Adjunction (A9)A pair of functors between categories: one lifts data to a richer representation (left adjoint), the other projects it back to a coarser one (right adjoint). A natural bijection connects them, specifying the optimal translation between the two levels. Translation has a price. The unit measures the cost of promotion (what must be added to lift); the counit measures the cost of demotion (what is lost in projecting back). Adjunctions do not eliminate translation loss; they make it non-arbitrary by identifying the best possible approximation in each direction. Every crossing between representational contexts — from one schema to another, from one language to another, from one discipline to another — has a measurable and irreducible cost.Bridge Expressiveness GapThe condition in which the layer carrying information across a composition boundary is more expressive than the typed surfaces on either side. A large language model can mediate between a compliance database and a risk-assessment service with a fluency that masks the absence of any shared convention declaration — the string carries the payload but not the receipt. Before such bridges existed, crossing the same boundary required explicit mappings, brittle adapters, or manual integration work; the pain forced some witnessing into the system. The modern bridge removes the pain without replacing the witness. The gap is the regime change that makes the coherence fee urgent: composition has become cheap, but the cost of certifying what survived the crossing has not fallen with it.Certification Contract (A19b)Typed success or typed failure, with no third option. A certification contract takes a proposed claim and returns either a witnessed assertion (the claim has been verified, here is the evidence) or a structured refusal (the claim could not be verified, here is why). Downstream consumers know exactly what they are receiving and what confidence level attaches. Systems that return 'maybe' or 'approximately' without typing the uncertainty violate the certification contract.Coherence Budget (A21)Global consistency is expensive: checking compatibility, verifying overlap agreement, monitoring for drift. Someone must pay. A coherence budget is the explicit declaration of what a system will pay — in computation, time, and institutional effort — to maintain it. A system that declares no budget has declared it will not maintain coherence at all. A system with an explicit budget can reason about tradeoffs: certify high-stakes claims, monitor medium-stakes ones, and accept structured failure (with obstruction witnesses) for claims that exceed the budget. The SEC audits public companies annually but not private ones; FASB enforces accrual accounting for large firms but grants small firms simplified standards — every institution makes this tradeoff, whether or not it names it.Coherence Requirement (A5)How does a new predicate enter a system without destroying what already holds? An extension introducing predicate q must satisfy: local definability, overlap agreement (views induce the same classification or produce a witnessed reconciliation), invariant preservation, and conflict handling (fork, scope restriction, or preference ordering — never silent overwrite). On overlaps, agree with proof, fork with scope, or reconcile with witness.Commitment Discipline (A1)The foundational anchor: a system satisfies commitment discipline if and only if it never extends its commitment set in a way that produces inconsistency. The principle is ancient — Roman law's doctrine of res judicata held that a matter once decided binds all subsequent proceedings — but its computational form is precise. Once committed, a claim constrains all future commitments; the system cannot assert both p and not-p without detecting the contradiction and refusing the extension. Language models lack this discipline. They produce plausible text that may contradict prior outputs without any mechanism for detecting the inconsistency. Knowledge coordination begins with the willingness to be bound by what one has already said.Composition BoundaryThe projection surface where a component's internal state narrows to its declared output schema, potentially dropping dimensions the global task requires. Every typed interface is a composition boundary: an API endpoint exposes response fields but not the server's internal logic; an MCP tool declares output columns but not the conventions that shaped them; a database view publishes selected attributes while the query planner's assumptions remain hidden. The boundary is not a defect — projection is what makes modular systems possible. The problem arises when the dimensions projected away at one boundary are load-bearing for the composition that consumes the output downstream. The coboundary operator formalizes which consistency requirements can reference observable fields and which cannot; the zero rows identify the blind spots.Conservative Extension (A17b)Add new vocabulary without changing the meaning of what was already there. A conservative extension guarantees that every query expressible in the old language returns the same answer in the new language on every old dataset — the formal basis of backward compatibility. Old truths remain true, old distinctions remain distinct, old queries remain stable. When an extension is