Struct Classification 

pub struct Classification {
    pub point_type: ConvergencePointType,
    pub substrate: SubstrateType,
    pub horizon: Horizon,
    pub calm: CalmClassification,
    pub data_classification: DataClassification,
}

Lattice position of a Process — six orthogonal axes.

Fields

point_type: ConvergencePointType

substrate: SubstrateType

horizon: Horizon

calm: CalmClassification

data_classification: DataClassification

Implementations

impl Classification

pub fn gate_compute() -> Self

The workspace-baseline classification — a ConvergencePointType::Gate point on the SubstrateType::Compute substrate with every other axis at its Default. The (Gate, Compute) pair names an unremarkable barrier point in the Compute plane: no domain-specific structural claim (no fan-out / fan-in / broadcast / observation semantics beyond the barrier gate) and no domain-specific substrate claim (no Financial / Network / Storage / Security / Identity / Observability / Regulatory plane bringing in its own compliance baselines). The three defaulted axes ride at the intentional workspace baseline the sibling closed-set primitives already own: Horizon at HorizonKind::Bounded (terminates naturally, no asymptotic metric axes required), CalmClassification::Monotone (no coordination required per CALM), and DataClassification::Internal (access-controlled but not externally regulated).

Pre-lift the six-line Classification { point_type: Gate, substrate: Compute, horizon: Default::default(), calm: Default::default(), data_classification: Default::default() } struct-literal recurred at TEN sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold — one production consumer plus nine test-fixture callsites spread across four crates, each restating the SAME (Gate, Compute) baseline verbatim:

• crate::ephemeral::default_ephemeral_class — the substitute [EphemeralSpec::into::<crate::crd::ProcessSpec>] fills into crate::crd::ProcessSpec::classification when the operator omits an explicit :classification slot on (defephemeral …). The one PRODUCTION consumer of the shape — a regression that drifted its point-type or substrate axis silently retargets every unadorned ephemeral to a different plane.
• crate::crd’s + crate::lib’s + crate::lifetime_clock’s + tatara_reconciler::{claim,render}’s + tatara_pool_reconciler:: controller_pool’s empty_spec / empty_process_spec / ephemeral_process / permanent_process test-fixture helpers + inline ProcessSpec literals — nine test-fixture callsites restating the SAME six-line struct-literal at the same shape.

Post-lift every callsite reads Classification::gate_compute(); a future workspace-wide baseline shift (a new Horizon default, a promotion of Compute to a compound baseline that pre-fills a canonical CalmClassification, a per-baseline compliance overlay stamping through the classification, or a rename of either axis enum) lands at ONE substrate function here and every downstream consumer inherits the upgrade mechanically. The current pin ties the three defaulted axes to the sibling closed-set defaults (HorizonKind::Bounded, CalmClassification::Monotone, DataClassification::Internal) so a future change to any sibling default surfaces at this primitive’s tests rather than as silent drift across ten independent callsites.

Sibling to the _or_default / _or_placeholder primitive family on crate::prelude::Process on the (return-form × axis) axis — those primitives own the borrow-form projections off a live Process; this one owns the construction shape for a fresh crate::crd::ProcessSpec whose classification axis is unremarkable. A future peer Classification::observe_observability() or similar named variant lands as a sibling method here when a second unremarkable-baseline shape opens.

Theory anchor: THEORY.md §VI.1 (generation over composition — the six-line struct-literal shape recurred at TEN hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger and is lifted onto ONE workspace-wide owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — a regression that drifted the baseline axis choice at only one consumer, or that broke the sibling-default correspondence, surfaces at this primitive’s tests rather than as silent operator-visible skew between the ephemeral sugar substitute and the ten downstream test-fixtures whose assertions depend on the shape).

pub fn has_point_type(&self, kind: ConvergencePointType) -> bool

Closed-set-driven presence probe — does this Classification carry the given ConvergencePointType discriminator on its Self::point_type slot? The ONE substrate primitive that owns the (Classification, ConvergencePointType) -> bool scalar-carrier walk shape.

Third scalar-carrier peer on the presence-probe axis

Peer of crate::spec::SignalPolicy::has_sighup_strategy and crate::encapsulates::EncapsulatesSpec::has_mode — all three probe a scalar closed-set-discriminator field on an inner crate::crd::ProcessSpec struct via a one-line self.<field> == kind body. Together they compose the SCALAR-CARRIER stratum of the workspace-wide closed-set-driven presence-probe algebra (the workspace-wide algebra spans three underlying representation kinds — Option-slot, slice, scalar — see the crate::spec::SignalPolicy::has_sighup_strategy docstring for the full-shape rundown; this method is the third scalar-carrier instance).

Semantics — VARIANT match, not POPULATED slot

has_point_type(kind) returns true iff self.point_type == kind. Distinct from BOTH prior scalar-carrier peers on the (parent-shape × child-shape) axis:

• crate::spec::SignalPolicy::has_sighup_strategy lives on a non-Option, DEFAULTED parent (SignalPolicy: Default) with a defaulted scalar child (SighupStrategy: Default = Reconverge) — a default carrier reads true for the default variant only.
• crate::encapsulates::EncapsulatesSpec::has_mode lives on an OPTION parent (spec.encapsulates: Option<EncapsulatesSpec>) with a defaulted scalar child (EncapsulationMode: Default = Manage) — a bare None parent reads false for every variant.
• has_point_type lives on a REQUIRED, non-Option, NON-DEFAULT parent (Classification has no impl Default) with a NON-DEFAULT scalar child (ConvergencePointType has no impl Default) — every well-formed crate::crd::ProcessSpec carries a Classification whose point_type slot is deliberately chosen by the operator, so the probe returns true on exactly ONE variant per spec and false on the other seven, with no default-arm short-circuit shortcut.

This closes the (required-parent × required-scalar-child) corner of the workspace-wide closed-set-driven presence-probe algebra at its first substrate primitive.

Compounding

A future closed-set-discriminator scalar field on Classification (a peer has_substrate, has_calm, has_data_classification — the four remaining classification-axis closed sets) lands as ONE peer inherent method with the same one-line self.<field> == kind body and routes through the same strip_and_classify_prefixed_kind::<K, _> shape in tatara-check. A future ConvergencePointType variant (a hypothetical Demux / Mux / Pipeline for finer topology carving) reaches every downstream through ONE ALL entry on the closed set with the probe body untouched.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the scalar-carrier presence-probe body lives at ONE substrate site so every downstream (point-type-<kind> require-tag family in tatara-check, closed-set audit dispatchers, future variant additions on ConvergencePointType) binds through the SAME shape rather than restating the classification.point_type == kind closure body at each callsite. THEORY.md §VI.1 — generation over composition; a future ConvergencePointType variant lands at ONE ALL entry + ONE as_str arm on the closed set and the probe picks it up mechanically without further per-consumer edits.

pub fn has_substrate(&self, kind: SubstrateType) -> bool

Closed-set-driven presence probe — does this Classification carry the given SubstrateType discriminator on its Self::substrate slot? The ONE substrate primitive that owns the (Classification, SubstrateType) -> bool scalar-carrier walk shape.

Fourth scalar-carrier peer on the presence-probe axis

Peer of crate::spec::SignalPolicy::has_sighup_strategy, crate::encapsulates::EncapsulatesSpec::has_mode, and Self::has_point_type — all four probe a scalar closed-set- discriminator field on an inner crate::crd::ProcessSpec struct via a one-line self.<field> == kind body. Together they compose the SCALAR-CARRIER stratum of the workspace-wide closed-set-driven presence-probe algebra (the workspace-wide algebra spans three underlying representation kinds — Option- slot, slice, scalar — see the crate::spec::SignalPolicy::has_sighup_strategy docstring for the full-shape rundown; this method is the fourth scalar- carrier instance).

Semantics — VARIANT match, not POPULATED slot

has_substrate(kind) returns true iff self.substrate == kind. FIRST co-tenant on the (required-parent × required- scalar-child) corner of the algebra with Self::has_point_type — both probe REQUIRED, non-Option, NON-DEFAULT slots on the same Classification parent whose two required axes carry no Default impl, so exactly ONE of the eight SubstrateType variants and exactly ONE of the eight ConvergencePointType variants answer true per well-formed crate::crd::ProcessSpec, with no default-arm short-circuit shortcut. Distinct from the two prior scalar-carrier peers on the (parent-shape × child- shape) axis: has_sighup_strategy lives on a non-Option, DEFAULTED parent (crate::spec::SignalPolicy carries #[derive(Default)]) with a defaulted scalar child (crate::signal::SighupStrategy defaults to crate::signal::SighupStrategy::Reconverge); has_mode lives on an OPTION parent (spec.encapsulates: Option<EncapsulatesSpec>) with a defaulted scalar child (crate::encapsulates::EncapsulationMode defaults to crate::encapsulates::EncapsulationMode::Manage).

This POPULATES the (required-parent × required-scalar-child) corner of the workspace-wide closed-set-driven presence-probe algebra at its SECOND substrate primitive after Self::has_point_type opened the corner, pinning the corner as a proven-repeatable primitive shape rather than a single- example curiosity.

Compounding

A future closed-set-discriminator scalar field on Classification (a peer has_calm on CalmClassification, has_data_classification on DataClassification — the two remaining defaulted-scalar-child classification-axis closed sets) lands as ONE peer inherent method with the same one-line self.<field> == kind body and routes through the same strip_and_classify_prefixed_kind::<K, _> shape in tatara-check. A future SubstrateType variant (a hypothetical Consensus for governance substrates, Physical for hardware substrates, Cache for ephemeral memoization substrates) reaches every downstream through ONE ALL entry on the closed set with the probe body untouched.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the scalar-carrier presence-probe body lives at ONE substrate site so every downstream (substrate-<kind> require-tag family in tatara-check, closed-set audit dispatchers, future variant additions on SubstrateType) binds through the SAME shape rather than restating the classification.substrate == kind closure body at each callsite. THEORY.md §VI.1 — generation over composition; a future SubstrateType variant lands at ONE ALL entry + ONE as_str arm on the closed set and the probe picks it up mechanically without further per-consumer edits.

pub fn has_calm(&self, kind: CalmClassification) -> bool

Closed-set-driven presence probe — does this Classification carry the given CalmClassification discriminator on its Self::calm slot? The ONE substrate primitive that owns the (Classification, CalmClassification) -> bool scalar-carrier walk shape.

Fifth scalar-carrier peer on the presence-probe axis

Peer of crate::spec::SignalPolicy::has_sighup_strategy, crate::encapsulates::EncapsulatesSpec::has_mode, Self::has_point_type, and Self::has_substrate — all five probe a scalar closed-set-discriminator field on an inner crate::crd::ProcessSpec struct via a one-line self.<field> == kind body. Together they compose the SCALAR-CARRIER stratum of the workspace-wide closed-set-driven presence-probe algebra (the workspace-wide algebra spans three underlying representation kinds — Option-slot, slice, scalar — see the crate::spec::SignalPolicy::has_sighup_strategy docstring for the full-shape rundown; this method is the fifth scalar-carrier instance).

Semantics — VARIANT match, not POPULATED slot

has_calm(kind) returns true iff self.calm == kind. FIRST occupant on a FRESH corner of the (parent-shape × child-shape) axis: a REQUIRED, non-Option, NON-DEFAULT parent (Classification has no impl Default because its two required axes point_type/substrate carry no default) combined with a DEFAULTED scalar child (CalmClassification defaults to CalmClassification::Monotone via #[default]). Distinct from every prior scalar-carrier peer on the (parent-shape × child-shape) axis:

• crate::spec::SignalPolicy::has_sighup_strategy lives on a non-Option, DEFAULTED parent (crate::spec::SignalPolicy carries #[derive(Default)]) with a defaulted scalar child (crate::signal::SighupStrategy defaults to crate::signal::SighupStrategy::Reconverge) — a bare SignalPolicy reads true on the default variant only.
• crate::encapsulates::EncapsulatesSpec::has_mode lives on an OPTION parent (spec.encapsulates: Option<EncapsulatesSpec>) with a defaulted scalar child (crate::encapsulates::EncapsulationMode defaults to crate::encapsulates::EncapsulationMode::Manage) — a bare None parent reads false for every variant.
• Self::has_point_type + Self::has_substrate both live on the REQUIRED, non-Option, NON-DEFAULT Classification parent with a NON-DEFAULT scalar child — every well-formed crate::crd::ProcessSpec carries a Classification whose corresponding slot was deliberately chosen by the operator, so exactly ONE of the eight variants answers true per spec.
• has_calm lives on the REQUIRED, non-Option, NON-DEFAULT Classification parent with a DEFAULTED scalar child (CalmClassification::Monotone is the Default via #[default]) — a bare Classification filled via ..Default::default() on the defaulted axes reads true for the default variant (CalmClassification::Monotone) and false for every other. Exactly ONE of the two variants answers true per spec, and the default-arm short-circuit is present (the operator can DECLINE to name the CALM axis and the spec still answers true on the default variant).

This OPENS the (required-parent × defaulted-scalar-child) corner of the workspace-wide closed-set-driven presence-probe algebra at its first substrate primitive — a corner distinct from all four prior scalar-carrier peers (which sit on the three prior corners: defaulted-parent × defaulted-child, Option-parent × defaulted-child, required-parent × required-child).

Compounding

A future closed-set-discriminator scalar field on Classification whose child carries #[derive(Default)] (a peer has_data_classification on DataClassification, whose default is DataClassification::Internal via #[default] — the remaining classification-axis closed set on a defaulted-scalar-child slot) lands as ONE peer inherent method with the same one-line self.<field> == kind body and routes through the same strip_and_classify_prefixed_kind::<K, _> shape in tatara-check. A future CalmClassification variant (a hypothetical ConditionallyMonotone for ops that are monotone under a witness, like CRDT joins under a fixed schema) reaches every downstream through ONE ALL entry on the closed set with the probe body untouched.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the scalar-carrier presence-probe body lives at ONE substrate site so every downstream (calm-<kind> require-tag family in tatara-check, closed-set audit dispatchers, future variant additions on CalmClassification) binds through the SAME shape rather than restating the classification.calm == kind closure body at each callsite. THEORY.md §VI.1 — generation over composition; a future CalmClassification variant lands at ONE ALL entry + ONE as_str arm on the closed set and the probe picks it up mechanically without further per-consumer edits.

pub fn has_data_classification(&self, kind: DataClassification) -> bool

Closed-set-driven presence probe — does this Classification carry the given DataClassification discriminator on its Self::data_classification slot? The ONE substrate primitive that owns the (Classification, DataClassification) -> bool scalar-carrier walk shape.

