# AppStore2031 future-native forecast method

**Status:** active research method for the local draft; not frozen
**Target:** July 2031  
**Method family:** workflow-separated future-world generation followed by a
dated current-market and published-concept collision audit  
**Supersedes:** withdrawn continuity-led method v1

## 1. Forecast question

What new categories and Top 10 marketplace listings could plausibly dominate a
first-party mobile or successor software marketplace in July 2031 after five
years of interacting technological, economic, social, environmental,
demographic and geopolitical change?

The ranked object is a **marketplace listing**, not necessarily a conventional
downloadable phone app. A listing may resolve to a native application, agent,
capability pack, persistent companion, synthetic environment, autonomous
organisation interface, robot service, protocol client or another first-party
marketplace unit that becomes normal by the target date.

The public interface uses fictional products to make the forecast tangible.
The forecastable object underneath each product is a bounded archetype with
observable inclusion and exclusion criteria.

## 2. What this method is designed to prevent

The method must not:

- begin with current app categories, incumbents or the previous inventory;
- generate a present-day product and add AI, privacy, provenance,
  interoperability or a new payment rail as decoration;
- assume that uncertainty makes a consequential future unimportant;
- turn policy ambition into delivered adoption;
- make one region a proxy for the world;
- make one technology, institution, company or product a mandatory answer;
- preserve an old category, listing, probability or rank by default; or
- use the dated collision audit as creative inspiration for candidate generation.

## 3. Evidence boundary

Every factual premise has an evidence cutoff. Records distinguish:

- observed deployment or behaviour;
- measured trend;
- modelled projection;
- expert elicitation;
- policy target or institutional intent;
- weak signal;
- design inference;
- scenario assumption; and
- explicit unknown.

Sources retain publisher, URL, publication and access dates, geography,
language and translation method, evidence class, limitations and status.
Contradictory, rejected and superseded evidence remains visible.

A source can support a present condition, trend or scenario branch. It cannot
prove a fictional product, future category or precise rank.

## 4. Workflow-separated sequence

The forecast is produced in seven separated stages. Later-stage information
must not leak backwards.

This is workflow separation, not a claim that an AI starts with a blank mind.
Authors are not supplied the previous catalogue, current-market comparison
corpus, audit findings, rejected or other candidates, or ranks, and active
retrieval of those materials is blocked before sealing. Model pretraining and
unavoidable developer and workspace context still exist and are disclosed as
a limitation.

### Stage A — horizon scan

Independent scanners examine changes across at least:

- AI, compute and autonomous agency;
- economy, work, firms, ownership and finance;
- health, biotechnology, care and demography;
- education, relationships, culture, attention and meaning;
- energy, climate, food, water and materials;
- robotics, mobility, manufacturing, spatial systems and interfaces; and
- geopolitics, governance, security, identity and public infrastructure.

The scan looks ahead, across unfamiliar sources and beyond one culture. It
records Horizon 1 conditions, weak signals, potential Horizon 3 conditions,
counterforces, unknowns and measurable signposts. It does not propose apps or
categories.

### Stage B — cross-impact futures

Scenario builders receive only the horizon-scan evidence. They identify:

- key variables and structural assumptions;
- reinforcing and conflicting pairs of disruptions;
- second- and third-order consequences;
- changed scarcities and newly abundant resources;
- new rights, liabilities, institutions and economic actors;
- regional divergence; and
- conditions that would make each world internally inconsistent.

They create multiple coherent 2031 worlds using morphological and cross-impact
analysis. At least one world must represent constrained progress, at least one
transformative machine capability, and at least one material institutional or
geopolitical discontinuity. These are not optimism/pessimism variants of one
base case.

No scenario receives a probability merely to force a consensus. Where credible
external forecasts exist, their distributions and disagreements are shown as
evidence, not collapsed into false precision.

