Refutation-Ledger Values: Auditable Warrant Accounting for Contestable Derived Claims

Derived content is consumed everywhere and carries no negative evidence. A legal research tool can fabricate or misattribute source material on between 17 and 33 percent of pre-registered queries (the Stanford RegLab study, https://arxiv.org/abs/2405.20362). A widely deployed sepsis model reached hundreds of hospitals on vendor-reported performance, and an external evaluation measured an AUC of 0.63 where 0.76 to 0.83 had been reported, with 67 percent of sepsis cases missed and alerts on 18 percent of admissions (https://jamanetwork.com/journals/jamainternalmedicine/fullarticle/2781307). A near-1,000-student field experiment found that access to a generative tutor improved practice performance by 48 percent but left students 17 percent worse on later exams taken without it (https://www.pnas.org/doi/abs/10.1073/pnas.2422633122). In each case the consumed artifact carried a positive signal — a citation, a score, an explanation — and none carried a record of what had been attacked and had failed.

The gap is not that evidence is absent; it is that the negative half is never recorded. A passing test is a boolean with no ledger of what was tried and failed; an explanation is displayable text with no attempt record; a derived label has a producer and no defeaters. Assurance research argues the point directly: positive arguments are confirmation-bias prone, and defeaters should be recorded, investigated, and retained (Assurance 2.0; Bloomfield et al.). Existing machinery does not transfer: TMS and ATMS maintain consistency rather than graded warrant; provenance semirings are positive-only; survival scores over scientific claims are offline reports, not runtime values with cites. This paper contributes the smallest thing that closes part of that gap: a value-level contract in which a warrant is a ledger, the grade is a recomputable function of the ledger, and demotion is exact through cites.

• A value-level contract only: a value's warrant is an append-only ledger of attempts; the grade is a total, recomputable function of that ledger with a declared dependence-class term, a cap of 3, and the minimum over cited grades; demotion is exact with respect to the cite graph. Every individual mechanism is known.
• A frozen Derived-Claim Arena that gives the declared dependence relation its best shot: 48 generated claims, 8 defect classes, 16 refuters in 4 families with fixed blind spots (regime X adds two families sharing f2's blind spot), 12 matched conflict pairs per regime, and 200 pre-committed seeds.
• A falsification record reported in place: the syntactic tuple variant B6 is killed by the F1 criterion; the shipped relation B7 passes P1-P5 at the 5th percentile; the cheap baselines, the negative arms, and the oracle ceiling are printed beside the headline rather than removed.
• A read-only lab at /warrant that never affects a score, path, rank, or teacher view, with the exact grade definition, the saturation note, and the declared relation visible next to every value.
• An explicit limits list: fabricated-but-consistent ledgers, declared blind spots, absorbing kill, synthetic corpus, and the admission trust root, stated rather than hidden.

The closest work is the record layer, not the value layer. `falsification-ledger` implements a pre-registered falsification contract over an append-only, hash-chained ledger with content-addressed reports and a chain recompute; FalsiFlyer binds kernel, dataset, and decision-rule hashes to verdicts in a signed, hash-chained ledger; `falsifyr` scores the survival of scientific claims from attacks keyed by family and seed. Each makes a claim's standing depend on recorded attempts. None treats a runtime value as the unit, none feeds a cite graph, and none demotes dependents through cites when an attempt refutes. An earlier version of this table also listed a fourth record-layer project as the closest single match for the grade clause; that repository could not be located when the reference list was re-checked, the row has been withdrawn rather than left standing, and no part of the claim above depends on it. The negative result that survives is the one stated in Section 1: no ledger, ledger-family, or truth-discovery system we located composes ledger-as-warrant, a dependence-class grade, and cite demotion at the value level.