not conservative — when adding a new predicate changes the truth value of an existing query — the change is breaking, and the system must produce a migration with witnesses specifying what changed and how to translate between old and new representations.Context Graph (A22)Typed nodes — contexts, claims, witnesses, constraints, equivalences — connected by edges specifying their relationships (supports, scoped-to, refines, transports, contradicts). The grammar is sparse by design. Three operations govern the graph: gluing (composing local knowledge into global coherence), restriction (projecting global knowledge into local views), and transport (moving claims across context boundaries via witnessed equivalences). The point is not to represent all possible knowledge but to maintain the invariants that make knowledge coordination reliable.Context Site Structure (A12b)Contexts form a site — a category equipped with a Grothendieck topology specifying which families of contexts count as covers. The topology determines what 'local' means, what 'overlap' means, and therefore what 'agreement on overlaps' requires. Different topologies on the same category yield different coherence standards. The choice is consequential: a coarse topology demands little agreement but permits contradiction; a fine topology demands much agreement but may be unsatisfiable.Cover and Restriction (A12)Context is a restriction structure: global data restricted to a local view yields the portion visible from that vantage. Views are partial; covers are complete. A cover is a family of local views that jointly see everything — no part of the domain escapes all views in the cover. Truth is indexed by view: a claim true in one context may be false in another, not because truth is relative but because different views have access to different evidence. Restriction maps specify how global knowledge degrades, or specializes, as it passes into local contexts.Dependent TypesTypes that depend on values — where the type of an expression can vary based on the value of another expression. In ordinary type systems, 'list of integers' is a fixed type; in dependent type systems, 'list of length n' is a type that depends on the value n. This enables specifications capturing invariants impossible to express in simpler systems: 'a sorted list,' 'a matrix of dimensions m × n,' 'a proof that this number is prime.' Dependent types are the technical machinery underlying fibrations: predicates whose type depends on context, where 'best' means something different for the shopper than for the warehouse. A term's type, and therefore what operations are valid on it, can depend on which context is active.Empire of StringsSystems whose primary internal currency is untyped text — token sequences that carry statistical plausibility but no typed evidence, no proof obligations, no commitment discipline. Large language models and retrieval-augmented generation pipelines inhabit this empire. They can propose (generate candidates that may be correct) but cannot certify (bind a proposal to evidence that would survive challenge). The empire's great virtue is flexibility: natural language accommodates any domain, any register, any query. Its great vice is that plausibility is indistinguishable from truth within the system's own representations. The trade becomes dangerous whenever downstream consumers treat proposals as if they were witnessed assertions.Empire of TablesSystems whose primary internal currency is typed, schema-bound data — relational databases, typed programming languages, and the broader ecosystem of table-structured information that enforces constraints at write time and rejects ill-formed queries at read time. The Empire of Tables can certify (it knows whether a claim satisfies its invariants) but cannot invent predicates (adding a new kind of claim demands a schema migration the system itself cannot initiate or evaluate). What it stores, it stores correctly; what it cannot store, it refuses. That is integrity. Its great vice is rigidity: the world changes faster than schemas do, and every phenomenon that does not fit the existing schema is either forced into inappropriate columns or excluded from the record entirely.Epistemic Status (A4)Truth relativized to a view and an inference regime: within a given context and logic, a claim is either derivable (true), its negation is derivable (false), or neither obtains (undetermined). SQL's three-valued logic — true, false, null — conflates at least four distinct situations: absent because never observed, absent because observed and found missing, absent because outside the view's scope, and absent because the logic cannot decide. The anchor makes the inference regime explicit: a closed-world system treats silence as negation; an open-world system treats silence as ignorance. The choice is not a technical detail but a constitutional decision about the burden of proof.Erlangen ProgrammeFelix Klein's 1872 insight, which restructured all of geometry: choose the group of admissible transformations first, then define the objects of study as whatever remains invariant under those transformations. Transformations first; objects second. Euclidean geometry is the study of what survives rotation and translation; projective geometry studies what survives projection from a point. The Erlangen Programme