### Stage C — changed actors and needs

Needs researchers receive the world packets but no current-app baseline,
previous taxonomy or previous inventory. For each world they identify:

- who or what can act;
- what those actors control, own, owe, fear and value;
- which present institutions have weakened, merged or disappeared;
- which activities have become cheap, abundant, scarce or compulsory;
- new coordination, trust, identity and relationship problems; and
- behaviours repeated frequently enough to support marketplace discovery.

Actors may include people, households, communities, human-machine teams,
synthetic persons, autonomous agents, autonomous organisations, public bodies,
robot fleets and networked infrastructure. The list is illustrative, not a
quota.

### Stage D — marketplace ontology and categories

Taxonomy builders receive the changed-actor and changed-need records. They do
not see current app categories or the previous taxonomy.

They determine:

- what a marketplace distributes in each world;
- which units deserve independent listings;
- how people or agents discover and trust them;
- which recurring purposes form distinct browse categories; and
- which categories exist across worlds or only under named conditions.

A Stage D category is provisional. It qualifies for candidate research when
all of these are true:

- it gives a coherent recurring reason to browse;
- at least one marketplace unit could plausibly be distributed and chosen as
  an independent listing;
- its purpose traces to changed Stage C needs rather than a familiar category
  name; and
- its inclusion, exclusion, collision and July 2031 resolution rules are
  observable.

There is no minimum number of needs or jobs at Stage D. Needs and products are
many-to-many: one product may answer several needs, and several genuinely
different products may answer the same need. A masked-field collision check may keep
two products for the same need only when their indispensable capability,
service model, actor relationship, delivered experience or liability and
failure structure is materially different. A different name, provider, price,
region, visual skin or technology label is not a material difference.

Category count is research-derived. A provisional category becomes a
publishable chart only after Stage F leaves at least ten pairwise-distinct,
independently audited `future-dependent-no-collision-found` candidates. Stage G
selects and ranks exactly ten. Stage D never manufactures
ten jobs to justify a chart.

Public rights and accountable decisions remain outside a listing. A product
may execute, coordinate, translate, evidence, deliver, simulate, monitor or
support under external authority. It may not itself confer a legal right or
permission, set public priorities, exercise command or professional judgement,
make settlement final, or issue an official remedy. The category and candidate
records must say where that accountable authority sits. A listing does not
need to complete the whole sovereign or institutional outcome to count.

### Stage E — future-native candidate generation

Stage E starts from the hash-bound corrected Stage D synthesis manifest. A
candidate author receives the exact canonical category, only the worlds shared
by that category and one assigned actor need, the full hash-bound need, one
material-difference brief, the public-authority boundary, the exact Stage D
workflow-separation disclosure and source receipts, and the authoring guide.
They do not retrieve current products, current app charts, previous listings,
previous ranks, archived/rejected Stage D material or other candidate sets.
Ambient pretrained knowledge may exist, but it is not task evidence.

Each candidate specifies:

- the new actor and job;
- the changed 2031 condition that creates the job;
- the complete user or agent experience;
- essential capabilities and disqualifiers;
- distribution and business or funding model;
- dependencies and readiness path;
- consequences if an enabling condition fails;
- scenario fit and regional variation;
- potential benefit, potential harm and likely abuse;
- update signals and resolution criteria; and
- a plain-language explanation for a 16-year-old reader.

Each provisional category receives its own external author context. That
context handles the category's complete configured reserve — 12 candidates in
the initial edition. Candidates within the same category may influence one
another, so we do not describe them as independently drafted. The defensible
separation is narrower: no category author receives the withdrawn v1 catalogue,
current-market material, prior-art findings, ranks or another category's
packets. Category author contexts are distinct from one another and from every
critic or auditor context. A later refresh derives the number of one-category
author groups and each group's candidate count from that edition's validated
dispatch; neither number is hard-coded as a permanent catalogue shape.

