Evidence-Governed Navigation Through Reconstructed Runtime Behavior

Operational evidence does not explain itself. Logs, transcripts, traces, Instrument Findings, temporal markers, and reconstructed worldlines may contain the information required to examine a runtime, but they do not tell an operator where to begin, which relationships matter, what evidence supports a finding, or where interpretation must stop.

Most analytical systems assume that the operator already knows which dashboard to open, which metric to trust, and which question to ask. That assumption becomes increasingly fragile as computational systems operate across longer horizons, coordinate through multiple roles and tools, and produce instability or failure that develops gradually rather than appearing as one isolated event.

SubstrateX Aperture™ addresses this through Guided Investigation Architecture.

Guided Investigation Architecture organizes evidence authorized by the Current Evidence Run into versioned investigation chapters, evidence-bound question contracts, governed instrument routes, reversible source trails, and bounded operator review—allowing an operator to examine how runtime behavior developed without permitting the interface, routing logic, or investigator to manufacture evidence or exceed the Runtime Evidence Record's claim boundary.

Its governing principle is:

Guide the investigation. Preserve the operator's judgment. Never manufacture the conclusion.

From Dashboards to Investigation

A dashboard presents information.

An investigation establishes a disciplined relationship among:

• the question being asked;

• the evidence required to answer it;

• the method or instrument authorized to examine it;

• the finding produced;

• the runtime coordinates and source spans supporting that finding;

• the evidence that remains absent or contradictory; and

• the limits of what may be concluded.

Aperture does not present its instruments as unrelated analytical surfaces. Guided Investigation organizes them around one reconstructed runtime and a sequence of questions answerable only through evidence authorized by the Current Evidence Run.

The architecture moves from:

Evidence display → evidence-guided inquiry

The operator does not merely receive a score, label, or summary. The operator can examine how a finding was formed, identify the governing method, inspect the relevant runtime frame or event, return to the supporting source, review contradictory evidence, and determine whether the interpretation remains within the authorized claim boundary.

Guided Investigation is therefore not a recommendation engine for conclusions. It is a navigation architecture for challengeable evidence.

The Governing Investigation Path

Guided Investigation establishes a bounded and reversible path through one evidence object:

Current Evidence Run and Runtime Evidence Passport
↓
REIM posture and recommended route
↓
Runtime Reconstruction chapter
↓
Evidence-bound question contract
↓
Authorized Instrument Finding, measurement, or marker
↓
Runtime frame, event, or replay position
↓
Supporting and contradictory source evidence
↓
Bounded operator interpretation
↓
Review, challenge, and preservation

The path is structured, but it is not coercive. Operators retain control over where they begin, which route they follow, which findings they inspect, which interpretations they challenge, and whether the available record supports an operational conclusion.

Most importantly, the path is reversible.

A chapter summary must lead back to its synthesis fields and REIM posture. A posture must lead back to its contributing findings and evidence basis. A finding must lead back to its registered measurements, markers, coordinates, and source spans.

The operator can therefore move:

• forward from evidence toward bounded interpretation; and

• backward from interpretation toward its evidentiary authority.

The Runtime Evidence Passport provides persistent identity across this movement. Every chapter, question, finding, frame, and preserved investigation state remains associated with the same evidence record.

Six Canonical Investigation Chapters

Guided Investigation uses six canonical chapters. Each chapter addresses a distinct class of questions while examining the same reconstructed runtime.

Evidence Formation

Governing question: What evidence object exists, how was it formed, and what is it permitted to establish?

This chapter may expose:

• source identity and qualification;

• ingestion and canonicalization history;

• canonical and run identities;

• evidence coverage and sufficiency;

• available and missing disclosures;

• evidence-authority conformance;

• metric-legitimacy posture;

• Runtime Evidence Passport state;

• Evidence Seal;

• certification scope and explicit non-certifications; and

• preservation readiness.

Evidence Formation establishes the authority boundary within which every later chapter operates.

Worldline Formation

Governing question: What observable trajectory formed, and where did its organization begin to change?

This chapter may examine:

• the canonical runtime spine;

• worldline development;

• event and role chronology;

• runtime coordinates;

• regime intervals;

• disturbance and transition evidence;

• candidate and confirmed markers;

• source-linked changes in trajectory; and

• recovery or continued movement after transition.

Relevant projections may include Seismo, Chronos, and Drift.

Runtime Formation

Governing question: Which observable patterns, interactions, temporal conditions, and stability structures supported the runtime that emerged?

