[{"data":1,"prerenderedAt":4},["ShallowReactive",2],{"POeoWHVQjO":3},"# reviser\n\nA reasonable-reflection artifact in the **belief-update** shape: a\nsystem whose belief set evolves under proposer/gate control, with\neach rung admitting a revision (or contraction or expansion)\noperator whose **rationality** as an update rule is kernel-blessed\nby an independent bundle of typed postulates.\n\n> **Climber checks theory construction; defeater checks\n> theory qualification; reviser checks belief revision.**\n\nThe proposer (an LLM, in the full version) does not propose new\nbeliefs as raw data. It proposes **revision *operators*** —\nfunctions `op : BeliefSet → Formula → BeliefSet` together with\nproofs that the operator satisfies the AGM rationality postulates.\nThe kernel admits or refuses based on whether the postulate bundle\ntype-checks. Admitted operators may be invoked at later rungs to\nupdate the belief set; the tower captures the resulting epistemic\ndynamics.\n\nThis is the LCF discipline applied not to proof construction nor to\nproof-system construction nor to qualification, but to **rational\nbelief change** — the keynote architecture pushed one level of\nabstraction up: the modification is itself a function with\ntyped-rationality content, and the gate checks the rationality of\nthe strategy, not just of a single move.\n\nIn the keynote portfolio:\n\n| artifact | what the gate governs |\n|---|---|\n| lean-grey | evaluator modification |\n| lean-green | causal `set!` on a heap cell |\n| LeanDisco | discovery of theorems and heuristics |\n| sc-mini | program-transformation rewrites |\n| climber | the right to extend the proof system |\n| defeater | the right to qualify conclusions |\n| **reviser** | **the right to revise beliefs rationally** |\n\n## The structural bet\n\nForty years of philosophical literature (Alchourrón-Gärdenfors-\nMakinson 1985, Katsuno-Mendelzon 1991, Darwiche-Pearl 1997) has\ncharacterized which belief-update operators count as *rational*\nvia postulates. We treat each postulate as a typed proof\nobligation. An operator gets admitted iff its postulate bundle\ntype-checks against the kernel. Iterated revision becomes a tower.\n\nThe non-monotonicity here lives at a different layer than\ndefeater's: defeater's tower has stable rules but conclusions\nthat vanish when defeated. Reviser's tower has the *belief set\nitself* shrink when retraction happens. **Defeater models what\ngets inferred; reviser models what gets believed.** Two different\nsites of non-monotonicity, both gated by typed certificates.\n\n## Status\n\nBuilt. Eight library files compile end-to-end on Lean 4.29.1 with\nno `sorry` and no added axioms. Smoke executable runs and prints\nthe load-bearing theorem catalog.\n\n## What lives here\n\n- **`Reviser/Object.lean`** — the belief substrate.\n  - `Belief`: `pos a` or `neg a` (atomic literal).\n  - `BeliefSet := List Belief`.\n  - `consistent`: no atom appears as both `pos` and `neg` — the\n    decidable, finite substitute for deductive closure + ⊥.\n  - `Belief.flip`: `pos a ↔ neg a`. Used by the consistency check.\n  - `consistent_filter`: filtering preserves consistency.\n\n- **`Reviser/Operator.lean`** — operators with rationality bundles.\n  - `SoundRevision`: a proposed function plus AGM postulates —\n    *success*, *inclusion*, *vacuity*, *consistency*. The kernel\n    admits iff the bundle type-checks.\n  - `SoundContraction`: contraction postulates — *inclusion*,\n    *vacuity*, *success*, *recovery*.\n  - `kernelRevise B b := (B.filter (· ≠ b.flip)) ++ [b]` — the\n    *filter* is Levi's contraction step; the *append* is expansion.\n  - `kernelContract B b := B.filter (· ≠ b)`.\n  - `kernelRevision : SoundRevision`, `kernelContraction : SoundContraction` —\n    canonical operators with all postulates discharged.\n\n- **`Reviser/Identities.lean`** — classical AGM identities.\n  - `levi_identity`: `kernelRevise B b = kernelContract B b.flip ++ [b]`.\n    Provable by `rfl` — the Levi identity falls out of the\n    definitions. The constructive form of `K * φ = (K - ¬φ) + φ`.\n  - `harper_identity`: `x ∈ kernelContract B b ↔ x ∈ B ∧ x ∈ kernelRevise B b.flip`.\n    The set-theoretic form of `K - φ = K ∩ (K * ¬φ)`.\n  - `recovery_roundtrip`: every belief in `K` survives the\n    contract-by-`b` then expand-by-`b` cycle. AGM Recovery\n    realized constructively at the literal level.