After grouped drafting and before the candidate tree is sealed, a separate
masked-field critic context is assigned to each category. It compares every
unordered pair inside the category — `n(n-1)/2`, which is 66 when there are 12
candidates — and also records at least one masked cross-category nearest match
for every candidate. The critic material masks names, providers, prices,
regions, skins and technology labels. This masking applies only to the supplied
review material; it does not erase pretrained or ambient knowledge. The critic
records the material difference axes and rejects unresolved duplicates. This
check does not turn the number of needs into a candidate quota.

The number of prepared candidate briefs per provisional category is an
explicitly configured reserve, not a fixed ten. One actor need may be assigned
more than once only when each brief uses a different structural axis:
indispensable capability, service model, actor relationship, delivered
experience, or liability and failure structure. Candidate and brief IDs are
always different.

Candidate authors must describe the world first and the product second. They
may not justify a product solely with a growing market or better implementation
of a current task.

Every candidate carries a structured author identity, its category batch and
author group IDs, and the unchanged hash-bound receipt for its own
category/world/need/brief packet. All candidates in one author group reference
the same group session receipt. That receipt lists every candidate ID, category
batch, packet hash, permitted output root and normalized candidate-output hash.
Validation rebuilds it from JSONL outside the edition and proves one exact
`fork_turns=none` spawn at depth one, or depth two when an approved Stage E
coordinator delegates the author spawn. The receipt records the depth and exact
parent-thread and agent-path linkage, all group inputs delivered before authoring,
one task turn, bounded writes and the ordered group output hash. Reusing that
canonical context outside its one author group fails validation. Edition-
authored actor names are labels, not independence evidence.

The author copies an exact packet-bound authorship object whose initial
`authoredAt` is only a schema placeholder. It is not time evidence. Once the
external session transcript passes, the integrator replaces that value with
the receipt's exact `taskCompletedAt` and adds the shared session pointer.
Normalised candidate hashes omit only those two mechanically integrated
metadata fields; all product, evidence, dependency, safety and future-distance
content remains bound. A canonical candidate must therefore have an
`authoredAt` equal to or later than its externally verified task completion.

Every later call after the canonical packet and scope is fail-closed: the
author can patch only the assigned output root for its one category group —
12 candidate files in the initial edition — or run bounded deterministic/status
checks. Direct unbound reads, web, MCP, collaboration, old editions, present
products and collision-audit evidence are not permitted. Every call, argument
and output is hash-bound through completion.
An allowed `functions.exec` input must match one validator-rendered canonical
source template byte-for-byte. Semantic JavaScript equivalence is not
accepted: bracket or computed properties, aliases or destructuring, unknown
globals, extra expressions or statements, and multiple calls are rejected.
The patch form contains exactly one literal `tools.apply_patch` call.
Every output patch is followed by exact deterministic validation of the
assigned root.

A natural-language classifier may flag likely product-shaping directions in
the visible task context. That classifier is a heuristic warning aid only: a
pass cannot prove semantic absence of shaping material, blindness, independent
invention or novelty. Its warning result and this limitation remain together
in the process record.

The Stage E seal is derived only after canonical validation of the repaired
Stage D ontology and the complete Stage E preparation. Its ontology binding
contains the exact publishable category IDs and hashes of the canonical Stage D
category, ontology, packet, synthesis-manifest and verification-envelope
artifacts. The candidate, dispatch, author-batch and collision sets must match
that external category universe exactly; they cannot make an omitted category
disappear by agreeing with one another.

Lifecycle advancement uses a recoverable pending journal covering both
`manifest.json` and `refresh-run.json`. Until both replacements match the
journaled target hashes, Stage F fails closed. Recovery either recognises the
complete new pair or restores both exact original byte sequences; a corrupt or
missing rollback backup leaves the journal visible and blocks later work. File
contents and the affected directory entries are fsynced around journal writes,
renames and removals. Before Stage F, validation also rereads the exact Stage E
packet, recomputes every allowed-input receipt from live bytes, and requires the
Stage E record to contain exactly the canonical packet receipt and current
candidates, collisions and seal output receipts.

