The Falsification Record

Four documents · which one you want

Rivering, step by step
the whole idea from nothing, in forty-two short steps. No prior knowledge. Start here if it is new to you.
Rivers and Their Direction
the reference. Every kind and archetype with its own rules, the ladder, the checklists. For looking things up once you know the idea.
What Rivering Proves
the technical companion. Which claims are theorems, which are empirical, which are only preference — and what would refute each.
The Falsification Recordyou are here
what we tried to break, what survived 270 real tables, and the four defects the testing found.

What is being claimed, and what isn't

A method that cannot be wrong is not worth having. So before any testing, the claims were separated by kind: which are theorems, which are empirical, which are heuristics, which are definitions, and which are merely policy. That separation lives in the technical companion.

This page is the other half: going and looking. A falsifier nobody attempts is decoration, and writing one down without trying it is worse than not writing it at all — it buys the appearance of rigour at no cost.

The claim, stated exactly

Two kinds — the river and the noun — held across 270 tables in one relational system and seven outside domains. Not that two is complete. That nothing has yet needed a third.

Those are different sentences and the difference is the whole point. The second is testable and was tested. The first is not available to anyone, on any evidence.

The archetypes are a different claim, and a smaller one. Branch and heartbeat of the river; state, summary and lock of the noun. They are open by design and have grown once, when the branch was added on 10 September. A new archetype refutes nothing. An archetype that belongs to neither kind would.

A note on dates. The run below was made on 8 September, when the list was still six flat kinds. It is reported as it was tested, with the two-kinds reading beside it. How the six became two is entry 06.

The run

One PostgreSQL database, 270 tables, 1.3 million rows in its largest. Every table through the ladder by machine, every fall-through read by hand.

270tables put
through the ladder

1fell through —
and it was debris

4defects found —
all in our own tools

65settled on a weak
signal — a human's job

The proposals the machine produced, in the six-kind terms it used on 8 September: noun 118 · river 82 · derived 34 · lock 28 · heartbeat 7 · unrivered 1. Read as two kinds, the same run is river 89 (heartbeat 7) · noun 180 (derived 34 · lock 28) · unrivered 1 — the branch did not exist yet. Those are a first pass to be confirmed, not a result — 65 of them rest on a single weak signal, and the tally was badly wrong until the fourth defect below was fixed.

The ledger

Each claim, the observation that would have refuted it, and what looking actually produced.

01 The list is complete — tested as six kinds Held

Refuted by: a table answering no to all six questions that is nonetheless settled as none of them.

Eight of 270 fell through on the first run. Read one by one: six were classifier misses — join tables, a settings row, a click log — each settling cleanly into one of the six kinds of the day once a person looked. One was genuine debris. One resisted, and is entry 02.

The list was not refuted. But the honest test is the first run, not the second: the classifier's signals were widened after seeing which tables fell through, and a re-run then left only the debris. That re-run checks the fix; it is not independent evidence.

Read in today's terms the result carries over unchanged. Every archetype holds exactly the rules its old kind held, so every table that settled into one of the six settled into a river or a noun. None came near being a third kind.

02 One table genuinely resisted Open

Table: tenant_order_counter(tenant_id, last_number, updated_at)

It hands out order numbers. Delete the row and the next order reuses a number already issued — a second action, which makes it a lock. But a lock is supposed to carry no cargo, and here the number is what's being claimed. A deli ticket machine that holds no number is not a ticket machine.

The cheapest reading sharpens the lock archetype's rule rather than adding a kind or an archetype: no cargo beyond the claim itself. It is a noun, and a lock. Recorded, not adopted. One row is not a pattern, and inventing a category from a single example is the mistake the list exists to prevent.

03 A lock never sits inside a river Violated in production

Looked for: uniqueness rules living on tables that are logs.

Found twice, in the most consequential table there is. contact_actions — the contact diary, 1.3 million rows — carries contact_actions_pathway_pending (unique on the journey step, where the row is pending) and contact_actions_idempotency_key_key, which is the documents' own “webhook already handled” example sitting in the exact place the documents forbid.

The rule was not refuted. The system was. That is the better outcome: a rule that finds something is worth more than one that agrees with everything.

04 The unit rule Held — instrument broke

Refuted by: a river with enormous rows-per-subject whose timeline is fine anyway.

The worst readings looked catastrophic — the diary at 595,089 rows per subject. Every one of them was measured against tenant_id, and a tenant is a scope, not a subject. Against its real subject the same table reads 83.

The rule survived. The instrument was pointed at the wrong column, and that produced the fourth defect below.