\n\n- **`Reviser/Tower.lean`** — iterated revision as a tower.\n  - `Step`: revision or contraction (each carrying its sound\n    operator and target literal).\n  - `applyStep_preserves_consistent`: each step preserves\n    consistency.\n  - `BeliefTower`: initial consistent belief set + finite step\n    list.\n  - `BeliefTower.beliefAt n`: fold of first `n` steps over\n    initial.\n  - `BeliefTower.consistency_preserved`: **headline metatheorem.**\n    Every rung is consistent. The `consistency` postulate of each\n    step's operator is what chains through.\n\n- **`Reviser/Demo.lean`** — five-rung sequence with visible\n  retraction.\n  - Rung 0: `K = []`. Rung 1: revise `pos a`. Rung 2: revise\n    `pos b`. Rung 3: revise `neg a` (retracts `pos a`). Rung 4:\n    contract `neg a`.\n  - Per-rung equality theorems (`rung0_eq` … `rung4_eq`),\n    retraction witnesses (`rung3_retracts_pos_a`,\n    `rung4_retracts_neg_a`), `demo_consistency`.\n\n- **`Reviser/Science.lean`** — scientific theory revision narrative.\n  - `K = [earthFlat]` → revise `shipsDisappearAtHorizon` → revise\n    `¬earthFlat` (retraction) → revise `earthRound` → revise\n    `satelliteImagery`.\n  - Per-rung equality theorems plus `rung2_retracts_earthFlat`,\n    `rung3_has_earthRound`, `science_consistency`.\n  - The textbook narrative for AGM dynamics — initial conviction,\n    evidence, theory abandonment, replacement, corroboration.\n\n- **`Reviser/Iterated.lean`** — iterated revision and operator\n  diversity.\n  - `setEquiv`: equality up to set membership (the natural\n    equality for AGM-style postulates that target *what is\n    believed*, not how it's listed).\n  - `kernelRevise_dp1`: `kernelRevise (kernelRevise B b) b ≈ kernelRevise B b`.\n    Idempotence under `setEquiv` — the second revision adds a\n    duplicate that set-equality washes out.\n  - `pessimisticRevise B b := if b.flip ∈ B then [b] else B ++ [b]` —\n    when conflict, drop everything; when no conflict, expand.\n  - `pessimisticRevision : SoundRevision` — a SECOND AGM-rational\n    operator with all four postulates discharged.\n  - `pessimistic_disagrees_with_kernel`: on `[pos a, pos b] * neg a`,\n    the two operators give different outputs (`[pos b, neg a]` vs\n    `[neg a]`). **AGM doesn't determine the operator uniquely.**\n  - `pessimistic_violates_dp2`: `pessimisticRevise` is AGM-rational\n    yet fails Darwiche-Pearl's DP2 postulate. **AGM doesn't\n    constrain iteration** — iterated revision (DP) is a strictly\n    stronger theory. Concrete Lean witness, parallel to defeater's\n    `Oscillate.lean` finding.\n\n- **`Reviser/Counter.lean`** — non-monotonicity witnesses.\n  - `belief_set_shrinks`: there exist rungs `m \u003C n` and a belief\n    that's in rung-`m`'s set but not in rung-`n`'s.\n  - `rung4_smaller_than_rung2`: a length witness.\n  - `reviser_nonmonotone`: every rung consistent yet the belief\n    set is genuinely non-monotone in the rung index.\n\n## Headline picture\n\n```\n              K₀ = []\n              │\n              │ rung 1: revise by pos a  (Vacuity: trivial expansion)\n              ↓\n              K₁ = {pos a}\n              │\n              │ rung 2: revise by pos b  (Vacuity: trivial expansion)\n              ↓\n              K₂ = {pos a, pos b}\n              │\n              │ rung 3: revise by neg a  (Levi: retract pos a, then add neg a)\n              ↓\n              K₃ = {pos b, neg a}        ← retraction visible\n              │\n              │ rung 4: contract neg a   (pure removal, no addition)\n              ↓\n              K₄ = {pos b}\n```\n\nEach rung's operator carries its postulate bundle — the kernel\nchecked the bundle at admission. The tower records the audit trail:\nwhich operator at which rung, with what rationality theory.\n\n## Relation to climber and defeater\n\n| | climber | defeater | reviser |\n|---|---|---|---|\n| polarity | extending | qualifying | revising |\n| modification | axiom-schema + soundness cert | exception-schema + defeasibility cert | *operator* + rationality bundle |\n| substrate | derivation calculus | rules + facts → conclusions | belief set |\n| headline | `climb_sound` | `rung_sound` | `consistency_preserved` |\n| monotonicity | strictly monotone | non-monotone (rules blocked) | non-monotone (beliefs retracted) |\n| non-monotonicity site | (none) | conclusion level | belief level |\n| modification shape | static schema | static schema | dynamic operator |\n\nSame kernel discipline (typed certificate, kernel admits or\nrefuses); three substrates; three polarities of modification. The\nkeynote's \"the architecture is substrate-agnostic\" claim becomes\na triad rather than a single example.