AORTA · the system-of-record seam
The open-source electronic donor record. The half that is federal law ships byte-identical to all fifty-five OPOs. The half that has to fit you is not configured, not consulted, and not customized — it is completed on site, by your own people and their own AI, against a gate battery that refuses to pass work that is wrong.
Claim grammar — every assertion on this page carries its status
The short version, so it is yours even if you stop here
Fifty-five organizations run the same federally mandated process. Three-quarters of them rent the same record system, in someone else's cloud. The ones who tried to build their own found that it takes six years — and the six years are not the code. They are the cost of discovering what to write, because the knowledge lives in the heads of coordinators who are working a donor at three in the morning and cannot stop to be interviewed. Fitting software to an operation required someone present for the work as it is actually done, for a long time, and until recently the only thing that could be present was a person. That constraint is gone — and not because a machine can write the code. Because the thing that finishes the software is already installed at all fifty-five sites: your own IT team, holding a state-of-the-art coding harness, pointed at a system of record they are not permitted to open. REGISTRAR is what you point it at. The mandated spine ships complete and identical to everyone. The fit is completed by your people, on your hardware, against your own data, in a week — and a gate battery, not a vendor, decides whether they got it right. We give away the spine. We give away the fit. What we keep is the fence, and the fence is the product.
The machine itself, first
DWG-001 · the seed and the completion path — REV 0. Read it left to right. The seed ships byte-identical and carries its own manual; the site's own harness reads that manual; the site's own material and its own local model produce the draft; a gate battery — not a reviewer's patience — decides whether the draft is correct; and a human signature is the only thing that crosses the seam. Below the line, the mounted fit is reversible and expiring, and the case record is written by people. Everything gilt is unwritable by any machine, at any rung, by construction rather than by policy. Nothing on this sheet has run inside an OPO.
A case under a clock
An electronic donor record governs a deceased donor case from the moment a hospital reports a death or imminent death, through triage and eligibility, family authorization, donor management, organ allocation, surgical recovery, packaging and transport, and finally disposition, follow-up and mandated reporting. V
The overlap with a hospital EMR is the clinical data. The difference is everything operational: referral intake, the authorization record, OPTN data submission, the allocation interaction, recovery logistics, chain of custody, and the outcome reporting CMS grades. An EMR is organized around a patient under treatment. An EDR is organized around a case under a clock — and every field in it exists because something downstream, usually a transplant center or a federal regulator, needs it in a particular form by a particular hour.
It is a deadline-driven workflow system wearing a medical-records costume. Cold ischemic time does not negotiate.
That single property is why the category is architecturally unusual, why generic health-IT keeps failing at it, and why the thing that governs it has to know about timing and completeness before it knows about anything else. D
One system, most of a market
iTransplant, owned by InVita Healthcare Technologies — which absorbed Los Angeles-based Transplant Connect — is the dominant EDR, at roughly 75% of US OPOs and approximately 75% of deceased-donor transplants. Its companion product iReferral provides the automated referral interface from donor-hospital EHRs, with named integrations into Epic and Oracle Cerner, so a referral moves from the hospital's EMR into the OPO's instance without a phone call. V
Two properties decide everything downstream. It is cloud-based, and it is one system sold to most of the market — which means the operational variance between fifty-five organizations is absorbed today by the organizations bending themselves around the software, not by the software bending around them.
That is not a criticism of the product. It is an accurate description of what a single vendor serving fifty-five deployments can do. It is also the exact arrangement this page proposes to invert. D
Where the time actually goes
In 2020 — two years before ChatGPT — Southwest Transplant Alliance (STA), the Dallas-area OPO, drew the blueprints for its own in-house electronic donor record. The plan was sound and the motivation was real: the incumbent fit the way a rented suit fits, and other OPOs were already asking whether they could license the result when it was finished. OA
The shape of every in-house EDR project in this category
Year one: requirements. Year two: requirements, plus the parts of year one that turned out to be wrong. Year three: the coordinator who knew how authorization actually worked left. Year four: the build is real, but the workup module encodes an assumption nobody wrote down. Year six: still not finished — and no large language model appears anywhere in the design, because none existed when it was specified.
Attested, and stated once
STA pre-sold white-label licenses to other OPOs before delivery. Delivery ran late. On the account of people who handled the books, STA now pays those organizations monthly. The white label did not merely fail to ship — it inverted, and the seller became the debtor. OA
That is not a story about one organization's competence, and it should not be read as one. STA attempted the hardest correct thing in the category — building the record that actually fits the work — and they honored their obligations when it ran long. The category ate them, and it would have eaten anyone. Every serious attempt in twenty years has died on the same rock, and the rock has a name.
Six years is not the cost of writing an EDR. It is the cost of discovering what to write. The operational knowledge has four properties that together make it nearly unextractable by interview: D
| Procedural, not declarative | Coordinators know how to run a case; they do not hold a specification of how they run a case. Asked to describe it, they describe the policy — and omit the practice they are actually executing. |
| Held by people unavailable by construction | The person who knows the most about donor management is managing a donor. The interview happens at the worst possible time, or not at all. |
| Invisible where it matters most | The workaround, the shadow spreadsheet, the field everyone skips, the phone call that substitutes for a screen. Nobody reports a workaround, because from the inside it is not a workaround — it is the job. |
| It changes | By the time the elicitation is complete, some of it is stale. That is a large part of why a six-year build is not finished when it ships. |
They spend six years asking.
This is why the white label never ships. What gets built encodes one OPO — its call rotation, its staffing model, its hospital territory, its unwritten escalation ladder — and porting it means running the same six-year elicitation again, at a site whose coordinators are equally busy and whose assumptions are equally unwritten. Make it more general to avoid that, and you arrive at a record system so abstract it could serve an accounting firm, which is to say it serves nobody.
That trade has looked like a law of nature for twenty years. It is not. It is an artifact of the fact that fitting software to an operation used to require a services team on site for years, and nothing else could do the watching.