showed that different geometries are not competing descriptions of the same reality but different answers to different questions about what transformations are admissible. The principle extends to knowledge coordination: identity is behavior under admissible probes, not a label assigned by a registry, and the choice of probe regime is a design decision determining what counts as 'the same.'Fibration (A14)A family of types indexed by context, where the type of a predicate varies depending on which context is active. Meaning is local. The word 'best' means something different (has a different type) in a shopping context (user-preference-dependent ranking) than in an inventory context (rank-ordered by turnover rate). Fibrations formalize this context-dependence: each context determines a fiber (a type), and reindexing maps specify how data moves between fibers when the context changes. Moving a claim from one context to another demands explicit transport — a formal operation specifying what is preserved and what changes in the translation.Galois ConnectionMove from a rich representation to a coarse one and back: you recover not the original but its best approximation at the coarser level. That is a Galois connection — an adjunction between partially ordered sets, a pair of monotone functions specifying the 'best approximation' when moving between levels of abstraction. The formalism captures operations like summarization (many records to one aggregate), abstraction (detailed to schematic), and projection (multi-dimensional to lower-dimensional). What the round-trip could not preserve is the translation cost.Grothendieck SiteA category equipped with a coverage — a specification of which families of morphisms count as 'covers' for the purpose of the sheaf condition. The site tells us what 'local' means (the covering families), what 'overlap' means (the intersections of covering families), and therefore what 'gluing' requires (agreement on overlaps). Different coverages on the same category yield different notions of local-to-global, different requirements for coherence. The Grothendieck site is chosen by system architects: a design decision that determines what counts as local truth and what conditions govern global coherence.Group Action and Invariant (A7)Felix Klein's insight, formalized: choose your admissible transformations first, then define reality as what survives them. A group acts on a space; an invariant is a property unchanged under any transformation in the group. Coordinates are artifacts of representation; invariants are the geometry. The Third Mode applies this discipline to knowledge coordination: choose which transformations count as legitimate (schema mappings, context translations, aggregation operations), then define equivalence as what those transformations preserve. What survives transport is what is real; what does not survive is an artifact of a particular vantage point.Invariant Set (A18)Every system enforces constraints, but not all constraints are equal. Hard invariants trigger rejection — the transaction fails, the assertion is refused. Soft constraints incur cost but not rejection — the result is penalized, flagged, or degraded. The partition matters because real systems cannot enforce everything with equal rigidity. A hard invariant that should have been soft produces brittleness; a soft constraint that should have been hard produces corruption. The invariant set is the system's constitution: what it will not compromise on, what it will tolerate with consequences, and the boundary between the two.Isomorphism and Witness (A8)Identity formalized as structure-preserving bijection with explicit proof. Two objects are isomorphic when maps exist between them that compose to identities in both directions. The witness is the pair of maps plus the proof that they compose correctly. Without the witness, isomorphism is merely claimed; with it, the claim is checkable by any party who can inspect the maps. The witness makes identity auditable — not a matter of assertion but of demonstrated correspondence.Keyless Joins (A23)Identity without brittle keys. In a hospital, the same patient appears as a medical-record number in radiology, a billing code in finance, and a bed assignment in the ward — three keys for one person, each brittle to transcription error. Keyless joins declare, propagate, and constrain equivalences: scoped, kinded (equality/isomorphism/approximation), and witnessed. Transitive closure respects scope boundaries. Conflicts produce obstruction witnesses, not silent merges. Identity emerges from explicit scoped declarations rather than from shared column values — a fundamental departure from the relational model's assumption that identity is a matter of matching keys.Locally Valid, Globally IncoherentThe failure mode where every bilateral check passes yet the end-to-end composition is semantically invalid, because conventions that are globally load-bearing were locally unwitnessed. Three accounting standards may each define lease concepts coherently, and every pairwise mapping between them may be internally consistent, yet the three-way composition does not close — the coherence fee of the trilateral cycle is four, and no bilateral audit can detect the gap. Integration testing does not resolve this: it composes the bilateral checks but inherits their