Sixth scalar-carrier peer on the presence-probe axis

Peer of crate::spec::SignalPolicy::has_sighup_strategy, crate::encapsulates::EncapsulatesSpec::has_mode, Self::has_point_type, Self::has_substrate, and Self::has_calm — all six probe a scalar closed-set- discriminator field on an inner crate::crd::ProcessSpec struct via a one-line self.<field> == kind body. Together they compose the SCALAR-CARRIER stratum of the workspace-wide closed-set-driven presence-probe algebra (the workspace-wide algebra spans three underlying representation kinds — Option- slot, slice, scalar — see the crate::spec::SignalPolicy::has_sighup_strategy docstring for the full-shape rundown; this method is the sixth scalar- carrier instance).

Semantics — VARIANT match, not POPULATED slot

has_data_classification(kind) returns true iff self.data_classification == kind. SECOND co-tenant on the (required-parent × defaulted-scalar-child) corner of the algebra alongside Self::has_calm — both probe REQUIRED, non-Option, NON-DEFAULT Classification parent slots with a DEFAULTED scalar child (DataClassification defaults to DataClassification::Internal via #[default], sibling to CalmClassification::Monotone’s #[default]), so exactly ONE of the six DataClassification variants answers true per spec AND the default-arm short-circuit is present (a Classification filled via ..Default::default() on the data_classification axis reads true on the default variant DataClassification::Internal and false on every other).

This POPULATES the (required-parent × defaulted-scalar-child) corner of the workspace-wide closed-set-driven presence-probe algebra at its SECOND substrate primitive after Self::has_calm opened the corner, pinning the corner as a proven-repeatable primitive shape rather than a single-example curiosity. The corner-property contract (“bare Classification reads true on the default variant”) now walks TWO independent defaulted-scalar-child slots on the SAME Classification parent — a regression that promoted a different DataClassification variant to #[default] (or wired the arm to a fixed variant answer) fails HERE at ONE narrow substrate site before drifting through every unadorned Process’s baseline data-classification answer.

Compounding

This method exhausts the four scalar closed-set-discriminator axes on Classification (Self::has_point_type, Self::has_substrate, Self::has_calm, and Self::has_data_classification) — the six-axis classification lattice publishes ALL FOUR of its scalar-carrier presence probes at ONE substrate site each. The remaining two axes (horizon — a nested struct threading HorizonKind through horizon.kind; the sixth axis is variant-dependent on the HorizonKind::Asymptotic arm) live on nested-struct-scalar slots rather than the direct-scalar corner the four current peers span — the Self::has_horizon_kind peer opens that fresh (required-parent × nested-struct-scalar-child) corner with the same has(kind) shape composed through one struct hop. A future DataClassification variant (a hypothetical seventh variant beyond Public / Internal / Confidential / Pii / Phi / Pci — say a TradeSecret bucket for competitive-sensitive data, or an Anonymized bucket for pseudonymized-PII whose regulatory posture differs) reaches every downstream through ONE ALL entry on the closed set + ONE as_str arm + ONE sensitivity_rank arm + one arm per predicate with the probe body untouched.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the scalar-carrier presence-probe body lives at ONE substrate site so every downstream (data-classification-<kind> require-tag family in tatara-check, closed-set audit dispatchers, future variant additions on DataClassification) binds through the SAME shape rather than restating the classification.data_classification == kind closure body at each callsite. THEORY.md §VI.1 — generation over composition; a future DataClassification variant lands at ONE ALL entry + ONE as_str arm on the closed set and the probe picks it up mechanically without further per-consumer edits.

pub fn has_horizon_kind(&self, kind: HorizonKind) -> bool

Closed-set-driven presence probe — does this Classification carry the given HorizonKind discriminator on its Self::horizon.kind slot? The ONE substrate primitive that owns the (Classification, HorizonKind) -> bool nested-struct- scalar-carrier walk shape.

Seventh peer on the presence-probe axis — first on a fresh corner

Peer of crate::spec::SignalPolicy::has_sighup_strategy, crate::encapsulates::EncapsulatesSpec::has_mode, Self::has_point_type, Self::has_substrate, Self::has_calm, and Self::has_data_classification on the workspace-wide closed-set-driven presence-probe algebra — the four scalar-carrier peers on Classification all read a closed-set discriminator DIRECTLY off a scalar Classification slot (point_type, substrate, calm, data_classification). has_horizon_kind instead threads through a NESTED-STRUCT intermediary (Horizon, the defaulted nested struct owning the horizon axis on the six-axis classification lattice) to reach a scalar HorizonKind discriminator on horizon.kind. This OPENS the (required-parent × nested- struct-scalar-child) corner of the algebra at its FIRST substrate primitive — a fresh corner distinct from all four corner-property-exhaustive scalar-carrier peers on Classification.

Semantics — VARIANT match on the nested scalar, not POPULATED nested struct

has_horizon_kind(kind) returns true iff self.horizon.kind == kind. The nested Horizon struct carries Default via #[derive(Default)] and its kind field defaults to HorizonKind::Bounded via #[default], so a Classification filled via ..Default::default() on the horizon axis reads true on the default kind HorizonKind::Bounded and false on HorizonKind::Asymptotic. The default-arm short-circuit is therefore present at this corner too — but through the extra struct hop the peer scalar-carrier peers on the defaulted- child corner (has_calm, has_data_classification) walk directly. A regression that dropped #[default] on HorizonKind, or that replaced Horizon::default() in Classification::gate_compute with an explicit non-Bounded kind, surfaces at this primitive’s tests before drifting through every unadorned Process’s baseline horizon answer.

Compounding

This method OPENS the (required-parent × nested-struct-scalar- child) corner of the workspace-wide closed-set-driven presence-probe algebra, distinct from the four corner-property- exhaustive scalar-carrier peers on Classification (Self::has_point_type, Self::has_substrate, Self::has_calm, Self::has_data_classification) whose bodies read a closed-set discriminator directly off a scalar slot. A future co-tenant on this fresh corner (a peer probe on another nested-struct’s scalar discriminator, e.g. a hypothetical has_optimization_direction reaching spec.classification.horizon.direction.unwrap_or_default(), or a nested-struct-scalar discriminator on a different ProcessSpec field’s inner struct) lands as ONE peer inherent method with the same two-hop self.<outer>.<inner> == kind body and routes through the same strip_and_classify_prefixed_kind::<K, _> shape in tatara-check. A future HorizonKind variant (a hypothetical Periodic sentinel for “terminates on each window boundary then re-arms”, pre-flagged on the closed set’s ALL docstring) reaches every downstream through ONE ALL entry + one as_str arm + one terminates arm + one requires_metric_axes arm on the closed set with the probe body untouched.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the nested-struct-scalar-carrier presence- probe body lives at ONE substrate site so every downstream (horizon-<kind> require-tag family in tatara-check, future audit dispatchers walking HorizonKind::ALL, future variant additions on HorizonKind) binds through the SAME has(kind) shape rather than restating the classification.horizon.kind == kind closure body at each callsite. THEORY.md §VI.1 — generation over composition; a future HorizonKind variant lands at ONE ALL entry + ONE as_str arm on the closed set and the probe picks it up mechanically without further per-consumer edits.

pub fn has_optimization_direction(&self, kind: OptimizationDirection) -> bool

Closed-set-driven presence probe — does this Classification carry the given OptimizationDirection discriminator on its Self::horizon.direction slot (with the substrate Option::unwrap_or_default treating None as the closed set’s #[default] Minimize)? The ONE substrate primitive that owns the (Classification, OptimizationDirection) -> bool nested- struct-Option-scalar-carrier walk shape.

Second occupant on the nested-struct-scalar-child corner —

the Option-hop co-tenant

Peer of Self::has_horizon_kind on the (required-parent × nested-struct-scalar-child) corner opened by that method — same two-hop composition through the nested defaulted Horizon intermediary, but the inner scalar slot is direction: Option<OptimizationDirection> (an Option-hop past the same nested Horizon) rather than a bare scalar. The corner therefore admits BOTH direct nested-scalar shapes (Horizon carries kind: HorizonKind directly, Self::has_horizon_kind walks it) AND Option-nested-scalar shapes (Horizon carries direction: Option<OptimizationDirection>, this method walks it through Option::unwrap_or_default), pinning the corner as a proven-repeatable primitive shape rather than a single- example curiosity. Every prior scalar-carrier peer on Classification (has_point_type, has_substrate, has_calm, has_data_classification) reads a closed-set discriminator DIRECTLY off a scalar Classification slot; this method (like Self::has_horizon_kind) threads through the nested Horizon intermediary, and additionally traverses the Option-slot with unwrap_or_default so the operator’s :requires (optimization-direction-Minimize) on an unadorned baseline still answers true on the closed set’s default arm.

Semantics — VARIANT match on the Option-defaulted nested

scalar, not POPULATED Option

has_optimization_direction(kind) returns true iff self.horizon.direction.unwrap_or_default() == kind. OptimizationDirection carries #[default] Minimize via the derived Default impl, so a Process filled through Horizon::bounded (which leaves direction: None) or through Horizon::default() (same shape, direction: None) answers true on OptimizationDirection::Minimize and false on OptimizationDirection::Maximize. This mirrors the default-arm short-circuit contract every other closed-set- defaulted-child probe on Classification publishes (has_calm, has_data_classification, has_horizon_kind) — the Option-hop is soft-mapped to the closed set’s default arm rather than surfaced as a distinct presence axis. A regression that flipped OptimizationDirection’s #[default] off Minimize (which would silently invert every unadorned Asymptotic Process’s rate-window evaluator polarity — see the OptimizationDirection::Minimize variant docstring) fails at this probe’s default-arm tests before drifting through every downstream consumer.

Semantics rationale — Option-hop as default vs presence

The direction: Option<OptimizationDirection> slot on Horizon is documented as “Asymptotic only” — a Bounded horizon has no meaningful direction so the operator leaves it None. Yet the closed set carries #[default] Minimize, so a bare Bounded Process’s optimization direction reads as Minimize at every consumer downstream via Option::unwrap_or_default. That default IS the substrate’s operator-facing answer for “what direction would this Process optimize toward if it became Asymptotic without further annotation?”, and a :requires (optimization-direction- Minimize) audit at the checks.lisp surface correctly matches every unadorned Process — matching the corner-property contract every other defaulted-child probe publishes. An operator who wants a strict presence axis (is direction *actually* set?) gets that answer through a distinct future primitive (has_optimization_direction_set) that would read the is_some bit alone — orthogonal to this variant-equality probe. This method commits to the variant-equality interpretation so the corner-property contract stays uniform with the four scalar-carrier peers.

Compounding

This method POPULATES the (required-parent × nested-struct- scalar-child) corner at its SECOND substrate primitive after Self::has_horizon_kind opened it — pinning the corner as a proven-repeatable primitive shape rather than a single- example curiosity, and DEMONSTRATING that the corner admits both direct-scalar and Option-scalar traversals through the same nested-struct intermediary via the closed set’s default. A future co-tenant on this corner (a peer probe on another nested-struct’s scalar or Option-scalar discriminator, e.g. a hypothetical has_backend_port_family reaching spec.routing.as_ref().and_then(|r| r.backend.tls_issuer.as_ref()).is_some() or a nested-struct-scalar discriminator on spec.encapsulates.<some-inner>.kind) lands as ONE peer inherent method with the same two-hop self.<outer>.<inner> walk (with or without an Option-hop threading through the closed set’s Default) and routes through the same strip_and_classify_prefixed_kind::<K, _> shape in tatara-check. A future OptimizationDirection variant (a hypothetical Stabilize sentinel for “drive toward a target value”, pre-flagged on the closed set’s ALL docstring) reaches every downstream through ONE ALL entry

• one as_str arm + one prefers_lower arm + one is_improvement arm on the closed set with the probe body untouched.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the nested-struct-Option-scalar-carrier presence-probe body lives at ONE substrate site so every downstream (optimization-direction-<kind> require-tag family in tatara-check, future audit dispatchers walking OptimizationDirection::ALL, future variant additions on OptimizationDirection) binds through the SAME has(kind) shape rather than restating the classification.horizon.direction.unwrap_or_default() == kind closure body at each callsite. THEORY.md §VI.1 — generation over composition; a future OptimizationDirection variant lands at ONE ALL entry + ONE as_str arm on the closed set and the probe picks it up mechanically without further per-consumer edits.

pub fn has_input_arity(&self, kind: Arity) -> bool

Closed-set-driven presence probe — does this Classification carry a ConvergencePointType whose typed input-edge cardinality projection (ConvergencePointType::input_arity) matches the given Arity discriminator? The ONE substrate primitive that owns the (Classification, Arity) -> bool derived-typed-projection walk shape.

Third occupant on the (required-parent × nested-struct-scalar-child) corner — first via a derived-typed-projection

Peer of Self::has_horizon_kind and Self::has_optimization_direction on the (required-parent × nested-struct-scalar-child) corner. Distinct from the two on ONE dimension: those two read a raw discriminator directly off the nested Horizon slot (self.horizon.kind / self.horizon.direction.unwrap_or_default()) so the child’s closed set IS the field’s type; this probe threads through the closed-set typed projection ConvergencePointType::input_arity (a const fn many-to-one collapse Transform | Fork | Broadcast | Observe → One, Join | Gate | Select | Reduce → Many) so the child’s closed set is REACHED THROUGH a typed projection layer, not read raw off a scalar. Byte-for-byte symmetric with the derived-typed-projection precedent set by crate::export::ExportSpecSliceExt::has_report_payload_shape on the (Option-parent × Vec-child × nested-Option-carrier × derived-typed-projection) corner — that peer routes through crate::export::ReportFormat::payload_shape the same way this method routes through ConvergencePointType::input_arity. FIRST occupant of the derived-typed-projection variant on the (required-parent × nested-struct-scalar-child) corner — widening the corner from “raw discriminator only” to “raw discriminator OR typed projection over the child” and pinning the corner as a proven-repeatable primitive shape rather than a direct-field-equality curiosity.