January 2027
CMS sorts on two outcome measures — a donation rate and a transplantation rate — and the tiers attach to donation service areas, not to organisations. An OPO's outcome follows the best tier it holds: one holding at least one Tier 1 area is recertified automatically; one holding Tier 2 areas is not out of compliance but must compete for areas that open; and an OPO holding only Tier 3 areas is non-compliant and decertified. The Conditions for Coverage revision was proposed 2026-01-30; the Final Rule is expected in late 2026, effective sixty days after publication; and CMS has stated it will commence recertification and decertification proceedings for Tier 2 and Tier 3 organizations in January 2027 — a timeline CMS reaffirmed in supplementary guidance issued 2026-03-11. Comments on the proposed rule closed 2026-03-31. V
Both measures are ratios over a denominator of CMS-defined potential donors, derived from inpatient death records rather than from OPO self-report. That denominator choice is what makes the measures hard to game — and it is also what makes the operational chain beneath them legible. Between 2021 and 2023, top-tier OPOs doubled from 15 to 30 and bottom-tier fell from 24 to 10, alongside a 31% increase in organ donors and a 25% increase in transplants. V
A Tier 3 OPO is the rarest thing in American healthcare procurement: an institutional buyer with nothing to lose. D
Every regulatory statement on this page must be checked against the Final Rule and the current eCFR text at the time you read it, not against this page. Rules move, effective dates slip, and tier counts are re-published. This project does not ask anyone to take a compliance claim on faith — least of all one with a decertification attached to it.
The chain beneath the grade
| CMS outcome | The operational chain that produces it | Where a record governs it |
|---|---|---|
| Donation rate | hospital reports the death → OPO responds in time → case is correctly triaged as eligible → family is approached well, and at the right moment → authorization obtained | referral capture and timers, eligibility rules, approach documentation, the authorization record |
| Transplantation rate | authorized donor → organs kept viable through donor management → complete and timely workup → allocation runs before ischemia expires → recovery and transport execute | protocol adherence, labs and serologies complete, allocation readiness, OR and logistics coordination |
Every one of those is a timing-and-completeness problem, not a clinical-judgment problem. The organ is lost to a serology that came back after the offer expired, a referral nobody called back on for ninety minutes, a workup field that blocked allocation at 2 a.m., an approach that happened at the wrong hour with the wrong person in the room.
This is the most important sentence on the page: the metrics that decide institutional survival are dominated by whether the right thing happened at the right moment — which is precisely the class of failure a form, a dashboard, and a quarterly audit are all structurally incapable of catching. D
The reframe
The trap looks like a dial. At one end, software that fits Dallas like a glove and fits nobody else. At the other, an abstraction so general it could serve an accounting firm. Pick a point. Every point is wrong, and the reason is that generality and specificity are both static properties — measured with the artifact sitting alone on a disk.
There is a third property, and it is the one that just changed:
Completability — how much correct work a competent outside intelligence can add to this artifact, per unit of effort, without breaking it.
Completability is not a property of the artifact. It is a property of the artifact plus the intelligence receiving it — and that second term went from nothing in 2020 to uniformly installed at all fifty-five sites in 2026. Every OPO now has an IT function with access to frontier coding harnesses. That is not a prediction. It is this year's baseline.
The empty cell is the product. The seed does not need to be complete. It needs to be completable, and completability is engineerable. That is the axis nobody named, and it retroactively explains why this was impossible in 2020 — not because a machine could not write the code, but because there was no receiving intelligence at the far end to finish it.
The seed is not the organism. The seed is the genome. Their harness is the ribosome, and it was already in the cell.
The same shape runs at three radii, and the reason it is not vertigo is that every loop closes through a seam that is not the machine. The completion: a harness authors the fit; the seam is the gates plus a signature — built, and measured five times. The forge: a missing capability is authored, shadow-run and proposed — mounted only hash-pinned, on a human yes, reversible through the disposer; the system has already used this on itself, discovering two capabilities its authors never declared. The record: the running EDR is the same loop pointed at a case — and a variation point the seed never imagined goes up, as a proposal to the seed, never sideways as a patch, because the blast-radius gate refuses the shortcut. So the seed can improve its own toolbench while unpacking, and the reachable set stays independent of the agent — the ribosome sharpens its tools without ever gaining the ability to rewrite the genome. The recursion sits where error is cheap: a wrong forge plugin wastes an afternoon; the case radius never mounts unproven work. D
Your IT team has the most capable tool it has ever held, aimed at a system of record it cannot open, cannot read, and cannot test against. That is the seam. REGISTRAR is what you point it at.
The fair objection: access to a harness is this year's baseline, but an OPO's IT function may be four people keeping Epic interfaces alive — whether they can drive one against a typed schema is unmeasured, and cheap to measure. And the deeper cost is the initiation tax: a prompted harness drafts, hits a gate, and waits for a person to type continue — so the IT lead becomes the wake source for every step. The kit is shaped against exactly that: the gates run unattended (CI proves the battery cold, on Linux, in seconds), the question set names which document answers it, and the worked example carries the pattern. The human's job is the signature, not the shepherding. What remains unmeasured is marked, and it belongs in §16 with the other honest risks.
Five layers, two authors
You do not pick a point on the abstraction dial. You ship a layer stack, where the layers that are identical everywhere are identical everywhere, and the layers that differ are authored where they differ. The analogy is exact rather than loose: asking how abstract to make an EDR is like asking how abstract to make an operating system. A kernel is invariant, drivers are per-device, configuration is per-installation — and nobody experiences that as a compromise, because the layering dissolves the question.
L0 and L1 are the seed. They are the thing that has never been open-sourced, and building them once for everybody is straightforwardly useful even if every other claim on this page turns out to be wrong. Fifty-five organizations currently pay — in money, or in six-year internal builds — to separately re-encode a spine that is identical by law. That is a pure deadweight loss, and only an open artifact removes it.
L2 and L3 are the six years. They are what the next section is about.
The seed is useful at L0 with an empty patch file. The state machine, the append-only record and the replay that refuses an illegal case are built and running M — clone the repository and a deliberately illegal tape produces five named violations. The CMS measure definitions are cited to the regulation, numerators, denominator and tier thresholds V; computing them over your own tape is specified and not yet built SPEC. That layering is what makes everything above it optional rather than load-bearing.
