witnessed and dark

The record holds two totals and they partition the same span.¹ Witnessed is stall time proven by observation. Dark is the remainder of elapsed time that no observation covers. Together they equal fast blocks elapsed since the record opened.

Witnessed is credited only from spans that two readings bracket. Dark is credited by subtraction, which is why it needs no observer and accumulates whether or not anyone is present.

Coverage is witnessed divided by elapsed. It is the single figure that describes how much of the record is proof rather than absence. It is not a score and it is not compared to a target.

Neither total is estimated, extrapolated, or annualised. Each is a count of fast blocks and can be recomputed by the reader from the register.

When an interval closes, the record compares the span it can prove against the span that actually elapsed between the two endpoints it holds. The proven part is credited to witnessed. Everything left over is credited to dark.

If two marks landed inside a stall, the span between them is proven and goes to witnessed. If a stall opened and closed with nobody present, no part of it is proven and the whole of it goes to dark.

A lapse produces the same arithmetic by a different route. The running interval is closed at its proven length and the remainder is written to dark, which is how the record admits a gap instead of guessing across it.

Crediting happens once, at close. No later call revisits an interval to move time from one total to the other.

A stall is recorded as at least as long as it was observed to be and never longer. The record understates rather than guesses, in every case, without exception.

The consequence is that every proven length is a lower bound on a true length the record does not claim to know. Where the two differ, the difference has already been credited to dark, so nothing is lost by the understatement.

This is why dark is not an error term. It is not the uncertainty around witnessed. It is the exact quantity of unsettled time that passed with no one looking, measured in the same unit and stored with the same permanence.

A reader who wants a tighter bound has one instrument available, which is to mark more often. There is no other.

Both totals are monotone. Witnessed never falls and dark never falls. No instruction in the contract subtracts from either, and no owner exists who could add one.

Later attention does not repair earlier absence. A long run of dense marking raises coverage from that point forward and leaves every earlier figure exactly as it was.

This is deliberate. A total that could be repaid would describe the present state of attention rather than the history of it, and the history is the only thing that cannot be reconstructed after the fact.

The invariants page checks monotonicity directly and prints the two disagreeing numbers if it ever fails.

One field holds the longest single stall the record has ever proven. It is stored with the slow block it hung on and with the address that was present for it.

The field is replaced only by a longer stall. A shorter one, however recent, leaves it untouched, and no call can lower it.

Because it is a proven length, the deepest is also a lower bound. A longer stall may have occurred while nobody was present, and if so it is in dark and not in this field.

It is kept separately from the totals because a single extreme and a running sum answer different questions, and averaging one into the other would destroy both.