### Executed final synthesis — the active Stage F-H path

The sealed candidate set is completed through the bounded ranking, listing and
name-screen method in
[From sealed research to the AppStore2031 Top 10s](FINAL_SYNTHESIS_AND_LIMITS.md).
It uses one transparent 100-point judgement frame, preserves every exclusion,
projects conditional regional rank ranges, writes the product explanation for
a 16-year-old reader and records a dated exact-name screen.

The larger transcript-bound audit and causal-simulation design below was an
attempted maximum-assurance path. Live packets exceeded the agent interface's
reliable output capacity and were repeatedly truncated. No output from those
sessions was accepted. These sections are retained as design and failure
history, not as the executed method or a requirement for refresh.

### Historical Stage F proposal — not executed

Only after candidate files are sealed do separate auditors receive them plus a
fresh market scan at the evidence cutoff. The audit is dynamic; the method
contains no permanent product or company examples.

Independent Stage F collision researchers search official stores, product
sites, open-source repositories, research prototypes and delivered
infrastructure for each candidate's central job and capability combination.
The immutable category packet derives and hashes the exact indispensable
capabilities, experience, service model, authority boundary and
future-dependent requirements from each sealed candidate. Every dynamic query
and comparison row must cite those candidate-specific anchors; a generic
category search or reusable difference statement is invalid. Each query
records its search language; a local-language query preserves the exact
searched wording in its anchor translation alongside the English terms that
bind it back to the sealed candidate.

Each candidate is searched through at least two distinct surfaces. Retained
sources preserve a first-party official/primary identity, a publication date
no later than the cutoff, exact identity/date/capability excerpts, and a hash
of the complete direct-URL open response. The external transcript receipt
recomputes the hashes and proves that every excerpt appeared in the opened
content. The identity excerpt must name the organisation, the host must own
the URL, and the date excerpt must prove the declared date. Passing evidence
normally requires two independent official or
primary organisations. An exhausted search with fewer records stays visible
as an evidence gap and mechanically returns `revise-and-reaudit`.
Each category audit retains a hash-bound packet receipt linking one structured
auditor context to the round, complete category candidate set, verified seal,
derived anchor hashes, cutoff, search limits and output root. Its external
session receipt binds the exact packet and audit output, dynamic queries,
direct URL opens and opened-content hashes. The validator uses canonical Codex
context IDs—not edition aliases—to prove fresh, disjoint author, collision
critic and auditor contexts. After packet retrieval, only canonical web search
and direct HTTPS open wrappers, one bounded output patch and deterministic
validation are allowed; arbitrary browsing, shell/filesystem reads and
collaboration calls fail.

A candidate fails when its central experience is substantially delivered or
commercially available at the cutoff and its forecast difference is mainly:

- improved quality, speed, price or scale;
- an added AI assistant;
- an added permission, provenance or audit layer;
- broader interoperability;
- a different payment rail; or
- expected mainstream adoption of an already complete product.

A candidate can survive only when a named future condition materially changes
at least one of:

- who or what the user is;
- the job being performed;
- the level or duration of autonomous action;
- the economic or ownership relationship;
- the physical or social experience;
- the institution through which the outcome is delivered; or
- what was technically, legally or economically possible at the cutoff.

Under immutable protocol `audit-v3`, the packet derives content-hash anchors
for mechanism, experience, service, authority and future dependence directly
from the sealed candidate. For every closest match, the auditor completes a
mechanism-by-mechanism matrix plus a structural matrix spanning the other four
kinds. Every matrix explanation preserves the exact anchor content hash and
substantively applies a distinctive multi-word phrase and candidate-distinctive
lexical term. The buildability case, verdict rationale and public reason each
bind and apply all five kinds. The matrix derives absent future requirements
and a cutoff-buildability assessment. A fixed `0.8` threshold then computes
the result: equivalent-buildable-now or threshold equivalence is `reject`;
uncertainty or exhausted evidence is `revise-and-reaudit`; and
`future-dependent-no-collision-found` is possible only when every closest
match lacks at least one indispensable future-dependent structural
requirement. The stored verdict must equal that computed result. Candidate and
category IDs, numbers, source/evidence labels and copied anchor text have no
semantic weight. Fingerprints remove those identities and superficial anchor
vocabulary before exact and near-clone checks, so swapped IDs, cross-candidate
anchor substitution and template reintroduction are rejected.
Cloned source, capability, difference and verdict reasoning is rejected after
that de-identification, including near-clones disguised with different labels.