\n\n## What's novel about reviser specifically\n\n1. **The modification is a *function*, not a schema.** Climber's\n   `SoundExtension` and defeater's `SoundDefeater` carry static\n   declarative content (a predicate on formulas, a trigger atom).\n   Reviser's `SoundRevision` carries an actual function with its\n   rationality theory. The proposer/gate pattern at the\n   meta-operator level.\n\n2. **The certificate is a *bundle of postulates*, not a single\n   proof.** AGM's five-postulate characterization becomes a typed\n   product. The kernel admits iff the whole bundle type-checks.\n\n3. **The tower captures genuine epistemic dynamics.** Each rung\n   is one belief-update step in time; the sequence is the agent's\n   epistemic history. Connects to keynote §4.2 (semantics of\n   evolving systems) directly — belief revision IS the textbook\n   evolving system.\n\n4. **Retraction is first-class.** Unlike climber (monotone), and\n   distinct from defeater (where rules are stable but conclusions\n   vary), reviser's belief set itself can shrink when revising by\n   contradictory evidence. The Levi identity makes retraction\n   automatic during revision; explicit `SoundContraction` is its\n   sibling.\n\n5. **AGM's underdetermination is constructive.** The postulates\n   characterize a *class* of operators, not a unique one.\n   `Iterated.lean` exhibits two AGM-rational operators\n   (`kernelRevision` and `pessimisticRevision`) that disagree on\n   the same input — and shows that the pessimistic one *violates*\n   Darwiche-Pearl's DP2. The \"AGM doesn't constrain iteration\"\n   point becomes a Lean witness, parallel to defeater's period-2\n   oscillation: a structural counterexample showing the theory's\n   limit.\n\n## Scope (design choices made)\n\n- **Atomic-literal substrate.** Beliefs are `pos a` / `neg a` for\n  string atoms. No compound formulas. This sidesteps SAT-decidability\n  in the kernel — every check is structural induction on a list.\n- **Finite belief sets.** Belief sets are `List Belief`, not arbitrary\n  closed sets of formulas. Deductive closure is finite-list\n  closure (just the literals stored).\n- **Single fixed proposer-side env.** No semantic interpretation; the\n  postulates are all syntactic. This matches AGM's \"syntactic\"\n  presentation rather than the model-theoretic (worlds-and-spheres)\n  one.\n- **Append-only tower history.** Rungs aren't deleted; later\n  revisions can effectively undo earlier ones, but the rung\n  structure remembers the full update history.\n\n## Open questions\n\n- **Full propositional substrate.** Move from atomic literals to\n  arbitrary propositional formulas. Requires SAT-decidability and\n  the AGM machinery for partial-meet contraction. Probably 2–3×\n  the line count. Full DP3/DP4 require this — they reference\n  `φ ∧ ψ` and entailment.\n- **Representation theorem (Katsuno-Mendelzon 1991).** Show that\n  AGM-rational revision operators correspond to total preorders on\n  worlds. The bridge between syntactic postulates and semantic\n  spheres-of-similarity. Hard but iconic.\n- **Full Darwiche-Pearl postulates.** `Iterated.lean` proves DP1\n  for `kernelRevise` and exhibits a DP2 violation by\n  `pessimisticRevise`. DP3 and DP4 require compound formulas;\n  fully formalizing the DP family would let us *gate* operators\n  on iterated-revision rationality, not just AGM.\n- **Connection to defeater.** Both are non-monotonic; both gate via\n  typed certificates. Is there a translation between them? Can a\n  reviser-tower simulate a defeater-tower or vice versa?\n- **LLM proposer cascade.** The proposer's job is to propose\n  `(op, postulate-bundle)` pairs. The kernel type-checks the bundle.\n  An LLM proposer for revision operators — likely small, since the\n  literature has standardized recipes — would close the proposer/\n  gate loop.\n",1780846778967]