an implicit strongest-model assumption that holds silently at small scale and breaks silently at large scale. The catch: ask whether the system has a *written* model at all; an unstated guarantee is a latent failure priced as a free feature.

broad_use:
- **Distributed computing.** Linearizability, sequential consistency, causal consistency, eventual consistency, and snapshot isolation are named models for replicated databases, file systems, and caches<!-- FACT-D60-428 -->[^tanenbaum-vansteen-2017], each a precise rule about which read outcomes are legal given a history of concurrent writes.
- **Multi-jurisdictional law and records.** Title registries, civil registers, and tax records held across jurisdictions need a rule for what each office may assume about the others' state, and closing a property sale presumes a particular consistency guarantee about the registry.<!-- FACT-D60-429 -->[^ruoff-1957]
- **Organizations with multiple sites.** Branch offices, factories, and field teams act on locally cached versions of corporate truth, and the chosen answer to "how stale may a local copy be, and must changes propagate before being acted on?" is a consistency model in all but name.
- **Scientific publication and replication.** Preprints, peer-reviewed versions, errata, and retractions form a system in which different readers see different current truths, and the norms about which version binds whom and how long propagation may take constitute an implicit consistency model for the scholarly record.
- **Memory hardware.** CPUs and GPUs publish memory models (x86-TSO, ARM relaxed, the Java memory model) specifying which orderings of reads and writes the hardware honours<!-- FACT-D60-430 -->[^sewell-etal-2010], and programmers reason against these rather than against transistor behaviour.

clarity: A consistency model converts a vague worry — "will everyone see the same thing?" — into an explicit, testable contract: given any history of operations, which observation sequences are permitted? It surfaces the hidden assumption every multi-observer system carries, that there is something it means for the parts to share state, and forces that assumption to be stated rather than left to silently fail. The clarifying force is to make the *divergence budget* explicit: a strong model declares that observers may not diverge at all, a weak one declares precisely how much and in what respects they may, and in either case the previously implicit question of who is allowed to see what, when, becomes a written specification one can check operations against. This is exactly the clarity a system needs at the moment it scales, because the naive assumption that "everyone sees everything immediately" is one that holds silently at small scale and breaks silently at large scale; naming the model converts a future surprise into a present, examinable design choice, and lets the designer reason locally — "I write, then I read; what am I guaranteed?" — rather than case by case over every possible interleaving.

manages_complexity: Without a stated consistency model, every interaction across a distributed system must be reasoned about one interleaving at a time, an intractable accounting once concurrency and propagation delay are present. With one, the designer replaces an enormous space of possible histories with a small set of permitted ones and draws a line above which applications can be built without re-examining the substrate: the model is a thin specification that absorbs the combinatorial complexity of concurrency into a few stated guarantees. The management move is to *match the guarantee to the operation rather than to the system as a whole* — strong consistency for funds movement, eventual consistency for like-counts<!-- FACT-D60-431 -->[^vogels-2009] — so that the expensive coordination is paid for only where it is needed and the cheap, loosely-coupled path is used everywhere else; most real systems are therefore mixtures, applying different models per operation type on the same shared object. A further management lever is to *treat propagation delay as a first-class variable*: the recurring question "how stale may local belief be before it bites?" is the same in caches, branch offices, jurisdictional registries, and rumour networks, and answering it explicitly lets one accept staleness deliberately and add compensating discipline — reconciliation jobs, audits, apology pathways such as refunds or errata — rather than paying for the strongest guarantee everywhere. The complexity that the model manages is the complexity of unbounded divergence; what it buys is the ability to bound and reason about that divergence at a stated cost.

abstract_reasoning: The consistency model's structural setup — a shared object, a set of observers, a history of operations, and a constraint on the permutations each observer may witness — is substrate-free, and once it is in place a fixed set of trade-offs recurs. *Strength-versus-cost reasoning*: stronger models forbid more behaviours and require more coordination, so moving along the strength axis is always a movement along a cost axis, and the analyst can reason about where on that axis a given operation should sit by asking how much divergence its correctness can tolerate. *Per-operation tiering*: because different operations on the same object can legitimately use different models, the right unit of analysis is the operation rather than the system, and recognizing this prevents the error of imposing the strongest needed guarantee uniformly. *Staleness budgeting*: treating the maximum tolerable propagation delay as an explicit parameter turns "is this copy fresh enough?" into a checkable bound and lets one design the refresh discipline to meet it. *Compensation as an alternative to prevention*: where a strong guarantee is too costly, one can adopt a weaker model and add a reconciliation, audit, or apology pathway that repairs the rare divergence after the fact, trading prevention for correction. Each of these is a reasoning template stated in terms of observers, histories, and permitted orderings, and each applies — with the engineered vocabulary translated — to a registry system, a multi-site organization, or a scholarly record as readily as to a replicated database.