Dynamic query evidence is also per-anchor rather than one free-text claim for a
list of IDs. Every `anchorMappings` row binds one exact query segment,
translation bridge and semantic rationale to one content-hash anchor. Both
authored fields independently retain multi-word material from that requirement.
When several anchors share one web query, each mapping must use at least two
terms not shared by the other mapped anchors. Reusing the candidate phrase with
one changed verb, or swapping segments and explanations between anchors, fails.
An English segment must itself carry the distinctive anchor meaning; translation
text cannot turn a generic segment into evidence. A non-English segment requires
globally unique `languageBridgeEvidence` bound to an exact excerpt from an
authoritative official or primary language source opened for the same query.
The transcript-bound excerpt must state an explicit
`[source-language] local segment => [en] English meaning` relation and the
source must separately establish the named organisation's language authority.
Juxtaposition is not translation, and one source/capability pair cannot cover
another mapping or query. A group-global semantic fingerprint also prevents an
auditor from cloning the same source, source and target languages, normalised
local segment and normalised English target relation under a new capability or
anchor ID. The external receipt proves
both excerpts occurred in the opened response.

Each Stage F web-search call carries one query and each web-open call carries one
direct HTTPS URL. A retained source binds to the exact ordered search-result
record through its query ID, one-based ordinal and canonical record SHA-256;
its `queryIds` are derived from those attributions. Receipt reconstruction then
proves that the attributed record's URL is the uniquely opened URL. Batched
opens, swapped result records and authored query labels cannot substitute for
that transcript evidence.

The last
verdict means no dated collision was found in the searched surfaces; it is not
a claim of global novelty. Rejected candidates are not shown to the original
author. A fresh replacement author receives only the assigned
category/world/need/brief packet and a generic statement that an additional
distinct candidate is required.

Every audit round archives the exact sealed candidate tree and appends a
canonical hash-chained record containing its round number, time, complete candidate
IDs and complete source-linked verdicts. A replacement receives a new ID and
new full-tree seal; its record links the rejected or revise-and-reaudit
predecessor to the successor, verified successor seal, fresh replacement
author identity, externally verified canonical context and sealed generic
packet receipt. Replacement authors cannot
be prior authors or auditors and receive no rejection or audit findings.
Only the subset of rejected or revise outcomes needed to restore the
ten-survivor floor has to be replaced; untouched reserve failures remain in
the next complete audit record.
Earlier rounds are immutable evidence. They cannot be collapsed into a
convenient final all-pass list, and the active audit must exactly match the last
round.

A category does not publish if Stage F cannot produce at least ten pairwise-distinct,
independently audited `future-dependent-no-collision-found` survivors. It returns to candidate
research or remains an unpublished provisional category; rankings are never
filled with weaker duplicates.

### Historical Stage G proposal — not executed

Only candidates with a dated
`future-dependent-no-collision-found` verdict enter ranking.

Candidates are judged independently within each coherent world and geographic
lens on:

- need intensity and frequency in that world;
- size and reach of the affected actor population;
- feasibility by 2031 conditional on that world;
- marketplace discoverability and distribution;
- repeat use, dependency or network effects;
- regulatory and infrastructure fit;
- substitutes and bundling risk;
- harmful-use and legitimacy constraints; and
- evidence quality for the causal path.

