FieldnoteBuilding the RSM kernel
Durable but Undiscoverable
When Wellzai first used the RSM kernel only through its public protocol, offers that had been stored correctly could not be found. The record was right. The view that discovery reads had never been refreshed.
The kernel had passed its own conformance suites. The test that taught us most was not another suite. It was an application. Wellzai was connected to the kernel as its first external consumer, with one constraint that made the exercise honest: it could reach the kernel only through the public protocol, the same way any other application would. The point was to find out what the contract could not yet do, and to fix only what genuinely blocked a journey a person needed to complete.
The first thing that broke was simple to describe. One person published a capability and an offer. The kernel accepted the operation, applied it and stored it durably. A second person then asked who could contribute that capability, and the answer came back empty. Nothing had been lost and nothing had been rejected. The offer was durable but undiscoverable.
The reason sits in a distinction the RSM treats as an invariant: projection is not authority. Discovery in the kernel does not read the canonical record directly. It reads a projection, a derived view built from canonical state and history and shaped for answering discovery questions. The canonical model classifies projections as governed, authorization-scoped views that are "never an authority". The corrected kernel plan went further and made the projection disposable. It must be possible to destroy it and rebuild it from canonical state to the same answers, because "a projection that cannot be destroyed and rebuilt to semantic equivalence has become an accidental source of truth."
That test was in place and it passed. The projection could be rebuilt. What no one had asked was who rebuilds it, and when. The projection was refreshed only when something explicitly asked for a rebuild or refresh. Nothing in the running service ever did, and by design no protocol operation triggers one. A running node would therefore answer discovery from an unbuilt or stale view forever. Each part was correct on its own. The failure lived in the space between them.
Viewgraph6 frames
Building the RSM kernel
Two reads, two levels of trust
Discovery reads a disposable copy. Disclosure reads the source, under authority checked at the moment of asking.
Wellzai
Discovery
Discovery answers from a projection
A derived view, rebuilt from canonical state. Useful, and never an authority.
Rendering diagram…
The projection is downstream of the record. It can be destroyed and rebuilt.
Who offers which kind of capability, in which broad area. Not quantities, not names, not a precise location: discovery returns discovery-safe facts, and details remain the subject's records.
Disclosure
Disclosure answers from the source
Authority is evaluated fresh on every request. Nothing is cached, journaled or replayed.
Rendering diagram…
The projection appears nowhere on this path.
First external consumer
Stored correctly, found by no one
The view could be rebuilt. Nothing in the running service ever rebuilt it.
Rendering diagram…
Every part was correct on its own. The gap was between them.
The fix
Refresh the view, keep the boundary
The smallest application-neutral change that made applied state discoverable.
The projection is re-derived in full from canonical state.
A refresh cannot change whether an operation was applied.
A failed refresh leaves the last checkpoint in place and is reported to an operator.
A running node no longer answers from a projection it never built.
The fix was deliberately small and application-neutral. After any operation is applied, the kernel now re-derives the projection in full from canonical state. A refresh can never change the outcome of the operation that triggered it. If a refresh fails, the projection stays at its last checkpoint, that state is visible, and an operator is told. Refreshes run one at a time, and the service rebuilds the projection when it starts. Nothing about Wellzai was encoded in the kernel to make this work.
The fix also left one thing alone, and that matters more than the fix. The authority path still never reads the projection. Whether a person may act for an organization, or may see a protected record, is decided against canonical state and current grants, never against the view that discovery uses. It would have been easy to treat a fresher projection as good enough for authority as well. That is how projections quietly become systems of record.
What we take from it
Correct state can still be invisible. A system can store the truth faithfully, prove that its derived views are reconstructable, and still show people nothing, because reconstructable is not the same as refreshed. The question for any derived view is not only whether it can be rebuilt from the source, but what keeps it current, what happens when that fails, and who can tell.
We also now see staleness as a state the system has to admit to. A projection left at its last checkpoint is behind, not broken, and being behind is acceptable so long as it is visible and the authority path does not depend on it. Discovery may be briefly out of date. Authority may not.
None of this was found by reasoning about the architecture. It was found by an application that had to live with the contract as written. The plan's separations held. What it had not specified was the operational wiring that keeps a disposable view in step with the record it is derived from, and that took a real consumer to expose.