Semantics — VARIANT match on the projected image, not on the source

has_input_arity(kind) returns true iff self.point_type.input_arity() == kind. Arity carries no Default impl (the Arity::ALL closed set is a bare 2-arm enum with no #[default]), so exactly ONE of the two arms answers true per well-formed crate::crd::ProcessSpec, with no default-arm short-circuit shortcut. The many-to-one projection shape means the answer is invariant under intra- bucket point-type swaps (Transform ↔ Fork ↔ Broadcast ↔ Observe all keep input-arity-One = true) and flips at bucket boundaries (Transform ↔ Join flips input-arity-One from true to false). A regression that (a) probed ConvergencePointType directly (dropping the .input_arity() call), (b) inverted the projection (One ↔ Many), or (c) crossed the wires with the sibling ConvergencePointType::output_arity projection (which disagrees on the fan-out arms Fork | Broadcast → Many vs. input_arity’s Fork | Broadcast → One) fails at this probe’s substrate site before drifting through every downstream consumer.

Compounding

This method POPULATES the (required-parent × nested-struct- scalar-child) corner at its THIRD substrate primitive after Self::has_horizon_kind opened it (direct-nested-scalar) and Self::has_optimization_direction populated it (Option-nested-scalar). Together the three demonstrate the corner admits three traversal shapes through the SAME two-hop self.<field>.<projection> walk: direct-scalar, Option-scalar-with-default, and derived-typed-projection. A future co-tenant reading a projected value off the same ConvergencePointType (a peer has_output_arity reading self.point_type.output_arity() == kind — the natural fourth occupant, opening the pair for DAG-composition axis coverage; a hypothetical has_topology_bucket reading .is_preserving() / .is_diffusive() / .is_convergent()) lands as ONE peer inherent method with the same one-line self.point_type.<projection>() == kind body and routes through the same strip_and_classify_prefixed_kind::<K, _> shape in tatara-check. A future ConvergencePointType variant (a hypothetical Demux for One → Many or Mux for Many → One) reaches every downstream through ONE ALL entry + one as_str arm + one input_arity arm + one output_arity arm on the closed set with THIS probe body untouched — the many-to-one projection means the bucket membership shift lands exactly at the projection’s own site.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-typed-projection presence-probe body lives at ONE substrate site so every downstream (input-arity-<kind> require-tag family in tatara-check, future DAG-composition validators, future variant additions on ConvergencePointType) binds through the SAME has(kind) shape rather than restating the classification.point_type.input_arity() == kind closure body at each callsite. THEORY.md §VI.1 — generation over composition; a future Arity variant (a hypothetical Zero for sinks) lands at ONE ALL entry + ONE as_str arm on the closed set + ONE arm on each input_arity/output_arity projection and the probe picks it up mechanically without further per-consumer edits.

pub fn has_output_arity(&self, kind: Arity) -> bool

Closed-set-driven presence probe — does this Classification carry a ConvergencePointType whose typed output-edge cardinality projection (ConvergencePointType::output_arity) matches the given Arity discriminator? The ONE substrate primitive that owns the (Classification, Arity) -> bool output-side derived-typed-projection walk shape.

Fourth occupant on the (required-parent × nested-struct-scalar-child) corner — second via a derived-typed-projection; closes the DAG-composition arity pair

Peer of Self::has_horizon_kind, Self::has_optimization_direction, and Self::has_input_arity on the (required-parent × nested-struct-scalar-child) corner. Byte-for-byte symmetric with Self::has_input_arity: this method walks the SAME self.point_type scalar carrier through the SAME Arity closed set — the sole distinction is the typed projection composed on the walk. has_input_arity composes ConvergencePointType::input_arity (Transform | Fork | Broadcast | Observe → One, Join | Gate | Select | Reduce → Many); this method composes ConvergencePointType::output_arity (Fork | Broadcast → Many, everything else → One). Together the two probes close the DAG-composition arity pair — the (input_arity, output_arity) typed projection that pins each variant to exactly one cell of the Arity × Arity topology table (endomorphic (One, One), diffusive (One, Many), convergent (Many, One)) so future DAG-composition validators dispatch on a typed projection rather than re-deriving from variant names. SECOND derived-typed-projection occupant on the (required-parent × nested-struct-scalar-child) corner — pinning the corner’s “one carrier, N typed-projection probes” property with a second projection over the same source closed set.

Semantics — VARIANT match on the OUTPUT-projected image

has_output_arity(kind) returns true iff self.point_type.output_arity() == kind. Arity carries no Default impl, so exactly ONE of the two arms answers true per well-formed crate::crd::ProcessSpec, with no default- arm short-circuit. The many-to-one projection shape means the answer is invariant under intra-bucket swaps (Fork ↔ Broadcast both keep output-arity-Many = true; Transform ↔ Join ↔ Gate ↔ Select ↔ Reduce ↔ Observe all keep output-arity-One = true) and flips at bucket boundaries (Fork ↔ Transform flips output-arity-Many from true to false). CROSS-PROJECTION DIAGONAL: Fork | Broadcast have (input_arity, output_arity) = (One, Many) so has_input_arity and has_output_arity DISAGREE on those two variants (the diffusive bucket is the unique cell where the two projections answer opposite Arity values); Join | Gate | Select | Reduce have (Many, One) so the two probes disagree there too (the convergent bucket is the mirror cell); Transform | Observe have (One, One) so the two probes AGREE (the endomorphic bucket). A regression that (a) probed ConvergencePointType directly (dropping the .output_arity() call), (b) inverted the projection (One ↔ Many), or (c) crossed the wires with ConvergencePointType::input_arity (which disagrees on the four arms in the diffusive + convergent cells) fails at this probe’s substrate site before drifting through every downstream consumer.

Compounding

This method POPULATES the DAG-composition arity pair for full axis coverage — the natural fourth occupant the Self::has_input_arity docstring names as the next derived-typed-projection co-tenant on the same self.point_type carrier. Operators authoring (defpoint … :requires (output-arity-Many)) in checks.lisp now get typed access to the fan-out axis (edge-cardinality checks: “every diffusive topology point emits fan-out” — the exact fleet-wide property the (Fork | Broadcast, Many) projection composition is designed to name) as the mirror of the input-side family, and the two conjoined (input-arity-One AND output-arity-Many) names the diffusive bucket exactly through the two typed projections rather than through the OR of raw point-type-<Fork | Broadcast> conjuncts. A future ConvergencePointType variant (a hypothetical Demux for One → Many or Mux for Many → One) reaches every downstream through ONE ALL entry + one as_str arm + one input_arity arm + one output_arity arm on the closed set with THIS probe body untouched — the many-to-one projection means the bucket membership shift lands exactly at each projection’s own site, not at every consumer that previously restated the bucket in code.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the second derived-typed-projection presence- probe body over the SAME self.point_type carrier lives at ONE substrate site so every downstream (output-arity-<kind> require-tag family in tatara-check, future DAG-composition validators, future variant additions on ConvergencePointType) binds through the SAME has(kind) shape. THEORY.md §VI.1 — generation over composition; a future Arity variant lands at ONE ALL entry + ONE as_str arm on the closed set + ONE arm on each input_arity/output_arity projection and both probes pick it up mechanically.

pub fn horizon_terminates(&self) -> bool

Derived-boolean predicate — does this Classification carry a Horizon whose kind projects to true under HorizonKind::terminates? The ONE substrate primitive that owns the (Classification) -> bool derived-nullary-predicate walk shape on the horizon.kind slot.

First occupant on the (required-parent × nested-struct-derived-nullary-bool) corner

Distinct from every prior presence-probe method on Classification — those all admit a closed-set kind argument that the probe compares against the stored / projected discriminator (Self::has_horizon_kind walks horizon.kind == kind, Self::has_optimization_direction walks horizon.direction.unwrap_or_default() == kind, Self::has_input_arity / Self::has_output_arity walk point_type.<projection>() == kind). This probe has NO argument at all: it collapses HorizonKind::ALL onto a single boolean question (“does this horizon terminate?”) via the closed set’s own HorizonKind::terminates predicate, so callers asking the workspace-wide scheduler-facing question “will this Process ever reach crate::phase::ProcessPhase::Reaped via natural termination” reach the answer through a nullary substrate call rather than restating classification.horizon.kind.terminates() at every consumer.

Semantics — derived nullary boolean, not variant equality

horizon_terminates() returns true iff self.horizon.kind.terminates(). The two-variant HorizonKind closed set publishes the truth table: HorizonKind::Bounded → true (has a fixed point, distance reaches 0, terminates naturally); HorizonKind::Asymptotic → false (runs in perpetuity, rate is the health signal, never terminates on its own). A Classification::gate_compute baseline (which uses Horizon::default with kind = HorizonKind::Bounded via #[default]) answers true — the substrate’s default-arm short-circuit propagates through the nested Horizon struct’s own Default impl to this predicate’s answer the same way it propagates through Self::has_horizon_kind’s HorizonKind::Bounded arm.

A future third HorizonKind variant (a hypothetical Periodic sentinel for “terminates on each window boundary then re-arms” — pre-flagged on the closed set’s ALL docstring) reaches this probe through ONE terminates arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per-variant policy decision to the closed set’s own truth table (HorizonKind::terminates) rather than duplicating the discriminator sweep here.

Compounding

This method OPENS the (required-parent × nested-struct-derived-nullary-bool) corner of the workspace- wide closed-set-driven presence-probe algebra at its FIRST substrate primitive — distinct from every prior corner occupant on Classification (which all take a closed-set kind argument). A future co-tenant on this fresh corner (a peer nullary predicate on another nested-struct’s derived boolean projection — a hypothetical horizon_requires_metric_axes composing HorizonKind::requires_metric_axes as the antisymmetric partner of horizon_terminates; a hypothetical intent_is_helm_driven composing over the tagged-union intent variants; a peer collapsing a routing form’s crate::routing::RoutingForm::ALL → bool) lands as ONE peer inherent method with the same nullary derived body and routes through the same fixed-tag substrate in [tatara-check]’s classifier — no per-consumer restatement of the classification.<field>.<projection>() chain.

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag terminating-horizon on [POINT_FIXED_TAG_ARMS] — byte-for-byte peer of the fixed tags [FixedTagArm] already publishes (depends-on, boundary-pre, boundary-post, compliance, signals). The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::horizon_terminates, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (terminating-horizon) audit answers the same question on both surfaces.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the terminating-horizon fixed tag in [tatara-check], future scheduler / termination-shape validators, future variant additions on HorizonKind) binds through the SAME horizon_terminates() shape rather than restating the classification.horizon.kind.terminates() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future HorizonKind variant lands at ONE ALL entry + ONE terminates arm on the closed set and this probe picks it up mechanically.

pub fn horizon_requires_metric_axes(&self) -> bool

Derived-boolean predicate — does this Classification carry a Horizon whose kind projects to true under HorizonKind::requires_metric_axes? The ONE substrate primitive that owns the (Classification) -> bool derived- nullary-predicate walk shape on the horizon.kind slot for the metric-axes-required question.

Second occupant on the (required-parent × nested-struct-derived-nullary-bool) corner

Byte-for-byte peer of Self::horizon_terminates via the SAME closed set HorizonKind reached through the SAME nested Horizon struct: Self::horizon_terminates composes HorizonKind::terminates as self.horizon.kind.terminates(); this method composes the ANTISYMMETRIC partner HorizonKind::requires_metric_axes as self.horizon.kind.requires_metric_axes(). The closed set pins the XOR contract terminates() ^ requires_metric_axes() on every variant (see horizon_kind_terminate_xor_requires_metric_axes on the closed set itself), so exactly ONE of the two derived-nullary probes answers true per Classification and the two probes together partition HorizonKind::ALL into two disjoint buckets. This POPULATES the (required-parent × nested-struct- derived-nullary-bool) corner of the workspace-wide closed-set- driven presence-probe algebra at its SECOND substrate primitive after Self::horizon_terminates opened the corner, pinning the corner as a proven-repeatable primitive shape rather than a single-example curiosity.

Semantics — derived nullary boolean, not variant equality

horizon_requires_metric_axes() returns true iff self.horizon.kind.requires_metric_axes(). The two-variant HorizonKind closed set publishes the truth table: HorizonKind::Bounded → false (has a fixed point, no asymptotic metric axes required); HorizonKind::Asymptotic → true (runs in perpetuity, rate and oscillation are the health signal and must be measured). A Classification::gate_compute baseline (which uses Horizon::default with kind = HorizonKind::Bounded via #[default]) answers false — the substrate’s default-arm short-circuit propagates through the nested Horizon struct’s own Default impl to this predicate’s answer, the mirror image of Self::horizon_terminates’s default-arm answer.

A future third HorizonKind variant (a hypothetical Periodic sentinel for “terminates on each window boundary then re-arms” — pre-flagged on the closed set’s ALL docstring) reaches this probe through ONE requires_metric_axes arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per-variant policy decision to the closed set’s own truth table (HorizonKind::requires_metric_axes) rather than duplicating the discriminator sweep here.