Each category/metric combination is authored in a fresh workflow-separated
context under immutable protocol `causal-judgement-v8`. The author sees the
sealed survivors, six worlds, 12 lenses and cited edition evidence, but no
other metric judgements, ranking output, previous rank, current-market
comparison corpus or storefront fiction. Exact external session receipts bind
the packet, bounded write, validation, timestamps, context identity and lack of
parent interference. One context cannot author two metrics or be reused from
an earlier workflow role.

Authors provide lower, central and upper ordinal causal-plausibility bands,
plus assumptions, falsifiers, evidence limits and a counter-case. They do not
provide decimal scores or probabilities. Citation count, prose length and
filled-field count are not positive signals. This explicitly prevents a
complete-looking candidate record from scoring well merely because it is
complete-looking.

Every record also binds content-hash anchors for the candidate mechanism, the
exact world proposition and candidate/world change, and the exact geographic
constraint and candidate/geography effect. Separate causal-chain fields must
independently preserve a distinctive multi-word fragment from every source
they claim to connect, add at least five residual concepts spanning at least
two causal roles, and bind evidence by candidate, world and geography. Exact
and order-insensitive semantic fingerprints remove the changing candidate,
world, lens, anchor, metric and band vocabulary; the semantic form also stems
inflections, groups generic synonyms and ignores grammatical word order.
Residual stems count only when they occur in explicit semantic evidence-field
allowlists for the exact row's candidate, world, lens, bound source or bound
claim. URL, identifier, provenance and other metadata never provide grounding;
all unbound stems collapse to one `unbound-concept`. Every authored causal
relation must bind locally grounded arguments on both sides, and every authored
causal consequence must have a locally grounded argument. A grounded aside
elsewhere in the clause is insufficient. Only role-token occurrences inside an
exact fully copied anchor span are exempt; repeating an anchor's causal stem
later does not inherit that exemption. Anchor-span matching is clause-local and
never crosses punctuation or `->`, while case and comma normalisation inside a
single clause remains valid. Arrow boundaries are recognised with no spaces,
one-sided spaces, ordinary spaces or tabs. Generic prose with
inserted IDs, isolated anchor terms, an anchor-and-band-swapped or paraphrased
template, numbered or unrelated-noun stuffing, repeated fingerprints or
mechanically cloned band matrices fails validation.

Present-day delivery is not a positive strength anchor. Current evidence
supports the trajectory and enabling conditions, while feasibility is assessed
at the target date conditional on the world.

The deterministic simulator samples only the independently authored ordinal
ranges. It does not add synthetic noise or derive uncertainty from citation
counts. Conditional output uses broad simulation-share bands and integer rank
ranges, not a claimed probability that a world occurs or a fictional product
exists.

The compiled judgement file is a deterministic projection, not another
authored layer. Its source-tree receipt binds every packet, output byte/value
hash, session receipt and author context. Canonical validation re-reads and
revalidates all those files, reconstructs the compiled bytes and refuses any
substituted band, prose, anchor or author pointer before ranking.

The ranking file is also a deterministic projection, not an editable result.
The compiler and production validator call the same canonical projector with
the sealed candidates, active audits, six worlds, 12 lenses and reprojected
judgements. Validation reconstructs exact pretty-JSON bytes rather than merely
checking chart shapes or self-declared hashes. A source-to-ranking receipt
chains the causal author source-tree hash to the judgement-file hash and one
category-sorted ranking leaf. Each leaf separately hashes conditional lens
charts, world charts, the main chart, sensitivity, adjacent explanations and
the complete ranking record. Self-rehashing a substituted or reordered result
does not make it canonical.

The model produces:

- one Top 10 for every category and world;
- geographic variations where evidence supports them;
- a scenario-balanced main chart that is explicitly not a probability-weighted
  global event forecast;
- rank sensitivity across alternative defensible world weights;
- confidence and the strongest counter-case; and
- the reason each listing sits above the next candidate.

The main chart may not hide a high-impact candidate solely because its enabling
world is uncertain. Scenario-specific dominance and sensitivity remain visible
beside the balanced rank.

