Precision Governance
You do not edit the software. You edit the governance, and the software is its compiled output. A feature exists if and only if a row exists in a governed registry; the surface — the worker response, the web component, the iOS view — is a pure functional binding over that row. Delete the row and the entire structure is garbage-collected across every surface at once, with no dangling reference left behind, because a generator re-projects the mirrors and the type system orphans whatever no longer has a declaration. The gate, crucially, watches the declaration, not the derivatives: it is impossible to hand-edit a consumer into a state its source of truth does not sanction, because the freshness gate re-runs the generator and a coupling gate refuses any registry that does not name the verifier guarding it. This is what precision means in a governed system — the blast radius of a change is exactly its declaration, removal is exact, and a system of a hundred-and-fifty services stays coherent not by vigilance but by construction. Governance First said edit the contract, not the output. Precision governance is the proof that you can — that the output can be made a total function of the contract, gated at the contract, garbage-collected from the contract.
The surface is the shadow of the declaration
Shadow Work observed that the commit is the visible tip of work and the smallest part of it. The same inversion holds for software itself. The code you see on a screen — the button, the API field, the menu item — is the shadow a governed declaration casts onto a surface. The body that casts it is a row in a registry: a line in a CANON table that says this feature exists, here is its shape, here is the verifier that watches it. A generator reads the row and projects it into every language a consumer speaks — TypeScript for the web, JavaScript for the worker, Python for the compiler, Swift for the phone. The consumers bind to the projection. They never hold the value; they resolve it.
An ungoverned codebase pretends the consumer is the source. The feature "lives" in the React component, and a copy of it lives in the worker, and another in the native app, and they drift, because three hands maintain three truths. Precision governance refuses the premise. There is one truth — the row — and three shadows, regenerated from it on every build. The shadows cannot disagree with the body any more than your shadow can wave while you stand still.
Deletion as garbage collection
The test of a source of truth is not how you add to it. It is how you remove from it.
This week we took GitHub off every user-facing surface — it is a developer's tool, a Claude Code concern, and a person who signs in with a magic link should never see it. The first attempt was the ordinary one: hunt the references, strip the worker fields, null out the component, delete the dead files. It worked, and it was wrong. It was imperative — a human walking the graph by hand, hoping the grep was complete, leaving a null stub where a feature used to be.
The correct move was one line. The GitHub "connect" affordance was a row in the § Galaxy HUDs registry — federation | galaxy | web | panel. We deleted the row. The generator re-projected the HUD mirrors across web, worker, Python, and iOS; the generated HudId type lost the member; the hand-written component map, declared exhaustive over that type, became a compile error at exactly the orphaned entry; the now-unreferenced component was deleted. One declaration removed, and the entire structure collapsed to nothing across four surfaces — by construction, not by search. There was no dangling reference to find because the type system found it for us, and no dead code to sweep because the thing that gave it the right to exist was gone.
That is garbage collection in the precise sense: a node is live iff it is reachable from a governed root through its anchor; sever the root and the node is, by definition, garbage, and the build collects it. Removal stops being an act of diligence and becomes an act of deletion — the rarest precision in software, where taking a feature out is as exact and as safe as putting one in.
The gate watches the declaration, not the derivatives
A registry alone is not enough. A generator can be circumvented; a mirror can be hand-edited; a consumer can be patched in place. Precision requires that the gate — the verifier that fails the build — point at the source, not the shadow.
Two universal gates make this hold. The first re-runs every generator and diffs the output against what is committed: hand-edit a projected mirror and the build fails, forcing you back to the row. The second, added this week, is a coupling: every registry that declares a generation cascade must name the verifier that watches it, in the same breath. This is the generalization of a gate we already trusted for axioms — every governed axiom must name its enforcer — lifted to every surface registry. The consequence is that you cannot ship a feature whose declaration no verifier is watching, and you cannot watch a feature by inspecting its consumers, because the gate is pointed upstream of them. The thing under guard is the intent, expressed once, and everything downstream is a regenerated, gated projection of it.
Each service, fully declarative and composable
The point is not the HUD. The point is that every service should be gated this way — its surface features declared in a registry, projected by a generator, bound by consumers, and watched by a verifier pointed at the declaration. When that holds, two properties fall out for free.
Composable: a service is a set of rows, and composing services is unioning their registries; there is no integration code to write, because the surfaces are projections and the projector already knows how to render the union. Declarative: the entire behavior of a service is readable from its governance, with no need to trace runtime control flow, because the runtime is a deterministic function of the declaration. Adding a form factor, a HUD, a corpus, a tool, a route — each is a row, and each propagates to every surface on the next build with zero per-surface code. Removing any of them is a deletion that garbage-collects.
We measured the system this week: roughly three hundred generators, nearly a thousand verifiers, around a hundred-and-twenty-five cascade registries — and, where the convention is explicit, every one of them already names its watching verifier. The foundation was already universal; what was missing was the law that says it must be, for every service, forever. Now it is a gate.
Not on chain is garbage
Underneath all of this is a single idea: the governed tree is a functional program. Objects are scoped; values are the source of truth; a value binds to its scope through an anchor — a lambda from a name to a value. On chain means committed in git, attested in the ledger, reachable from a governance root, and resolved by its anchor. Everything else — a hardcoded literal that no anchor derives, an orphan file no root reaches, a duplicate surface that is a second binding outside the one projector, a feature whose declaration was deleted but whose code lingers — is a free variable, and free variables beta-reduce away. They are not bugs to be tolerated; they are garbage to be collected, and the drain that collects them is the same drain that gated the HUD.
This is why precision governance is not a style preference. It is the only discipline under which a system this large can be removed from safely, and a system you cannot safely remove from is a system that only grows — toward entropy, toward drift, toward the slow death of every codebase that pays the typist and forgets the source. Precision is the property that the map and the territory are the same object, projected, and that a change to either is a change to both, by construction.
You do not edit the software. You edit the governance. The software was always its shadow.