Discovery and confirmation

Discovery asks what might work. Confirmation asks whether one frozen, distinct claim survives evidence that discovery could not inspect.

The firewall

Discovery, corpus retrieval, synthesis, triage, and repair cannot read reserved confirmation data. Confirmation receives a frozen claim and executable specification; it cannot revise the idea after seeing the reserve.

Single-use confirmation

The reserve for a claim is consumed atomically. Repeated peeking is refused. Before any consumption, Penrose checks whether the confirmation cohort can resolve the declared effect. If not, it returns cannot_confirm and leaves the reserve untouched.

Generated candidates

Generated hypotheses are unanchored discovery artifacts. They are capped below the strongest verdict until independently confirmed. A generator cannot promote its own candidate or approve it at P9.

Human review

Even a successfully confirmed research-supported claim remains a research result. P9 is a human authorization boundary, not a statistical gate and never an automated deployment step.