### Historical Stage H proposal — not executed

Fresh listing authors turn each ranked candidate into clear marketplace copy,
build dependencies, harms, imagined reviews and rank explanations. They supply
three fictional name/provider options but cannot publish or collision-clear
any of them.

After the exact listing drafts are compiled, the system creates immutable
category-scoped name-auditor packets under
`fictional-name-collision-audit-v3`. Each packet binds the draft hash and
provides exact quoted name-and-provider queries for every one of the three
options across app-store, domain, company and trademark discovery surfaces.
The auditor must run in a fresh depth-one context disjoint from every listing
author, run every query exactly in its own web call, and directly open one
official or primary result in its own web call for every query. The external
receipt reconstructs this one-query/one-structured-result-record/one-open chain
from Codex session JSONL. The output binds the retained record's zero-based
ordinal and canonical SHA-256; the receipt requires that exact record, rather
than accepting a URL substring elsewhere in the response. It rejects batch
and record-order swaps, derives `accessedAt` from the exact open-output
timestamp, requires a complete date in the transcript-bound date excerpt, and
binds direct URLs, exact excerpts and opened-content hashes. It also reprojects
fixed identity and rights-conflict signals from the exact opened result. Case,
spacing, punctuation and accents are normalized before a bounded deterministic
edit-distance check; similar identities are material collisions and cannot
clear. Auditor-authored labels cannot change the decision.

Auditors never assert their own independence, choose an identity or assign a
clearance verdict. A fixed rule derives material-collision decisions from the
opened-result signals. Only after all surfaces cover all three options does
the compiler select the lowest-numbered cleared authored pair whose name and
provider remain unique in the edition. No eligible cleared pair
means the listing cannot compile. This is a bounded collision check for a
fictional educational forecast, not legal trademark clearance.
Auditor entries remain in immutable packet candidate/rank order. Selection
runs in packet-index assignment order and then packet candidate order, so
reordering an output cannot decide which listing receives a shared first pair.

Before canonical listings compile or validate, the system reprojects both the
listing drafts and the compiled name audit from their immutable packets,
outputs and live external session receipts. Internally consistent replacements
or self-rehashed audit files do not pass.

## 5. Future-distance record

Every published listing includes a machine-readable future-distance record:

```json
{
  "cutoffBaseline": "What can be delivered at the evidence cutoff",
  "materialDifference": "What is structurally different in 2031",
  "enablingChanges": ["Evidence-linked or explicitly assumed changes"],
  "newActorOrRelationship": "The actor, right, institution or relationship that changed",
  "closestPriorArt": ["Dated source IDs found only after generation"],
  "auditVerdict": "future-dependent-no-collision-found",
  "failureCondition": "What would make this merely incremental"
}
```

`closestPriorArt` is a legacy compatibility field name. It contains only the
closest matches found in the named, dated current-market and published-concept
collision audit; it does not imply a complete prior-art search or a novelty
finding.

The public detail panel explains this as:

1. **Why this could not be the same product in 2026.**
2. **What changed in the world.**
3. **What the 2031 product lets someone or something do.**
4. **What could prevent it from appearing.**

## 6. Fiction and disclosure

Every name, developer, icon, rating, review and rank is fictional and labelled
at point of use. Imagined reviews may illustrate both benefit and failure but
cannot be written as evidence.

The site distinguishes:

- observed evidence;
- inference;
- scenario condition;
- product design;
- rank judgement; and
- imagined marketplace copy.

## 7. Refresh contract

A refresh is a new forecast run from the current evidence position, not an edit
of the previous inventory.

Before generation, the refresh process may read previous evidence to identify
due signals and source updates. Scenario, needs, taxonomy and candidate authors
must receive newly assembled workflow-separated packets that exclude previous
categories, products and ranks. This restricts supplied and actively
retrievable run material; it does not erase pretrained or ambient knowledge.