blindness to dimensions that survive no observable projection. The failure is structural rather than incidental, a topological property of the composition graph that persists regardless of the quality of the components or the rigor of the edge-level validation.Logic Selection (A15)Different views may operate under different logics. A closed-world database assumes that what is not recorded is false; an open-world ontology assumes that what is not recorded is unknown. Classical logic admits excluded middle; intuitionistic logic does not. When views under different logics must merge, the merge itself demands a reconciliation logic — a meta-level decision about which inference rules govern the combination. Logic is not a fixed background assumption; it is a parameter of the view, and changing it changes what conclusions follow from the same data.Model and Satisfaction (A3b)The formal semantics for what 'safe evolution' means: a schema extension is conservative if every model of the old schema can be expanded to a model of the new one without changing any old truth values. This is the model-theoretic ground for backward compatibility — the guarantee that old queries return old answers after a schema change. A non-conservative extension silently alters the meaning of existing claims, which is why the formal apparatus treats it as a breaking change demanding explicit migration witnesses.N-ary Event Object (A31)Higher-arity events are meaning atoms; binarizing destroys invariants. A sale involves a buyer, a seller, a good, a price, a date, and a jurisdiction — six participants in distinct roles. Decomposing this into binary edges (buyer-sold, seller-sold, good-priced) loses the binding that makes it a single event: the constraint that these six participants were involved in the same transaction at the same time. The n-ary event object preserves this binding as a first-class entity, carrying its participants, their roles, and the constraints that connect them. Systems that force all data into binary relations silently destroy the structures that make complex meaning possible.Obligation TransportThe passage of semantic commitments across composition boundaries through intermediaries that may be more expressive than the verification surfaces they connect. A bill of exchange transported the merchant's obligation from Florence to Bruges through a chain of endorsements, each of which preserved the original commitment's conditions. The obligation survived the journey because the medium carried not merely the claim but the terms on which the claim could be challenged. Modern tool-composition pipelines transport obligations through bridges — prompt layers, orchestration contexts, serialized payloads — that are fluent enough to carry any payload but too weakly typed to certify which commitments survived the crossing. The problem is old; the speed and opacity of the modern bridge are new.Obstruction WitnessWhen the sheaf condition cannot be satisfied, when local sections disagree on their overlaps and no consistent global section exists, the system must produce a structured failure artifact. Silent failure is forbidden. The obstruction witness records what went wrong: the family of local sections, the minimal overlaps where agreement failed, the provenance of each conflicting claim, and the remediation options available. This is graceful refusal with explanation, the epistemic equivalent of a court that cannot reach a verdict but publishes its reasoning and the points of disagreement. Systems that fail silently (returning approximate answers when exact answers are impossible, or truncated results when complete results conflict) violate the discipline that makes knowledge coordination trustworthy.Predicate Acceptance (A29)Predicate invention is safe only when the new predicate arrives with its full dossier: tests specifying intended behavior, scope limiting where it applies, invariants it must preserve, versioning specifying compatibility with existing predicates. Acceptance is the gate through which new vocabulary enters the system. Without acceptance criteria, predicate invention is unconstrained proliferation — anyone can add any distinction, and coherence degrades with each addition. With them, each new predicate earns its place by demonstrating it satisfies the conditions the system demands.Predicate Invention (A17)Extending a signature by introducing a new predicate is not free creation: each new predicate must satisfy the coherence requirement on overlaps, preserve existing invariants, and pass through the acceptance gate. This is what distinguishes disciplined vocabulary growth from unconstrained proliferation — the difference between a legal system that adds statutes through procedure and one that adds them by fiat.Predicate Package / Citizenship Papers (A24)The mandatory dossier shipped with every predicate: signature (types, arity), intension (definition, measurement), runtime specification, tests (exemplars, confounders), invariants (hard and soft), provenance (author, date, authority), scope (where valid). No claim travels without its papers. A pharmaceutical compound ships with a regulatory dossier specifying composition, dosage, contraindications, and manufacturing conditions; the predicate package applies the same discipline to knowledge claims. This is proof-carrying code — validated and maintained as a unit, not scattered across documentation, comments, and tribal knowledge.Predicate Search Space (A20)Inventing predicates is searching a constrained hypothesis space. The constraints come from the sheaf condition (local definability, overlap agreement), invariant preservation (the new predicate must not break existing invariants), and the coherence budget (the search cannot exceed its allocated resources). The space is not infinite — it is bounded by what the existing signature, coverage structure, and invariant set permit. Predicate invention is creative within constraints, and the constraints distinguish disciplined invention from unconstrained proliferation.Proposal Operator (A19)Statistical pattern matching that produces hypotheses, not certified truths. The proposal operator takes a query and returns scored candidates — ranked by embedding similarity, retrieval relevance, or probabilistic fit. The candidates are proposals: they may be correct, plausible but wrong, or hallucinated. The distinction between proposal and certification is the central disciplinary boundary. Systems that present proposals as certified facts — that treat retrieval scores as truth values — collapse this boundary. What comes out of the retrieval stage has a status (proposed), and that status must be upgraded through certification before the result can be relied upon.Provenance Judgement (A2)Claims must carry typed evidence, not arrive bare. A provenance judgement takes the form Γ ⊢ π : Π(p), meaning that witness π attests that claim p holds under context Γ. The judgement tethers every assertion to its evidential basis, enabling downstream systems to detect conflicts (two witnesses that disagree), assess standing (which witness class was invoked), and trace responsibility (who asserted what on the basis of what evidence). This is the formal analogue of what the medieval notary performed: not vouching for truth but recording what evidence was presented, under what conditions, by whom.Query as Contract (A25)A query is not a request for data but a contract specifying what evidence is required: which contexts may be referenced, which predicates are invoked, which witness classes are acceptable, and what uncertainty the requester will tolerate. The logic mirrors legal discovery: a subpoena specifies what documents are sought, under what authority, within what temporal scope, and subject to what privilege claims. Results carry standing labels — certified, witnessed, or proposed — that specify the epistemic status of each returned item. The contract is auditable: a downstream consumer can inspect not only what was returned but under what obligations the return was made.Refusal Obligation (A27)When a system cannot satisfy a request while maintaining its invariants, it must refuse gracefully — producing a structured explanation of why the request failed, what constraints were violated, and what alternatives might succeed. The principle has common-law precedent: a judge who denies a motion must state reasons on the record so that the ruling can be appealed. The refusal obligation is the counterpart to the gluing condition: the sheaf says when local data can combine into global coherence; the refusal obligation says what must happen when combination is impossible. The obstruction witness is the artifact produced: not merely 'no' but 'no because' — a record of the minimal overlaps where agreement failed, the provenance of each conflicting claim, the allowed remediation options. Graceful refusal with explanation is the alternative to silent collapse.Schema as Signature (A3)A schema is a signature — a specification of what types exist, what predicates can be stated, and what constraints bind them. Adding a predicate is not a data operation but a language change: it extends what the system can say. Words have consequences. When a medieval guild added a new category of membership, it did not merely insert a record; it changed what claims could be made, what disputes could arise, what rights attached. Every extension of vocabulary is a morphism between formal languages, carrying proof obligations about what the extension preserves.Scoped Equivalence (A30)Equivalence is context-indexed: two things may be equivalent in one scope and distinct in another. Context decides. A paperback and a hardcover are equivalent qua text content but distinct qua physical object. A JPEG and a PNG are equivalent qua visual appearance but distinct qua compression algorithm. Scoped equivalence makes the scope explicit — the equivalence holds within a specified set of contexts, and transport (using the equivalence to substitute one thing for another) is valid only within that scope. Claims of equivalence that omit their scope are claims that cannot be checked, because the checker does not know which contexts to test.Semantic BurdenThe full set of conventions, assumptions, and implicit agreements that a correct composition depends on, including dimensions no single boundary's observable schema exposes. A financial settlement pipeline may require that every tool use the same day-count convention, the same jurisdictional framework, the same rounding mode — but these conventions live in the internal state of each tool and appear in no output schema. The semantic burden is what the composition actually needs; the