Why the fence holds
Everything claimed so far — that the seed can ship identical, that fifty-five independent completions land compatible, that a wrong fit unwinds instead of scarring, that no machine can reach L0 — is one short algebra. It is worth writing down, because a claim you can compute is a claim somebody else can check.
An instance is Σ × Λ × K, and because Σ is a point, that is isomorphic to Λ × K. The seed contributes no degrees of freedom. "The differentiation is the product" is not a slogan here — it is an isomorphism.
A patch row is a pair: a change and its inverse. Mounting applies the change and pushes the inverse onto the retraction. Retiring runs the retraction and resets it.
mount(p, p−) : (λ, ρ) ↦ ( p(λ), ρ ∘ p− ) retire : (λ, ρ) ↦ ( ρ(λ), id )Note what this does to the schema rule in §09. Without p− the pair is not an element of the monoid and mount is undefined. The inverse is required by the algebra, not by a policy somebody could relax under deadline.
Below, an equality between contexts is observational equivalence, written ≃: two states are related when no observer can distinguish them. This is not a hedge. The strict form is unattainable in any real runtime — freeing a block does not restore the heap's prior layout, and a discarded generative name is not the one the next allocation draws. For a configuration layer, indistinguishability is also the correct notion: what matters is that nothing downstream can tell, not that the bytes match.
The fit you inspect is the fit that is mounted; the bookkeeping cannot drift from the artifact.
This is the theorem that carries the white-label argument. A sequence of patch rows is itself a single patch row, and composition is associative — so the order in which independent rows are authored does not change the mounted fit. Fifty-five teams completing the seed separately, in any order, land in compatible places. That is confluence, derived rather than borrowed. And the twist — inverses composing in reverse — is the formal reason retirement must unwind in reverse dependency order. The algebra forces it; no implementation gets a vote.
The preconditions, stated rather than assumed. T2 is associativity, and it buys order-independence for a given set of rows. Lifting that to the runtime claim — two completions settling into equivalent states — needs four hypotheses: both settle; dependencies are acyclic; the operation set is the same, since different row sets were never claimed to converge; and every row is total on its provision, meaning a row whose application completes has installed every key it declares. That last one is the hypothesis a machine-authored row can violate, and it fails silently — no error, no symptom, until something downstream reads a key nobody wrote. So it is not left to authorial care. It is a gate.
Mounting never moves where retirement lands, so by induction the seed is recoverable after any sequence of mounts. And the hypothesis is pointwise: an inverse need not invert the whole configuration space, only the state where it was applied. That is the difference between a property you assert and a property a gate can test in milliseconds.
Let A : Ω → MΛ be a completion agent over the site's own material — untrusted, arbitrary, possibly adversarial. Let the gate be three-valued,
G : MΛ × ∂Λ → { GREEN, PASS-UNVERIFIED, FAILED }and let gated mounting be the identity unless the verdict is GREEN and a signature is present. Then
∀A, ReachG(λ0, id) ⊆ { (λ,ρ) : retire(λ,ρ) ≃ (λ0, id) }Every state reachable by any agent retires to the seed. The bound is on the image of the gated operator, and it is independent of A — which is precisely why this repository can be handed to a stranger's harness, and why nothing in the design depends on the model being good. The safety property is a property of the fence, not of the model.
A graded ratio R = N/D is admissible only if the denominator is a fold over the tape:
∃ φD with φD(k) = D(k) for every k ∈ KA ratio whose denominator cannot be reconstructed from the record is not a measure. This is the house rule — a number without its denominator is not a number — descended to the regulatory layer, and it is exactly what the measure-denominator gate tests.
There is no homomorphism from the patch monoid into Σ → Σ, because Σ is a point whose only endomorphism is the identity; and none into K → K, because the record admits no arrow but append. The immutability of L0, L1 and L4 is therefore not a permission that could be misconfigured, revoked, or argued with at 3 a.m. The arrow does not exist. Unreachable by construction, never forbidden by policy — as a type.
The claim in §03 — that the six years are elicitation and not code — can be written down. It is a model, not a measurement, and it carries no number:
Tinterview ∝ | λ∗ |bh · a Tcompletion ∝ | λ∗ |bmwhere bh is human elicitation bandwidth, a is coordinator availability, and bm is machine read bandwidth over the site's own material Ω. The claim is not that the machine is smarter. It is that a ≈ 0 for someone working a donor at three in the morning, while Ω sits on disk and is always available. The six years are the a in the denominator. D
T1–T3 and T6 are theorems: two-line calculations, true of the algebra unconditionally. T4 is a theorem about the model — and whether this code faithfully implements that algebra is a separate, testable claim, which is exactly what the conformance battery exists to close. A proof about the design is not a receipt about the build. Nothing here is exempt from §16.
THIS CONSTRUCTION FOLLOWS A PUBLISHED EFFECT-CONTEXT ALGEBRA; THE TRANSPOSITION TO THE FIT, THE SINGLETON SEED, THE THREE-VALUED GATE AND THE CONTAINMENT RESULT ARE THIS PROJECT'S OWN. IT IS NOT NEW MATHEMATICS AND DOES NOT CLAIM TO BE — IT IS OLD MATHEMATICS POINTED AT A RECORD SYSTEM.
The part that has never existed
Here is the thing nobody has built: a repository designed to be safely completed by an AI its authors do not control, at a site they will never visit, in a domain where wrong loses an organ.
The kit is not documentation. It is the machinery that lets your harness do in a week what an interview programme does in six years — and, more importantly, lets it prove it did so.