Each refresh must:

1. update the horizon scan and revisit the complete active disruption set;
2. rebuild cross-impacts and coherent worlds;
3. rederive changed actors and needs;
4. rederive marketplace ontology and categories;
5. generate candidates independently;
6. perform a new cutoff-date current-market and published-concept collision audit;
7. rerank the surviving inventory; and
8. only then compare the completed edition with its predecessor.

The change record identifies categories and products that appeared, vanished,
merged or changed, but those comparisons never become authoring inputs.

Method evolution is permitted only as an explicit versioned decision with its
own Gauntlet evidence. Old frozen editions remain immutable and are never
rewritten to match the new method.

If a named gate fails before candidate sealing, the failed research is not
quietly edited into a successor. The dedicated invalidation writer requires a
validator-clean pre-seal edition and an explicit edition-bound authorisation.
That authorisation binds the exact pre-state manifest and refresh-run, the
copied `FAIL` / `B-worlds` verdict JSON and Markdown, its complete artifact
receipt set, and the edition-local Stage B-D integration and lifecycle output
receipts. A verdict from another run therefore cannot authorise disposition.
The writer preserves the reached stage as history, protects the pre-state and
retained tree, excludes the edition from active forecast ancestry, and refuses
any Stage F or G state.

A clean replacement is not an evolution of that failed inventory. It has no
valid forecast predecessor, no predecessor freeze hashes and no category,
candidate, rank, listing or current-product carryover. Its only source-edition
artifact is a local receipt for the invalidated manifest and disposition; all
forecast-generating records are rebuilt.

## 8. Gauntlet evaluation

Builders never grade their own work. Each piece is inspected by a fresh critic
against real external foresight methods and the real candidate artifact.

The retained bootstrap and prompt bind the critic to exactly four ordered
packet-bound inspection calls: prompt, scope and two content files. Every
`functions.exec` source must match the canonical wrapper byte-for-byte. Bracket
or computed tool access, aliases or destructuring, extra expressions,
statements or calls, direct web/MCP/computer calls and unbound reads are
rejected. Every call, complete argument and adjacent output is hash-bound in
the external-session receipt; critics cannot inspect further files or edit.

An edition at `ranked` or later is invalid until all six required scopes have
passing final receipt artifacts. The validator reconstructs every receipt from
external Codex session JSONL and rejects empty, partial, alias-only, missing or
unverifiable sets. Canonical critic contexts are unique and disjoint from stage
builders, candidate and replacement authors, collision auditors and one
another. The field named `criticBlindPacket` is retained for file
compatibility, but it is a hash-bound workflow-separated critic packet, not
proof of a blank context. It hashes the actual ranked v2 artifacts, so old or
unbound criticism cannot complete a new edition.

Mandatory regressions include:

- workflow separation between generation and dated collision material;
- no named company or product in the general rules;
- no automatic carry-over from the previous edition;
- complete future-distance records;
- categories derived before current-category comparison;
- immutable, contiguous collision-audit rounds with complete rejection and
  replacement lineage;
- sealed author packets, category audit packets, externally rebuilt Codex task
  receipts and disjoint canonical author/auditor contexts;
- visible high-impact uncertainty;
- factual claims linked to dated sources;
- explicit harms and counterforces;
- understandable explanations; and
- local data, type, test, build and signed-out route proof.

## 9. Resolution and limitations

The final contract will define how a July 2031 assessor maps observed
marketplace listings to forecast archetypes without seeing predicted ranks.
Where the marketplace itself has changed, the assessor will first map the
observed first-party discovery surface to the forecast marketplace-unit and
category definitions.

The forecast cannot discover unknown unknowns on demand. It instead publishes
its scan coverage, excluded evidence, explicit unknowns, scenario omissions and
an `unforeseen field` so later scoring does not pretend the named candidates
were exhaustive.

The method aims for disciplined imagination, not certainty. A surprising
forecast is not automatically good, and a familiar outcome is not
automatically wrong. The requirement is that every published new product earns
its claimed temporal distance and that uncertainty is shown rather than
quietly converted into continuity.