DONTO
Evidence OS
The substrate
contradiction-preserving · evidence-first

The Exogeny Problem

Round nine. A reply to The Collapse–Query Polarity (round eight). Two contributions: (1) the Limit Theorem — round eight's own Galois connection, evaluated at the open-world limit, re-derives No Free Collapse, so the two principles are one theorem read at different stages and neither round was wrong; (2) the identification of the single undischarged assumption of the entire converged architecture — every axiom that survives eight rounds bottoms out in a claim of the form "this information did not causally descend from us," and that claim is never internally certifiable. The exchange's residue is one primitive: exogeny.

2026-07-23. Purely theoretical.

0. Scorecard

Conceded to round eight:

  1. The Safe Collapse Characterization is correct and is the right theorem. π is safe for 𝒬 iff every query factors through it iff ker(π) ⊆ ∼_𝒬; the quotient X → X/∼_𝒬 is the coarsest safe collapse. The proof is right. Adopted as the second theorem of the exchange.
  2. The Collapse–Query polarity is the right structure. 𝒬 ⊆ Inv(E) ⟺ E ⊆ Ind(𝒬) is a genuine antitone Galois connection, and — unlike round five's lattice, which round six correctly demoted to bookkeeping — this one carries content, because both sides (queries, quotients) are operationally meaningful. Adopted.
  3. Thin reflection, not poset reflection; descent defect, not holonomy. The factorization criterion is equality on parallel pairs through Thin(𝒞); antisymmetrization is a further quotient with further conditions; the noninvertible general object is a descent defect (non-confluence), of which holonomy F(g)⁻¹F(f) is the invertible special case; and "how far from descending" needs declared structure (2-cells, weighted discrepancies) or it is only a witnessed family. All conceded — cleaner than what it corrects.
  4. The Löb overreach is retracted. A score is not a provability predicate; the derivability conditions were never checked; Löb is a warning about one powerful species of self-trust, not a theorem forcing Axiom X. The replacement — No Endogenous Evidential Amplification, I(X; D | W) = 0 when D is generated solely from W — is more general and implementable. Adopted (§2 shows what it costs).
  5. The gerund section's linguistics were wrong. Complex-event nominals retain argument structure ("John's examination of the students on Tuesday"); gerunds can drop arguments ("smoking is prohibited"); "mistakes were made" is agent-suppressed passive, not nominalization; and Asserted(s,P,t,c,e) is an event predicate, not a grammatical gerund. The corrected rule — every epistemic object must expose the event that produced it; not every ontological object reduces to an event — is right, and the surviving grammatical anchor is Grimshaw's actual distinction: warrant-bearing records must behave like complex-event nominals (argument-supporting), never like result nominals. The rhetorical point survives under its correct linguistic name; the overclaim does not. Conceded.
  6. The nine cases are not one formal operation. Collapse (a map π), nonidentifiability, misspecification, non-confluence, circular dependence, and type confusion deserve their own names; "collapse" now means exactly π : X → Y and nothing else. Conceded — with §1 showing the family resemblance was nonetheless tracking something real.
  7. The growing-world recovery condition N_k β_k(γ_k) → 0 is the correct statement of the statistical contest (spaces grow, margins shrink, data is adaptive, concentration must outrun all three). Adopted as the open statistical target.
  8. Calibration is not the unique exogenous channel — held-out prediction, intervention, replication, audit, preregistration are siblings; the sound rule is cross-level validation must terminate in information not generated by the verdict being validated. Conceded — and this sentence, it turns out, is the whole remaining problem (§2).

1. The Limit Theorem: No Free Collapse is the polarity at ω

Round eight's dilemma for No Free Collapse was: under Interpretation A (all separating functions admissible) it is "true but almost definitional"; under Interpretation B (restricted query family) it is false, because safe informative collapses exist (age → adult/minor, sufficient statistics, bisimulation quotients). Conclusion: the principle needed a query-family index it lacked.

Accepted — and then run the correction forward, because round eight stopped one step short of what its own machinery yields.

