What is the third thing an honest record can say?

“I don’t know yet” is the most important truth value. A system that never overwrites has three honest things it can say. One of them is the answer a regulated audit can least afford to lose.

Put a witness under oath and you find the three quickly. Yes. No. And, when the witness is honest, I don’t know. The third is not a weaker answer than the other two. It is the answer that keeps the other two worth trusting, because a witness who will say “I don’t know” when he doesn’t know is a witness whose yes and no you can take to the bank. I mean, all things equal, of course.

Take that third answer away, force him to choose between the first two on pain of contempt, and you have not made him more decisive. You have made him lie, once in each direction, every time he does not know.

A software system that records the world in a single truth-value, true or false, one bit, has no way to say not yet known. When a fact has not arrived, or has arrived along one axis of time but not the other, the bit still has to be something, and something defaults to false. So the system reports false when it means I have not been told yet. Those are the two states a regulated audit must never confuse. False is the world saying no. Not yet known is the world not having spoken. A record that collapses the two will, under audit, produce a no it never had grounds for.

Keeping two clocks is frugal

Here is where it bites, drawn from the mortgage-underwriting example in the research note (PLRN #18).

A compliance agent has to certify that an applicant’s debt-to-income ratio stayed within the regulatory limit across the last thirty days. Twenty-nine of those days are on record, within limit. The thirtieth is a federated (i.e., coming from another system) fact still in flight; the feed that carries it simply has not landed.

A two-valued system has to call the month false: not covered, therefore violated. It has just manufactured a compliance violation out of a slow data feed. And a manufactured violation is not free. It fires an alert, it opens a case, and now a person has to spend an afternoon discovering and then proving that the thing which never happened never happened, and unwinding the record that says it did happen. That’s a “cost of doing regulated business” that’s entirely avoidable.

WunderOS calls that month undef (i.e., I don’t know yet) and holds it there. When the late day lands, the answer resolves on its own, and no human was ever paged to clean up after a feed that ran three hours behind. _The savings is real, probably undetectable, and in aggregate at scale is considerable.__

But let’s not be too pie-in-the-sky, huh?

The fair (but wrong) objection is that a third value sounds like a hedge, a way for a system to duck a question it ought to answer. It would be, if we had bolted it on. We did not, and WunderOS can hold that third answer where a two-value system cannot, for reasons built into the substrate rather than painted on top of it.

The difference between native-born agentic and legacy retrofit real-world consequences that matter.

You have to get this right at the beginning

WunderOS never overwrites. A single bit is already spent on true-or-false; it has nowhere to put not yet. Because the WunderOS record is append-only, a fact, a later correction of it, and the gap where nothing has yet landed all sit on the record together, each stamped with its own time. There is room for the honest third answer because nothing is ever destroyed to make room.

Since WunderOS keeps two clocks, not yet known is not a vibe the system is enacting, but a timestamp that does not exist yet. A fact can already be true in the world while the moment of the system’s learning it has not arrived, because, for example, the feed carrying it has not landed. The debt-to-income month reads undef for exactly that reason: the thirtieth day’s world-time may be settled, but its arrival-time has not happened, and because WunderOS records the two separately it can point at the gap instead of guessing, rightly or wrongly, across it.

The answer is then forced, not chosen. There is a body of theory, approximation-fixpoint theory, for computing exactly what follows from what you know and no more, when what you know is incomplete. For this reason WunderOS’s evaluator runs AFT. Undef is the answer it is compelled to give at precisely the points where deciding either way would mean inventing information the system does not have. And WunderOS carries that answer as a real value through every query it serves, rather than flattening it back to a bit the moment the next layer asks, which is what keeps I don’t know yet from quietly decaying into no one join downstream.

In this way WunderOS is by design as much a strict truth-teller as LLMs are sycophantic enablers.

That is why the third value and two clocks are one commitment seen twice. A system with one clock has to overwrite, and a system that overwrites has to pretend it always knew. A system that never overwrites can afford to admit the gap between what is so and what it has been told, and building the whole substrate around never having to pretend is what lets WunderOS answer for itself under audit.

If you only remember one thing…

So here is the one sentence I hope you carry out: an audit can trust this system’s *no* precisely because the system was never forced to fake one.

The full account, the three values worked against every temporal operator of a single loan, and why false and not yet are packed into different bytes on purpose, is at pentad.ai/PLRN/018, sections five and six especially.