TMS and ATMS give exact dependency-directed retraction for beliefs and assumption sets, but a belief is alive or dead, not graded by a ledger; we borrow the retraction obligation and restrict our claim to it (the demotion sanity check exercises TMS-style retraction and is reported as a check, not as the novelty). Provenance semirings are positive-only: a refuted attempt has no semiring value, so demotion is not derivable from the algebra. Defeasible argumentation (Verheij's accrual; weighted gradual semantics) makes the quality and count of independent reasons a first-class grading input, but has no executable ledger, no syntactic refuter identity, and no exact cite demotion. Truth discovery detects copied sources and penalizes dependent votes, but produces claim confidence rather than runtime warrants. Subjective logic and Dempster-Shafer require source separation for fusion and document how hard that assumption is; the truth-discovery literature makes the same point in the grading setting, that counts over dependent sources are not counts over independent ones, and that is the standing counter-pressure that regime X operationalizes. Knight and Leveson is cited above as the multiversion-programming origin of the independence assumption, but that paper was not read for this table, so no claim here rests on its content. Assurance 2.0 records defeaters and warns that counts are gameable; EviBound promotes claims only with machine-checkable evidence; the evidence-ledger line audits traceability. T1 states the exact delta row by row, and nothing in that table supports a claim that ledgers, retraction, or attack-family scoring are new here.

A value is an artifact with a payload, a kind, a context, and frozen cites. Attempts arrive as append records over the value's chain, and nothing rewrites the chain. The model below is the whole contract; the engine, the audit, and the lab render it and nothing else.

Attempt = { refuter: RootId, family: RootId, seed: u64, outcome: survived | refuted | inconclusive, cost: Nat, witness: Digest, submittedBy: Identity }; Append = { prev: Digest, attempt: Attempt, admittedBy: VerifierId, sig: Digest }; Value = { id: ValueId, op: assert | derive, kind, payload, context, cites: frozen ValueId[], chain: Append[] }; ValueId = Digest(op, kind, payload, cites, context, genesis).

gamma(v) = dead if any admitted attempt in chain(v) has outcome refuted; else gamma(v) = min(K, classes(v), min over c in cites(v) of gamma(c)), where classes(v) is the number of distinct declared dependence classes among v's survived attempts; Dependent(a, b) := sameFamily(a, b) or declaredCoverageOverlap(a, b) >= 1/2; K = 3; seeds are repetitions and never create a class.

• I1' Auditable grade: any published grade equals the read-time recompute, transitively from leaves over the value's admitted chain; audit reports mismatches, malformed attempts, broken prev links, and anchor mismatches. Scope: arithmetic consistency and anchored tamper-evidence only, not truth and not authenticity of a well-formed fabrication.
• I2' No bookkeeping inflation: the class count counts distinct registered (refuter root, family root) pairs; identical attempts, replays, seed sweeps, re-signings, and cosmetic code versions add 0. Declared residual: distinct roots controlled by one author still count separately.
• I3' Exact demotion: with frozen cites and unique ids, a value is dead iff a directed path through cites reaches a value with an admitted refuted attempt; precision and recall are 1 by construction, and derive on dead cites yields a dead value.
• I4' Append-only, monotone, absorbing: chains append only and outcomes are immutable; appends with no refuted attempt are monotone non-decreasing on every affected grade; any append containing a refuted attempt is absorbing-dead for the value and all its dependents, and no operation resurrects a value.

The class count is a union over survived attempts. Surviving pairs are deduplicated by (refuter root, family root); two pairs share a declared dependence class when they share a family or when their families' declared coverage overlaps by at least one half, and the classes are the connected components of that relation. Seeds and cosmetic code versions change nothing: a replay adds no class. A refuter registered as a new lineage still counts as a new root, which is the declared residual that the registry makes visible through authorRoot.

K = 3. The cap is a product decision, not a measurement: it bounds the blast radius of a single value and keeps the grade readable, and it saturates. Above three declared dependence classes the grade stops moving, so diminishing returns are hidden and must be read from the ledger rather than from the number.

A derived value cannot out-warrant its weakest cite: the grade is also the minimum over cited grades, and any cited value that is dead makes the dependent dead. The closure is not code that propagates demotion; it is a read-time recursion over frozen cites, which is why over-demotion and under-demotion are impossible by construction once every cite names an earlier value.