observable surface is what the composition can actually check. The coherence fee measures the gap between them. What makes the burden dangerous is precisely its invisibility: each tool operates correctly within its own frame, and the burden's weight is felt only when the composition fails in ways no adjacent check could have detected.Sense Boundary (A6)A context-indexed equivalence relation that partitions terms into senses. The word 'pomegranate' in a culinary context denotes a fruit; in a design context, a color; in a decorative-arts context, a motif with centuries of iconographic history. Each sense is valid within its context; the boundary specifies where one sense ends and another begins. Sense boundaries interact with the sheaf condition: when two contexts overlap, their sense assignments must agree on the overlap or the ambiguity must be surfaced as an obstruction witness.Sense Gluing (A28)Disambiguation is gluing: local sense choices must agree on overlaps. When a term has multiple senses across contexts, the sheaf condition demands that wherever two contexts share a boundary, the sense assigned in each must be compatible. 'Bank' means a financial institution in one context and a river feature in another — these senses need not agree because the contexts do not overlap. But if a context about 'bank erosion' and a context about 'bank regulation' both reference the same entity, the senses must be reconciled or the ambiguity explicitly surfaced. Sense gluing makes disambiguation an operation governed by structure, not heuristic guesswork.SheafA mathematical structure, originating in Grothendieck's reformulation of algebraic geometry in the 1960s, that formalizes how local information composes into global knowledge. A presheaf on a site assigns data to each context and specifies how that data restricts to sub-contexts. A sheaf adds two requirements: locality (if two sections agree on every overlap, they are the same section — no hidden global information) and gluing (every family of local sections that agree on overlaps can be assembled into a unique global section). The sheaf condition is the mathematical formalization of coherence: local truths compose into global truth when, and only when, they agree where their domains intersect.Sheaf Condition (A13)The conjunction of locality and gluing that constitutes the formal requirement for coherent knowledge composition. Given a cover of a domain by local contexts, the sheaf condition demands that whenever local sections form a matching family (they agree on every pairwise overlap), there exists a unique global section whose restriction to each local context recovers exactly the local section. This is the mathematical formalization of the principle 'on overlaps, agree' — the same principle that medieval fair courts enforced when merchants from different jurisdictions had to reconcile their accounts at the boundaries where their trading territories intersected.Similes of SymmetryWitnessed equivalences that survive translation, inspection, and dispute across contexts — the central epistemological concept of Volume I. A simile asserts that two things are alike; symmetry is the mathematical discipline specifying under what transformations the likeness holds. The combination is precise. A simile of symmetry is a claim of equivalence that has earned the formal apparatus required to travel: not a vague analogy but a witnessed correspondence backed by evidence of preservation under specified transformations. Knowledge coordination demands not just the assertion of sameness but the specification of the conditions under which sameness can be checked, transported, and challenged.Standing (Epistemic)The right to have one's claims considered within a discourse — not a binary (has standing / lacks standing) but a gradient. Standing is earned through demonstrated reliability within a context: the expert who has been right before has more standing than the newcomer; the source that has submitted to verification has more than one that refuses audit. Standing is domain-specific: high standing in physics does not transfer automatically to medicine. A claim accompanied by appropriate witnesses has standing that an unwitnessed claim lacks. Standing is not truth — a high-standing claim can be false, a low-standing claim can be true — but standing determines what the system treats as worth checking, what gets promoted to contested claim rather than dismissed as noise. The epistemic equivalent of creditworthiness: a measure of how much verification investment a claim deserves.The Bill of ExchangeThe bill carried a chain of endorsements, each one a stake wagered by the endorser. If the bill was dishonored, liability flowed backward until someone paid. The bill's worth depended entirely on whether its claims could be verified; a forged signature destroyed value because verification exposed it. Teaches: truth can travel through chains of stakes.The Coherence FeeThe irreducible cost of making local truth compose into global coherence — thermodynamic, not political, and therefore impossible to eliminate by removing intermediaries or cheapening verification. Someone must always pay: the energy required to check whether two local claims agree on their overlap, the computation required to transport a witness across a context boundary, the institutional effort