This chapter may examine:

• recurrence and continuity;

• role and interaction topology;

• tool relationships;

• modulation and re-anchoring;

• drift and pressure formation;

• containment and stability context;

• cross-signal dynamics;

• alignment and interference; and

• the evidence supporting or limiting formation-related claims.

Relevant projections may include Pressure, Bridge, Noesis, Scope, Dynamics, and Interferometer.

Failure Formation

Governing question: Did weakening, candidate boundary formation, confirmed Basin Exit, observable failure, or recovery occur—and what evidence supports each stage?

This chapter distinguishes:

• early weakening from confirmed transition;

• candidate boundary from confirmed Basin Exit;

• computed marker from source-supplied marker;

• post-exit observation from formal lead time;

• local correction from sustained recovery; and

• association from cause.

Relevant projections may include Seismo, Chronos, Drift, Pressure, Scope, Dynamics, and Interferometer.

Runtime Replay

Governing question: Does the reconstructed sequence remain aligned with the canonical frames, events, markers, and source record?

This chapter may expose:

• ordered playback frames;

• runtime event ledger entries;

• source-turn, canonical-turn, and frame-coordinate relationships;

• temporal and dependency ordering;

• marker placement;

• eligible evidence horizons;

• replay consistency;

• missing intervals; and

• source spans supporting visible reconstruction elements.

Replay connects the interpreted worldline back to the evidence-bearing chronology. It does not generate an alternate runtime.

Operational Interpretation

Governing question: What do the supported findings mean within the selected Operational World, and what external judgment remains necessary?

This chapter may bring together:

• REIM posture and alternative classes;

• Evaluation and Synthesis Layer outputs;

• Human Read;

• Operational World terminology and context;

• Bridge findings concerning recorded roles and handoffs;

• recommended inspection routes;

• unresolved questions;

• operator-declared context; and

• the boundaries separating evidence from operational judgment.

The Operational World Lens may change terminology and emphasis. It cannot alter the canonical findings, evidence basis, missingness, REIM posture, or Passport authority state beneath the chapter.

These chapters do not impose a predetermined incident narrative. They establish a governed set of investigative environments through which one runtime can be examined.

Evidence-Bound Question Contracts

Every investigation chapter is organized around explicit questions.

Examples include:

• What trajectory is supported by the record?

• When did weakening first become observable?

• Which roles, events, or tool interactions accompanied the change?

• Did displacement accumulate, stabilize, or contract?

• Was Basin Exit computed under the declared boundary method?

• Is an observable failure marker available?

• Is formal lead time admissible?

• Did apparent recovery persist across subsequent activity?

• Which findings remain unavailable because required evidence is missing?

• Which interpretation received the strongest support, and which alternatives remain?

• Which conclusions fall outside the claim boundary?

Each question operates under an evidentiary contract specifying, where applicable:

• required evidence objects;

• eligible measurements and markers;

• authorized instruments or methods;

• applicable coordinate system;

• eligible evidence horizon;

• availability and sufficiency requirements;

• permitted finding type;

• handling of missing or contradictory evidence;

• source-lineage requirements; and

• prohibited claims.

Questions direct attention. They do not predetermine answers.

A question may remain unanswered when its requirements are not met. Guided Investigation must represent that state explicitly rather than substitute a nearby metric, default value, generated explanation, or visually plausible conclusion.

Binding Questions to the Nine Instruments

Guided Investigation connects each question to the instruments capable of providing relevant measurements and findings.

Seismo
Worldline development, disturbance formation, regime transition, boundary evidence, Basin Exit support, and recovery posture.

Chronos
Event ordering, symbolic time, recurrence, compression, shear, temporal relationships, replay windows, and admissibility of temporal claims.

Drift
Displacement from registered anchors, curvature, recurrence loss, continued departure, and re-alignment.

Pressure
Runtime strain, accumulated load, contraction, boundary pressure, collapse-related support, and recovery reserve.

Bridge
Recorded role relationships, authority movement, tool interactions, handoffs, coordination continuity, and operational interaction structure.

Noesis
Observable formation, recurrence, modulation, continuity, re-anchoring, and fragmentation without claims of cognition or selfhood.

Scope
Runtime topology, containment relationships, boundary geometry, deformation, and possible recovery corridors.

Dynamics
Cross-signal runtime motion and changing relationships among registered stability, temporal, interaction, and trajectory dimensions.

Interferometer
Alignment, divergence, reinforcement, and interference among registered streams or recurring behavioral structures.

The investigation layer does not recompute these findings, merge their authorities, or create an independent runtime. It routes the operator to findings already associated with the Current Evidence Run and connects those findings to their supporting evidence.