Grades are pull-based. lambda(v) is a pure structural recursion memoized per call; there is no stored demotion state and no propagation pass. audit recomputes the closure transitively from leaves, compares the published grades against the recompute, and reports mismatches, malformed attempts, broken prev links, and anchor mismatches. Scope: arithmetic consistency against the ledger plus anchored tamper-evidence at the append point — not truth, not authenticity of a well-formed fabrication, and not a statement about evidence quality.

export function D(chain: readonly Append[], registry: Registry): number;
export function lambda(store: Store, registry: Registry, id: ValueId): Grade;
export function why(store: Store, id: ValueId): { readonly chain: readonly Append[]; readonly cites: readonly ValueId[] };
export function audit(
  id: ValueId,
  store: Store,
  registry: Registry,
  published: PublishedGrades,
  anchor: HeadAnchor | null,
): Report;
export function recomputeGrades(id: ValueId, store: Store, registry: Registry): ReadonlyMap<ValueId, Grade>;

// Grade = "dead" | 0 | 1 | 2 | 3; K = WARRANT_MAX_GRADE = 3.
// D counts declared dependence classes; lambda is the read-time closure.

The arena is built to give the declared dependence relation its best shot and to make cheap counters look strong. There are 48 claims across 4 kinds (hint, explanation, difficulty label, prerequisite edge); each claim has a hidden boolean defective flag, and a defective claim carries exactly one of 8 defect classes. Sixteen refuters sit in 4 families with fixed blind spots — f0 is blind to classes {0, 1}, f1 to {2, 3}, f2 to {4, 5}, f3 to {6, 7} — and an attempt refutes a defective claim exactly when its class is outside its family's blind spot; correct claims always survive. A fifth oracle family with an empty blind spot exists only for scoring.

Five regimes run over the same claims, so every comparison is paired: R redundant, D diverse, C churn (R plus extra seeds in the same family), P replay (identical attempts repeated), and X correlated, where f2' and f3' share f2's blind spot so a family count sees three modes where only one exists. Each regime holds 12 conflict pairs whose two sides are matched on raw survivor count, so the raw-count baseline B1 ties by construction. The 200 seeds are frozen before the run and regenerate the corpus, the manifests, and the pairs.

s <- (1664525 * s + 1013904223) mod 2^32; every regime, claim assignment, and conflict pair is regenerated from the frozen seed list, and no other randomness exists in the arena.

Before any number: the arena's ground truth and the shipped grader's dependence relation are two readings of the same declared table. In regime X, families F2P and F3P carry F2's blind spot and overlap its declared coverage, so B7 merges exactly what B8 treats as one mode, and B7 = B8 by construction. Every comparison involving B7 and B8 in T3-T5 is therefore a consistency check on the implementation, not a measurement of grader quality, and the +1.000 pair-win, +1.000 AUC, and +1.000 AP@12 gaps over B5 are consequences of the declared table rather than findings about evidence fusion. What that arena does reproduce is the published result that naive count fusion collapses when sources are correlated (Dong, Berti-Equille & Srivastava 2009; Knight & Leveson 1986), which is a reason to discount correlated counts and not a new result. The two informative contrasts in the arena are B5 versus B6 (dedup by family versus dedup by attempt tuple) and B7 versus B5 under seed churn, where the claim is invariance rather than superiority.

Every table and figure below is transcribed from the arena artifact (digest ca0cda0f562b8c10, 200 seeds), and the permanent gate re-runs the arena and pins the headline cells. Means and 5th percentiles are over the seed sweep; criteria apply to the 5th percentile except where a criterion names churn or demotion. One property of these cells needs stating because it makes the threshold machinery weaker than it looks: for pair-win and AUC the per-seed value is identical across all 200 seeds, so the mean and the 5th percentile coincide and the percentile threshold is satisfied exactly when the mean is. Those cells carry no sampling variability, and the seed sweep is a determinism check, not a stability check. Only the AP@12 cells for the count baselines show spread (mean 0.5175, 5th percentile 0.250).