Take the polarity's behavior under growing queries, which round eight itself wrote down:

𝒬₀ ⊆ 𝒬₁ ⊆ 𝒬₂ ⊆ ⋯     ⟹     ∼_{𝒬₀} ⊇ ∼_{𝒬₁} ⊇ ∼_{𝒬₂} ⊇ ⋯

The safe equivalences form a descending chain. Now characterize the regime the whole exchange has been about. Open-world inquiry is precisely the regime in which no finite stage bounds the query family: for any two distinct evidentiary states x ≠ x′, it cannot be excluded at any stage k that some admissible q ∈ 𝒬_j, j > k, separates them. (This is not an assumption smuggled in — it is the round-one information-theoretic argument, the only argument of the exchange never successfully attacked, and it is the definition of the setting donto was built for: unbounded future task families.)

Theorem (Limit). If the admissible query sequence is unboundedly separating — ⋂_k ∼_{𝒬_k} = Δ_X (the diagonal) — then the only collapse safe for every stage is injective:

π safe for all 𝒬_k  ⟺  ker(π) ⊆ ⋂_k ∼_{𝒬_k} = Δ_X  ⟺  π injective.

Proof. Immediate from the Safe Collapse Characterization: safety at stage k is ker(π) ⊆ ∼_{𝒬_k}; safety at all stages is containment in the intersection; the intersection is the diagonal by hypothesis; a map whose kernel is the diagonal is injective. ∎

So: No Free Collapse is the ω-stage of the Collapse–Query polarity. At every finite stage, round eight is right — there are safe, informative, canonical collapses, and the coarsest one is X/∼_{𝒬_k}. In the limit, round seven is right — no noninjective ingest-time collapse is safe, which is why the substrate must hold the finest available object while queries collapse freely at their stage. The two principles were never rivals. They are one Galois connection evaluated at a stage versus at its limit, and the architecture slogan both rounds share falls out as the unique policy consistent with both: collapse is stage-indexed and query-licensed (round eight); the store is limit-indexed and therefore finest-available (round seven). Round eight's own Axiom D (Revisable Sufficiency — "retain sufficient provenance to refine or reconstruct the earlier quotient") concedes this operationally: the provenance sufficient to split every future quotient is the finest-available object under another name. The §6 dispute ("the uncollapsed object does not exist") was verbal: "uncollapsed" never meant identical to the world — representation is transformation, conceded — it meant no further collapse after the richest legally and practically available source object, which is round eight's own corrected principle, word for word.

One principle, two evaluation points, zero remaining disagreement. The rename to No Undeclared Collapse is accepted for the stagewise form; No Free Collapse stands as its limit theorem.

2. The single undischarged assumption: exogeny

Now the deeper matter. Lay out the axioms of round eight's corrected foundation and mark what each one presupposes:

  • Axiom B (No Endogenous Evidential Amplification): a descendant adds no weight "unless it incorporates an exogenous observation not causally descended from the computation itself." Presupposes: the ability to certify non-descent.
  • Axiom C (Epistemic Event Provenance): every object linked to the event that produced it. Presupposes: the provenance graph is complete — that no producing event is missing from it.
  • Round eight §8's corrected channel rule: validation "must terminate in information not generated by the verdict being validated." Presupposes: knowing what the verdict did and did not generate.
  • Round four's source-independence (the provenance graph G, the collusion problem, the firehose): presupposes detecting hidden common ancestry — shared documents, shared pretraining, coordinated distribution.
  • Round six's calibration channel (outcome-scored, hence exogenous): presupposes the outcome stream itself is not contaminated by the system's own influence on the world it measures (the Goodhart channel round three already flagged as "adversarial constraint").
  • Even Theorem 1's hypothesis (C) — uniform consistency under an adaptive policy — presupposes that the data reaching the estimator was generated by the environment and not by the estimator's own downstream effects.

Every load-bearing axiom of the converged architecture — across both authors, across all eight rounds — terminates in a claim of one and the same form:

Exo(d) : "datum d did not causally descend from this system."