required to maintain consistency across time. The coherence fee is what remains when the trust tax has been stripped away — the floor below which verification cost cannot fall, because verification is physical work and physical work dissipates energy. Landauer's 1961 result establishes the limit at the bit level; real systems operate orders of magnitude above it, but the principle holds: composing truth has a cost denominated in joules, not merely in fees. Eliminating the trust tax is a political achievement. Paying the coherence fee is a thermodynamic necessity.The Notary's SealOne of the four touchstones. The medieval notary pressed his seal into wax not to vouch for the truth of what the document claimed but to certify that the claim had been witnessed under specified conditions — the parties present, the date, the jurisdiction, the form of oath. The seal was not truth but attestation: a second-order claim that the first-order claim had passed through a verification procedure. This distinction between vouching for content and certifying process is the foundational insight of witness theory. The notary's seal teaches that witnesses can bind: attestation under specified conditions creates obligations that survive the attestor's departure, the parties' disagreement, and the passage of time.The Trust TaxThe extractable premium charged for occupying the verification chokepoint — rent disguised as coherence. The trust tax is the difference between what a party pays for verification and what that verification would cost in a competitive market. The medieval notary performed a genuine function: authenticating documents, witnessing transactions, certifying that claims had been made under proper conditions. That function had a genuine cost — the coherence fee. But entry restrictions that protected the notary's investment also generated a premium above that cost, captured because the merchant had no alternative. The trust tax is parasitic on the coherence fee: it exists only because the coherence fee is real, and it survives only as long as the chokepoint holder can prevent the individual from verifying for herself. The tax collapses when verification becomes cheap enough that the individual can perform it without an intermediary.Third ModeBetween string-dominant and schema-dominant systems lies an unnamed layer: a notarial protocol that produces witnesses, receipts, and structured obstructions. Enables contextual predicate invention under invariants while maintaining coherence. Takes proposals (similes) and subjects them to verification until they earn certification (symmetries).Third Mode Definition (A32)The formal culmination: a system is Third Mode if and only if it supports predicate invention with conservative extension, witnessed equivalence with scoped transport, view structure with sheaf-condition gluing, and explicit coherence cost accounting. This is not an aspiration. It is a checkable specification with four conjuncts, each traceable to formal anchors in the dependency graph. A system satisfying three of the four is not Third Mode. The definition is strict because the alternative is a label that means nothing.Touchstone Battery (T1-T10)Ten recurring failure modes that any system claiming Third Mode status must handle without silent degradation. The suite: contradiction detection (T1), reference resolution across contexts (T2), compositional meaning preservation (T3), precision maintenance under transformation (T4), correct treatment of negation and absence (T5), disciplined predicate invention (T6), context-sensitive equivalence (T7), uncertainty and value-laden judgment (T8), schema evolution under coherence constraints (T9), and higher-arity event representation (T10). Each touchstone corresponds to a characteristic failure: language models hallucinate references (T2), databases cannot invent predicates (T6), neither handles n-ary events natively (T10). When a system fails a touchstone, the failure traces to a specific anchor the system has not satisfied.Transport Discipline (A16)When a fact established in one context must be used in another, something must translate it. Transport operators specify the translation: what transformations are applied, what invariants are preserved, what information is lost or gained. Given a witnessed equivalence between A and B within scope S, the transport operators specify how to move data from A-contexts to B-contexts and back. Without them, equivalence is merely asserted; with them, equivalence is operational — the system knows not just that A and B are 'the same' but how to act on that sameness. Transport is not free: the unit and counit of adjunctions measure what is lost in translation.UnivalenceThe principle, originating in Homotopy Type Theory (2013), that equivalent types may be treated as identical for substitution purposes — but only when a transport certificate specifying the equivalence is produced and its scope declared. Evidence is the price of identity. Univalence operationalizes the intuition that 'if two structures behave identically under all admissible operations, they are the same structure' while insisting that every such identification be witnessed, not merely assumed. Equivalence licensed by evidence is as good as identity; equivalence assumed without evidence is a source of silent error.Verification DebtDeferred