The book taught act one (getting a kernel to accept a proof) across twelve
chapters and never taught act two: the protocol that makes a green light mean
something to someone who was not present. ch11 armed the reader to interrogate a
CERTIFICATE and left the script that interrogates certificates — software the
author wrote, verified by nothing — entirely unexamined. That was the gap eight
rounds of external review found in the companion projects, and it is a didactic
failure of this book too.
ch13 teaches it from the war stories: the two acts and why act one is the easy
one (eleven theorems in two days, never disputed; eight review rounds and
eighteen defect classes to make the button over them credible); the single shape
every failure had (something load-bearing sat outside the binding), with the
demonstrated exploits including ALL GREEN over a repository proving False, a
certificate reduced to 'the loop equals the loop' with every fingerprint
byte-identical, and a stubbed compiler wrapper going green in 3.6 seconds over
destroyed proofs; completeness of binding and its four rules (derive the
population, fail closed on absence, exact not subset, a stranger must re-derive);
and the meta-defect of assertions that pass for the wrong reason, including the
tautological assert that appeared twice — the second time inside its own repair.
Closes with the habit to carry: ask both questions, and invite someone to attack
your button early, because none of the eighteen was found by the author.
ch11 now forward-references it at the point where the old blind spot sat.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