Compounding

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag metric-axes-required on POINT_FIXED_TAG_ARMS — byte-for-byte antisymmetric peer of the sibling terminating-horizon fixed tag. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::horizon_requires_metric_axes, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (metric-axes-required) audit answers the same question on both surfaces.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the metric-axes-required fixed tag in tatara-check, future scheduler / metric-provisioning validators, future variant additions on HorizonKind) binds through the SAME horizon_requires_metric_axes() shape rather than restating the classification.horizon.kind.requires_metric_axes() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future HorizonKind variant lands at ONE ALL entry + ONE requires_metric_axes arm on the closed set and this probe picks it up mechanically.

pub fn calm_requires_coordination(&self) -> bool

Derived-boolean predicate — does this Classification carry a CalmClassification whose variant projects to true under CalmClassification::requires_coordination? The ONE substrate primitive that owns the (Classification) -> bool derived- nullary-predicate walk shape on the calm slot.

Third occupant on the (parent × derived-nullary-bool) corner

Peer of Self::horizon_terminates and Self::horizon_requires_metric_axes on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set-driven presence-probe algebra — the FIRST occupant threading the calm axis rather than the horizon.kind sub-axis. Distinct from the two horizon.* peers by ONE structural degree: this probe reads a DIRECT scalar closed-set field (Self::calm) rather than the NESTED-STRUCT projection (self.horizon.kind) both horizon_* peers walk; the derived- nullary shape and the truth-table composition style match exactly. Populates the corner as a proven-repeatable primitive shape across TWO distinct closed-set axes (HorizonKind, CalmClassification) rather than an axis-local curiosity.

Semantics — derived nullary boolean, not variant equality

calm_requires_coordination() returns true iff self.calm.requires_coordination(). The two-variant CalmClassification closed set publishes the truth table (the CALM theorem’s typed image, Hellerstein 2010): CalmClassification::Monotone → false (can be distributed without coordination); CalmClassification::NonMonotone → true (requires coordination). A Classification::gate_compute baseline (which uses [CalmClassification::default = Monotone] via #[default]) answers false — the substrate’s default-arm short-circuit propagates through the scalar closed-set field’s own Default impl to this predicate’s answer. The mirror-image distinguishing feature vs the two horizon_* peers: those short-circuit through TWO layers of Default (Horizon::default → HorizonKind::default); this probe short-circuits through ONE layer of Default (CalmClassification::default) because Self::calm is a direct scalar rather than a nested struct wrapper.

A future third CalmClassification variant (a hypothetical ConditionallyMonotone sentinel — pre-flagged on the closed set’s ALL docstring) reaches this probe through ONE requires_coordination arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per-variant policy decision to the closed set’s own truth table (CalmClassification::requires_coordination) rather than duplicating the discriminator sweep here.

Compounding

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag coordination-required on POINT_FIXED_TAG_ARMS — byte-for-byte peer of the sibling terminating-horizon and metric-axes-required fixed tags on the (parent × derived-nullary-bool) corner. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::calm_requires_coordination, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (coordination-required) audit answers the same question on both surfaces.

Future scheduler dispatch between Raft writes and gossip propagation (documented on CalmClassification::requires_coordination itself) reads THIS predicate rather than re-deriving from the variant name at each callsite — the classification-axis lattice-typed image of the CALM theorem lives at ONE substrate site and every scheduler / coordination-mode chooser downstream binds through the SAME calm_requires_coordination() shape.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the coordination-required fixed tag in tatara-check, future scheduler / coordination-mode validators, future variant additions on CalmClassification) binds through the SAME calm_requires_coordination() shape rather than restating the classification.calm.requires_coordination() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future CalmClassification variant lands at ONE ALL entry + ONE requires_coordination arm on the closed set and this probe picks it up mechanically.

pub fn data_is_regulated(&self) -> bool

Derived-boolean predicate — does this Classification carry a DataClassification whose variant projects to true under DataClassification::is_regulated? The ONE substrate primitive that owns the (Classification) -> bool derived-nullary- predicate walk shape on the data_classification slot for the regulated-data question.

Fourth occupant on the (parent × derived-nullary-bool) corner

Peer of Self::horizon_terminates, Self::horizon_requires_metric_axes, and Self::calm_requires_coordination on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set-driven presence-probe algebra — the FIRST occupant threading the classification-data axis rather than the horizon or calm sub-axes. Populates the corner across THREE distinct closed-set axes (HorizonKind, CalmClassification, DataClassification) rather than two — pinning the corner as a proven-repeatable primitive shape across the substrate’s three classification- axis closed sets that publish a #[default] variant, not a single-axis or two-axis curiosity. Byte-for-byte structural peer of Self::calm_requires_coordination: both walk a DIRECT scalar closed-set field (self.calm / self.data_classification) on the Classification parent — TWO layers of Default short-circuit (Classification::gate_compute → the direct scalar child’s #[default]) — distinct from the two horizon_* peers which walk a NESTED-STRUCT projection (self.horizon.kind) with THREE layers of Default (Classification::gate_compute → Horizon::default → HorizonKind::default). SECOND direct-scalar peer on the corner: calm_requires_coordination opened the direct-scalar variant, this method populates it, pinning “direct-scalar derived-nullary-bool” as a proven-repeatable structural sub-corner rather than a single-example curiosity.

Semantics — derived nullary boolean, not variant equality

data_is_regulated() returns true iff self.data_classification.is_regulated(). The six-variant DataClassification closed set publishes the truth table: DataClassification::Public / DataClassification::Internal / DataClassification::Confidential → false (not subject to external regulatory regime); DataClassification::Pii / DataClassification::Phi / DataClassification::Pci → true (HIPAA / PCI-DSS / GDPR-style data-subject controls apply). A Classification::gate_compute baseline (which uses [DataClassification::default = Internal] via #[default]) answers false — the substrate’s default-arm short-circuit propagates through the scalar closed-set field’s own Default impl to this predicate’s answer, mirror image of Self::calm_requires_coordination’s Monotone-default short-circuit through the same structural depth.

The closed-set-internal pin data_classification_regulated_implies_restricted seals the implication is_regulated() ⇒ is_restricted() on every variant, so a true answer here implies the sibling (data_is_restricted, when it lands) also answers true; the reverse does not hold (Internal | Confidential are restricted but not regulated).

A future seventh DataClassification variant (a hypothetical TradeSecret bucket for competitive-sensitive data, or an Anonymized bucket for pseudonymized-PII whose regulatory posture differs from raw PII) reaches this probe through ONE is_regulated arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per- variant policy decision to the closed set’s own truth table (DataClassification::is_regulated) rather than duplicating the discriminator sweep here.

Compounding

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag data-regulated on POINT_FIXED_TAG_ARMS — byte-for-byte peer of the sibling terminating-horizon, metric-axes-required, and coordination-required fixed tags on the (parent × derived-nullary-bool) corner. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::data_is_regulated, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (data-regulated) audit answers the same question on both surfaces.

Future compliance-baseline auto-selectors dispatching on the (is_regulated, is_restricted) two-axis projection (documented on DataClassification::is_regulated itself) read THIS predicate rather than re-deriving from the variant name at each callsite — the classification-data-axis lattice- typed image of the regulated-data question lives at ONE substrate site and every compliance-mode chooser downstream binds through the SAME data_is_regulated() shape.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the data-regulated fixed tag in tatara-check, future compliance-baseline / regulatory-regime validators, future variant additions on DataClassification) binds through the SAME data_is_regulated() shape rather than restating the classification.data_classification.is_regulated() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future DataClassification variant lands at ONE ALL entry + ONE is_regulated arm on the closed set and this probe picks it up mechanically.

pub fn data_is_restricted(&self) -> bool

Derived-boolean predicate — does this Classification carry a DataClassification whose variant projects to true under DataClassification::is_restricted? The ONE substrate primitive that owns the (Classification) -> bool derived-nullary- predicate walk shape on the data_classification slot for the restricted-data question.

Fifth occupant on the (parent × derived-nullary-bool) corner

Peer of Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, and Self::data_is_regulated on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set-driven presence- probe algebra — the SECOND peer threading the classification- data axis after Self::data_is_regulated opened it, pinning the classification-data axis as a proven-repeatable structural sub-corner across TWO sibling closed-set projections (DataClassification::is_regulated / is_restricted) rather than a single-projection curiosity. Byte-for-byte structural peer of Self::data_is_regulated: both walk the SAME direct scalar closed-set field (self.data_classification) on the Classification parent through TWO layers of Default short-circuit (Classification::gate_compute → [DataClassification::default = Internal]) — distinct from the two horizon_* peers by ONE structural degree (they walk a NESTED-STRUCT projection with THREE layers of Default). THIRD direct-scalar peer on the corner after Self::calm_requires_coordination opened + Self::data_is_regulated populated the sub-corner: seals “direct-scalar derived-nullary-bool” as the substrate’s third occupant on the sub-corner and the FIRST corner peer whose gate-compute baseline projects to true rather than false, mirror-image of the Bounded-default terminating-horizon baseline on the horizon-axis nested sub-corner.

Semantics — derived nullary boolean, not variant equality

data_is_restricted() returns true iff self.data_classification.is_restricted(). The six-variant DataClassification closed set publishes the truth table: DataClassification::Public → false (freely distributable); DataClassification::Internal / DataClassification::Confidential / DataClassification::Pii / DataClassification::Phi / DataClassification::Pci → true (access controls beyond freely-distributable apply). A Classification::gate_compute baseline (which uses [DataClassification::default = Internal] via #[default]) answers true — the substrate’s default-arm short-circuit propagates through the scalar closed-set field’s own Default impl to this predicate’s answer, distinct from Self::data_is_regulated’s false baseline (which projects the SAME Internal default through the antisymmetric arm of the closed set’s predicate pair). This baseline-flip is the FIRST direct-scalar corner peer where the gate-compute baseline answers true, not false.

The closed-set-internal pin data_classification_regulated_implies_restricted seals the implication is_regulated() ⇒ is_restricted() on every variant, so data_is_regulated() returning true implies THIS predicate also returns true; the reverse does not hold (Internal | Confidential are restricted but not regulated). This is the FIRST substrate-primitive pair on the (parent × derived-nullary-bool) corner whose two predicates carry a non- trivial closed-set-internal implication relationship — a future compliance-baseline auto-selector can rely on data_is_regulated() ⇒ data_is_restricted() by construction rather than restating the implication at every callsite.

A future seventh DataClassification variant (a hypothetical TradeSecret bucket for competitive-sensitive data, or an Anonymized bucket for pseudonymized-PII whose access posture differs from raw PII) reaches this probe through ONE is_restricted arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per- variant policy decision to the closed set’s own truth table (DataClassification::is_restricted) rather than duplicating the discriminator sweep here.

Compounding

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag data-restricted on POINT_FIXED_TAG_ARMS — byte-for-byte peer of the sibling terminating-horizon, metric-axes-required, coordination-required, and data-regulated fixed tags on the (parent × derived-nullary- bool) corner. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::data_is_restricted, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (data-restricted) audit answers the same question on both surfaces.

Future compliance-baseline auto-selectors dispatching on the (is_regulated, is_restricted) two-axis projection (documented on DataClassification::is_regulated itself) read THIS predicate rather than re-deriving from the variant name at each callsite — the classification-data-axis lattice- typed image of the restricted-data question lives at ONE substrate site and every compliance-mode chooser downstream binds through the SAME data_is_restricted() shape.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the data-restricted fixed tag in tatara-check, future compliance-baseline / access-control-mandatory validators, future variant additions on DataClassification) binds through the SAME data_is_restricted() shape rather than restating the classification.data_classification.is_restricted() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future DataClassification variant lands at ONE ALL entry + ONE is_restricted arm on the closed set and this probe picks it up mechanically.

pub fn point_is_endomorphic(&self) -> bool

Derived-boolean predicate — does this Classification’s ConvergencePointType project to true under ConvergencePointType::is_endomorphic? The ONE substrate primitive that owns the (Classification) -> bool derived- nullary-predicate walk shape on the point_type slot for the 1→1 topology-bucket question.

Sixth occupant on the (parent × derived-nullary-bool) corner

Peer of Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, Self::data_is_regulated, and Self::data_is_restricted on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set-driven presence-probe algebra — the SIXTH occupant on the corner and the FIRST peer threading the classification-point_type axis rather than the horizon, calm, or data axes. Direct-scalar peer of Self::calm_requires_coordination / Self::data_is_regulated / Self::data_is_restricted: walks a DIRECT scalar closed-set field’s derived projection on the Classification parent (no nested-struct hop like the two horizon_* peers), but distinct from all three by ONE structural degree — ConvergencePointType has NO Default impl, so the derived-nullary answer here does NOT carry a substrate default-arm short-circuit through the parent’s #[default] chain. The Self::gate_compute baseline still fixes an answer (Gate.is_endomorphic() = false), pinned by classification_gate_compute_point_is_endomorphic_is_false, but that answer is chosen deliberately by the baseline’s point_type: Gate field rather than reached through a closed-set-side #[default]. Populates the corner as a proven-repeatable primitive shape across FOUR distinct classification-axis closed sets (HorizonKind, CalmClassification, DataClassification, ConvergencePointType) rather than a three-axis curiosity.

Semantics — derived nullary boolean, not variant equality

point_is_endomorphic() returns true iff self.point_type.is_endomorphic(). The eight-variant ConvergencePointType closed set publishes the truth table (via the shape-preserving-topology (1,1) arity partition): ConvergencePointType::Transform / ConvergencePointType::Observe → true (1→1 shape); ConvergencePointType::Fork / ConvergencePointType::Broadcast → false (1→N diffusive); ConvergencePointType::Join / ConvergencePointType::Gate / ConvergencePointType::Select / ConvergencePointType::Reduce → false (N→1 convergent). A Classification::gate_compute baseline (which uses ConvergencePointType::Gate deliberately as the baseline convergent barrier point) answers false — this is NOT a Default-arm short-circuit (unlike the four earlier direct-scalar / nested-struct corner peers), because ConvergencePointType has no impl Default; the baseline is a chosen field value, not a defaulted one.

A future ninth ConvergencePointType variant lands at ONE ALL entry + ONE is_endomorphic arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per-variant policy decision to the closed set’s own truth table (ConvergencePointType::is_endomorphic) rather than duplicating the discriminator sweep here.