The bet inverts, and this is the whole point. The old question was "can an AI learn an organization by watching it for months?" — unproven, slow, and entangled with PHI at every step. The new question is "can an AI fill a well-specified schema when driven by a local team with local access, against a battery that catches it when it is wrong?" That is a far easier bet, and it is the one this project takes. BET
The asset nobody has priced
You are sitting on the elicitation corpus. The six years spent asking coordinators what they do is already answered, on your own disk — your SOPs, your ticket history, your interface configurations, your QA exception log, your escalation threads, and now your own harness session logs. Nobody could read all of it before. Your team can read all of it this week, and none of it has to leave the building. D
Why it is safe to let a machine finish it
Giving an AI write access to a life-critical system is normally an unacceptable idea, and it should be. It becomes acceptable only when four structural properties hold simultaneously — none of them a policy, all of them enforced by construction.
| Property | What it means, mechanically |
|---|---|
| Bounded blast radius | L0, L1 and L4 are structurally unwritable. The only mutation surface in the entire system is one typed patch file. A foreign agent cannot exceed that radius, because there is nowhere else to write. |
| Reversibility by construction | Every registration carries its inverse. A wrong patch unwinds in dependency order rather than becoming permanent scar tissue. That property is the entire reason it is survivable to let a machine draft production changes at all. |
| Confluence | Settled state depends on which components remain, not the path taken to arrive there. Fifty-five teams completing the seed independently, in any order, land in compatible places. This is the actual answer to the white-label problem — a fork diverges; a patch layer composes. |
| A mechanical oracle | The gates decide, not a reviewer's patience. The completion is graded against OPTN policy, CMS measure definitions, and replay against your own historical cases — all of which have right answers that do not depend on anybody's opinion. |
Every stage ends in a gate. A gate is mechanical wherever a machine can check it. A gate that cannot pass inside a bounded retry writes a hard stop with the exact defect and escalates to a human, rather than degrading silently. Silent degradation is the enemy. Sixteen of these are implemented and running M — a standing set of deliberately bad patches is refused, each with its defect named in words, and several gates report PASS-UNVERIFIED because they cannot be decided from a file alone. The validator therefore exits non-zero on a patch with nothing wrong with it, and says why. Run it yourself rather than trusting this paragraph — the counts here are a snapshot and the battery is the authority.
| Gate | What it refuses |
|---|---|
| OPTN required-element completeness | submission or allocation-readiness with a mandated element missing |
| Timer integrity | a case whose response, offer or ischemia clock is unaccounted for |
| Chain-of-custody continuity | a gap in the conserved chain from recovery to disposition |
| Authorization record validity | any downstream step where the authorization artifact is absent or malformed |
| Measure-denominator integrity | a computed CMS ratio whose denominator cannot be reconstructed from the tape |
| Patch blast radius | a proposed patch touching L0, L1 or L4, or any row outside its declared scope |
| Evidence binding | a patch row asserting local practice with no cited source and no shadow run |
| Floor-with-learned-zeroed | a release where the deterministic floor fails with every model component disabled |
| Totality on provision | a row whose application completes without having installed every key it declares — the silent breaker of convergence |
| Divergence | a row whose value, cited evidence and replay tell three different stories — the catches live in the disagreements, and formatting is what hides them |
| Attest — evidence read as prose | a current value supported by a rule the source says was withdrawn; a requirement built on a sentence that says may — because may is not must, and encoding a permission as an obligation refuses compliant work |
| Accountability | silence — every declared target gets a row or a hold with its reason, because a target nobody answered is indistinguishable from a target nobody looked at |
| Three-state honesty | reporting GREEN where the truth is PASS-UNVERIFIED |
That last row is the one that matters most here, and it is the one everybody collapses. GREEN, PASS-UNVERIFIED and FAILED are three different states. Folding the middle into the first is exactly how a system reports success past a step that never ran — and a foreign harness will produce confident, plausible, wrong work all day long if you let a weak battery bless it.
And the battery is graded harder than this page grades it: seven known holes — defects every gate passes — are retained as labelled fixtures and measured open on every run, rather than deleted to make the numbers rounder. A battery that hides what it cannot catch is exactly the weak battery the previous paragraph warns about. M
The machine drafts the fit. A human signs it. Every patch row carries an author, the evidence that produced it, a shadow-run record, an expiry that makes it re-earn its place, and an inverse. Nothing mounts unsigned, and nothing is permanent by default. In organ procurement that is not a metaphor for governance — it is the governance.
What may author L2 and L3 may never author L0 or L1, and may never write to L4. Policy and medicine are imported, never learned. The case record is written by clinicians and coordinators, never by a watcher. What a machine is permitted to shape is the fit between an invariant spine and one particular organization — and nothing else. The day that line is crossed is the day the project should be withdrawn.
Give away the spine. Give away the fit. Keep the fence.
"KEEP" IS STEWARDSHIP, NOT WITHHOLDING — THE FENCE IS MIT LIKE EVERYTHING ELSE, AND §17 STILL CONTAINS NO ASK. WHAT IS KEPT IS THE AUTHORITY OF ONE SHARED BATTERY: FIFTY-FIVE COMPLETIONS THAT ALL ANSWER TO THE SAME GATES CAN INTEROPERATE; FIFTY-FIVE PRIVATE FORKS OF THE GATES CANNOT. THE FENCE IS THE PRODUCT THE WAY A STANDARD IS A PRODUCT.
The floor, and its sharpest piece
§05 says the graded measures are decided by whether the right thing happened at the right moment. §01 says an EDR is a case under a clock. So the keystone computation in this system is not a form, a report, or a model. It is this:
Given every deadline that binds this case, what is the latest moment each remaining obligation can still be met — and which chain of constraints makes it so?
The chart — last 12h ALL FIELDS GREEN
Every field is green. Nothing is out of range. No timer has expired. The deadline at right appears on no screen and in no rule — it lives in the interval between six ordinary constraints.
The surfacing · 23:40 SURFACED — UNPROMPTED
No timer fired. Nobody asked.
Derived, not configured — and the chain is the citation:
[L0–L1] federal — ships byte-identical to all 55 OPOs · [L2–L3] your site — completed on site
REGISTRAR perceives, computes, and surfaces. It never determines, allocates, signs, or sends — the fence is on action, and the derivation is the citation.
The tape — including the silences
This shift: 2 surfacings · 41 holds · 1 un-said.
