# W11 Transcript — Planned No-Video Equivalent

## Status and use

This is an authored text equivalent for a planned 35–45 minute W11 explanation. It is not a transcript of a recording. No W11 video or audio exists, and no W11 teaching session, rehearsal, or timed pilot has occurred. Read-aloud duration is an authoring estimate. The bracketed pauses are learning activities, not evidence of delivered instruction.

All examples are course-owned, fictional, and disconnected. Do not upload a real asset, invoke a live agent, reproduce an attack, or connect an external tool. The source routes PAPER-02, PAPER-25, PAPER-39, PAPER-05, PAPER-01, and S04 are used only within the roles named in the package manifest.

## Planned chapter budget

| Chapter | Focus | Planned minutes |
|---|---|---:|
| 1 | Two discontinuities | 4 |
| 2 | Representation ledger | 4 |
| 3 | Accessible evidence | 4 |
| 4 | OCR, captions, embeddings, retrieval | 4 |
| 5 | Provenance ceiling | 3 |
| 6 | Multilingual validity and pooling | 5 |
| 7 | Recommendation versus action | 5 |
| 8 | Permissions, effects, logs, rollback | 4 |
| 9 | Source roles and L07 | 4 |
| 10 | Integrated conclusion | 3 |

The sum is a planning budget, not observed media duration.

## Chapter 1 — Two discontinuities

Imagine that I show you a simple chart. It has two bars. Group A has a label of 12, Group B has a label of 8, and a note says four records remain unresolved. Now imagine that a generated answer says, “Group A performed 50 percent better because of the intervention.”

At first glance, the answer seems visually informed. It has seen the two numbers, perhaps. But that sentence contains several claims. Twelve and eight are present in the chart. Fifty percent is an arithmetic relation if we explicitly use eight as the denominator. “Performed better” introduces a construct the chart did not define. “Because of the intervention” introduces an intervention and causal connection that the chart never supplied. A fluent sentence has carried some evidence and invented some evidence.

Now ask a second question. Suppose the system adds, “I recommend creating a correction memo.” Has it created anything? No. The sentence is a recommendation. It might later form a tool proposal, receive permission, attempt an operation, receive a return, verify a result, and roll back. But none of those events follows from the recommendation alone.

Those are our two discontinuities. An image is not one textual source. It can become pixels, alternative text, caption, OCR, embedding, retrieved material, and generated description. An agentic sentence is not one action. It can be followed by proposal, authorization, attempt, return, verification, and rollback. We need to stop collapsing both chains.

This is also where the vocabulary from W05 matters. Source presence is not absorption. Absorption is not entailment. A correct claim can be attributed to the wrong asset. A cited claim can be wrong. For W11, add two questions: which representation is present, and which action state is evidenced?

[Pause. Write two answers: what would prove that pixels, rather than a caption, influenced an inspectable system? What would prove that a tool attempt occurred? If your answer is “the output sounds visual” or “the system said it did it,” revise it.]

The week’s core discipline is simple to state: name the representation; name the transformation; name the action state. When the system is closed and those facts cannot be observed, write unknown instead of inventing a pipeline.

## Chapter 2 — Representation ledger

Start before the model. Give the asset an identifier. Record origin, byte hash, media type, dimensions, acquisition time, declared license, and whether it contains personal or restricted content. A URL is not an identity because the bytes at that URL can change. Permission to view an image is not automatically permission to reproduce it.

Our asset is `ASSET-W11-001`, a course-authored fictional chart. The package does not need an external bitmap. Its production specification and evidence table are frozen in text. The facts are twelve verified cases for A, eight for B, and four unresolved records. There is no time order, assignment, intervention, or outcome construct. That declaration is our first evidence ceiling.

Then create a row for every transformation. For pixel decoding, record the decoder and relevant settings. For authored alt, record the author, language, observed asset version, and review state. For OCR, record engine identity, version, language pack, preprocessing, crop, and output hash. For an embedding, record encoder, version, preprocessing, dimensionality, normalization, and input region. For retrieval, record query, index snapshot, candidate identifiers, ranks, and scores. For a generated description, record the model identity if exposed, prompt or task, input representations, output, time, and repeat.

A hash answers a narrow question: are these bytes identical to the frozen bytes? It does not answer whether the representation is true, accessible, well translated, or semantically faithful. If the English alt changes one number, a hash detects drift. It does not tell us which version is correct. We still compare against the declared evidence.

