03 — The Compare Exception

Status: investigated + resolved 2026-07-17. The accused was acquitted; the rule it prompted stands.

The suspicion

The book’s index carried this chapter as an open charge: “JinDesk’s Compare route ATTACHes multiple KLSes side by side — a read-side hole in the tenant membrane that predates the doctrine.” Sense 62’s law is strict — tenant means isolation, a facet classifies but never connects, connection is an explicit instance-to-instance API — and a surface that opens several knowledge stores in one query session sounded like exactly the polite violation bounded contexts suffer.

The investigation

Read the code before writing the argument. What /[tenant]/compare actually does:

• it lists KLS files from this tenant’s own store/ directory — the working copy, its immutable snapshots, its scenario builds;
• it opens each in a throwaway in-memory session via ATTACH … (READ_ONLY);
• it never reaches into another tenant’s directory, another tenant’s bucket, or another tenant’s anything.

So the shipped Compare is time-travel inside one bounded context: this tenant now, versus this tenant at a frozen decision point, versus this tenant under a what-if scenario. The aggregate boundary (the KLS as an immutable, self-describing artifact) is exactly what makes the comparison honest — you are comparing two sealed editions of the same world. No membrane is crossed. The older description in the engine’s own documentation (“cross-tenant comparison happens at JinDesk level”) describes an ambition the implementation never cashed — a documentation drift, now on the record.

The verdict

Not an exception. No exemption needed. Within-tenant comparison across time and scenario is not merely permitted — it is one of the product’s honest superpowers, because snapshots are immutable and self-describing.

The rule the case leaves behind

The suspicion was still worth having, because the ambition is real: operators will want two hospitals on nuMetrix side by side. When cross-tenant comparison arrives, the doctrine already tells us its shape:

1. Comparison is a fleet act, not a tenant act. It belongs on an operator surface (the cockpit’s world), gated by fleet authority — never reachable from inside a tenant, whose world must stay whole.
2. A facet defines the cohort; it still never connects. “Compare these two” is classification plus presentation; the tenants themselves exchange nothing.
3. Published language only. A cross-tenant view may read what each tenant’s KLS publishes (Gold, findings, verdicts) — commensurable because the pack vocabulary is the lingua franca — and nothing below it.
4. Read-only at the engine level — (READ_ONLY) on every ATTACH is already the house idiom; keep it structural, not conventional.

When someone builds that surface, this chapter is its spec review.