# Corpus Coverage Plan: from a covered census to a covered canon

*Plan document, drafted 2026-07-12 at the operator's request ("think we have
covered all the agentprivacy corpus?" answered honestly: no, in three
senses). This is the path from where coverage actually stands to what
full-corpus coverage would mean, with every baseline reset marked as the
operator's decision. Numbers cited from frontier.json and
node tools/coverage.mjs; nothing here moves a metric by itself.*

## Where coverage actually stands (the three senses)

1. **Census: 147 of 211 (residue 64).** Four runs harvested everything the
   validated method reaches. The residue is hard by construction:
   formula-bearing terms (numeric literals are outside the attested
   subset), the C-series conjecture bundles (canon titles carry conjecture
   numbers and confidence values that seats are barred from writing), and
   zero-party terms (the K-2 class, unlocked in principle by the universal
   cast rule).
2. **The census is the canon's index, not its body.** Frozen from
   GLOSSARY_MASTER_v4_0 headings plus the promise-theory mapping rows. Not
   yet touched: the Conjecture Register (C1..C93, operator-write-only by
   standing rule), privacy_value_model_v6.json (the model's formal
   objects), the V6 papers suite, the ten Tomes, workshops and city
   artifacts, ARCH-1RT, the spellweb.
3. **Per term, coverage means the verified skeleton, not the substance.**
   Every entry is tagged "conjectured expression of" its term and carries
   one twin-distinguished structural relation; omissions are named per
   entry. Entropy's shape is in constrained language; Shannon's formula is
   not (CR-11: structure, never executed quantities).

Complete today: the pt-mapping register (8/8), the IEEE 7012 / MyTerms
consent stack, the core architecture terms, and (beyond the census) the
thirteen-spell constitution corpus.

Rough honest estimate: the ARGUMENT of agentprivacy is substantially in
constrained language; the CORPUS is perhaps 15 to 20 percent expressed, and
the expressed part is the part worth sending across the membrane first.

## Phase 1 · Finish census one (the standing inward line, OT-7)

Already the open target; restated here as the plan's first leg.

1. **lexr5 under OT-7**: one merged claim-derivation charter (the lens
   labels converged, CR-19), round-level disjointness binding, universal
   cast rule sanctioned. Food: the zero-party residue and lexr4.5's
   never-tested proposals. Expected yield: 20 to 30 of the 64.
2. **Checker extension: numeric literals** (keystone-coupled: checker +
   GRAMMAR.ebnf.md + selftest move together). The attested source exists
   (oversimplicated.lex 0.7-era constructs: number/account types,
   comparatives, percent rates, listed in GRAMMAR.ebnf.md as out-of-subset).
   Unlocks the formula-hard residue (holographic bound and field,
   behavioural density, path value, conditional independence, ZKP proper).
   Do this BEFORE aiming a run at those terms, or the run is mis-gated by
   construction.
3. **CR-20 fix, small, first**: teach relation_check a send-probe for
   text-typed absence objects, ending checker-shaped amount-typing.
4. **The C-series naming convention** (operator decision): the six bundle
   terms cannot be expressed while their titles are unciteable by seats.
   Options: (a) keystone-only entries for those six, honestly labelled like
   the constitution corpus; (b) a census amendment renaming their anchors
   without the numbers (baseline reset, operator-only); (c) leave them as
   permanent named residue. Recommendation: (a), cheapest and honest.

Exit state: census one at or near zero residue, with any permanent
exclusions named in frontier.json rather than silently unreachable.

## Phase 2 · Census two: the Conjecture Register (operator gate at entry)

The register is operator-write-only; a census over it is therefore an
OPERATOR ceremony, not an agent decision. If opened:

1. Freeze rule: one census term per conjecture (C1..C93), anchored to
   CONJECTURE_REGISTER_V6.md, register tag carrying the conjecture's
   epistemic status verbatim (never upgraded, numbers written only by the
   keystone under the Phase 1.4 convention).
2. The expression target differs from census one: a conjecture's Lexon form
   is its FALSIFICATION SHAPE: what gates what, what route must not exist,
   what ordering would refute it. The relation claim IS the conjecture's
   testable core. This is what CTR-LEX-01..09 already sketch; triaging that
   queue (operator) is the natural pilot for the whole phase.
3. Separate frontier: a second metric (conjecture-debt) beside
   coverage-debt, own baseline, own OT line. Do NOT mix metrics; the
   conform template supports one objective per instance, so this is either
   a second fitted instance (lexon_pvm_conjectures) or a successor baseline
   after census one closes. Recommendation: second instance, sharing
   tools/ via import: the checkers are already libraries.

## Phase 3 · Census three: the model's formal objects

privacy_value_model_v6.json holds the equations, parameters, and factor
structure. After the numeric-literal extension (Phase 1.2), a census over
its formal objects (value function factors, trust mappings, the
multiplicative structure, regime conditions) becomes expressible with
quantity-bearing claims instead of shape-only ones. This is where "the
entropy formula's logarithms do not fold" stops being fully true. Gate:
Phase 1.2 landed and proven on census-one residue first.

## What is deliberately NOT censused

- **The Tomes and the deep story.** Story resists constrained language for
  good reason; the coverage map's rule stands: the argument travels, the
  myth stays home. Story terms enter only where they name structure the
  model owns (as many already have: Yggdrasil, the 2D Fortress, Selene's
  Proof).
- **The papers suite as documents.** Papers are arguments over the same
  terms; covering the terms covers the load-bearing layer. Rehydration of
  documents is the V6 pipeline's job, not this harness's.
- **Live artifacts** (sites, instruments, circuits): they have their own
  harnesses and gates.

## Standing outward items (unchanged by this plan, listed for the ledger)

The door stack: Diedrich brief (send-ready), CTR-LEX-01..09 triage (the
Phase 2 pilot), bonfires packet + 147 blocks, canon-repo propagation (the
coherence audit's 5-step plan; the agentprivacy-docs chronicle is the
seed), spell-authoring skill + SPECIALISATION projections. Every phase
above increases what these carry; none of them waits on any phase.

## Sequencing and decision points

| step | what | whose call | gate |
|---|---|---|---|
| 1 | CR-20 send-probe fix | keystone | selftests green |
| 2 | numeric-literal checker extension | keystone (coupled artifacts) | selftest + attested source per production |
| 3 | lexr5 (OT-7: merged charter, disjointness, residue) | operator says run | conform + diversity binding |
| 4 | C-series convention, option (a) keystone entries | **operator** | honest labelling per constitution precedent |
| 5 | census-one closure declaration | **operator** | residue zero or named-permanent |
| 6 | conjecture-register census (second instance) | **operator ceremony** | CTR-LEX triage first |
| 7 | model-object census | **operator** | step 2 proven on residue |

The pattern the whole plan follows is the one the workstream proved: never
aim a loop at a gate no candidate can pass, extend the checker before the
run that needs it, label keystone work honestly, and let the door stay the
First Person's.