An instrument may be relevant to a question without being able to answer it alone. Cross-instrument synthesis must remain governed by the Evaluation and Synthesis Layer and the evidence record rather than being improvised by the interface.

The investigation may contain many questions and many instruments, but it remains governed by one runtime, one Passport identity, and one evidence authority.

Evidence Trails

Every material investigative statement must remain inspectable through an evidence trail.

An operator should be able to move from:

Chapter statement or Human Read proposition
↓
Synthesis field and REIM posture
↓
Instrument Finding, measurement, marker, or evaluation state
↓
Runtime frame, event, or replay position
↓
Supporting source span

This prevents the interface from becoming the evidence authority.

A visualization may help the operator perceive a relationship, but the visualization does not establish that the relationship exists. Its authority comes from the Runtime Evidence Record, declared computation, governing contract, source lineage, and claim boundary beneath it.

Evidence trails must preserve:

• source and canonical references;

• runtime coordinates;

• method and version identity;

• finding and instrument identity;

• evidence-basis and availability state;

• supporting and contradictory evidence;

• confidence or uncertainty posture where applicable;

• claim limitations; and

• Passport and run references.

When supporting evidence is incomplete, the trail must preserve that absence. It cannot silently convert missing evidence into zero, inferred chronology, a confirmed marker, or a stronger narrative.

Relationship to Runtime Evidence Interpretation

The Runtime Evidence Interpretation Matrix (REIM) and Guided Investigation serve different functions.

REIM asks:

Which registered interpretation posture is best supported, which alternatives remain, and where should inspection begin?

Guided Investigation asks:

How can the operator examine, challenge, qualify, or reject that posture through the evidence that supports it?

REIM may route attention toward temporal formation, temporal boundary formation, runtime drift, role coordination pressure, tool-loop pressure, boundary formation, recovery or re-entry, observable formation, or a multi-factor incident.

The classification does not close the investigation. It does not establish cause, assign blame, determine truth, or replace operator judgment.

REIM recommends the evidence path. Guided Investigation makes that path navigable and reversible.

If the operator finds evidence that appears inconsistent with the REIM posture, the architecture must expose the contradiction. The operator's challenge may be recorded as investigation state, but it does not silently rewrite REIM or the evidentiary core. A revised classification requires an authorized recomputation or later versioned review process.

Relationship to Human Read and Chapter Synthesis

Human Read and chapter synthesis provide intelligible entry points into the evidence. They are not independent analytical authorities.

At the beginning or conclusion of a chapter, Aperture may present a compact synthesis identifying:

• the strongest supported findings;

• the evidence authority behind them;

• the REIM posture and relevant alternatives;

• contributing instruments;

• material source spans;

• the applicable confidence posture;

• missing or contradictory evidence;

• unresolved questions; and

• the boundary beyond which interpretation cannot proceed.

This synthesis must be derived from the Evaluation and Synthesis Layer, REIM, Human Read, and authorized evidence trails. It cannot create telemetry, introduce a new scientific finding, move a marker, or replace an unavailable result with prose.

The summary remains a navigational object. Every material statement must resolve backward into the evidence architecture.

Synthesis tells the operator what to inspect. It does not tell the evidence what to say.

Operational World Context

The same runtime may be investigated within software engineering, security operations, cloud infrastructure, workflow coordination, monitoring and reliability, agent-tool operations, support, validation, or another supported Operational World.

The Operational World Lens may change:

• terminology used to introduce a finding;

• questions emphasized first;

• recommended instrument sequence;

• operational examples;

• investigative context; and

• operator-facing explanatory emphasis.

It cannot change:

• source, canonical, run, or record identity;

• the canonical runtime;

• registered telemetry;

• temporal markers;

• Instrument Findings;

• regime or Basin Exit computation;

• evidence-basis or missingness state;

• REIM's canonical posture;

• claim boundaries;

• Evidence Seal; or

• Runtime Evidence Passport authority state.

The Operational World gives the investigation context. It does not give the canonical evidence a different identity or authority.

Relationship to the Adaptive Evidence Cockpit

Guided Investigation and the Adaptive Evidence Cockpit are related but distinct.

ArchitectureResponsibilityGuided InvestigationDefines chapter contracts, question structures, evidence routes, reversible trails, and operator-review boundaries.Adaptive Evidence CockpitDetermines how those structures are presented, prioritized, and navigated for a particular operator and context.

The cockpit may alter:

• recommended starting chapter;

• navigation emphasis;

• question order;

• explanatory depth;

• terminology;

• visible instrument priority;

• information density; and

• next-step guidance.