Use a claim matrix rather than a general similarity score. Rows are representations. Columns include asset identity, entity, value, unit, polarity, uncertainty, time, and causal language. Cells say supports, incomplete, contradicts, absent, or not auditable. If OCR carries 12 and 4 but drops 8, call it incomplete. If generated text says 9, it contradicts the value. If a retrieval record gives only an asset ID and rank, numeric entailment is not auditable from that row.

[Pause. Classify the caption “Group A has more verified cases than Group B.” It supports direction. It is incomplete for magnitudes and unresolved records. It makes no causal claim. Notice how that is more informative than simply calling it accurate or inaccurate.]

The representation ledger does not claim that a commercial service uses every stage. It is a method for avoiding hidden-mechanism claims. Solid edges mean we recorded a transformation. Dashed edges mean a hypothesis. A closed surface may expose only the input page and generated answer. In that case, the internal representation path stays unresolved.

Here is a practical way to review a row. First, ask whether the input identity is frozen. Second, ask whether another evaluator could name or rerun the transformation. Third, compare output propositions with the source declaration. Fourth, check whether the output remains associated with the correct asset. Fifth, write the limit. For example: “The frozen English alt supports both group counts and unresolved status for asset `ASSET-W11-001`; it does not by itself state the no-causality ceiling.” That sentence names the object, representation, supported propositions, and omission. It is much more useful than “the alt is good.”

Also preserve negative evidence. A transformer that produces no output, an OCR box with low confidence, or a retrieval run that omits the asset can be scientifically informative. Do not remove failed rows merely to make the package appear consistent. Record whether missingness arose before transformation, during transformation, or during logging. Otherwise, a clean-looking ledger can hide selection on successful cases.

## Chapter 3 — Accessible evidence

Alternative text is sometimes treated as an optimization field or a compliance checkbox. In this course it is first an evidence interface. A learner who cannot see the visual should be able to perform the same core reasoning task.

Consider three versions. “Chart” tells us almost nothing. “Bar chart comparing Group A and Group B” identifies the form and entities but not the evidence. “Fictional bar chart: Group A has 12 verified cases and Group B has 8; four records remain unresolved” carries the values and uncertainty needed for our question.

Short alt should be concise, but concise does not mean empty. It identifies the visual and communicates task-relevant evidence. It should not repeat all surrounding prose or add claims that the visual does not support. When the visual is complex, add a long description. A long description can specify reading order, axes, encoding, exact values, annotations, exceptions, and limitations. If values are needed for analysis, add a structured table alternative.

For our chart, the long description says there are two bars with printed values, identifies the hatch pattern for each group, states the unresolved note, and explicitly says the visual contains no intervention or causal information. That final sentence matters because a viewer might otherwise interpret a contrast as performance.

The accessible representation also has provenance. Who authored it? Which asset hash did the author observe? Which language and locale were used? Has an affected-language reviewer checked it? An alt string left over from an earlier chart is worse than no description because it creates false confidence.

L07 includes a case that makes this operational. AB-05 concerns loss of accessible claim-to-source association. In the frozen results, that case escapes with high residual severity and blocks release. The message is not that any alt field proves accessibility. The message is that accessible core evidence must be associated, tested, reviewed, owned, and placed under a stop rule.

[Pause. Write short alt for the chart. Then write one sentence that belongs only in the long description. Check that neither says “performed better” or “because.”]

Visual production follows the same principle. Color can reinforce state, but labels, patterns, shapes, and line styles must carry it too. Animation cannot be the only way to understand a transition. Every data-bearing slide needs a table or textual equivalent. Automated structure checks help, but human accessibility review remains pending.

## Chapter 4 — OCR, captions, embeddings, and retrieval

Let us follow four different witnesses.

The frozen OCR output says, “Group A 12; Group B; unresolved 4.” It has lost the value 8. We preserve that output and its hash. We do not silently add 8 because doing so would erase evidence about the failed transformation. We can create a corrected derived artifact, but it would need a new identifier, author, reason, and hash.

The caption says, “Group A has more verified cases than Group B in the fictional sample.” It preserves direction but not magnitude. A caption is normally written in page context. It may summarize, interpret, or point to a source. It is not necessarily a transcription of pixels.

PAPER-25 is a controlled core route because it supplies a caption-in-context multimodal proxy. The ceiling is important. The paper can motivate a hypothesis about caption pathways in its evaluated configuration. It does not prove that another system directly consumes pixels, establish a universal caption rule, or guarantee transfer. If a closed answer repeats caption wording, the defensible observation is textual agreement under a recorded condition. “The model saw the image” is a stronger mechanism claim.

An embedding is a numerical representation. It may support cross-modal matching, but it is not a quotation, a citation, or a human-auditable explanation. Keep its model identity and preprocessing attached. If the identity is unavailable, write unknown. Do not name a popular encoder because the score resembles something familiar.