verification compounds like financial debt. Checks that should have been performed but were postponed create a liability that grows over time. Like technical debt in software, verification debt accrues interest: the longer verification is deferred, the more expensive it becomes, and the more damage incorrect assumptions may have caused. The debt comes due when coherence fails catastrophically — when the unverified claim turns out false, when the conflict can no longer be papered over, when the undocumented predicate collides with another. Verification debt is the economic concept underlying the coherence budget: systems must decide how much debt they are willing to carry and what they will pay to service it.Versioning Rules (A26)The protocol by which a system survives time. Conservative extensions are safe: old queries return old answers, no migration required. Breaking changes demand explicit migration with witnesses — a record of what changed, what old truths may be affected, and how to translate between versions. Versioned predicates carry compatibility contracts specifying which prior versions they extend and which they break. Without versioning rules, system evolution is a sequence of silent breaking changes; with them, evolution is auditable and reversible.Vocabulary Operator (A11)Vocabulary determines what distinctions a system can state, and therefore what truths it can express. When the DSM reclassified homosexuality from disorder to non-disorder in 1973, it did not discover a new fact; it performed a vocabulary operation that changed what the psychiatric system could subsequently say. The vocabulary operator formalizes this feedback loop between what you can say and what you can know: expanding vocabulary creates new distinctions; contracting vocabulary collapses them. The loop stabilizes when invariants constrain which changes are permissible. Every schema migration, every ontology revision, every taxonomic reclassification is a vocabulary operation — and each carries consequences for what was previously expressible.Witness Classes (A2c)Not all verification is alike, and the composition rules differ accordingly. Three classes: (1) Decidable — total, deterministic verification that outputs ok or fail. A type checker confirms that code compiles; an arithmetic proof terminates with certainty. (2) Probabilistic — terminates with confidence bounds. A radiologist's ML classifier scores a chest X-ray at 94% likelihood of pneumonia; the confidence propagates through every downstream decision. (3) Attested — checks a provenance chain, outputs ok_if_trusted(authority). An organic certification stamp attests that a supplier followed the protocol; trust the stamp, trust the claim. A decidable witness composes freely; a probabilistic witness propagates uncertainty; an attested witness propagates trust assumptions.Witness StructureA certificate that binds a claim of equivalence to the conditions under which that claim can be inspected, transported, and challenged. Where a bare assertion says 'these two things are the same,' a witness structure specifies the scope within which the sameness holds, the evidence supporting it, and the procedure by which a challenger can contest it. Local truths compose into global coherence through witness structures: the sheaf condition demands that wherever two local claims overlap, their witness structures must agree. The medieval bill of exchange was precisely such a structure — it carried not just a promise to pay but the chain of endorsements, jurisdictional references, and conditions under which the promise could cross linguistic, monetary, and legal boundaries.Witnessed Assertion (A2b)A claim paired with evidence sufficient to support it under specified conditions — the fundamental unit of accountable discourse. A peer-reviewed journal article is a witnessed assertion: the claim is grounded in data and methods, but the evidence does not make it infallible — only inspectable. Unlike bare assertions (claims without evidence) or certified facts (claims the system has fully verified), witnessed assertions occupy the middle ground: the claim is grounded but not necessarily true; the evidence is attached but not necessarily sufficient for all purposes. The witness structure specifies under what conditions the assertion can be relied upon, what confidence it warrants, and what happens if subsequent verification fails. Witnessed assertions compose: two can be combined into a third, with the resulting witness structure reflecting the composition of the originals.Witnessed Sameness (A10)Equivalence made into a first-class artifact with operational consequences. A passport and a driver's license may both identify the same person, but the equivalence holds only within scope (domestic travel, not international), under specific conditions (both unexpired, photo matches bearer), with specific operational rights (one opens a gate, the other starts a car). Formally: a tuple w = (K, A, B, S, prov, ops) where K = witness class (=/≅/≃/≲), A and B = entities related, S = scope predicate over contexts and time, prov = provenance with confidence and expiration, ops = operational contract with transport operators and validity gate. The tuple binds an equivalence claim to the evidence that supports it, the scope within which it holds, and the operations it licenses.