portal compiles one access rule per state a self_transition names, and
without them assumed the day the case arrived. The builder already
knew the answer - `moves_of(need, SUBMITTER)` carries the from-state
of every move - and now writes it down, so the applicant answering a
request for papers from `incomplete` gets a rule for it, and withdrawal
is offered from wherever the case has got to.
Measured on the building authority: the submitter had two rules, both
out of `open`. It now has ten, across applications and appeals.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Three seeds over the building authority's front door, then three more
over a variant where the two bare needs became doors of their own.
The diagnosis held: six of the eight front-door misroutes went to the
appeal, a concrete sentence standing among abstract categories, which
collected everyone with any sort of grievance whatever it was about.
Behind a door of its own it collected none.
The site got no better for it - 77.3% against 80.0%, inside the spread.
Two offers went from findable to hidden: the firm whose insurance
certificate had lapsed found "to be on the list, and then to file
without asking again" as a sentence on the front door, and fails every
seed once it is behind a door called "Work as a firm".
So the leak was not costing what it looked like it was costing, and the
rewrite is rejected on measurement. The mixed front door stays.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A municipal building authority is the first sector that the line a
case walks could not describe. An application is returned for the
drawing it was missing and walks the same stretch again; an appeal
ends the moment the authority changes its own decision, without ever
reaching the board; an applicant may withdraw from anywhere, while a
refusal may only come once the papers are in.
`reached_from: { <stage>: [<stage>, ...] }` says where a stage is
entered from when the line does not. A stage named there is entered
from exactly those stages and nowhere else, so saying where a refusal
may come from also says where it may not - which `turned_down_from`
could not, being one list for every bad ending at once.
Found by replaying fifteen real building cases through portal's own
engine against a throwaway JetStream: it refused three legal paths and
accepted two illegal ones. Portal needed no change - hand-writing the
correct graph into aggregates.yaml, cycle and all, was accepted and
enforced exactly. The rebuilt site now produces that same graph from
the plan, and the access policy follows it.
Also: a public view is of a bucket, not of a need. A permit register
holds the owner's small application and the approved firm's large one
and is one page either way; the rule refused to publish a bucket the
moment any role filed into it. A bucket only a role ever writes to is
still refused.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