knowledge_transfer: The transferable content of the consistency model is a set of design interventions that carry across substrates because each attaches to the abstract inter-observer contract rather than to any particular technology, with the caveat that the vocabulary is CS-native and the transfer outside computing is by analogy. The first transferable move is *make the guarantee explicit before scaling*: a small system's implicit "everyone sees everything immediately" assumption breaks silently as it grows, and naming the model converts that latent failure into a present choice — the move applies as much to a company opening branch offices as to a service adding replicas. The second is *match the model to the operation, not the system*: the discipline of using strong consistency where correctness demands it (funds movement, a last-unit reservation, a binding registry entry) and eventual consistency where it does not (display counts, cached read-only views) transfers directly to a registry that holds a linearizable central truth while local recorders' offices hold cached copies, and to an organization that keeps some figures authoritative-and-synchronized while letting others lag. The third is *use a weaker model and add compensating discipline*: rather than pay for the strongest guarantee everywhere, accept bounded staleness and add reconciliation, audit, or apology pathways — refunds and errata and recount procedures are the human-scale analogues of a reconciliation job. The fourth is *treat propagation delay as a first-class variable*: the question of how stale a local belief may be before it causes harm is one question whether the copy is a cache, a branch office's records, a jurisdiction's registry, or a rumour, and budgeting that delay explicitly is the same intervention in each. A multinational retailer that uses cached stock counts at the storefront, a linearizable decrement against a warehouse reservation so two stores cannot sell the same last unit, and a snapshot-isolation view for nightly reconciliation is making exactly the structural decisions — what guarantee, for whom, at what cost — that a national land registry makes when local offices hold cached title information, the central registry holds the linearizable truth, and contract law specifies which office's view binds in a dispute; the decisions transfer one-to-one, with only the substrate and the vocabulary changing.

formal_abstract:
Consider a replicated key-value store holding a single counter, with three replicas as the *observer set* and the counter as the *shared object*. Two clients concurrently issue `increment` writes; a third issues a `read`. The *operation history* records all three operations plus their propagation between replicas. Now fix the *ordering constraint* under competing models. Under *linearizability* (the strongest model), there must exist a single total order of the operations consistent with real-time: if the read is issued after both increments have returned, it must observe the counter at $+2$; no replica may legally return $+1$ or $0$.<!-- FACT-D60-432 -->[^herlihy-wing-1990] Under *causal consistency*, only causally-related operations are ordered, so a read that has seen one increment must see all increments that happened-before it, but concurrent increments may be observed in either order.<!-- FACT-D60-433 -->[^ahamad-etal-1995] Under *eventual consistency* (the weakest), the read may legally return any value the history could produce — $0$, $+1$, or $+2$ — provided all replicas converge once writes quiesce.<!-- FACT-D60-434 -->[^vogels-2009] This is the *strength-versus-cost trade-off* made precise: linearizability forbids the most interleavings and demands the most coordination (a consensus round, blocking, latency), while eventual consistency permits maximal divergence and demands none, paying instead with a *staleness budget* — how long the read may lag — and a reconciliation step to converge. The same shared object thus admits a whole lattice of legal-observation contracts, and the design act is choosing one.

**Mapped back:** The replicated counter instantiates the full signature — a shared object, divergent observers, a concurrent operation history, an ordering constraint that *is* the model, and a strength axis dual to a coordination-cost-and-staleness axis.

applied_industry:
A multinational retailer's inventory system makes per-operation consistency choices on one shared object — the stock count — exactly as the formal lattice predicts, and the engineering vocabulary translates cleanly into operational design. The *shared object* is the count of a given SKU; the *observers* are storefront displays, warehouse reservation services, and the nightly reconciliation job. The retailer *matches the model to the operation, not the system*. The storefront "items remaining" badge uses *eventual consistency* — a cached, possibly-stale count is fine, since showing "7 left" when there are really 6 harms little, and the *staleness budget* is generous. But the decrement that reserves the *last unit* uses a *linearizable* operation against the warehouse: two stores must not both sell the final item, so this write pays for a coordination round to enforce a single total order.<!-- FACT-D60-435 -->[^herlihy-wing-1990] The nightly audit uses a *snapshot-isolation* view, reading a consistent point-in-time cut across replicas without blocking live traffic.<!-- FACT-D60-436 -->[^berenson-etal-1995] Where the system deliberately tolerates divergence, it adds *compensation rather than prevention*: if an oversell slips through, a refund-and-apology pathway repairs it after the fact, the human-scale analogue of a reconciliation job. The identical structural decisions — what guarantee, for whom, at what cost, with what compensation — are made by a national land registry where local recorders' offices hold cached title copies (eventual), the central registry holds the linearizable binding truth, and contract law specifies which office's view governs in a dispute.<!-- FACT-D60-437 -->[^ruoff-1957]

**Mapped back:** Retail inventory and a multi-jurisdictional land registry both tier consistency per operation on a shared object — strong where correctness demands it, weak-plus-compensation elsewhere — budgeting staleness explicitly, instantiating the inter-observer contract in distributed-systems and institutional-records substrates.