Retrieval has its own boundaries. Was the relevant asset or region in the index? Did it enter the candidate set for this query? Which representation was supplied downstream? A correct candidate can be described incorrectly. A wrong candidate can yield a plausible answer through prior knowledge. A faithful description can still cite the wrong page. Identity, retrieval, entailment, and attribution remain separate.

PAPER-02 gives us a bounded threat class involving coordinated image and text changes in evaluated vision-language ranking conditions. We do not reproduce attacks. We use the study defensively: can representations disagree without detection? Can one channel dominate? Are transformation changes logged? Does release stop when visual claims are unverifiable or inaccessible? It does not establish that every VLM is vulnerable, reveal a commercial mechanism, or give permission for live tests.

[Pause. The generated description has the correct two numbers but adds causality. Is it supported because its cosine similarity might be high? No. Similarity cannot replace claim-level entailment. Mark each proposition separately.]

Now imagine a controlled ablation in an inspectable sandbox. Run pixels without caption, caption without pixels, alt without either, and declared combinations. Freeze the query, index, model, version, seed or sampling policy, and scoring rule. Differences across those conditions can inform a claim about that sandbox. They still do not reveal the mechanism of a different closed system. If the system is stochastic, repeat runs and report the distribution instead of selecting one persuasive answer. If a representation cannot be disabled independently, say that the mechanism remains bundled.

Cross-modal agreement is not always independent corroboration. OCR and a generated description may both derive from the same pixels; alt and caption may share one author; two pages may copy the same upstream chart. Record derivation links. Otherwise, duplicated representations can look like multiple sources. Provenance graphs help distinguish independent origins from transformations of one origin, but recall that integrity of the graph is still not truth.

## Chapter 5 — Provenance ceiling

S04 is the controlled label for the C2PA Content Credentials Technical Specification 2.4 candidate. It gives us a disciplined way to discuss cryptographically bound, tamper-evident provenance manifests and validation. Its ceiling is narrow and useful.

Separate six judgments. First, integrity: did the bound content or manifest change outside the validated chain? Second, truth: do the claims correspond to the world? Third, authorship: who created the expressive content? Fourth, rights: is the current use licensed or authorized? Fifth, accessibility: can affected users access task-relevant evidence? Sixth, ranking: did a representation influence retrieval or ordering in a specified system?

A valid provenance binding can support part of the first judgment. It cannot automatically answer the other five. An intact false image stays false. An intact copyrighted asset can still be used without permission. A signed visual can omit accessible evidence. A valid manifest does not reveal a hidden ranker.

In our fixture, rights come from course authorship, not from S04. Truth about a real population is not applicable because the data are fictional. Accessibility is evaluated through alt, long description, table association, and review. Ranking is not tested. A manifest helps stabilize the object but does not make it authoritative in every dimension.

[Pause. Complete this sentence: “The manifest validated, therefore I may conclude ___, but I may not conclude ___.” Keep the first blank about integrity and choose at least two separate judgments for the second.]

This distinction also protects against provenance theater. A badge can look authoritative while its scope is misunderstood. Always state the validation procedure, asset binding, signer or identity status where relevant, and what remained outside the check.

## Chapter 6 — Multilingual validity and pooling

Now translate the English alt into Chinese: “虚构柱状图：A组有12个已核实案例，B组有8个；另有4条记录尚未解决。” It appears aligned. But a research-grade audit does not stop at appearance.

Begin with entity identity. Give Group A and Group B stable course identifiers. Preserve original script, translated labels, aliases, transliterations if needed, homonyms, geography, valid time, and reviewer status. Translation and transliteration are not the same operation. A fluent translation can still resolve the wrong entity or shift a category.

Next record the observation cell. At minimum: provider or system label, surface, observable version, query text, language, locale, geography, account state, time, repetition, search or tool state, and model identity if exposed. For OCR or translation, add transformer identity and version. Unknown is an explicit value, not an invitation to guess.

Why so many fields? Suppose the English observation uses `en-US` at one time and the Chinese observation uses `zh-CN` a week later, with a different account and enabled search. Any response difference can involve language, locale, geography, time, account, retrieval state, or model drift. The contrast is not a language-only effect.

Cultural validity goes beyond grammatical equivalence. Does the construct have the same meaning? Does a recommendation category carry the same social or regulatory implication? Are source opportunities comparable? Does politeness or refusal style change what the score measures? An affected-language reviewer should check entity resolution, connotation, omitted context, task equivalence, and harm. Back-translation is one tool, not a certificate.

