# Governed Reads and Observation

> Deterministic reads, declared-versus-observed semantics, and non-mutating verification.

A governed read provides the system's declared meaning rather than forcing each
operator or AI Peer to reconstruct it from storage.

## Read path

**TM-OBS-001 — Deterministic current read.** An implementation **MUST** provide
a deterministic way to read the current selection, current-state identity, and
material uncertainty for the coherence boundary in scope.

**TM-OBS-002 — Read provenance.** A governed read **MUST** identify the source
or record from which each material result was obtained sufficiently to inspect
its ancestry.

**TM-OBS-003 — Read does not advance truth.** Performing a read or conformance
check **MUST NOT** accept a proposal, alter current truth, or repair a mismatch.
Operational telemetry that does not affect truth semantics may still be
recorded under a declared policy.

**TM-OBS-004 — Machine and human forms.** If a read provides a structured
machine value and a presented human value, both **MUST** resolve to the same
declared meaning. Suppression, truncation, absence, and uncertainty **MUST** be
labelled.

## Live observation

These requirements apply when an implementation compares declared current
truth with an external or runtime system.

**TM-OBS-005 — Declared and observed separation.** Declared state and observed
state **MUST** remain separate values. An observation **MUST NOT** silently
rewrite the declaration it checks.

**TM-OBS-006 — Observation metadata.** A live observation **MUST** identify its
source, observation time, method, expected value, observed value when
available, and operational meaning.

**TM-OBS-007 — Three-way result.** A comparison **MUST** distinguish:

- `match` — the requested observation was made and equals the declaration;
- `mismatch` — the requested observation was made and differs; and
- `unknown` — the requested observation could not establish either result.

**TM-OBS-008 — No inference from absence.** Inaccessibility, timeout,
permission failure, parse failure, or missing evidence **MUST NOT** be
normalized to an expected operational state. An unreachable service is not
thereby stopped or healthy.

**TM-OBS-009 — Stable aggregate semantics.** When checks are aggregated, the
result **MUST** be `mismatch` if any requested check mismatches; otherwise
`unknown` if any requested check is unknown; otherwise `match`.

## Repair boundary

A separate apply or reconciliation path may respond to a mismatch. It must use
the normal evidence, authority, review, and transition requirements. A reader
that silently reconciles drift destroys the distinction it was meant to
measure.