Descent

An argument that LOWERS this operation's ceiling for one call, and the reason it may. greenhouse decisions/0029, forced by `capabilities:enable --dry-run` asking permission to do nothing: rule S2 judges the OPERATION, so a rehearsal of an Executable and Privileged operation carried the ceiling of the real thing though it wrote nothing. WHY THIS IS THE DANGEROUS DIRECTION. `escalatesOn` is safe because it can only raise: a careless or lying declarant only harms themself, which is what lets an adversarial enumerator be additive (GOV-14). Lowering inverts that — whoever declares a descent badly is not punished, they are EXEMPTED, and the failure is invisible: a heavy operation that quietly stops asking. So three things are true of every descent here: · it names the full RESULTING ceiling, never a delta — «a bit less» is not a place, and what a reader needs is exactly where this lands; · it carries its REASON, the same shape `rollbackContract` already has for the one reversibility level that buys less scrutiny; · a descent that cannot hold does not lower anything. Failing upwards is the only failure this axis can afford.

public function __construct(string $argument, ?mixed $whenValue, Milpa\Command\Effect\EffectProfile $to, string $because, ?Milpa\Command\Effect\DescentCertificate $certificate = null):

Parameters

public function triggeredBy(array $arguments): bool

Does this call trigger the descent? Identity on the value, so a different one does not.

Parameters

public function holds(Milpa\Command\Effect\EffectProfile $original, ?Milpa\Command\Effect\CallSubject $subject = null): bool

Is this descent one anybody should honour? A reason is required, and the destination has to be genuinely lighter on every axis. A descent that raises anything is not a descent — it would be a back door for climbing without saying so. AND SINCE greenhouse decisions/0050, A REASON IS NOT ENOUGH. Until then a non-empty `because` was the entire mechanism: whoever declared a descent was believed, so lying bought an exemption rather than costing one — measured in `evidence/0238`, where a handler did exactly what its descent denied and got both the lowered ceiling and the gate's silence. The certificate answers five questions nobody has to be trusted about, and any «no» leaves the ceiling where it was: did this payload come from the certifier at all (greenhouse decisions/0051), does it speak about THIS operation and THESE arguments, was it earned watching THIS handler, does it justify THIS destination, and did a control demonstrate every axis this descent lowers. The signature is asked first because it is the cheapest and because everything after it is meaningless without it: `evidence/0249` deleted the artifact, rewrote it by hand, and every other check passed with flying colours.

Parameters

public function explain(Milpa\Command\Effect\EffectProfile $original, ?Milpa\Command\Effect\CallSubject $subject): array

The provenance of every axis this descent brings down — the receipt of decisions/0057. Called only after {@see holds()} has said yes, so it does not re-gate; it re-derives the citations. Authority is re-judged live because its claim is a RECEIPT, not currency (decisions/0053) — so a channel that records this always records the policy that was in force at composition, never a stale one. Observed axes cite the certificate that covered them.

Parameters