Guided Investigation preserves:

• chapter identities and contracts;

• evidence requirements;

• eligible methods and instruments;

• Instrument Findings;

• runtime coordinates;

• marker authority;

• source lineage;

• Passport references; and

• claim boundaries.

Guided Investigation structures the inquiry. The Adaptive Evidence Cockpit changes how that inquiry is presented. Neither changes the evidence.

Operator Judgment and Challenge

Guided Investigation supports human judgment; it does not automate it away.

The operator can:

• inspect evidence supporting a transition;

• compare findings across instruments;

• challenge a REIM posture or chapter synthesis;

• review unresolved or contradictory evidence;

• distinguish observed, computed, derived, projected, and interpreted material;

• add authorized investigative context identified as such;

• record an alternative interpretation;

• determine whether an operational conclusion requires external evidence; and

• decline to accept a conclusion that the record does not adequately support.

Operator annotations and decisions must remain distinguishable from canonical evidence. They may enter the investigation state or export envelope with their own provenance, but they cannot rewrite telemetry, markers, findings, or the Evidence Seal.

This is particularly important when the evidence establishes sequence or association without establishing cause.

Aperture may show that drift preceded a boundary transition, that role pressure accompanied instability, or that a tool loop persisted during a collapse-related interval. It cannot infer hidden intent, determine blame, or establish unique causation from those relationships alone.

Preserving the Investigation

During active analysis, the Current Evidence Run remains the computational authority and the Runtime Evidence Passport provides persistent evidence identity.

When the investigation is preserved, the Certified Runtime Evidence Record and its artifact may include:

• the canonical runtime;

• reconstructed worldline and runtime frames;

• authorized Instrument Findings;

• temporal markers and coordinate definitions;

• REIM posture and routing;

• synthesis and Human Read projections;

• chapter and review state;

• inspected evidence trails;

• operator-supplied context identified as such;

• alternative interpretations or unresolved contradictions;

• missing evidence;

• claim boundaries;

• Runtime Evidence Passport and Evidence Seal references; and

• preservation metadata.

Preservation does not certify that every operator interpretation is true. It records what was supplied, computed, routed, inspected, challenged, and claimed—together with the authority and provenance attached to each element.

Evidence Commons carries that lineage forward without converting investigation state into canonical evidence.

The Claim Boundary

Guided Investigation does not independently establish:

• hidden model state or private reasoning;

• intent, consciousness, cognition, agency, or identity;

• objective truth;

• root cause or universal causation;

• human or organizational blame or legal responsibility;

• official benchmark performance;

• universal safety, deployment readiness, or regulatory compliance;

• calibrated probability without applicable calibration;

• guaranteed future failure or recovery; or

• required operational action.

It routes the operator through evidence authorized to address narrower questions about observable longitudinal computational behavior.

The architecture may help the operator determine what the evidence supports. It does not determine what the operator or institution must decide.

The Architectural Contribution

Guided workflows, dashboards, and investigation checklists are not individually new. The contribution is their integration within a source-bound Runtime Evidence Observatory governed by one evidence identity and one claim-bounded authority architecture.

Within SubstrateX Aperture™:

• REIM routing remains distinct from investigative review;

• questions are connected to explicit evidence requirements;

• six canonical chapters examine the same reconstructed runtime;

• all nine instruments remain bounded by their contracts;

• chapter synthesis remains derived and navigational;

• every material statement retains a reversible source trail;

• Operational World context cannot modify computation;

• adaptive presentation cannot modify chapter contracts;

• unavailable evidence remains explicitly unavailable;

• operator challenge remains visible and attributable;

• Passport identity persists across every surface; and

• the completed investigation can be preserved with its provenance and claim boundary intact.

Guided Investigation therefore does more than make Aperture easier to use. It establishes the disciplined path through which complex runtime evidence becomes inspectable and understandable without becoming detached from its source.

The Governing Definition

Guided Investigation Architecture is the versioned, evidence-governed navigation system through which SubstrateX Aperture™ converts REIM routing and authorized runtime evidence into canonical investigation chapters, explicit question contracts, bounded instrument routes, reversible source trails, and preservable operator review—without allowing navigation, context, synthesis, or judgment to alter the evidence being examined.

Within the Engineering section, Guided Investigation follows Operational World Mapping and precedes the Adaptive Evidence Cockpit.

The sequence is deliberate:

Qualify the evidence → identify the record → contextualize the inquiry → investigate the evidence → adapt the presentation

SubstrateX Aperture™ does not merely show operators what its instruments found. It provides a governed path from investigative question to finding, from finding to source, and from source to the limits of what can responsibly be concluded.