Compounding

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag endomorphic-point on POINT_FIXED_TAG_ARMS — byte-for-byte peer of the sibling terminating-horizon / metric-axes-required / coordination-required / data-regulated / data-restricted fixed tags on the (parent × derived-nullary-bool) corner. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::point_is_endomorphic, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (endomorphic-point) audit answers the same question on both surfaces. Sibling projections ConvergencePointType::is_diffusive and ConvergencePointType::is_convergent compose byte- identically as future seventh + eighth corner occupants; when all three land the three-way partition contract is_endomorphic ⊕ is_diffusive ⊕ is_convergent sealed on the closed set by convergence_point_type_buckets_cover_every_variant composes through the parent-composed layer as a substrate- wide theorem exactly as the closed-set XOR pair terminates ^ requires_metric_axes composes through this corner today.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the endomorphic-point fixed tag in tatara-check, future DAG composition / edge-cardinality validators, future variant additions on ConvergencePointType) binds through the SAME point_is_endomorphic() shape rather than restating the classification.point_type.is_endomorphic() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future ConvergencePointType variant lands at ONE ALL entry + ONE is_endomorphic arm on the closed set and this probe picks it up mechanically.

pub fn point_is_diffusive(&self) -> bool

Derived-boolean predicate — does this Classification’s ConvergencePointType project to true under ConvergencePointType::is_diffusive? The ONE substrate primitive that owns the (Classification) -> bool derived- nullary-predicate walk shape on the point_type slot for the 1→N fan-out topology-bucket question.

Seventh occupant on the (parent × derived-nullary-bool) corner

Peer of Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, Self::data_is_regulated, Self::data_is_restricted, and Self::point_is_endomorphic on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set-driven presence- probe algebra — the SEVENTH occupant on the corner and the SECOND peer threading the classification-point_type axis, pinning that axis as a proven-repeatable structural sub-corner across TWO sibling projections rather than a one-off. Direct- scalar peer of Self::point_is_endomorphic: the two share the SAME parent slot (self.point_type), the SAME closed-set carrier (ConvergencePointType), and the SAME chosen-field baseline discipline (ConvergencePointType has no Default impl, so the derived-nullary answer here does NOT carry a substrate default-arm short-circuit through the parent’s #[default] chain — Self::gate_compute fixes point_type: Gate deliberately, and Gate.is_diffusive() = false).

Semantics — derived nullary boolean, disjoint from endomorphic

point_is_diffusive() returns true iff self.point_type.is_diffusive(). The eight-variant ConvergencePointType closed set publishes the truth table (via the (One, Many) arity cell): ConvergencePointType::Fork / ConvergencePointType::Broadcast → true (1→N fan-out); every other variant → false (endomorphic or convergent). A Classification::gate_compute baseline answers false deliberately (Gate is a convergent barrier, not a diffusive fan-out).

A future ninth ConvergencePointType variant lands at ONE ALL entry + ONE is_diffusive arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per-variant policy decision to the closed set’s own truth table (ConvergencePointType::is_diffusive) rather than duplicating the discriminator sweep here.

Compounding — first corner-peer mutex on the point_type axis

This is the FIRST corner-peer pair on the point_type axis (with Self::point_is_endomorphic) whose two projections carry a non-trivial closed-set-internal MUTEX relationship (point_is_endomorphic ⇒ ¬point_is_diffusive — no variant lands in both buckets, sealed on the closed set by convergence_point_type_buckets_cover_every_variant). Distinct from the FIRST corner-peer implication pair on the data axis (data_is_regulated ⇒ data_is_restricted) by the implication direction — regulated-⇒-restricted has one bucket contained in the other, while endomorphic-vs-diffusive has two disjoint buckets partitioning a common universe. When the third sibling Self::point_is_convergent lands, the mutex closes into the three-way XOR partition contract point_is_endomorphic ⊕ point_is_diffusive ⊕ point_is_convergent sealed on the closed set by convergence_point_type_buckets_cover_every_variant — a substrate-wide theorem that composes through this corner exactly as the closed-set XOR pair terminates ^ requires_metric_axes composes today.

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag diffusive-point on POINT_FIXED_TAG_ARMS — byte-for-byte peer of the sibling endomorphic-point fixed tag. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::point_is_diffusive, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (diffusive-point) audit answers the same question on both surfaces.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the diffusive-point fixed tag in tatara-check, future DAG composition / edge-cardinality validators, future variant additions on ConvergencePointType) binds through the SAME point_is_diffusive() shape rather than restating the classification.point_type.is_diffusive() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future ConvergencePointType variant lands at ONE ALL entry + ONE is_diffusive arm on the closed set and this probe picks it up mechanically.

pub fn point_is_convergent(&self) -> bool

Derived-boolean predicate — does this Classification’s ConvergencePointType project to true under ConvergencePointType::is_convergent? The ONE substrate primitive that owns the (Classification) -> bool derived- nullary-predicate walk shape on the point_type slot for the N→1 fan-in topology-bucket question.

Eighth occupant on the (parent × derived-nullary-bool) corner

Peer of Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, Self::data_is_regulated, Self::data_is_restricted, Self::point_is_endomorphic, and Self::point_is_diffusive on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set-driven presence-probe algebra — the EIGHTH occupant on the corner and the THIRD peer threading the classification-point_type axis. Direct-scalar peer of Self::point_is_endomorphic / Self::point_is_diffusive: the three share the SAME parent slot (self.point_type), the SAME closed-set carrier (ConvergencePointType), and the SAME chosen-field baseline discipline (ConvergencePointType has no Default impl, so the derived-nullary answer here does NOT carry a substrate default- arm short-circuit through the parent’s #[default] chain). Distinct from the two sibling probes on ONE structural degree — the Self::gate_compute baseline’s point_type: Gate answer projects to true HERE (Gate.is_convergent() = true), mirror-inverted from the two siblings’ false answers, so this is the FIRST direct-scalar corner peer whose parent- composed gate-compute baseline projects true through a chosen-field (rather than defaulted) answer.

Semantics — derived nullary boolean, closes the three-way carving

point_is_convergent() returns true iff self.point_type.is_convergent(). The eight-variant ConvergencePointType closed set publishes the truth table (via the (Many, One) arity cell): ConvergencePointType::Join / ConvergencePointType::Gate / ConvergencePointType::Select / ConvergencePointType::Reduce → true (N→1 fan-in); every other variant → false (endomorphic or diffusive). A Classification::gate_compute baseline answers true deliberately (Gate is the canonical convergent barrier point of the workspace baseline).

A future ninth ConvergencePointType variant lands at ONE ALL entry + ONE is_convergent arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per-variant policy decision to the closed set’s own truth table (ConvergencePointType::is_convergent) rather than duplicating the discriminator sweep here.

Compounding — closes the three-way XOR partition on the point_type axis

This is the THIRD sibling on the point_type axis closing the mutex pair Self::point_is_endomorphic / Self::point_is_diffusive (which sealed point_is_endomorphic ⇒ ¬point_is_diffusive) into the FULL three-way XOR partition contract point_is_endomorphic ⊕ point_is_diffusive ⊕ point_is_convergent = true for every ConvergencePointType variant. Sealed on the closed set by convergence_point_type_buckets_cover_every_variant (which pins each variant lands in EXACTLY ONE bucket) and now composed through the parent-composed layer as a substrate-wide theorem. THREE-way XOR is a stricter contract than the closed- set XOR pair terminates ^ requires_metric_axes that composes through this corner today via the two horizon_* peers — this axis carries a partition of THREE non-empty buckets rather than TWO, so the ternary XOR is the natural generalization composed through the corner.

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag convergent-point on POINT_FIXED_TAG_ARMS — byte-for-byte peer of the sibling endomorphic-point / diffusive-point fixed tags. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::point_is_convergent, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (convergent-point) audit answers the same question on both surfaces.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the convergent-point fixed tag in tatara-check, future DAG composition / edge-cardinality validators, future variant additions on ConvergencePointType) binds through the SAME point_is_convergent() shape rather than restating the classification.point_type.is_convergent() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future ConvergencePointType variant lands at ONE ALL entry + ONE is_convergent arm on the closed set and this probe picks it up mechanically.

pub fn substrate_is_resource(&self) -> bool

Derived-boolean predicate — does this Classification’s SubstrateType project to true under SubstrateType::is_resource? The ONE substrate primitive that owns the (Classification) -> bool derived-nullary- predicate walk shape on the substrate slot for the resource-plane bucket question.

Ninth occupant on the (parent × derived-nullary-bool) corner

Peer of Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, Self::data_is_regulated, Self::data_is_restricted, Self::point_is_endomorphic, Self::point_is_diffusive, and Self::point_is_convergent on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set- driven presence-probe algebra — the NINTH occupant on the corner and the FIRST peer threading the classification- substrate axis (the fourth of six classification axes, after horizon, calm, data_classification, and point_type). Direct-scalar peer of Self::point_is_endomorphic / Self::point_is_diffusive / Self::point_is_convergent: all four share the shape (direct scalar closed-set field with no Default impl on the child, so no default-arm short-circuit through the child’s #[default] chain). Distinct from the three point_type-axis siblings on the parent slot walked (self.substrate vs self.point_type) and on the closed set carried (SubstrateType vs ConvergencePointType) — the Classification::gate_compute baseline’s chosen field (substrate: Compute) projects true HERE (Compute.is_resource() = true), mirror-aligned with the Self::point_is_convergent sibling’s true-on-baseline answer and mirror-inverted from the two other point_type peers.

Semantics — derived nullary boolean over the closed-set plane

substrate_is_resource() returns true iff self.substrate.is_resource(). The eight-variant SubstrateType closed set publishes the truth table (via the plane partition): SubstrateType::Financial / SubstrateType::Compute / SubstrateType::Network / SubstrateType::Storage → true (resource plane — you allocate budgets from it); SubstrateType::Security / SubstrateType::Identity / SubstrateType::Observability / SubstrateType::Regulatory → false (policy or telemetry plane). A Classification::gate_compute baseline answers true because its substrate: Compute field is deliberately resource-plane.

A future ninth SubstrateType variant lands at ONE ALL entry + ONE is_resource arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per-variant policy decision to the closed set’s own truth table (SubstrateType::is_resource) rather than duplicating the discriminator sweep here.

Compounding — first substrate-axis peer, opens the three-way plane partition

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag resource-substrate on POINT_FIXED_TAG_ARMS — byte-for-byte structural peer of the sibling terminating-horizon / metric-axes-required / coordination-required / data-regulated / data-restricted / endomorphic-point / diffusive-point / convergent-point fixed tags on the (parent × derived-nullary-bool) corner. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::substrate_is_resource, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (resource-substrate) audit answers the same question on both surfaces. Sibling projections SubstrateType::is_policy and SubstrateType::is_telemetry compose byte-identically as future tenth + eleventh corner occupants; when all three land the three-way partition contract is_resource ⊕ is_policy ⊕ is_telemetry sealed on the closed set by substrate_type_buckets_cover_every_variant composes through the parent-composed layer as a substrate-wide theorem — the exact ternary lift already sealed on the sibling point_type axis by classification_point_type_probes_form_three_way_xor_partition_over_all.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the resource-substrate fixed tag in tatara-check, future plane-baseline / compliance-baseline selectors, future variant additions on SubstrateType) binds through the SAME substrate_is_resource() shape rather than restating the classification.substrate.is_resource() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future SubstrateType variant lands at ONE ALL entry + ONE is_resource arm on the closed set and this probe picks it up mechanically.

pub fn substrate_is_policy(&self) -> bool

Derived-boolean predicate — does this Classification’s SubstrateType project to true under SubstrateType::is_policy? The ONE substrate primitive that owns the (Classification) -> bool derived-nullary- predicate walk shape on the substrate slot for the policy-plane bucket question.

Tenth occupant on the (parent × derived-nullary-bool) corner

Peer of Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, Self::data_is_regulated, Self::data_is_restricted, Self::point_is_endomorphic, Self::point_is_diffusive, Self::point_is_convergent, and Self::substrate_is_resource on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set- driven presence-probe algebra — the TENTH occupant on the corner and the SECOND peer threading the classification- substrate axis, promoting that axis from a proven-repeatable one-off (substrate_is_resource alone) to a proven-repeatable pair. FIRST corner-peer pair on the substrate axis whose two projections carry a non-trivial closed-set-internal MUTEX relationship (substrate_is_resource ⇒ ¬substrate_is_policy — the eight-variant SubstrateType closed set carves its variants into THREE disjoint buckets sealed by substrate_type_buckets_cover_every_variant), structural twin of the sibling point_type-axis MUTEX pair sealed by classification_point_is_endomorphic_and_point_is_diffusive_are_mutex_over_all. Direct-scalar peer of Self::substrate_is_resource and the three sibling point_type-axis arms: all five share the shape (direct scalar closed-set field with no Default impl on the child, so no default-arm short-circuit through the child’s #[default] chain). The Classification::gate_compute baseline’s chosen field (substrate: Compute) projects false HERE (Compute.is_policy() = false), mirror-inverted from the sibling substrate_is_resource baseline’s true.

Semantics — derived nullary boolean over the closed-set plane

substrate_is_policy() returns true iff self.substrate.is_policy(). The eight-variant SubstrateType closed set publishes the truth table (via the plane partition): SubstrateType::Security / SubstrateType::Identity / SubstrateType::Regulatory → true (policy plane — you enforce constraints on it); SubstrateType::Financial / SubstrateType::Compute / SubstrateType::Network / SubstrateType::Storage / SubstrateType::Observability → false (resource or telemetry plane). A Classification::gate_compute baseline answers false because its substrate: Compute field is deliberately resource-plane, not policy-plane.

A future ninth SubstrateType variant lands at ONE ALL entry + ONE is_policy arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per-variant policy decision to the closed set’s own truth table (SubstrateType::is_policy) rather than duplicating the discriminator sweep here.