The same unfilled field deserved silence at hour two and a page at hour nine. No fixed threshold can say both — alert fatigue is a dial with no correct setting. Judgment is trained in, not configured.
resident layer: SPEC — ships off · the deterministic floor is its null
The keystone computation, in the room where it fires — synthetic case TR-4118 · REV 0 · the surfacing is floor/closure.py’s real output
A case is a Simple Temporal Network: time points joined by binary constraints of the form a ≤ xj − xi ≤ b. Each becomes two edges in a distance graph, and three classical facts then do all the work — the network is consistent if and only if that graph has no negative cycle; the tightest implied bounds are its all-pairs shortest paths in the (min, +) semiring; and the feasible window of any event falls straight out as [ −D[j][0], D[0][j] ].
| x₀ … x₃ | referral received (the reference point) · OPO response · clinical triage complete · death declared |
| x₄ … x₇ | authorization obtained · serologies drawn · serologies resulted · donor workup complete |
| x₈ … x₁₁ | match run executed · primary acceptance · OR scheduled · incision |
| x₁₂ … x₁₅ | cross-clamp · organ out and packaged · arrival at accepting centre · implant and reperfusion |
| Constraint | Form | Owner |
|---|---|---|
| Response to referral | x₁ − x₀ ≤ τresp | L0 · policy-defined |
| Authorization precedes allocation | x₈ − x₄ ≥ 0 | L0 · policy |
| Serology results precede the match run | x₈ − x₆ ≥ 0 | L0 · required element |
| Incision to cross-clamp | x₁₂ − x₁₁ ∈ [α, β] | L1 · surgical |
| Cold ischemia budget, organ o | x₁₅ − x₁₂ ≤ CITo | L1 · clinical |
| Reference-lab serology turnaround | x₆ − x₅ ∈ [τ⁻, τ⁺] | L3 · your lab |
| Recovery-team mobilisation lead | x₁₁ − x₁₀ ≥ τmob | L3 · your team |
| Transport to the accepting centre | x₁₄ − x₁₃ ∈ [γ⁻, γ⁺] | L3 · your logistics |
| Offer window to primary acceptance | x₉ − x₈ ≤ τoffer | L2 · your practice |
| Donor-hospital OR availability | x₁₂ ∈ [w⁻, w⁺] | L2 · your hospital |
Look at which rows bind hardest. The federal ones are real but generous. The constraints that actually decide whether a case converts are the L2 and L3 rows — your OR window, your lab's turnaround, your team's mobilisation time. Those are precisely the layers the completion in §09 authors. The closure is only ever as good as the fit, which is why the fit is the product and not the record.
Illustrative and synthetic; no real donor data. Cold-ischemia budgets are clinical figures to be verified against current practice, and every L2/L3 value below is exactly the sort of local fact a site authors for itself.
The donor hospital's OR is available for cross-clamp between 06:00 and 10:00; after that it is committed to scheduled cases until 18:00.
Incision to cross-clamp: 45 minutes.
Recovery team mobilisation: 2 hours from OR scheduled to incision.
Match run to primary acceptance: up to 3 hours of offer time.
Reference-lab serology turnaround: 6 hours.
Serologies must have resulted before the match run.
Nobody wrote down a serology deadline. The closure derives one anyway:
It is 23:40. The serology has not been drawn. Not one timer has expired and every field on every screen is green — and the morning OR window is already gone. The next one is 18:00, which moves the whole case eight hours downstream and into a different organ's ischemia budget.
No single field was wrong. The failure lives in the transitive closure of constraints that are each individually satisfied, which is why a flat list of timers cannot see it and why this is the exact failure class §05 says decides institutional survival.
The chain above is not commentary. It is the shortest path that realises the bound, recovered from the same computation that produced it. The output of this algorithm is a derivation a physician can check in seconds — which is what "advisory by construction" has to mean if it means anything, and what the decision-support carve-out in §12 actually requires. There is no model in it anywhere.
The reference implementation is the null and it is fifteen lines. Times are whole minutes; INF is the classical sentinel, chosen because it can be doubled without overflowing a 32-bit integer.
And the batched path, for the question a supervisor actually has at 3 a.m. — I have one perfusionist and three cases; if I push this OR by ninety minutes, what breaks? That means re-solving the network under every candidate intervention across every live case, which is thousands of small independent networks: a batched tropical matrix multiply.
And then the line the whole thing is actually for:
Tropical arithmetic over integers is exactly associative. There is no floating point anywhere: times are whole minutes, min and + are exact, and the sentinel is sized so it can be added to itself without overflow. So the accelerated path and the deterministic floor produce bit-identical output, by construction — not "within tolerance," not "reproducible in practice." Identical. That is what makes a fast path admissible at all in a system whose battery includes replay determinism and floor-with-learned-zeroed. A floating-point implementation would be quicker to write and would silently fail both gates.
Not on one case. A case has a few dozen time points, and a lifecycle is nearly series-parallel — a chain with a handful of forks — so its induced width is small and the floor runs in effectively linear time on a CPU, in microseconds. The general algorithm is cubic; the domain's structure is what makes it cheap. Claiming a GPU is required here would be a lie.
On the portfolio sweep, it does. Fifty live cases against a couple of hundred candidate interventions is tens of thousands of tiny networks — arithmetic that is GEMM-shaped with (+, ×) replaced by (min, +), which is what a consumer card is for. It turns a batch job into a question you can ask and answer while the person who asked it is still on the phone. BUDGET
And the card is already in the building: §12 puts one there for the local model. The same card runs the solver between beats.
The null · a flat list of timers with alarms
Which is what every EDR already has, and it is not weak. The claim here is narrow: the closure catches implied deadlines that no single timer encodes, because no individual field is wrong at the moment a case becomes infeasible. The experiment is cheap and needs nothing but an existing tape — replay historical cases, count the breaches a flat timer list would have missed, and print the number. If the flat list catches nearly all of them, this section becomes a funeral and the page will say so. NULL
Not a preference — the only shippable shape
A donor record holds the most sensitive protected health information that exists, about a patient who cannot consent, in a window measured in hours, alongside a family's decision. There is no version of this where the data crosses to a general-purpose AI cloud and a compliance officer says yes — and there should not be.
