\section{Observer-Declared Timeline Model}
\label{sec:model}

An observer-declared timeline is a deterministic, evidence-bounded projection
of accepted facts from a declared perspective. The model is a surface and
verification contract, not a physical storage schema. In particular, it does
not require facts to be packaged as Episodes; Section~\ref{sec:design}
introduces Episodes as Kungfu's implementation choice.

\subsection{Facts, authority, and accepted cuts}

A \emph{fact} is an event, record, manifest, receipt, payload commitment,
causal edge, human decision, or verification result treated as evidence. Each
fact has source identity, provenance, and an authority boundary. Occurrence,
record, and admission remain distinct: something may happen without being
recorded, and a record does not automatically enter every accepted fact world.

For a view $V$, let $A_V$ be its \emph{accepted fact cut}. The cut names the
source ranges, heads, cursors, manifests, watermarks, freshness bounds, or other
coordinates admitted for that view. It also records known omissions. A view
need not accept every fact the product has seen, but it must not present an
undeclared subset as complete reality.

Accepted facts and their source commitments are authority inputs. A database
index, folded state, GUI history, exported ordering, or summary is derived.
Deleting and rebuilding a projection must not rewrite authority, and
disagreement between authority and projection must be reported as drift.

\subsection{Observer and consequence position}

An \emph{observer} is the perspective for which a view is formed. It may be a
human, agent, workspace, runtime location, service, or product surface. The
observer is not necessarily the author or owner of the facts.

A useful declaration also states the observer's \emph{consequence position}:
the purpose, responsibility boundary, and action context in which the view is
expected to be used. The same accepted facts may support different relevance
or presentation for a local operator, a remote worker, a release reviewer, or
an auditing agent. Consequence position does not permit invention of facts. It
explains why a bounded projection matters and which actions it can responsibly
support.

This field carries KFD-3 into the model. Without it, observer identity can
become inert metadata while the interface still hides whose value, constraints,
and available choices shaped the view.

\subsection{Causality and projection policy}

Let $\prec_V$ be the known causal relation induced by $A_V$, including declared
cross-source dependencies. A projection policy $P_v$ selects and orders
accepted facts for display, replay, export, or agent consumption under semantic
version $v$. For observer $O$, the visible timeline is

\begin{equation}
T_{O,P_v} = \Pi_{O,P_v}(A_V, \prec_V).
\end{equation}

The projection $\Pi$ must be deterministic for its declared inputs and must
produce a linear extension of known causality. If $a \prec_V b$, a valid
projection cannot place $b$ before $a$. Concurrent or causally unrelated facts
may be ordered by observer policy, source priority, local sequence, or a stable
tie-breaker, but the choice must be inspectable and versioned. When accepted
evidence cannot support a total order, the result is partial, degraded, or
rejected rather than silently repaired with wall-clock order.

\subsection{Trust and cooperation obligations}

An observer declaration is useful only if later participants can test two
classes of claim.

\paragraph{Reliance.}
The declaration must expose enough authority coordinates, policy identity,
causal constraints, gaps, and verification evidence to reconstruct why the
view may be trusted for its stated purpose. It is not a universal trust score;
another purpose may require another assessment.

\paragraph{Action.}
The declaration must expose enough consequence position, safe remaining
operations, responsibility, and constraint information for a participant to
choose, refuse, or bound a next action. A technically reproducible ordering that
hides its action relevance does not complete the KFD-3 obligation.

These obligations keep the timeline inside the Foundation loop. The view starts
from a fact cut, supports bounded reliance, enables inspectable cooperation,
and allows resulting consequences to return as new evidence without letting the
action certify its own history.

\subsection{Degraded evidence}

A timeline may remain useful when evidence is incomplete. Instead of hiding
that incompleteness, it should declare states such as missing causality,
incomplete accepted ranges, stale remote facts, redacted payloads, schema
mismatch, unverifiable source, unresolved conflict, unknown policy, or a
projection that has not reached its required cut.

Degradation is operation-sensitive. Missing payload bytes may prevent replay
while still allowing manifest inspection; a stale index may prevent indexed
query while still allowing rebuild; an incomplete remote range may block a
completion claim while still supporting local inspection. A single health bit
is weaker than a report that names the evidence gap and the capabilities that
remain safe.

\subsection{Observer incarnation and continuity}

The core model identifies whose perspective a view represents. A long-lived
logical observer may then have multiple physical or software incarnations. We
model one incarnation as

\begin{equation}
O^e = (o, e, r, v, c_a, c_p),
\end{equation}

where $o$ is the logical observer identity, $e$ is a monotonic incarnation or
epoch, $r$ identifies the implementation performing the projection, $v$ is the
policy semantics, $c_a$ is the accepted authority cut, and $c_p$ is the cut
reached by derived projection. A name, PID, socket, heartbeat, or GUI instance
cannot substitute for these claims.

Replacing an incarnation creates a transition rather than identity by
assertion. Let

\begin{equation}
W_{e \rightarrow e+1} = (O^e, O^{e+1}, c, q, R),
\end{equation}

where $c$ is the predecessor cut accepted by the successor, $q$ states the
policy or runtime compatibility relation, and $R$ is retained recovery
evidence. A valid witness shows how the successor rejected stale authority,
accepted a non-regressing cut, rebuilt or verified derived state, and reached a
declared readiness condition. A semantic change may preserve fact continuity
while producing a new view identity; the witness must not erase that change.

This separates three claims: \emph{fact-authority continuity}, in which facts
remain intact across replacement; \emph{observer continuity}, in which a
successor proves its relation to the prior perspective; and
\emph{presentation continuity}, in which an interface reconnects and displays
a coherent view. Presentation continuity cannot prove the first two.

\subsection{Minimal declaration}

The core observer-declared surface contains:

\begin{itemize}[leftmargin=*]
  \item stable view identity and subject;
  \item observer identity and consequence position;
  \item accepted fact sources, ranges, authority cut, and known omissions;
  \item projection cut, policy version, causal dominance, and tie-breaker;
  \item degraded evidence states and safe remaining operations; and
  \item verification status and evidence references.
\end{itemize}

When continuity across implementations is claimed, the surface additionally
contains current incarnation, predecessor relation, runtime or implementation
identity, and continuity-witness status. These fields refine the published
KFD-4 observer-perspective schema \cite{kfd2026observer}; they are proposed from
implementation experience and are not yet a published schema revision. A
schema defines vocabulary and a verification boundary. Importing it cannot by
itself prove that an adopter's runtime or displayed view is correct.