Compounding — second substrate-axis peer, opens the substrate MUTEX pair

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag policy-substrate on POINT_FIXED_TAG_ARMS — byte-for-byte structural peer of the sibling resource-substrate / terminating-horizon / metric-axes-required / coordination-required / data-regulated / data-restricted / endomorphic-point / diffusive-point / convergent-point fixed tags on the (parent × derived-nullary-bool) corner. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::substrate_is_policy, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (policy-substrate) audit answers the same question on both surfaces. Sibling projection SubstrateType::is_telemetry composes byte-identically as a future eleventh corner occupant; when it lands the three-way partition contract is_resource ⊕ is_policy ⊕ is_telemetry sealed on the closed set by substrate_type_buckets_cover_every_variant composes through the parent-composed layer as a substrate-wide theorem — the exact ternary lift already sealed on the sibling point_type axis by classification_point_type_probes_form_three_way_xor_partition_over_all.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the policy-substrate fixed tag in tatara-check, future plane-baseline / compliance-baseline selectors, future variant additions on SubstrateType) binds through the SAME substrate_is_policy() shape rather than restating the classification.substrate.is_policy() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future SubstrateType variant lands at ONE ALL entry + ONE is_policy arm on the closed set and this probe picks it up mechanically.

pub fn substrate_is_telemetry(&self) -> bool

Derived-boolean predicate — does this Classification’s SubstrateType project to true under SubstrateType::is_telemetry? The ONE substrate primitive that owns the (Classification) -> bool derived-nullary- predicate walk shape on the substrate slot for the telemetry-plane bucket question.

Eleventh occupant on the (parent × derived-nullary-bool) corner — CLOSES the substrate axis

Peer of Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, Self::data_is_regulated, Self::data_is_restricted, Self::point_is_endomorphic, Self::point_is_diffusive, Self::point_is_convergent, Self::substrate_is_resource, and Self::substrate_is_policy on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set- driven presence-probe algebra — the ELEVENTH occupant on the corner and the THIRD peer threading the classification- substrate axis. This peer CLOSES the substrate axis on the corner into the FULL three-way XOR partition contract substrate_is_resource ⊕ substrate_is_policy ⊕ substrate_is_telemetry — the closed-set partition already sealed on SubstrateType by substrate_type_buckets_cover_every_variant now composes through the parent-composed layer as a substrate-wide theorem pinned by classification_substrate_probes_form_three_way_xor_partition_over_all. The ternary lift on the substrate axis is the structural twin of the sibling point_type-axis ternary lift sealed by classification_point_type_probes_form_three_way_xor_partition_over_all. Direct-scalar peer of Self::substrate_is_resource, Self::substrate_is_policy, and the three sibling point_type-axis arms: all six share the shape (direct scalar closed-set field with no Default impl on the child, so no default-arm short-circuit through the child’s #[default] chain). The Classification::gate_compute baseline’s chosen field (substrate: Compute) projects false HERE (Compute.is_telemetry() = false), mirror-inverted from the sibling substrate_is_resource baseline’s true and aligned with the sibling substrate_is_policy baseline’s false.

Semantics — derived nullary boolean over the closed-set plane

substrate_is_telemetry() returns true iff self.substrate.is_telemetry(). The eight-variant SubstrateType closed set publishes the truth table (via the plane partition): SubstrateType::Observability → true (telemetry plane — the singleton bucket that passively observes other workloads without carrying their payload or gating their access); every other variant → false (resource or policy plane). A Classification::gate_compute baseline answers false because its substrate: Compute field is deliberately resource-plane, not telemetry-plane.

A future ninth SubstrateType variant lands at ONE ALL entry + ONE is_telemetry arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per-variant telemetry decision to the closed set’s own truth table (SubstrateType::is_telemetry) rather than duplicating the discriminator sweep here.

Compounding — CLOSES the substrate axis into a three-way XOR partition

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag telemetry-substrate on POINT_FIXED_TAG_ARMS — byte-for-byte structural peer of the sibling resource-substrate / policy-substrate / terminating-horizon / metric-axes-required / coordination-required / data-regulated / data-restricted / endomorphic-point / diffusive-point / convergent-point fixed tags on the (parent × derived-nullary-bool) corner. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::substrate_is_telemetry, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (telemetry-substrate) audit answers the same question on both surfaces. THIRD substrate-axis peer CLOSES the three-way XOR partition contract is_resource ⊕ is_policy ⊕ is_telemetry sealed on the closed set by substrate_type_buckets_cover_every_variant through the parent-composed layer as a substrate-wide theorem — the exact ternary lift already sealed on the sibling point_type axis by classification_point_type_probes_form_three_way_xor_partition_over_all.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the telemetry-substrate fixed tag in tatara-check, future plane-baseline / compliance-baseline selectors, future variant additions on SubstrateType) binds through the SAME substrate_is_telemetry() shape rather than restating the classification.substrate.is_telemetry() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future SubstrateType variant lands at ONE ALL entry + ONE is_telemetry arm on the closed set and this probe picks it up mechanically.

pub fn calm_is_monotone(&self) -> bool

Derived-boolean predicate — does this Classification’s CalmClassification project to true under CalmClassification::is_monotone? The ONE substrate primitive that owns the (Classification) -> bool derived- nullary-predicate walk shape on the calm slot for the CALM-monotone-plane question — the positive framing peer of Self::calm_requires_coordination.

Twelfth occupant on the (parent × derived-nullary-bool) corner — CLOSES the calm axis

Peer of Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, Self::data_is_regulated, Self::data_is_restricted, Self::point_is_endomorphic, Self::point_is_diffusive, Self::point_is_convergent, Self::substrate_is_resource, Self::substrate_is_policy, and Self::substrate_is_telemetry on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set-driven presence-probe algebra — the TWELFTH occupant on the corner and the SECOND peer threading the classification-calm axis. This peer CLOSES the calm axis on the corner into the FULL binary XOR partition contract calm_is_monotone ⊕ calm_requires_coordination — the closed-set partition sealed on CalmClassification by calm_classification_monotone_xor_requires_coordination now composes through the parent-composed layer as a substrate-wide theorem pinned by classification_calm_probes_form_binary_xor_partition_over_all. Structural twin of the sibling horizon-axis binary XOR partition sealed on the closed set by horizon_kind_terminate_xor_requires_metric_axes (which composes at the closed-set layer today — the parent-composed lift lands here as the calm axis’s counterpart). The calm axis becomes the THIRD classification axis (after point_type, substrate) to reach the closed XOR partition landmark on this corner, promoting the axis-closure milestone from a twin (ternary on point_type + substrate) to a triple (adding binary on calm). Direct-scalar peer of Self::calm_requires_coordination: both walk the same scalar calm slot on the parent — TWO layers of Default short-circuit reaching the derived-nullary predicate (Classification::gate_compute → CalmClassification::default). The Classification::gate_compute baseline’s default-arm answer projects true HERE (Monotone default → is_monotone() = true), mirror-inverted from Self::calm_requires_coordination’s Monotone-default false.

Semantics — derived nullary boolean over the closed-set plane

calm_is_monotone() returns true iff self.calm.is_monotone(). The two-variant CalmClassification closed set publishes the truth table: CalmClassification::Monotone → true (CALM ⇒ can be distributed without coordination); CalmClassification::NonMonotone → false (CALM ⇒ requires coordination). A Classification::gate_compute baseline answers true because its calm: CalmClassification::default() = Monotone field defaults via CalmClassification’s #[default], so every unadorned Process reads as gossip-eligible (safe under the CALM theorem: monotone operations distribute without coordination).

A future third CalmClassification variant (a hypothetical ConditionallyMonotone sentinel for CRDT joins under a fixed schema) lands at ONE ALL entry + ONE is_monotone arm on the closed set with the probe body untouched — the nullary- predicate shape defers every per-variant monotonicity decision to the closed set’s own truth table (CalmClassification::is_monotone) rather than duplicating the discriminator sweep here.

Compounding — CLOSES the calm axis into a binary XOR partition

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag monotone-calm on POINT_FIXED_TAG_ARMS — byte-for-byte structural peer of the sibling coordination-required fixed tag (the antisymmetric partner on the same axis) and of every other (parent × derived- nullary-bool) corner arm. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::calm_is_monotone, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (monotone-calm) audit answers the same question on both surfaces. SECOND calm-axis peer CLOSES the binary XOR partition contract is_monotone ⊕ requires_coordination sealed on the closed set by calm_classification_monotone_xor_requires_coordination through the parent-composed layer as a substrate-wide theorem — the exact binary lift already sealed on the sibling horizon axis at the closed-set layer by horizon_kind_terminate_xor_requires_metric_axes, now with the parent-composed layer’s own XOR partition test on the calm axis.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the monotone-calm fixed tag in tatara-check, future scheduler / coordination-mode validators reading the positive CALM framing, future variant additions on CalmClassification) binds through the SAME calm_is_monotone() shape rather than restating either !self.calm_requires_coordination() or self.calm.is_monotone() at the callsite. THEORY.md §VI.1 — generation over composition; a future CalmClassification variant lands at ONE ALL entry + ONE is_monotone arm on the closed set and this probe picks it up mechanically.

pub fn data_is_public(&self) -> bool

Derived-boolean predicate — does this Classification’s DataClassification project to true under DataClassification::is_public? The ONE substrate primitive that owns the (Classification) -> bool derived-nullary- predicate walk shape on the data_classification slot for the freely-distributable-data question — the positive framing peer of Self::data_is_restricted.

Thirteenth occupant on the (parent × derived-nullary-bool) corner — CLOSES the data axis

Peer of Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, Self::data_is_regulated, Self::data_is_restricted, Self::point_is_endomorphic, Self::point_is_diffusive, Self::point_is_convergent, Self::substrate_is_resource, Self::substrate_is_policy, Self::substrate_is_telemetry, and Self::calm_is_monotone on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set-driven presence-probe algebra — the THIRTEENTH occupant on the corner and the THIRD peer threading the classification-data_classification axis. This peer CLOSES the data axis on the corner into the FULL binary XOR partition contract data_is_public ⊕ data_is_restricted — the closed-set partition sealed on DataClassification by data_classification_public_xor_restricted now composes through the parent-composed layer as a substrate-wide theorem pinned by classification_data_probes_form_binary_xor_partition_over_all. Structural twin of the calm-axis binary XOR partition sealed at the parent-composed layer by classification_calm_probes_form_binary_xor_partition_over_all on the sibling calm axis — both axes carve into a is_X / requires_X (positive/negative-framing) complementary bucket pair whose union covers every closed-set variant. The data axis becomes the FOURTH classification axis (after point_type, substrate, calm) to reach the closed XOR partition landmark on this corner, promoting the axis-closure milestone from a proven-repeatable triple (ternary on point_type + substrate plus binary on calm) to a proven-repeatable quadruple (adding a SECOND binary on data_classification). Direct-scalar peer of Self::data_is_regulated and Self::data_is_restricted: all three walk the same scalar data_classification slot on the parent — TWO layers of Default short-circuit reaching the derived-nullary predicate (Classification::gate_compute → DataClassification::default). The Classification::gate_compute baseline’s default-arm answer projects false HERE (Internal default → is_public() = false), mirror-inverted from Self::data_is_restricted’s Internal-default true on the SAME defaulted data_classification slot.

Semantics — derived nullary boolean over the closed-set plane

data_is_public() returns true iff self.data_classification.is_public(). The six-variant DataClassification closed set publishes the truth table: DataClassification::Public → true (freely distributable — no access control required); DataClassification::Internal / DataClassification::Confidential / DataClassification::Pii / DataClassification::Phi / DataClassification::Pci → false (some access-control regime applies). A Classification::gate_compute baseline answers false because its data_classification: DataClassification::default() = Internal field defaults via DataClassification’s #[default], so every unadorned Process reads as access-controlled (safe under the compliance baseline: an operator must deliberately opt into public distribution).

The closed-set-internal pin data_classification_regulated_implies_not_public seals the implication is_regulated() ⇒ ¬is_public() on every variant, so Self::data_is_regulated returning true implies THIS predicate returns false; this is the ANTISYMMETRIC pair to the sibling data_classification_regulated_implies_restricted on the same closed set, and the FIRST substrate-primitive pair on the (parent × derived-nullary-bool) corner whose two predicates project ONE closed set into the pair of complementary buckets whose union is a full binary XOR partition AND whose intersection is empty on every variant.

A future seventh DataClassification variant (a hypothetical TradeSecret bucket for competitive-sensitive data, or an Anonymized bucket for pseudonymized-PII whose regulatory posture differs from raw PII) reaches this probe through ONE is_public arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per-variant policy decision to the closed set’s own truth table (DataClassification::is_public) rather than duplicating the discriminator sweep here.

Compounding — CLOSES the data axis into a binary XOR partition

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag public-data on POINT_FIXED_TAG_ARMS — byte-for-byte structural peer of the sibling data-restricted fixed tag (the antisymmetric partner on the same axis) and of every other (parent × derived-nullary-bool) corner arm. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::data_is_public, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (public-data) audit answers the same question on both surfaces. THIRD data-axis peer CLOSES the binary XOR partition contract is_public ⊕ is_restricted sealed on the closed set by data_classification_public_xor_restricted through the parent-composed layer as a substrate-wide theorem — mirror of the calm axis’s parent-composed binary XOR closure classification_calm_probes_form_binary_xor_partition_over_all.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the public-data fixed tag in tatara-check, future compliance- baseline / audit-log-optional validators reading the positive distribution framing, future variant additions on DataClassification) binds through the SAME data_is_public() shape rather than restating either !self.data_is_restricted() or self.data_classification.is_public() at the callsite. THEORY.md §VI.1 — generation over composition; a future DataClassification variant lands at ONE ALL entry + ONE is_public arm on the closed set and this probe picks it up mechanically.

pub fn direction_prefers_lower(&self) -> bool

Derived-boolean predicate — does this Classification’s Horizon::direction slot (defaulted through [OptimizationDirection::default = Minimize] on absence) project to true under OptimizationDirection::prefers_lower? The ONE substrate primitive that owns the (Classification) -> bool derived-nullary-predicate walk on the horizon.direction slot for the lower-is-better optimization-polarity question.