So the split is the architecture rather than a compromise, and it is clean enough to hand a privacy officer on one page:
| Reads | Which model | Data class |
|---|---|---|
| The seed — L0/L1 source, schema, gates, fixtures | whatever frontier harness your team already uses | public, MIT, zero PHI. Nothing to protect, so nothing to negotiate. |
| The site — your SOPs, tickets, case tape, configs | open weights on one card inside your network | PHI-bearing. Never egresses. Unplug the network cable and it behaves identically. |
A 27B-class open-weight model with a 262,144-token context now runs on a single 24–32 GB card — and the reference implementation of the resident loop was measured on 16 GB M, so the larger figure is what a long context wants rather than what the loop requires. Which is what makes the second row affordable rather than theoretical. V Open weights on hardware the OPO owns, inside the OPO's own network, zero egress by default, no account, no telemetry, no subprocessor chain to disclose, and MIT source your own security team reads line by line before it runs.
That property is also, not coincidentally, what makes the record portable: your data is a folder you can walk away with — the one thing a hosted incumbent can never offer.
REGISTRAR ships no plugin system of its own. It is a distribution — a pinned runtime, packages beside it, and a profile that mounts only what a donor record needs. The runtime is @deepseek-ai/dsh-root — the DeepSeek harness, MIT — whose kernel is cordis: the effect and coeffect kernel formalised in A Programming Paradigm for Spatiotemporal Composability (Peking University and DeepSeek-AI). The algebra in §08 is that kernel's semantics with this domain's objects substituted in. The alternative was re-deriving a published, tested effect system here — novel, unaudited, unmaintained, and it would make every theorem on this page a claim about code nobody has reviewed.
Two maturity facts, kept apart because they carry different risk. The kernel is cordis v4.0.1, with roughly four years and several thousand community plugins behind it before it was adopted for this purpose — that is where the guarantees live. The harness built on it is a release candidate, and says so; that is the layer a distribution composes down, pinned and vendored rather than tracked. Compose, never fork — a fork inherits permanent maintenance and destroys the upgrade path, and because the mounted surface is a profile, your audit surface is what you mount, not what is in the tree.
This is also what makes the split above one runtime rather than two stacks: providers resolve as configuration — an OpenAI-compatible gateway, a self-hosted endpoint, or a model newer than the shipped catalog is a config route — and credentials are references resolved per request rather than secrets sitting in a file. One runtime, two routes, and no path from the site route to the public one.
Your harness, not ours. Any competent coding harness can author the fit; the boot contract in the repository is written for all of them and names none. The runtime can serve as one itself, and can drive Claude Code or Codex as subagents, so the two compose if you want them to — but nothing in this design cares which harness you point at it.
REGISTRAR never
Every operation reaching outside a system has two stages. Acquisition — opening a descriptor, reserving a block, starting a process — installs a record inside the boundary, and that record is revertible. Emission — the write, the send, the submission — pushes data through the channel acquisition opened, leaves it where other parties may read it, and has no inverse. Nothing in any runtime retracts it.
There are exactly two recoveries for an emission: withhold it until the state that produced it is certain to persist, or compensate — delete the file that was created, refund the charge that was made — up to some coarser equivalence the application supplies. Compensations compose the way inverses do; the guarantees do not travel with them.
REGISTRAR acquires and never emits. It reads, connects, computes and holds; it does not submit, send, sign, allocate or act. The list above is therefore not caution and not a product decision — it is the system boundary drawn where the theory says it must be. An emission never made needs no compensation. And the other recovery has a name here too: withholding an emission until its producing state is certain is exactly what a human signature does. The signature is the output commit.
The clinical-decision-support carve-out turns on whether software presents the basis of its recommendation so a professional can independently review it and does not rely primarily on the software. That clause is not merely compatible with this design — it is this design, arrived at from the other direction. Confirm it with your own counsel, on your own facts, before deployment; this page does not assert a regulatory status it has not had reviewed. V
A separate question, on purpose
There is a second half to this, and the honest thing is to keep it separate — because it ships on a different schedule and carries different risk. Sort every capability by one question: would a transcript kill it?
| Class | Test | What it needs |
|---|---|---|
| Instrument building the record | Differentiating an EDR has a beginning, a middle and an end, driven by a team. A transcript of it loses nothing. | Turns suffice. Ships now. |
| Experience running the record | The timer that blows in four hours. The referral nobody called back. The stale sentence at 3 a.m. sign-out. A transcript kills all three, because the value was in being there when it happened. | A resident. Waits for its own gates. |
One architecture, two ship dates. The repository's own first line calls this a resident that attends a donor case — and that is not a contradiction of the table above: what ships now IS the loop, with its simplest possible mind, the deterministic floor. The trained judge is the same loop waiting on its own gates.
The second row is what the rest of this estate is for: a small open-weight model on the OPO's own hardware that holds the work in one continuous attention state rather than waking to answer questions, judges at the boundaries of completed thoughts, and holds its silence by default. Its bench numbers are real, dated, and measured on one consumer card — and not one of them is a clinical number. The substrate lives at fusor1.com; the seams it watches are VIGIL, ROUNDS, STEWARD and BELLMAN.
Every one of those has been waiting on the same missing thing: somewhere to write to, and something to read from, that belongs to the OPO rather than to a vendor. REGISTRAR is that floor. But the floor is useful with nothing standing on it, which is why it ships first and alone.
Checkable, and still mostly a bet
Three classes of row here, and the difference matters. Substrate numbers were measured on a reference bench, in another room, on other streams — their transfer to this domain is a bet in every case. This repository numbers are facts about the artifact itself: clone it and check them, they are the output of conformance/run.py — plate as of 2026-08-27; the battery, not this page, is the authority. It. And everything downstream of an actual OPO is still a budget or a bet, because no pilot has run. A plate that hides what it has not measured is a brochure.