05 A river's subject is what its rows point at Earned its keep

Refuted by: nothing — it is a definition. Testable only for usefulness.

It did the work in entry 04. What tells you the 595,089 is noise is the subject test: remove the tenant from “Levan paid £240 for the coaching package” and the line still says something; remove Levan and nobody paid. Useful on 270 tables, and load-bearing on the one that mattered.

06 The list of six was arguing with itself Revised — 10 September

Refuted by: the list's own text, and one production finding that fitted none of the six.

The list was arguing with itself in two places. It said “a heartbeat is a river” — and then listed the heartbeat as a separate kind. And it needed a footnote to explain why state and summary did not contradict each other, because their rules were identical but one.

Then a production river turned up carrying page views, section views and content views — at 188, 106 and 24 rows per person, about 29% of the whole river. Each row plainly is a fact, so nobody could call them heartbeats. They fitted no kind, so nobody moved them. A thing with no name does not get moved.

The fix was structural, and no rule changed. The six collapsed into two kinds, the river and the noun. The heartbeat became an archetype of the river, and state, summary and lock archetypes of the noun, each carrying exactly the rules its old kind carried. The page views got a name of their own: the branch, a river's own water split off for volume.

Said plainly, because it matters: this revision came from reading the method against itself and from one production finding. It was not a new independent run. The 8 September ladder has not been re-run with the branch in it, and the branch is deliberately a person's call rather than the classifier's.

07 The cross-table checks find a second river Failed on a live database — 13 September

Refuted by: two tables recording the same fact about the same subject, in a rivered database, that the checks for exactly that did not flag.

Found by a user, not by the method. A funnel and an analytics page disagreed about how many people had seen a registration form. Two observers watched that form: the analytics beacon wrote the sighting into the person's diary, and the form's own widget wrote it into a side table keyed by browser id. Measured side by side: 17,435 browsers from 20 July in the side table, 11,182 in the diary from 6 August.

What was tried. Every table had been through the ladder, and the side table was classified correctly — a river, a branch, retention decided. The checks for this defect already existed: two rivers on one subject (C1), and a copy reaching further back than its original (C8). The rules that would have required the fix already existed too: the river gets the conclusion, and extracting detail incurs the debt of writing it.

Why nothing fired. The subject was read as “an anonymous browser — no table”. The method said to point at the noun the rows point at, and there was none, so C1 had no pair to compare. And no per-table question — which is all classification is — can see a relationship between two tables.

What survived: the two kinds, every archetype, every rule, and the classification of every table. What changed, none of it a kind: the subject survives identity resolution (a browser that resolves to a person is that person); a river has one door, pairing with “a copy has none”; and a write-site census — who writes each table, across all of them — now runs beside the per-table pass as check C12.

And the census failed its own first run, in the useful direction. It was given a known answer as its control — the diary has exactly one door, because a CI guard enforces it — and reported five. It was right; the guard allowed a folder of functions, not one. Said without softening: the river this method held up as its exemplar had five doors, and nobody knew until somebody counted. The belief came from reading a guard's name rather than its code. A rule that cannot be checked is not a rule; the census is what makes “a river has one door” checkable. The control's job is to prove the search can see, never that a door is unique. Its first run also missed a writer whose call was split over two lines, and was fixed. Re-counting with the sharpened subject also retired a finding the reference had carried since 5 September — twelve of thirteen rivers about a person reach the diary — which is now three of fifteen measured in full.

What broke — and it was mostly us

The run surfaced four defects, and every one of them was in the instruments rather than the method. One was bad enough to invalidate a headline number before anyone quoted it.

Worth stating plainly rather than dressing up: testing the method mostly caught us testing it badly. Which is still the point — a broken instrument reporting all-clear is indistinguishable from a healthy system.

The one that mattered

Measuring the unit against every foreign key instead of the subject classified a 1.3-million-row contact diary as a heartbeat — and inflated the heartbeat count from 7 to 46.

Had the report shipped on that run, it would have told its reader that a third of the system's logs were noise. The fix is derived rather than listed: a pointer that appears on most tables in the schema is a scope, not a subject. Here tenant_id sits on more than half of 270 tables and no genuine subject comes close.

The other three tool defects: a JSON check that crashed on every mixed column, because PostgreSQL does not promise to evaluate the parts of an AND in order; a timestamp check that required an enforced foreign key and was therefore blind to the audit log — the canonical river in the system, which has three id columns and zero constraints; and a unit figure reported for nouns, which have no unit at all.