Reading the tables. Ties count 0.5 in pair-win; thresholds are stated at the 5th percentile (nearest rank over the 200 frozen seeds) and both the mean and the percentile are printed. For the pair-win and AUC cells the per-seed value is identical across all 200 seeds, so mean and 5th percentile coincide and the percentile threshold is satisfied exactly when the mean is; those cells carry no sampling variability and the seed sweep is a determinism check, not a stability check. Only the AP@12 cells for the count baselines show spread (mean 0.5175, 5th percentile 0.250). B8 is analysis-only: it is the oracle family's blind-spot-class count, present for the ceiling argument and never implementable by the system; in regime X it coincides with B7 by construction, so their agreement is a consistency check. B5 is the strongest cheap adversary we constructed (distinct surviving families, capped at K = 3 - a cap that is load-bearing in regime X, where a defective claim can survive three families), not a strawman, but it is also a capped counterfactual rather than an adversarial optimum. B0-B4 and B6 are constant or chance-like on the matched pairs, which is what count-matching is for. The aggregates for regimes R, D, C, and P coincide at the reported precision; X is the discriminating regime, and only the declared dependence relation stays at 1.000 there.

The contract has a visible envelope. Every item below is a limit of the shipped system or of the experiment, not a caveat added after the fact.

• dead is not 0: the grade domain is dead plus 0 through K; dead is terminal, ordered below every k-warranted value, and never rendered or counted as 0.
• Declared dependence has blind spots: D is syntactic (same declared family, or declared coverage overlap of at least one half). Shared method, shared input domain, and shared blind spot survive it; Knight and Leveson's correlated-failure result is the standing counter-pressure, and regime X is built to show a family-dedup count being fooled by it.
• Fabricated but consistent ledgers are out of scope: a producer that controls the append point can fabricate a well-formed, internally consistent ledger, and audit-by-recompute will recompute from it. The admission trust root is the append point; hash chains are tamper evidence, not signatures.
• Absence of attempts is not survival: 'no challenge recorded' is not a positive warrant, and the empty ledger and the all-inconclusive ledger both grade 0.
• Saturation at K: the cap is 3; above it, more surviving classes do not move the grade and diminishing returns are hidden.
• Refuter cost is recorded, never weighed: a cheap attempt and an expensive attempt count alike.
• Instance versus claim semantics: values are artifacts, and the same payload can exist as a different instance in a different context, so a warrant answers about an instance unless canonical context identity is adopted.
• B8 is not implementable: it is a generator-side oracle used for scoring only, never in the engine or the lab.
• Demotion sanity tests retraction, not significance: precision and recall are 1 by construction against the reachable-set oracle; it checks TMS-style retraction and must not be sold as the novelty.
• The corpus is synthetic: ground truth is generated from the blind-spot table, never inferred from a grader; 48 claims and 12 pairs per regime are small, and no real content is audited.
• The arena is circular where it looks strongest: in regime X the shipped relation B7 and the analysis-only oracle B8 are the same function of the same declared table, so the +1.000 pair-win, AUC, and AP@12 gaps over B5 are consequences of the generator. What the arena supports is stability under seed churn and the pre-declared kill of B6; the collapse of count fusion under correlated sources is the published result it reproduces, not a discovery (Dong, Berti-Equille & Srivastava 2009; Knight & Leveson 1986).
• The 200 seeds are regenerations of a deterministic generator, not 200 observations: for pair-win and AUC the per-seed value is identical, so mean and 5th percentile coincide and the percentile threshold is non-binding. Only the AP@12 count-baseline cells show spread.
• No truth guarantee: a survived attempt does not make a claim true; a refuted attempt is taken on the refuter's authority, and a false refutation is permanent because kill is absorbing.
• One author can register many roots and families; the registry makes author concentration visible, but semantic dependence is undecidable and remains a declared residual that K caps rather than fixes.