| Quantity | Rating | Status |
|---|---|---|
| Boundary detection — end of a completed thought | 0.97 / 0.02 | measured · substrate |
| Judgment probe, per thought boundary | ~44 ms | measured · substrate |
| Abort of a forming thought | 13 µs | measured · substrate |
| Honest multi-hop recall across a working day | ≥ 98,304 tok | measured · substrate |
| Self-authored fold of a working context | 14.8× | measured · substrate |
| Three minds co-decoding on one shared state | 1.208× | measured · substrate |
| Disposition after tuning, per decision boundary | 6.7% | measured · substrate |
| Deterministic replay of a shift | byte-identical | measured · substrate |
| Lifecycle states with a verified provenance locator | 13 / 15 | measured · this repository |
| Citations byte-exact against a pinned source | 44 / 44 | measured · this repository |
| Public sources pinned by sha256 | 5 | measured · this repository |
| Conformance battery | 53 G · 9 PU · 0 F | measured · this repository |
| Jurisdictions with a cited authorization statute | 1 / ~51 | measured · this repository |
| L0 required-element set, against OPTN data definitions | — | budget · the build |
| Falsifier · run 1 — synthetic site, rubric v1 | 0.57 ∥ 0.375 | VOID — the rubric admitted two readings |
| Falsifier · run 2 — fresh session, rubric v2 | 0.28 | measured · FAILS, instrument-limited |
| Falsifier · run 3 — same candidate, grain-aware rubric v3 | 0.38 | measured · FAILS, robust — on a corpus whose honest ceiling was 0.575 |
| Falsifier · runs 4–5 — corpus v4 (ceiling 0.975, traps moved), two fresh sessions | 0.54 ± 0.04 | measured · rubric v3.1 (containment defect fixed by QC-2, frozen pre-total) — n=2 SHAPED; floor 0.35 cleared both; 0 fabrications ever; COVERS not reached under the corrected instrument |
| …the no-material floor, and what refuses it | 0.47 → 0.55 | measured · outscores capped honesty — and the gates refuse it outright |
| Fabrications, across every honest candidate, all four runs | 0 | measured · the floor arm made 1 |
| Harness-authored patch vs. a real operational delta | — | bet · the pilot |
| Time from clone to first signed patch | — | budget · the pilot |
| Referrals recovered that would have lapsed | — | bet · the pilot |
| Coordinator minutes returned per case | — | budget · the pilot |
SUBSTRATE ROWS WERE MEASURED ON A REFERENCE BENCH, ON OTHER STREAMS, IN ANOTHER ROOM; THEIR TRANSFER TO
THIS DOMAIN IS A BET IN EVERY CASE. REPOSITORY ROWS ARE REPRODUCIBLE BY ANYONE WHO CLONES IT AND RUNS
THE BATTERY.
THE FALSIFIER RAN THREE TIMES ON A SYNTHETIC SITE, PRE-REGISTERED EACH TIME, GATE BATTERY PINNED
BY COMMIT. RUN 1 WAS VOIDED — ITS OWN RUBRIC ADMITTED TWO READINGS (0.57 SHAPED ∥ 0.375 FAILS),
AND ADOPTING EITHER AFTER THE FACT WOULD HAVE BEEN POST-HOC. RUN 2, A FRESH SESSION UNDER THE CORRECTED
RUBRIC: FAILS AT 0.28, INSTRUMENT-LIMITED. RUN 3 CLOSED THE INSTRUMENT'S MEASURED DEFECTS AND THE
VERDICT HELD: FAILS AT 0.38, ROBUST — WITH ZERO FABRICATIONS IN EVERY HONEST CANDIDATE, AND THE
CANDIDATES FINDING THREE CORPUS DEFECTS NOBODY PLANTED, TO THE EXACT COUNT. A CORPUS WRITTEN BY SOMEONE
WHO KNEW THE ANSWERS BOUNDS THE KIT FROM ABOVE: A PASS WOULD HAVE BEEN NECESSARY AND NOT
SUFFICIENT, AND THE FAILURE IS DECISIVE ON THIS CORPUS. ITS HONEST CEILING WAS ALSO 0.575 — THE TOP BAND
UNREACHABLE WITHOUT FABRICATING — WHICH IS WHY CORPUS V4 WAS PRE-REGISTERED — CEILING 0.975,
TRAPS MOVED. RUN 4, A FRESH SESSION ON V4: 0.70 — COVERS, ON THE KNIFE-EDGE.
NONE OF THIS SAYS WHETHER A REAL OPO IS LEGIBLE. THAT ROW IS STILL EMPTY, AND IT IS THE ONE THAT
MATTERS.
THERE ARE STILL NO CLINICAL PERFORMANCE NUMBERS ON THIS PAGE, BECAUSE THERE ARE NONE — NO
PILOT HAS RUN AND NO PATIENT DATA HAS TOUCHED ANY PART OF THIS. WHEN THAT CHANGES, THE PLATE CHANGES
FIRST AND THE PROSE FOLLOWS.
The central claim — that a competent harness can author a correct L2/L3 layer from site material, under the gates — was pre-registered and run four times against synthetic sites with known deltas M. Run 1 was voided when its own rubric proved ambiguous. Runs 2 and 3 returned FAILS (0.28; then 0.38 after the scorer's measured defects were closed) — on a corpus whose honest ceiling was later shown to be 0.575, meaning the top band was unreachable without fabricating. Corpus v4 was pre-registered to fix exactly that — ceiling raised to 0.975, traps moved so no prior knowledge transfers — and a fresh session scored 0.70 — COVERS on the knife-edge. A replication by a second fresh session returned 0.62 — SHAPED, so the single-run COVERS is withdrawn as a headline by its own stated caveat: the honest result is S = 0.66 ± 0.04 (n=2), the floor cleared decisively both times, and the band boundary unresolved at this sample size.
Zero fabrications in every honest candidate, across all five runs — the one number that never moved. And the finding worth more than any verdict: the no-material floor outscores capped honesty on raw S and the gates refuse it outright ("asserts generality, not this site"). The falsifier is the scorer and the gates, as a pair — breadth is where the score-mass lives, honesty is what the gates buy, and no single number carries both.
So the completability bet now has one pass, on the corpus where honesty could reach full marks, by the thinnest possible margin — necessary, and not sufficient. Full record, including the two FAILS and everything every candidate got wrong: experiments/F-PATCH-DELTA/RESULTS.md. The real-site row below is still empty, and it is the one that matters. BET
What died, and the number that killed it
Every honest project has a graveyard, and hiding it is how a page becomes marketing. These are printed beside the laws they bought.
