Appendix B — Engineering Moves

B.3 Keep Representation and Reality in Correspondence

Problem. A model becomes dangerous when engineers and agents continue to trust it after it no longer corresponds to the system it represents.

Move. Treat correspondence as an invariant. Check both that reality still satisfies modeled claims and that consequential implementation elements have not appeared outside the model's declared scope.

Figure B.3-1 shows the two directions.

C.3 Keep representation and reality in correspondence, checked in both directions A model and the running system it describes, joined by two checks that run in opposite directions. One check reads a modeled claim and asks whether reality still satisfies it — this catches wrong modeled facts. The other check starts from reality and asks whether anything important has appeared outside the model — this catches unmodeled reality. Both must run: correspondence is a two-way invariant, not a one-time claim. MODEL what we claim is true REALITY the running system claim Does reality still satisfy the model? catches a wrong modeled fact Did something important appear outside the model? catches unmodeled reality coverage Treat correspondence as an invariant, and check it in both directions. One direction catches wrong modeled facts; the other catches reality the model never admitted.
Figure B.3-1. Correspondence runs both ways. A two-way loop joins MODEL and REALITY. One arrow asks whether reality still satisfies the model, catching a wrong modeled fact; the other asks whether something important appeared outside the model, catching unmodeled reality.

Example — Architecture drift. A component-and-zone model declares where code belongs and which dependencies it may take. A gate compares the declared architecture against the imports the implementation actually makes. A change that violates the modeled structure fails the check at commit time.

Example — Governance coverage. The same correspondence idea runs the other way. An orphan-coverage walk starts from code and asks what model or control governs it. Uncovered code is not automatically wrong; it shows where implementation currently sits outside the modeled governance estate and requires an explicit decision.

Related mechanisms: Component & zone model · Drift & parity gates · Cross-source coherence lints · Orphan-coverage metric · Symbol-anchored traceability.

© James C. Davis, 2026–present