Fourteenth occupant on the (parent × derived-nullary-bool) corner — first via the optimization-direction axis

Peer of the thirteen prior nullary-bool substrate primitives on Classification (Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, Self::data_is_regulated, Self::data_is_restricted, Self::point_is_endomorphic, Self::point_is_diffusive, Self::point_is_convergent, Self::substrate_is_resource, Self::substrate_is_policy, Self::substrate_is_telemetry, Self::calm_is_monotone, Self::data_is_public) on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set-driven presence- probe algebra. FIRST occupant threading the classification- horizon.direction axis — opens the SIXTH classification axis into the fixed-tag algebra after the horizon, calm, data, point, and substrate axes; distinct from every prior corner peer on ONE structural degree: the source carrier is Option<OptimizationDirection> nested inside the Horizon struct rather than a direct scalar or a nested direct-scalar. Byte-for-byte peer of the sibling Self::has_optimization_direction on the Option-carrier hop (both unwrap the Horizon::direction slot through Option::unwrap_or_default against the closed-set-level [OptimizationDirection::default = Minimize]); this method is the derived-nullary-bool projection over the same defaulted scalar, mirroring the (has-variant, is-projection) pair on the sibling point_type axis.

Semantics — derived nullary boolean, defaulted through Option

direction_prefers_lower() returns true iff self.horizon.direction.unwrap_or_default().prefers_lower(). The two-variant OptimizationDirection closed set publishes the truth table: OptimizationDirection::Minimize → true (cost / latency / error rate — lower is better); OptimizationDirection::Maximize → false (throughput / coverage / revenue — higher is better). A Classification::gate_compute baseline (which carries horizon: Horizon::default() whose direction field is None) answers true deliberately — an unadorned Process’s polarity reads as lower-is-better, matching the substrate [OptimizationDirection::default = Minimize] chosen precisely so an under-specified Asymptotic horizon can’t silently flip the rate-window evaluator’s polarity onto the Maximize path (a future Maximize-default-via-rename would silently invert every existing alert that treats decreasing rate as healthy).

A future third OptimizationDirection variant (a hypothetical Stabilize sentinel for “drive toward a target value”, which neither minimization nor maximization names) reaches this probe through ONE prefers_lower arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per-variant policy decision to the closed set’s own truth table (OptimizationDirection::prefers_lower) rather than duplicating the discriminator sweep here.

Compounding — opens the optimization-direction axis on the corner

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag prefers-lower-direction on POINT_FIXED_TAG_ARMS — the SIXTH classification axis to reach the fixed-tag corner. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::direction_prefers_lower, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (prefers-lower-direction) audit answers the same question on both surfaces. A future antisymmetric peer (direction_prefers_higher reading !self.horizon.direction.unwrap_or_default().prefers_lower(), or a projection through a peer OptimizationDirection::prefers_higher closed-set arm) closes the binary XOR partition on this axis — mirror of the calm-axis (monotone-calm ⊕ coordination-required) and data-axis (public-data ⊕ data-restricted) closures — as the SECOND occupant on the axis.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the prefers-lower-direction fixed tag in tatara-check, future asymptotic-health rate-window / regression-detector evaluators keying on the optimization-polarity, future variant additions on OptimizationDirection) binds through the SAME direction_prefers_lower() shape rather than restating the classification.horizon.direction.unwrap_or_default().prefers_lower() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future OptimizationDirection variant lands at ONE ALL entry + ONE prefers_lower arm on the closed set and this probe picks it up mechanically.

pub fn direction_prefers_higher(&self) -> bool

POSITIVE-FRAMING PEER of Self::direction_prefers_lower — does this Classification’s Horizon::direction slot (defaulted through [OptimizationDirection::default = Minimize] on absence) project to true under OptimizationDirection::prefers_higher? The ONE substrate primitive that owns the (Classification) -> bool derived- nullary-predicate walk on the horizon.direction slot for the higher-is-better optimization-polarity question.

Fifteenth occupant on the (parent × derived-nullary-bool) corner — CLOSES the optimization-direction axis

Peer of the fourteen prior nullary-bool substrate primitives on Classification (Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, Self::data_is_regulated, Self::data_is_restricted, Self::point_is_endomorphic, Self::point_is_diffusive, Self::point_is_convergent, Self::substrate_is_resource, Self::substrate_is_policy, Self::substrate_is_telemetry, Self::calm_is_monotone, Self::data_is_public, Self::direction_prefers_lower) on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set-driven presence-probe algebra. FIFTEENTH occupant on the corner and SECOND peer threading the classification-horizon.direction axis — CLOSES the axis into the FULL binary XOR partition contract direction_prefers_lower ⊕ direction_prefers_higher sealed on the closed set by optimization_direction_prefers_lower_xor_prefers_higher and composed through the parent-composed layer by classification_direction_probes_form_binary_xor_partition_over_all. ALL SIX classification axes (horizon, calm, data, point, substrate, optimization-direction) now have their partitions closed at the corner — the fixed-tag algebra reaches full axis-coverage on the classification lattice.

Direct byte-for-byte structural peer of Self::direction_prefers_lower: both walk the SAME Horizon::direction slot through TWO layers of Default (Horizon::default → direction: None; then [OptimizationDirection::default = Minimize]) to reach the closed-set-level projection. The Classification::gate_compute baseline’s default-arm answer projects false HERE (Minimize default → prefers_higher() = false), mirror-inverted from Self::direction_prefers_lower’s Minimize-default true on the SAME defaulted horizon.direction slot — the antisymmetric twin on the substrate polarity default.

Semantics — derived nullary boolean over the closed-set plane

direction_prefers_higher() returns true iff self.horizon.direction.unwrap_or_default().prefers_higher(). The two-variant OptimizationDirection closed set publishes the truth table: OptimizationDirection::Minimize → false (cost / latency / error rate — decreasing values improve); OptimizationDirection::Maximize → true (throughput / coverage / revenue — increasing values improve). A Classification::gate_compute baseline (which carries horizon: Horizon::default() whose direction field is None) answers false because [OptimizationDirection::default = Minimize] projects prefers_higher = false, so every unadorned Process reads under the lower-is-better polarity — matching the substrate polarity default (safe under the asymptotic-health rate-window evaluator’s convention: an operator must deliberately opt into Maximize polarity rather than the substrate silently flipping every unadorned Process onto the higher-is-better path).

A future third OptimizationDirection variant (a hypothetical Stabilize sentinel for “drive toward a target value”, which neither minimization nor maximization names) reaches this probe through ONE prefers_higher arm on the closed set with the probe body untouched — the nullary-predicate shape defers every per-variant policy decision to the closed set’s own truth table (OptimizationDirection::prefers_higher) rather than duplicating the discriminator sweep here. The XOR pin on the closed set forces such a variant to answer false on BOTH prefers_lower AND prefers_higher unless a deliberate extension carves the closed set into a ternary partition.

Compounding — CLOSES the optimization-direction axis into a binary XOR partition

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag prefers-higher-direction on POINT_FIXED_TAG_ARMS — byte-for-byte structural peer of the sibling prefers-lower-direction fixed tag (the antisymmetric partner on the same axis) and of every other (parent × derived- nullary-bool) corner arm. The ephemeral surface publishes the same tag via crate::ephemeral::EphemeralSpec::direction_prefers_higher, which composes THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (prefers-higher-direction) audit answers the same question on both surfaces. SECOND optimization-direction-axis peer CLOSES the binary XOR partition contract direction_prefers_lower ⊕ direction_prefers_higher sealed on the closed set by optimization_direction_prefers_lower_xor_prefers_higher through the parent-composed layer as a substrate-wide theorem — mirror of the calm-axis (monotone-calm ⊕ coordination-required) and data-axis (public-data ⊕ data-restricted) closures already landed on the corner, and the SIXTH (and final) classification axis to reach the closed XOR partition landmark at this corner.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the prefers-higher-direction fixed tag in tatara-check, future asymptotic-health rate-window / regression-detector evaluators keying on the positive higher-is-better polarity framing, future variant additions on OptimizationDirection) binds through the SAME direction_prefers_higher() shape rather than restating either !self.direction_prefers_lower() or self.horizon.direction.unwrap_or_default().prefers_higher() at the callsite. THEORY.md §VI.1 — generation over composition; a future OptimizationDirection variant lands at ONE ALL entry + ONE prefers_higher arm on the closed set and this probe picks it up mechanically.

pub fn input_arity_is_one(&self) -> bool

Derived-boolean predicate — does this Classification’s point_type slot project to Arity::One under ConvergencePointType::input_arity? The ONE substrate primitive that owns the (Classification) -> bool derived- nullary-predicate walk on the DAG-composition input-arity projection.

First derived-nullary-bool corner occupant on the input-arity axis

Peer of the fifteen prior nullary-bool substrate primitives on Classification (Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, Self::data_is_regulated, Self::data_is_restricted, Self::point_is_endomorphic, Self::point_is_diffusive, Self::point_is_convergent, Self::substrate_is_resource, Self::substrate_is_policy, Self::substrate_is_telemetry, Self::calm_is_monotone, Self::data_is_public, Self::direction_prefers_lower, Self::direction_prefers_higher) on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set-driven presence-probe algebra. SIXTEENTH occupant on the corner and FIRST occupant threading the classification-point_type- derived input-arity axis — opens the SEVENTH classification axis into the fixed-tag algebra after the six axes (horizon, calm, data, point-type, substrate, optimization-direction) already closed at the corner. The input-arity axis is a derived typed projection through ConvergencePointType::input_arity rather than a stored classification slot — so this predicate composes an extra closed-set-level projection hop compared to the sibling point_is_* triple that walks the raw point_type slot.

Semantics — derived nullary boolean over the input-arity projection

input_arity_is_one() returns true iff self.point_type.input_arity().is_one(). The eight-variant ConvergencePointType closed set publishes the truth table through ConvergencePointType::input_arity: Transform | Fork | Broadcast | Observe → One → true; Join | Gate | Select | Reduce → Many → false. A Classification::gate_compute baseline (which carries point_type: Gate) answers false — Gate.input_arity() = Many, so the multi-input bucket carves the workspace-wide baseline into the multi-input cell.

A future ConvergencePointType variant (a hypothetical Demux for One → Many or Mux for Many → One) reaches this probe through ONE input_arity arm on ConvergencePointType with the probe body untouched — the many-to-one projection means the bucket membership shift lands exactly at ConvergencePointType::input_arity, not at every consumer that previously restated the bucket in code.

Compounding — opens the input-arity axis at the parent-composed corner

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check composes this primitive as a fixed tag single-input-arity on POINT_FIXED_TAG_ARMS — byte-for-byte structural peer of every other (parent × derived-nullary-bool) corner arm. The antisymmetric partner Self::input_arity_is_many closes the input-arity axis into the FULL binary XOR partition contract sealed on the closed set by arity_is_one_xor_is_many_over_all — mirror of the binary XOR closures on the calm axis (monotone-calm ⊕ coordination-required), the data axis (public-data ⊕ data-restricted), and the optimization-direction axis (prefers-lower-direction ⊕ prefers-higher-direction). A future ephemeral-surface peer (EphemeralSpec::input_arity_is_one) will compose THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (single-input-arity) audit answers the same question on both surfaces.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the future single-input-arity fixed tag in tatara-check, DAG composition validators keying on the single-input framing, future variant additions on ConvergencePointType) binds through the SAME input_arity_is_one() shape rather than restating the two-hop self.point_type.input_arity().is_one() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future ConvergencePointType variant lands at ONE ALL entry + ONE input_arity arm on the closed set and this probe picks it up mechanically.

pub fn input_arity_is_many(&self) -> bool

ANTISYMMETRIC PEER of Self::input_arity_is_one — does this Classification’s point_type slot project to Arity::Many under ConvergencePointType::input_arity? The ONE substrate primitive that owns the (Classification) -> bool derived-nullary-predicate walk on the multi-input side of the DAG-composition input-arity projection.

Seventeenth corner occupant — CLOSES the input-arity axis into a binary XOR partition

SEVENTEENTH occupant on the (parent × derived-nullary-bool) corner of the workspace-wide closed-set-driven presence-probe algebra and SECOND peer threading the classification- point_type-derived input-arity axis — CLOSES the SEVENTH classification axis into the FULL binary XOR partition contract input_arity_is_one ⊕ input_arity_is_many sealed on the closed set by arity_is_one_xor_is_many_over_all and composed through the parent-composed layer by classification_input_arity_probes_form_binary_xor_partition_over_all. Structural mirror of the calm-axis binary XOR partition (monotone-calm ⊕ coordination-required), the data-axis binary XOR partition (public-data ⊕ data-restricted), and the optimization-direction-axis binary XOR partition (prefers-lower-direction ⊕ prefers-higher-direction) — the FOURTH parent-composed binary XOR partition on the corner.

Semantics — derived nullary boolean over the multi-input projection

input_arity_is_many() returns true iff self.point_type.input_arity().is_many(). The eight-variant ConvergencePointType closed set publishes the truth table through ConvergencePointType::input_arity: Transform | Fork | Broadcast | Observe → One → false; Join | Gate | Select | Reduce → Many → true. A Classification::gate_compute baseline (which carries point_type: Gate) answers true — Gate.input_arity() = Many, so the multi-input bucket carves the workspace-wide baseline. Direct antisymmetric mirror of Self::input_arity_is_one on the SAME projection through the SAME closed set.

