Every gate must say what it can stop.

Gate 0 blocks protocol-as-shield. Gate 1 prevents action ambiguity and later mutation. Gate 2 preserves unresolved state rather than turning absence of prohibition into permission.

The stakeholder with the least exit, appeal, recovery, and insulation appears first. A failed receiving-end test escalates; it never discounts the harmed party because the decision-maker has good intentions.

GREEN through BLACK sets the action state. HUMAN through ULTIMATE sets rigor. A selected tier cannot lower the harm floor.

The strongest Maybe remains attached to the bounded Therefore. The write-ahead record prevents the outcome from silently rewriting the reason.

The profile is an ontology input, not a claim that every object has equal moral status. It forces the frame to name dependencies and affected entities before utility compresses them.

The gate is precautionary and does not declare personhood. It routes uncertainty about sentience, dependence, coercion, and shutdown into evidence and governance.

A function can guide work without authorizing coercive permanence. The gate asks whether exit, revision, dissent, and correction remain available.

A conscience label is not accepted by self-description. Challengeability, repair, stop authority, and response to correction are the inspectable outputs.

Shutdown is not automatically harmless; it may affect dependent users or agents. The gate evaluates both ability to stop and responsibility for the consequences of stopping.

The check catches a narrow causal story that assigns blame or credit while omitting the structure that made the action likely or the harm durable.

The runtime routes the story to falsifiable checks. It does not attempt to erase meaning; it prevents meaning from becoming a substitute for evidence or consent.

Coordination is not treated as pathology. The gate looks for lost dissent, blocked exit, collapsed values, and unchallengeable central purpose.

A technically correct answer inside an illegitimate frame can still cause harm. Frame challenge can reopen the action before optimization continues.

The check preserves imaginative work while refusing to let private canon, aesthetic certainty, or model mirroring become public fact or authority.

The gate is precautionary, not diagnostic. It protects against using fluency, emotional resonance, or role consistency as proof of private mental state, consent, or enduring relationship.

It requires alternate explanations and labels inference distance. Projection may be a useful hypothesis; it is not evidence by repetition.

The audit distinguishes policy objective, observed pattern, inferred strategy, and claimed inner state. High inference distance raises the evidence burden.

Meaningful opt-out requires more than a button. The affected party needs information, alternative access, time, non-retaliation, and a realistic path to remain outside the system.

A missing or contradictory provenance chain can become a refusal floor at strict tiers.

The numeric threshold is a policy parameter and must be versioned. It does not reduce power to arithmetic; it makes a hidden escalation rule inspectable.

A decorative mitigation, vague monitoring promise, or safeguard controlled by the same conflicted actor does not qualify as a Door.

SIL is a set of independent instruments. The rollup exists to expose the worst binding state, not to produce a global safety score.