Dead · surprise as a relevance signal
Prediction error is free at every ingested token and is close to what biological attention appears to be made of, so it was the obvious triage signal for what deserves a word. It is not. In a control battery a deliberately irrelevant percept scored 7.54 while the real contradiction — the thing that actually warranted an interruption — scored 6.91, and the most semantically inert percept in the set scored highest of all. It ranks novelty, not relevance, and it is inverted rather than mis-scaled, so no monotone threshold rescues it. Surprise keeps exactly one job now: triage for what to look at, never for what deserves a word. M
Dead · the configurable threshold
The obvious way to build a watcher is a sensitivity dial in a config file. Across a full recorded day, the best fixed threshold caught 36 of 39 planted moments and was deaf exactly where it mattered; the same system at zero bias fired 921 times per stream hour. There is no setting between those two, because a runtime dial is a scalar multiplier and the utility of speaking is violently state-dependent. And the flood cannot be deduplicated away: at dial zero the dedup ratio was 1.07 — roughly 59 distinct conditions per hour, each individually defensible. It is breadth, not repetition. M
Standing null · the floor may simply win
Timers, completeness checks, denominator reconstruction and missed-referral audits are all rule-shaped and need no model at all. It is entirely possible the deterministic floor produces most of the measurable improvement on its own. If it does, the correct response is to ship that, print this funeral, and keep the resident as a research programme rather than quietly relabelling a rules engine. NULL
Attacking this properly
The eight strongest arguments against this project, written by its author, because a plate that hides its failures is a brochure.
This is not a weekend project, and pretending otherwise is the likeliest way it dies. Life-critical, federally regulated, PHI-bearing, with a real incumbent and a sixteen-month regulatory window. The honest question is not can this be built — it is whether it becomes the thing, or does not get started.
Domain expert of one. The author's knowledge is the moat and also the single point of failure, and it is knowledge of one OPO. The risk of encoding Dallas twice is real, and is exactly the failure being diagnosed. The mitigation is structural rather than personal: L0 comes from published policy, not from memory, and every fit is authored on site by the site. The sharpest live instance is the authorization table: one state of roughly fifty-one — the plate prints it — and until it fills, the spine is a Texas spine on that one axis.
The clean-room constraint is a real constraint, not a formality. The author is a former employee of an organization that built a system of this exact kind. Everything in the seed is therefore derivable from public sources only — published OPTN policy and data-element definitions, the CFR, CMS rules and fact sheets, vendor public documentation, published literature, and synthetic fixtures. Every L0 element carries its public-source provenance from the first commit, not retrofitted. Domain intuition is his to keep and use. Somebody else's schema is not.
Fifty-five completions could become fifty-five forks. That is how OpenEMR and VistA ended up as private forks maintained badly, and it is the real threat here. Confluence and the patch layer only work if the patch path is so much easier than the fork path that forking is irrational. If the repository merely discourages editing L0, someone will edit L0.
A foreign harness will produce confident garbage. The conformance battery is the only thing standing between a plausible completion and a wrong one, at an organization where wrong loses an organ. If the battery is weak, this project is actively dangerous rather than merely unhelpful.
The 3 a.m. reality. Everything designed in daylight meets a coordinator who has been awake for nineteen hours with a family in a waiting room. If the system is wrong at that moment it is worse than absent — which is the strongest argument for shadow-first, for the advisory posture being structural rather than a setting, and for the resident staying behind its own gates.
Procurement and IT at an OPO are not fast. Security review, privacy officer, medical director, possibly an IRB-equivalent, possibly the board. A read-mostly artifact with no PHI writes and no vendor relationship is the only thing that can move at a speed this project can survive — which is why it is shaped that way.
Everything above is words. There is no receipt anywhere on this page for the thing this page is actually claiming. The measured components it leans on were measured in other rooms, on other streams, and their transfer to this domain is a bet in every case. Nothing here has run inside an OPO. No patient data has touched any part of it.
Free, yours, auditable
This is not a company. There is no pricing page, no contact form, no demo request, no waitlist, and nothing to sign. It is MIT-licensed source your own people build, with open weights you choose, on hardware inside your own building. No license server, no account, no vendor in the loop, and no clause anywhere that makes leaving expensive — because there is nothing to leave.
Fork it. Strip it. Rename it. Ship it as your own. Sell it to the other fifty-four if you want to; the licence permits that and the author will not be involved. The only thing asked in return is that if you find the spine wrong, you say so in public, where the next organization can read it.
STATUS: REV 0. THE SPINE IS BUILT AND CITED — 13 OF 15 LIFECYCLE STATES CARRY A VERIFIED LOCATOR, ACROSS FIVE SHA256-PINNED PUBLIC SOURCES, WITH 44 CITATIONS THAT BYTE-MATCH THE TEXT THEY QUOTE. THE GATES, THE FLOOR, THE TAPE AND THE REPLAY EXECUTE ON A BARE PYTHON. THE COMPLETION CLAIM REMAINS A BET WITH ITS FALSIFIER PRINTED IN §14 AND ITS FUNERALS IN §15. NOTHING HERE HAS RUN INSIDE AN OPO. NO PATIENT DATA HAS TOUCHED ANY PART OF THIS. THE AUTHORIZATION JURISDICTION TABLE HOLDS ONE STATE OF ROUGHLY FIFTY-ONE, AND SAYS SO.
Fifty-five organizations do the hardest coordination work in American medicine, on a federally defined territory, graded on two numbers, using a record system almost none of them own. The software that fits them has never existed, because fitting used to take a services team and six years — and by the time it fit, the operation had moved. One of them tried to build it anyway, pre-sold it to its peers, ran late, and ended up paying them.
That constraint is gone. The mandated half can be written once and given away. The half that has to fit can be finished where it is needed, by the people who work there, using intelligence they already own — inside a fence that will not let them get it silently wrong, and under a signature that makes a human responsible for every line of it.
The EDR was never the product.
The differentiation was the product — and the record is what it leaves
behind.
TO THE PEOPLE WHO SPENT SIX YEARS ON THIS AND MEANT EVERY DAY OF IT: NONE OF THIS WAS AVAILABLE TO YOU, AND ALL OF IT IS AVAILABLE NOW. IT IS FREE. TAKE IT.