Compounding — CLOSES the input-arity axis into a binary XOR partition

The point-domain require-tag surface will compose this primitive as a fixed tag multi-input-arity on POINT_FIXED_TAG_ARMS — antisymmetric peer of the sibling single-input-arity fixed tag. Together with the sibling Self::input_arity_is_one the two predicates seal the input-arity axis into a binary XOR partition on the parent- composed layer as a substrate-wide theorem, closing the axis at the SEVENTH-classification-axis landmark.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the future multi-input-arity fixed tag, DAG composition validators keying on multi-input fan-in semantics, future variant additions on ConvergencePointType) binds through the SAME input_arity_is_many() shape rather than restating either !self.input_arity_is_one() or self.point_type.input_arity().is_many() at each callsite. THEORY.md §VI.1 — generation over composition; a future ConvergencePointType variant lands at ONE ALL entry + ONE input_arity arm on the closed set and this probe picks it up mechanically.

pub fn output_arity_is_one(&self) -> bool

Derived-boolean predicate — does this Classification’s point_type slot project to Arity::One under ConvergencePointType::output_arity? The ONE substrate primitive that owns the (Classification) -> bool derived- nullary-predicate walk on the DAG-composition OUTPUT-arity projection — antisymmetric partner (on the DAG-composition arity PAIR) of the sibling Self::input_arity_is_one that walks the SAME point_type slot through the SAME Arity closed set but composes a DIFFERENT typed projection (ConvergencePointType::output_arity rather than ConvergencePointType::input_arity).

Eighteenth (parent × derived-nullary-bool) corner occupant — opens the EIGHTH classification axis

Peer of the seventeen prior nullary-bool substrate primitives on Classification (Self::horizon_terminates, Self::horizon_requires_metric_axes, Self::calm_requires_coordination, Self::data_is_regulated, Self::data_is_restricted, Self::point_is_endomorphic, Self::point_is_diffusive, Self::point_is_convergent, Self::substrate_is_resource, Self::substrate_is_policy, Self::substrate_is_telemetry, Self::calm_is_monotone, Self::data_is_public, Self::direction_prefers_lower, Self::direction_prefers_higher, Self::input_arity_is_one, Self::input_arity_is_many) on the workspace-wide (parent × derived-nullary-bool) corner of the closed-set-driven presence-probe algebra. EIGHTEENTH occupant on the corner and FIRST occupant threading the classification-point_type-derived output-arity axis — opens the EIGHTH classification axis into the fixed-tag algebra after the seven axes (horizon, calm, data, point-type, substrate, optimization-direction, input-arity) already opened at the corner. The output-arity axis is the SECOND derived typed projection (ConvergencePointType::output_arity, after the input-arity axis’s ConvergencePointType::input_arity) rather than a stored classification slot — so this predicate composes an extra closed-set-level projection hop compared to the sibling point_is_* triple that walks the raw point_type slot.

Distinctness from the input-arity axis

The input-arity and output-arity axes carve the eight-variant ConvergencePointType closed set into DISTINCT partitions — six of the eight variants (Fork | Broadcast | Join | Gate | Select | Reduce) DISAGREE between the two projections, and only the two endomorphic variants (Transform | Observe — both (One, One)) agree. So output_arity_is_one is NOT a redundant restatement of input_arity_is_one; the two together name the (input_arity, output_arity) typed pair contract canonically already carried on ConvergencePointType by the is_endomorphic | is_diffusive | is_convergent triple — but as SEPARATE nullary predicates on the parent-composed layer rather than as a bucket dispatcher.

Semantics — derived nullary boolean over the output-arity projection

output_arity_is_one() returns true iff self.point_type.output_arity().is_one(). The eight-variant ConvergencePointType closed set publishes the truth table through ConvergencePointType::output_arity: Transform | Join | Gate | Select | Reduce | Observe → One → true; Fork | Broadcast → Many → false. A Classification::gate_compute baseline (which carries point_type: Gate) answers true — Gate.output_arity() = One, so the single-output bucket carves the workspace-wide baseline into the single-output cell. Note the workspace-baseline answer FLIPS between the input-arity and output-arity axes on the exact same baseline: input_arity_is_one is false on gate_compute, but output_arity_is_one is true — direct evidence that the two axes carve the closed set into structurally different partitions.

A future ConvergencePointType variant (a hypothetical Demux for One → Many or Mux for Many → One) reaches this probe through ONE output_arity arm on ConvergencePointType with the probe body untouched — the many-to-one projection means the bucket membership shift lands exactly at ConvergencePointType::output_arity, not at every consumer that previously restated the bucket in code.

Compounding — opens the output-arity axis at the parent-composed corner

The point-domain require-tag surface in tatara-reconciler::bin::tatara-check will compose this primitive as a fixed tag single-output-arity on POINT_FIXED_TAG_ARMS — byte-for-byte structural peer of every other (parent × derived-nullary-bool) corner arm. The antisymmetric partner Self::output_arity_is_many closes the output-arity axis into the FULL binary XOR partition contract sealed on the closed set by arity_is_one_xor_is_many_over_all — mirror of the binary XOR closures on the calm axis (monotone-calm ⊕ coordination-required), the data axis (public-data ⊕ data-restricted), the optimization-direction axis (prefers-lower-direction ⊕ prefers-higher-direction), and the input-arity axis (input_arity_is_one ⊕ input_arity_is_many). A future ephemeral-surface peer (EphemeralSpec::output_arity_is_one) will compose THIS method through crate::ephemeral::EphemeralSpec::resolved_classification so the two-surface parity contract holds — the operator’s :requires (single-output-arity) audit answers the same question on both surfaces.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the future single-output-arity fixed tag in tatara-check, DAG composition validators keying on the single-output framing, future variant additions on ConvergencePointType) binds through the SAME output_arity_is_one() shape rather than restating the two-hop self.point_type.output_arity().is_one() chain at each callsite. THEORY.md §VI.1 — generation over composition; a future ConvergencePointType variant lands at ONE ALL entry + ONE output_arity arm on the closed set and this probe picks it up mechanically.

pub fn output_arity_is_many(&self) -> bool

ANTISYMMETRIC PEER of Self::output_arity_is_one — does this Classification’s point_type slot project to Arity::Many under ConvergencePointType::output_arity? The ONE substrate primitive that owns the (Classification) -> bool derived-nullary-predicate walk on the multi-output side of the DAG-composition output-arity projection.

Nineteenth corner occupant — CLOSES the output-arity axis into a binary XOR partition

NINETEENTH occupant on the (parent × derived-nullary-bool) corner of the workspace-wide closed-set-driven presence-probe algebra and SECOND peer threading the classification- point_type-derived output-arity axis — CLOSES the EIGHTH classification axis into the FULL binary XOR partition contract output_arity_is_one ⊕ output_arity_is_many sealed on the closed set by arity_is_one_xor_is_many_over_all and composed through the parent-composed layer by classification_output_arity_probes_form_binary_xor_partition_over_all. Structural mirror of the input-arity-axis binary XOR partition (input_arity_is_one ⊕ input_arity_is_many), the calm-axis binary XOR partition (monotone-calm ⊕ coordination-required), the data-axis binary XOR partition (public-data ⊕ data-restricted), and the optimization- direction-axis binary XOR partition (prefers-lower-direction ⊕ prefers-higher-direction) — the FIFTH parent-composed binary XOR partition on the corner and the SECOND on the derived-typed-projection stratum (after the input-arity closure).

Semantics — derived nullary boolean over the multi-output projection

output_arity_is_many() returns true iff self.point_type.output_arity().is_many(). The eight-variant ConvergencePointType closed set publishes the truth table through ConvergencePointType::output_arity: Transform | Join | Gate | Select | Reduce | Observe → One → false; Fork | Broadcast → Many → true. A Classification::gate_compute baseline (which carries point_type: Gate) answers false — Gate.output_arity() = One, so the single-output bucket carves the workspace-wide baseline. Direct antisymmetric mirror of Self::output_arity_is_one on the SAME projection through the SAME closed set.

Compounding — CLOSES the output-arity axis into a binary XOR partition

The point-domain require-tag surface will compose this primitive as a fixed tag multi-output-arity on POINT_FIXED_TAG_ARMS — antisymmetric peer of the sibling single-output-arity fixed tag. Together with the sibling Self::output_arity_is_one the two predicates seal the output-arity axis into a binary XOR partition on the parent- composed layer as a substrate-wide theorem, closing the axis at the EIGHTH-classification-axis landmark. Together with the four sibling closed binary XOR partitions (input-arity, calm, data, optimization-direction) the (parent × derived-nullary- bool) corner now carries FIVE closed binary XOR partitions — the derived-typed-projection stratum grows the corner from stored-slot walks into DAG-composition typed projections systematically.

Theory anchor: THEORY.md §II.1 invariant 5 — composition preserves proofs; the derived-nullary-bool predicate body lives at ONE substrate site so every downstream (the future multi-output-arity fixed tag, DAG composition validators keying on multi-output fan-out semantics, future variant additions on ConvergencePointType) binds through the SAME output_arity_is_many() shape rather than restating either !self.output_arity_is_one() or self.point_type.output_arity().is_many() at each callsite. THEORY.md §VI.1 — generation over composition; a future ConvergencePointType variant lands at ONE ALL entry + ONE output_arity arm on the closed set and this probe picks it up mechanically.

pub fn gate_compute_with_axis<A: ClassificationAxis>(axis: A) -> Self

Compose the workspace-baseline Self::gate_compute with a single-axis mutation — return Self::gate_compute() with the axis slot carrying axis’s classification-axis type overwritten by axis. The ONE substrate primitive that owns the (Classification, single-axis variant) → Classification baseline-with-axis-mutated composition shape.

Substrate ergonomics

Pre-lift the shape Classification::gate_compute() with a single axis slot overwritten by a per-test swept variant recurred at ≥ 40 hand-authored test-fixture callsites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold, each restating the SAME six-line struct-literal that names FOUR baseline slots verbatim and mutates ONE. Post-lift every callsite reads Classification::gate_compute_with_axis(populated) — one line, ONE substrate primitive owns the four-baseline-slot restatement, and a future workspace-wide baseline shift lands at ONE site via Self::gate_compute rather than at every downstream test fixture that names the four unmutated slots explicitly.

Compounding

A future SIXTH classification axis (foreshadowed by the six-axis lattice language on the CRD-facing prose) lands as ONE peer impl ClassificationAxis on the new axis’s closed set + ONE new slot on Classification itself — every test fixture using gate_compute_with_axis picks up the sixth axis mechanically without touching the callsite. A future audit dispatcher walking every classification axis (the “walk every classification axis through its XOR partition landmark” shape the FIFTH-axis-closure commit 2c74fab explicitly named as the next-lift target) binds through the SAME trait rather than a five-arm dispatch on axis identity.

Theory anchor: THEORY.md §II.1 invariant 5 (composition preserves proofs — the four-baseline-slot restatement is the composition proof gate_compute already carries at ONE site; this primitive extends the ONE-site composition guarantee through the per-axis mutation shape). THEORY.md §VI.1 (generation over composition — a future sixth axis lands as ONE ClassificationAxis impl and every test fixture picks it up mechanically).

pub fn with_axis<A: ClassificationAxis>(self, axis: A) -> Self

Fluent per-axis overlay — post-composes ONE additional ClassificationAxis variant on top of self, returning the mutated Classification by value. Sibling to Self::gate_compute_with_axis on the (baseline-composer × per-axis-overlay) axis: gate_compute_with_axis(a) is the (start-from-baseline, overlay-one-axis) shape; with_axis(a) is the (start-from-arbitrary-classification, overlay-one-more- axis) shape. Together they compose the workspace-wide (Classification, N-axis-conjunction) construction algebra: Classification::gate_compute_with_axis(a).with_axis(b).with_axis(c) chains an arbitrary N-axis conjunction onto the Self::gate_compute baseline through ONE substrate primitive per axis rather than restating the FIVE-field struct-literal (point_type, substrate, horizon, calm, data_classification) verbatim at every N-axis-conjunction test-fixture callsite.

Substrate ergonomics

Pre-lift the shape Classification { <mutated-axes>, ..(remaining-baselines) } recurred at ≥ 5 hand-authored multi-axis-conjunction test-fixture callsites in this file past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold, each restating the FIVE-field struct-literal with distinct (Fork+Storage), (Fork+Storage+NonMonotone), (Fork+Storage+NonMonotone+Pii), (Fork+Storage+NonMonotone+Pii+HorizonKind::Asymptotic), and (Fork+Storage+NonMonotone+Pii+HorizonKind::Asymptotic+ direction=Maximize) conjunctions. Post-lift each callsite reads Classification::gate_compute_with_axis(Fork).with_axis(Storage) … (chained per axis), and the four/three/two/one-baseline-slot restatement binds through the ONE substrate composer at every callsite. The prior lift onto Self::gate_compute_with_axis (76d469c + 08714f6 + 7f14656) closed the SINGLE-axis- overlay shape; this primitive extends the same trait dispatch through arbitrary N-axis conjunctions without introducing a variadic-tuple-overlay dispatch path.

Compounding

A future SIXTH classification axis (foreshadowed by the six-axis lattice language on the CRD-facing prose) lands as ONE peer impl ClassificationAxis on the new axis’s closed set — every multi-axis-conjunction test fixture using .with_axis(...) picks up the sixth axis mechanically by appending ONE more .with_axis(new_variant) call rather than growing an N-field struct-literal to N+1 fields at every site. A future audit dispatcher walking a fixed N-axis conjunction on every classification axis binds through the SAME chained-overlay shape rather than a per-N-arity composer family (gate_compute_with_axes2, gate_compute_with_axes3, …).

Theory anchor: THEORY.md §II.1 invariant 5 (composition preserves proofs — the per-axis overlay is the axis-local composition proof ClassificationAxis::overlay owns at ONE site; this primitive lifts the ONE-axis composition guarantee through arbitrary chaining without a per-arity dispatch path). THEORY.md §VI.1 (generation over composition — a future N-axis-conjunction test lands as ONE chained .with_axis(...) sequence versus a fresh N+1-field struct- literal per callsite).

Trait Implementations

impl Clone for Classification

fn clone(&self) -> Classification

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Classification

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Classification

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for Classification

fn schema_name() -> String

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn is_referenceable() -> bool

Whether JSON Schemas generated for this type should be re-used where possible using the $ref keyword.

impl PartialEq for Classification

fn eq(&self, other: &Classification) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Classification

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Classification