How to Test The ChoiceLessChoice

Three surfaces matter for a test: the Sanctuary where the conversation and the calculation happen, the Archive where a sealed receipt is written, and Preflight where a sealed boundary is held. The conversation is deliberately quiet: no step grids, no score tables to fill in, no interview script. Structure appears only when you ask for it or confirm it.

It does not invent scores

A score you did not state is a neutral 5 marked not declared. If every score in a frame is a default, the run does not produce a winner — it returns Insufficient Basis.

It does not rename your words

Option names, priority names and the exact phrasing you confirmed are what the calculation and the receipt use. A label you never used should never appear in your result.

It does not change your frame without a yes

Criteria, scores, weights and the decision structure stay as you left them. A suggested new consideration is offered as untested and explicitly labelled; incorporating it requires your explicit agreement.

It does not let a model do arithmetic

The panel of voices may explore and name blind spots, but it cannot rank options or produce the verdict. The verdict comes from the deterministic calculation over your declared values.

It does not decide for you

The calculated result is an output you can inspect, dispute and override. The decision remains yours.

If you declare a cost limit, an option whose cost exceeds it is removed from consideration outright. It is not scored lower and it cannot win, however attractive its other numbers are. The calculation is performed over the options that remain inside the limit.

If every option exceeds the limit, there is no winner to report: the outcome is Insufficient Basis. That is a result, not a crash — the frame you confirmed is still sealed and readable.

Test it: declare two options, set a budget one option clearly exceeds, and confirm that the over-budget option cannot be returned as the result even when its raw total is higher.

When a frame is committed, the state is written as an ordered chain of receipts — G0, G1, and so on — where each receipt is derived from the one before it. Execution is only accepted against the latest generation. This is the part of the system that is easiest to verify from the outside, and the part you are most useful for attacking.

G0  committed state (intent + constraints + prev_hash = null)
 |
 v
G1  commit(new constraints)  ->  state_hash derived from G0 hash
 |
 v
execute(state_hash)
 ├── latest generation ......... 200 accepted · external_actions: disabled
 ├── older generation .......... 409 STALE_STATE · current generation returned
 ├── unknown hash .............. 422 unknown_receipt
 └── another owner's decision .. 404 / 403 refused

A stale submission is not silently accepted and not silently ignored: it is refused with the current generation returned, so you can see what the machine now believes. Nothing outside the app is ever triggered by an execution attempt.

Test it: commit a frame, commit a change so the generation advances, then attempt execution with the earlier receipt. Expect a refusal naming the current generation — not a result.

When the evidence in the frame cannot support a verdict — missing scores, fewer than two options, no priorities, every option outside the budget, or an unresolved conflict — the outcome is INSUFFICIENT BASIS. It seals to the Archive with your confirmed frame, the score matrix and the reason.

What it deliberately does not do: name a winner, invent an action, or quietly fill the gap with a plausible-sounding recommendation. An unresolved decision recorded honestly is more useful than a resolved decision recorded falsely.

The downloaded file is choiceflow-receipt-<id>.json, format choiceflow-receipt/v1, with four ordered stages:

1 · conversation

Every spoken or typed turn, in order, attributed to you or to the room.

2 · confirmed_frame

The dilemma, options, priorities with weights, the score matrix, the declared budget and costs, and the list of values that were neutral defaults rather than your words. Carries the confirmation hash.

3 · calculation

The formula in plain language and the raw totals it produced, so you can recompute them yourself from stage 2.

4 · result

The calculated result, the explanation, and the standing note that the decision remains yours.

The file also carries the receipt identifier, the server-issued SHA-256 seal, and the seal timestamp. The seal is issued by the server when the receipt is written; the export does not create it. The download control appears on the completion screen in the Sanctuary — the Archive shows the same seal against the stored receipt rather than a second download.

Execution is a dry run

The boundary gate never performs an external action. No payment is taken, no message is sent, nothing outside this application is triggered — by design, at every generation.

The boundary is enforced inside this system

What a test proves is that state cannot be advanced on stale or forged evidence within this runtime. It is not a claim about an external agent's behaviour.

Preflight observations are supplied by you

The simulator's events — a timeout, a denied tag touched, a risk spike — are generated when you press them, then classified and halted by the real server. The halt you see is genuine. It is not evidence that a live upstream failed on its own.

An unknown cost is not a proven cost

A budget can only be breached by a cost you stated. An option with no cost recorded is not disqualified — it is simply unpriced, which is worth reporting as a gap in your own frame.

Voice runs in your browser

Spoken input and spoken replies use your browser's own speech facilities. Recognition errors are browser errors; report the sentence you said and what was captured.

Sovereign Legacy is a research concept

It is presented as research, works only from material you are entitled to use, and remains generated content — not the person it draws on.

For anything that surprises you, four things make a report actionable:

• The exact sentence you said or typed, copied as it was spoken.
• What you expected the system to treat as declared, and what it actually used.
• The receipt identifier from the Archive, or the state generation from a boundary attempt.
• Whether the failure was silent (a wrong number appeared) or loud (you were told it could not proceed).

Silent failures are the serious ones. A wrong number that arrives without protest is worth far more to report than a refusal you were warned about.