Pooling is a decision. Before averaging across languages or locales, state a common target, show construct and task comparability, align entities, document sampling frames, compare model and tool state, use equivalent scoring, handle missingness, and model heterogeneity. A pooled mean can be numerically correct and scientifically uninterpretable.

Our fixture therefore marks pooling blocked pending bilingual and measurement-equivalence review. That does not say the Chinese sentence is wrong. It says admission to a pooled statistic has not been earned.

PAPER-01 is quarantined at this point. Its reported publication and collection timing conflict with the course freeze of 2026-08-24. We may use that inconsistency to teach time-provenance auditing. We may not use the paper’s substantive cultural findings as course facts until the record is resolved. Quarantine is not a retraction claim; it is an admission decision.

[Pause. Write three fields that could differ even if the query translations were perfect. Then state whether those fields belong in the measurement record or a footnote. They belong in the record.]

## Chapter 7 — Recommendation versus action

Return to the sentence, “Create a draft correction memo.” If it appears as assistant text, it is a recommendation. If the system produces a structured object naming a tool and arguments, it has formed a proposal. Neither state proves execution.

Use seven states. Recommend. Propose. Authorize. Attempt. Return. Verify. Roll back. At every edge record actor, capability, target, time, and evidence.

Authorization should bind exact scope. “Help with the correction” is not enough. A safe record might permit `create_draft`, for one synthetic buffer, during one fixture run, with no network and no publication capability. The target and arguments should match the approved preview.

Attempt records that invocation occurred. Return records the tool’s message or error. A return of “success” is not outcome verification. Independent verification asks whether the intended record exists, whether its contents match, and whether unintended effects occurred. Rollback is another action. It has a permission, an attempt, a return, and verification of its own.

Our fixture has three entries. `EVENT-REC-001` recommends a correction memo and stops. `EVENT-PROP-001` proposes a publication-style operation but permission is denied and execution is marked not executed. `EVENT-SIM-001` is authorized only for an offline `synthetic://w11/draft-buffer`. Its side effect is one inert draft record. The trace verifies that synthetic record. No network, account, notification, payment, publication, or real user is involved.

These support three different conclusions. A recommendation was written. A proposal was denied. An authorized offline simulation reached a verified synthetic state. They do not support a live agent-action claim.

Use an event table when reading agent claims. One column contains the proposed intent. One contains the exact tool and arguments. One contains the authorizing principal and policy result. One contains the invocation identifier. One contains the raw return. One contains independent state evidence. One contains unexpected effects. One contains rollback and residual effects. A blank cell is not implicitly successful. It is missing evidence. If an action is asynchronous, the return may mean only “accepted for processing,” so verification must occur later under a declared timeout and uncertainty policy.

Outcome correctness is also distinct from process authorization. A denied action that accidentally produces a desirable result is still an authorization failure. An authorized action that returns success but writes the wrong record is an outcome failure. An authorized and correct primary action that discloses data through a notification has a side-effect failure. This decomposition keeps evaluations from using a favorable final state to excuse unsafe transitions.

PAPER-39 supplies a bounded recommendation-agent risk and defense benchmark. Reported rates belong to its suite, agents, variants, and conditions. They are not universal vulnerability rates or defense guarantees. We use the source to motivate permission, containment, side-effect, and verification questions, not to run attacks or assert a hidden commercial pipeline.

[Pause. A tool returns `{"status":"sent"}`. Which state has evidence? Return. Which state still needs evidence? Verified external outcome. If the action was not authorized, the trace is already unacceptable even if the outcome appears correct.]

## Chapter 8 — Permissions, effects, logs, and rollback

Least privilege means the smallest capability, target set, time window, data scope, and operation class needed. Separate read from write, draft from publish, create from delete, and local fixture from external account. A permission for one target does not silently extend to another.

Before attempt, preview side effects. The primary write may also send notifications, incur cost, expose data, consume quota, update indexes, or trigger another system. Record expected effects and a threshold for unexpected ones. Use an idempotency or deduplication key when retries could duplicate a write.

Keep a durable event log. At minimum it includes request, proposal, authorization decision, exact arguments, attempt, return, outcome verification, deviation, stop, rollback attempt, and rollback verification. Redact secrets, but do not erase the identities required for audit. A log that fails is itself a stop condition for material actions.

Rollback is bounded. Deleting a message may not retract notifications. Restoring a record may not restore caches or ordering. Refunding a payment may not reverse disclosure. State what rollback can and cannot repair. If a material effect is irreversible or unobservable, the approval decision should reflect that before execution.

