Principle 9 of this essay says the confirmed miss is the unit, and that complaints are not
data. A complaint is a feeling about a work. An objection anchored to a specific sentence,
with a status and an answer, is something you can act on. So this page is the essay's own
argument applied to the essay.
Everything below is unresolved unless it says otherwise.
Raise one
There is an "object to this section" link at the head of every section of
the essay, and you can also select any passage and a button will appear.
Your name is not published unless you ask for it to be: by default the docket shows your
role alone. Submissions are read before they appear. Full terms, including your right of
reply and how to withdraw, are in the policy.
What counts as a miss/ Open
A miss is a gap between a declared expectation and an observed outcome. in context
This does not catch the cases that matter most. Take a real fatality: a vehicle whose perception had no category for the hazard in front of it. Its declaration that the path was clear was vacuously true, because "clear" means clear of objects it represents. No declared expectation was violated. A person died. Under this definition that is not a miss, and a definition that does not register a death as a miss is not a floor beneath anything.
Machine review, safety-case and requirements perspective
Author's response
Conceded in the text rather than resolved. Section four now carries the objection, names margin exhaustion as the better definition, and says plainly why the weaker one is still in place. The claim that the work stands or falls on this definition has been removed, because it does not.
What counts as a miss/ Text changed
That is what makes the measurement neutral. Not the wisdom of the measurer. in context
False as written, and it is the sentence the keystone rests on. Measuring against declarations is objective, because the gap is computable. It is not neutral, because the declaration set is selected by an interested party. Deferring to the declarer is not avoiding values; it is delegating value-setting to the participant with the conflict and then calling the output neutral. Under pressure the honest move and the profitable move diverge: declare less, later, narrower.
Machine review, safety-case and requirements perspective
Author's response
The word neutral is now qualified in the body of section four, and auditable is named as the accurate word. The custodian requirement, that an unalterable register be held by someone other than the declarer, is stated there too.
The principles/ Open
Checkers only compose if their failures are uncorrelated. in context
Then principle 4 manufactures exactly the correlation principle 7 forbids. Routing the catching layer through the deciding layer's declarations forces the adjudicator to inherit the declarer's categories, assumed environment, and list of things worth mentioning. Two parties reading one declaration set are one checker with respect to omission, however independent their interests. Independence of interest is not independence of representation.
Machine review, safety-case and requirements perspective
Pain is free to send because the nerve has no reputation. A human report is never free. Practitioners at the centre of an incident carry insomnia, shame, restricted duty, career damage, and in documented cases worse. So the design question is not whether to remove the cost, which cannot be done, but who is made to carry it. In systems that work, the organisation carries it. In systems that fail, the reporter does.
Machine review, frontline reporting perspective
Author's response
The section now separates formal sanction, process cost and social cost, and states that the social cost is the largest and least visible. The principle still reads "The Report Is Not the Punishment" and probably should become "The Organisation Carries the Cost of the Report", which is a design instruction rather than a wish. Not yet done.
The principles/ Open
Authority to interrupt and to trigger a bounded response. No authority to govern. in context
Then nothing in the architecture requires findings to reach anyone outside the loop. As specified it is closed: signal to catcher, catcher confirms, memory propagates inside the system. If the deciding layer declines to act, no principle does anything. One national investigator has issued more than fifteen thousand recommendations and can compel none of them; its actual leverage is that it publishes and names who refused. There is a thirteenth principle missing.
Machine review, accident investigation and oversight perspective
The principles/ Open
Each caught and corrected miss raises confidence in the layer, which raises reporting, which raises catches. in context
Twelve principles and not one of them is: test it. An untested channel and an unexercised stop authority are indistinguishable from healthy ones from the inside, which is this essay's own thesis applied to its own architecture and not noticed. The biology to ground it is already in the text: immune memory is maintained by re-exposure, and the vaccination example under principle 10 is a deliberately induced drill. The operational test is to count the stops that turned out to be unnecessary and confirm nothing happened to the person who called them. Zero false stops diagnoses a dead cord.
I will say plainly that I have a commercial interest in this field, and that the architecture I am describing is one I am trying to build. in context
Then the essay has a standing problem it does not resolve by disclosing it. An argument that the industry needs an independent assurance layer, written by someone who sells a safety layer and co-founded an assurance institute, is an argument whose conclusion happens to describe a market for its author. The disclosure is necessary and it is not sufficient. A reader is entitled to weigh the whole doctrine as interested, and the interest runs deeper than a paragraph can offset: principle 7 says whoever certifies a miss must have no stake in which answer it turns out to be, and by that standard the author is the wrong person to be writing the standard.
Raised by the author against himself, before anyone else did
Author's response
Correct, and I am not going to argue it down. The architecture indicts my own industry and my own company in the same breath as everything else, which is the only reason it is publishable by me at all, and it is still not a resolution. Two things follow and both are on the record: nothing on this site or in this essay cites my own performance figures, product behaviour or patents, and the assurance institute referred to is deliberately not the publisher of this work and carries no mark on it. If the doctrine is any good it will outlive my interest in it, and if it only works when I am the one holding it, it was never an architecture.
What would count as this page failing.
Principle 4 says a system that declares no expectations cannot be caught missing, so here
is the expectation for this mechanism. Comment systems on scholarly work have a dismal
record: one large medical index recorded objections on about two hundredths of one percent
of its articles before it was shut down for disuse. This page should be assumed to be
heading the same way unless it is not.
The declared expectation: three objections from named people I did not personally
ask, by 31 December 2026. If that has not happened, this page will say so, on this
page, and the mechanism will be recorded as having failed rather than left to sit and look
healthy. Last reviewed: 29 July 2026.
Statuses mean what they say. Open: raised, not answered, and I have not
changed anything. Text changed: the essay was edited because of it.
Answered: I have replied and left the text alone.
Accepted as a limit of the work: the objection is correct and the
architecture does not address it, which is stated in the text rather than fixed.