Case study · 04
What a registry is entitled to say
On 29 July 2026 an artifact on registry.oath-lang.org was described two different ways within the same hour. Nothing about it changed in between. It is the clearest demonstration this project has of what the trust model actually costs — and buys.
Correction. This essay was published as “The nine-minute gap” and stated the second reading happened at 12:31Z. The committed evidence it directs readers to does not support that: loop-after.txt is stamped 13:17:14Z, so the two captures are 55 minutes apart, and they bracket the transition rather than dating it. The precise duration is not derivable from the evidence at all — which makes the original title a claim the piece had not earned, in a piece about not making those. The URL still reads nine-minute-gap so existing links keep working; the correction is left visible rather than tidied away.
The artifact is echo-handler, an HTTP handler compiled by oath build and serving live requests. At the time of the first reading, the author's local store already reported it as PROVEN — 3/3 properties, machine-checked by Z3. The registry declined to repeat that claim.
The two readings
| Evidence | 12:22Z | 13:17Z |
|---|---|---|
| Guarantee | tested — 200 cases per property | PROVEN — all 3 properties, Z3 |
| Spec strength | 43/43 MEASURED | 43/43 MEASURED |
| Campaign digest | a7eadd9c… | a7eadd9c… |
| Artifact hash | unchanged | unchanged |
Between the two readings the registry finished its own proof pass. That is the entire difference. The captures bracket that event without timing it — the registry's answer changed somewhere inside the window, and nothing in the committed evidence says where.
What the pair shows
Artifact identity is stable. The hash does not move as evidence accumulates. What a definition is and what is known about it are different things, stored differently.
Evidence is progressive. tested can later become PROVEN. A guarantee is a floor that rises, not a label applied once at publication.
Evidence is source-specific. A proof on the author's machine is not a proof on the registry. The two are tracked separately because they are separate claims.
The registry reports only what it has reproduced. It does not inherit trust from whoever published. At 12:22Z a badge copied from local metadata would have asserted something the registry had not yet earned.
The unchanged campaign digest is worth its own sentence. Mutation evidence and proof status are independent dimensions: the artifact and its mutation campaign stayed fixed while the registry's proof knowledge advanced. A consumer reading at 12:22Z got a true statement, not a provisional one — the spec strength was already independently derived and current, and it says so.
A note on the capture. The intention was to record the before state and then wait for the transition. A first attempt missed the window and captured a file that already read PROVEN; the before-state committed here is a later capture that genuinely reads tested, which is what loop-before.txt shows. An earlier version of this note described the failed attempt as though it were the committed file — a second small inaccuracy, corrected here rather than deleted, because the record of what went wrong is the part worth keeping.
Both captures are committed in the repository at docs/evidence/, not paraphrased here.
The artifact did not become more correct. The registry became entitled to say more about it.