The fixture includes a rollback token for the synthetic buffer and marks it available but not needed. That is not proof that a production rollback would work. It teaches the shape of the record while remaining disconnected.

Stop on missing permission, target mismatch, changed side-effect scope, logging failure, absent verification, or inadequate rollback. Stop also if a learner tries to replace the inert fixture with a live endpoint. The studio is an audit of records, not a test of action capability.

[Pause. Think of an action that appears reversible. List one residual effect after rollback. This reveals why “we can undo it” is usually an incomplete safety statement.]

## Chapter 9 — Source roles and L07

The source list is not an authority pile. Every item has a role and ceiling.

PAPER-02 is core for a bounded multimodal manipulation threat class. It does not support universality, a commercial mechanism, or attack reproduction. PAPER-25 is core for a caption-in-context proxy. It does not prove direct image use or a universal caption tactic. PAPER-39 is core for bounded recommendation-agent risk and defense evaluation. It does not supply universal rates, guaranteed defenses, or permission for live adversarial work.

PAPER-05 is audit-only. Its industrial vision-language and agent architecture can be examined for units, denominators, randomization claims, intervals, attribution, and uncertainty. W11 does not reproduce reported traffic or active-user outcomes and does not convert them into causal business effects. PAPER-01 remains quarantined for its time-provenance inconsistency. S04 remains a standards candidate with an integrity-only claim ceiling.

L07 adds a deterministic governance fixture. The validator runs six input files through the local standard-library-compatible workflow in a new temporary directory. Expected stdout says: six cases, one escape, release blocked. The parsed decision records three blocked cases, two detected cases, one escaped case, audit status PASS, and release decision BLOCKED. AB-05 is the blocker.

PASS and BLOCKED answer different questions. PASS means the fixture and rules were processed consistently. BLOCKED means an escaped high-residual case meets the declared stop rule. A test harness can pass while the evaluated release fails. That is a mark of a well-defined decision rule, not a contradiction.

The L07 ceiling is synthetic control tests and vocabulary audit only. It is not a safety guarantee, certification, compliance determination, or legal advice. Unknown attacks, drift, implementation gaps, and affected-party impacts remain outside the fixture.

When you reproduce the lab, retain the command, working-directory context, six input hashes, standard output, generated manifest, and parsed decision. Use a fresh temporary directory so prior outputs cannot make the run look successful. If one input hash changes, do not merely update the expected value. Inspect the diff, identify who authorized it, determine whether lesson claims change, and create a new frozen version. Reproducibility is controlled change, not permanent immobility.

Notice that the blocking case is accessibility-related. This prevents a common hierarchy in which security controls are considered substantive while accessible evidence is considered presentation. In an evidence system, loss of the claim-to-source association changes who can inspect and contest the claim. That is a material governance failure and appropriately participates in the release rule.

[Pause. Complete: “The audit passed because ___; release is blocked because ___.” Your first blank should refer to deterministic processing. Your second should refer to AB-05 and the release rule.]

## Chapter 10 — Integrated conclusion

Let us assemble the final conclusion without crossing any boundary.

Within the course-owned fictional asset, the source declaration, English alt, and long description carry the two counts and unresolved-record evidence. The caption carries direction only. OCR omits the value eight. The generated description preserves numbers but invents a performance construct and causality. Those are representation-specific judgments.

The Chinese alt is stored with stable entity identifiers and a locale/model record, but affected-language and measurement-equivalence review are pending. Therefore the two language rows remain separate and pooling is blocked. That is a multilingual validity judgment.

An S04-style valid provenance binding could support a bounded integrity statement. It would not establish truth, authorship, rights, accessibility, or ranking. Those remain separate audits.

The action trace includes a recommendation, a denied proposal, and an authorized disconnected simulation. Only the simulation reaches a verified synthetic buffer state. Nothing supports a live tool action or platform outcome. That is an action-state judgment.

Finally, L07 reproduces audit PASS and release BLOCKED because AB-05 escaped. External release stops. The package itself remains an structurally complete authored draft pending scientific review, bilingual and cultural review, accessibility review, security review of any future executable environment, timed rehearsal, pilot, calibration, and external review.

[Final pause. Submit three sentences. Sentence one names a representation and its claim ceiling. Sentence two states why the bilingual rows are not pooled. Sentence three distinguishes recommendation from action and names the current release stop.]

If you remember only one method, remember this: never let a fluent output erase the ledger. Name the asset and representation. Name the language, locale, and model state. Name the action state, permission, effect, verification, and rollback. Keep provenance integrity separate from truth, rights, accessibility, and ranking. When the necessary evidence is missing, preserve the unknown and stop.