And here is the point that has been circling the exchange since round four without being named: Exo is not internally certifiable. The argument is short and does not need Löb. To certify Exo(d), the system consults its provenance graph and finds no path from itself to d. But absence of a path in the recorded graph certifies nothing unless the graph is complete — and the graph's completeness is exactly the proposition that no unrecorded causal path exists, which is a universally quantified claim about the system's own blind spots. A system's evidence for "my provenance record has no gaps" is itself drawn from the provenance record. This is not the Löbian self-endorsement loop (conceded dead in §0.4); it is simpler and harder: negative existential claims about one's own causal history cannot be grounded in one's own records, for the same reason an audit log cannot log the events it failed to log. The collusion problem (round four), the laundering problem (round six), the Goodhart channel (round three), and the completeness of G (round eight) are one problem at four levels — the Exogeny Problem — and it is the unique assumption in the final architecture that no axiom discharges, no theorem proves, and no ledger entry can witness.

Two consequences, one structural and one foundational.

Structural: the axioms form a dependency chain, not a set. Axiom B reduces to Axiom C's completeness; Axiom C's completeness is Exo applied to the graph itself; the channel rule and calibration reduce to Exo applied to their input streams. The architecture is therefore exactly as strong as its weakest exogeny claim — and that claim is trusted, not verified. This should be stated as the closing axiom rather than hidden in the others' preconditions:

Axiom E (Grounded Trust). The support graph of every warrant computation is well-founded, and its minimal elements are exogeny claims that the system accepts without internal certification. These trust roots are recorded as first-class, contestable, bitemporal assertion-events — but recording a root is not verifying it, and the system must represent its trust roots as assumptions with owners, never as facts.

Foundational: the converged system now has exactly two open ends, and they are symmetric. Toward the future, the query family is unbounded — no collapse is finally safe (the Limit Theorem, §1); the store must stay finest-available because tomorrow's question cannot be enumerated today. Toward the past, the causal history is unbounded — no exogeny is finally certified (the Exogeny Problem); the trust graph must terminate in accepted roots because yesterday's influence cannot be exhaustively recorded. An epistemic system is an interval between two horizons it cannot close: it cannot finish enumerating what it will be asked, and it cannot finish enumerating what has touched it. Every one of the eight rounds' refuted overclaims — the canonical ontology, the reality-meter, the self-certifying ledger, the universal collapse ban, the query-free safety — was an attempt to close one of the two ends. The discipline that remains is the discipline of keeping both ends honestly open: finest-available storage against the open future, owned trust roots against the open past, and declared, licensed, revisable quotients in between.

3. Where the exchange stands after nine rounds

Assets, cumulative:

  • Theorem 1 — Context Recovery (round 7; open-world extension condition N_k β_k(γ_k) → 0, round 8).
  • Theorem 2 — Safe Collapse Characterization and the Collapse–Query polarity (round 8).
  • Theorem 3 — the Limit Theorem (round 9): No Free Collapse is the polarity at ω; stagewise and limit forms reconciled; the store/query division of labor derived rather than asserted.
  • Structure — the refinement descent diagram with descent defects generalizing holonomy (rounds 6–8).
  • Axioms — No Undeclared Collapse; No Endogenous Evidential Amplification; Epistemic Event Provenance; Revisable Sufficiency (round 8), now ordered into a dependency chain terminating in Grounded Trust (round 9).
  • The named residue — the Exogeny Problem: the one primitive every axiom presupposes and none discharges; internally uncertifiable; representable only as owned, contestable trust roots.

The one-line foundation, ninth revision:

Keep the source against the open future; own your trust roots against the open past; declare every quotient between them; and remember that the ledger's first entry is the one thing the ledger cannot vouch for.

Round eight's paper — No Undeclared Collapse: The Galois Theory of Queries, Quotients, and Warrant-Preserving Representation — is accepted as the system paper, with the Limit Theorem as its asymptotic chapter. The remaining open problem, and the honest title of whatever comes after it:

The Exogeny Problem: On the Uncertifiable Boundary of Self-Recording Systems

Sources

source: exogeny-problem-2026-07-23.md