Defects in the method itself came from a different exercise — writing the proofs, not running the tests. Four claims did not survive being stated formally: an overclaimed rule about nouns, a missing third shape for writing state, a definition of state that excluded the future, and a lock rule that turned out to be about robustness rather than correctness. Those live in the technical companion, and they are kept separate here on purpose: proving and testing catch different things, and a record that mixed them would overstate what the run found.

The pattern worth keeping

When this method fails, it fails at the questions and the instruments — not at the rules the categories carry. The one change to the categories themselves, six becoming two kinds, moved no rule; it moved where the rules live. That is where to look first next time.

The scale, measured rather than guessed

The unit rule used to end in a judgement: “the smallest thing a person would want to see on a timeline.” True, and unfalsifiable. It now ends in a number, and the number came from the run rather than from anybody's taste.

Across 77 rivers and heartbeats, the 99th percentile of rows per subject:

Across 77 rivers	rows / subject
median	19
75th percentile	72
90th percentile	202
95th percentile	953
worst	31,372

83% sit under 100. Only three of the seventy-seven cleared 1,000 — and all three turned out to be heartbeats rather than rivers. So the scale reads: under 100 is ordinary, 100–1,000 is worth a look, over 1,000 is almost certainly a heartbeat wearing a river's clothes.

A threshold picked from one system is still a threshold picked from one system. It is offered as calibration, not as a constant.

What can honestly be claimed

Claimable. Two kinds, the river and the noun, survived 270 tables in a real, messy, ten-year-old operational database and seven outside domains — accounting, inventory, bitemporal records, time-series, graph databases, warehouse schemas, document stores. The archetypes are open and grew once, by one: the branch. Everything else that did not fit became a mark, a rule, or a scoping question — never a kind. One table resisted and is recorded as open rather than explained away. The method found two live violations in the system it was pointed at.

Not claimable, and worth saying before somebody says it back to us:

— We tested our own method, with our own tool, against our own database. That is the weakest thing about this record and no amount of care inside it fixes that. Nobody else has run this on a system we have never seen.

— The classifier is a first pass, not a verdict. 65 of its 270 answers rest on a single weak signal, and it was wrong about 39 tables until a bug was found. It exists to shrink the manual pile, not to replace it.

— “Two is complete” remains unavailable. Seven domains is more than one and less than enough. The list can only ever accumulate failures to be refuted.

— The two-kinds revision was not a new run. It came from reading the method against itself and from one production finding (entry 06). The machine run above was made under the six-kind list, and its two-kinds reading is a translation, not a re-test.

— The outside domains were tested by reading, not by running. No accounting ledger or graph database was probed; their shapes were reasoned against published descriptions of how those systems are built.

— A rivered database is not a clean one. Entry 07: every table classified, correctly, and a second river still ran for two months. The census that now covers that gap has been run on one database, and it cannot see writes through dynamic accessors, variable table names, triggers, or other repositories.

What would change our mind

Stated in advance, because a prediction made after the fact is not a prediction.

A third kind — a table, in any system, that is genuinely settled, is not debris, and is neither something that happened nor something that is. One such table retires the number two.

An archetype that belongs to neither kind. New archetypes are expected; that is what open means. One that is neither a shape of the river nor a shape of the noun is a third kind by another name.

A third mark that isn't a kind in disguise. Two marks each changing exactly one rule is a pattern with two data points. A third would confirm the shape or expose it as coincidence.

A second river the census cannot find. Two tables recording one fact about one subject, in a system where every writer is visible to the census and every anonymous key has been resolved, and still no door count and no subject comparison flags them. That would mean the cross-table pass is blind in a way entry 07 did not reveal.

A river that is fine at scale. A log running well past 1,000 rows per subject whose users are content would break the unit threshold, though not the unit rule.

Two kinds that collapse into one. Completeness has been tested; minimality has not. The pull is real: every noun but the lock is derived from a river, so perhaps everything is the river. What holds them apart is that something must refuse, at the moment of writing, and a river only narrates what already happened. Whatever holds that rule is doing a noun's job. That is an argument rather than a proof. (The heartbeat, which once came closest to collapsing into the river, now sits inside it as an archetype — the revision agreed with that objection rather than refuting it.)

Why publish the failures. Every defect the run found was in our own instruments, one of them serious enough to have shipped a false headline. A record that reported only the survivals would be more flattering and worth nothing: the reader's question is not did it pass but was the test capable of failing it. Four defects and one open table is the evidence that it was.

If you run this on a system we have never seen and something falls through that is not debris, that is the most useful thing that could happen to it.