PM-DET-0020

A State Restriction and a Derivation expression MUST NOT read the wall clock, a random source, a hostname, an environment variable, process state, or any value outside the model and the object data supplied to the evaluation. All temporal comparison MUST be against a time supplied as data.

Non-normative: DESIGN because no source says it. Nothing in the blog or the claims prohibits any of this, and each one silently destroys the property PM-DET-0010 describes. The sources cannot be blamed for the omission — they are a blog and a patent, not an implementation spec — but an implementation that inherits the silence will not be deterministic, and will appear to be for a long time before anyone notices.

The floating-point exclusion is the least obvious and the most likely to be argued about. Decimal arithmetic with a declared rounding mode is required; IEEE binary floats make a comparison's result depend on platform and evaluation order.

Derivation kind five — "external objects required by the object behaviour" (PM-DRV-0020) — is the hole this assertion has to close. As written it permits an arbitrary call into a foreign system in the middle of a state computation.

The sources' own worked Derivation violates this assertion, in both of its two rows. The Derivation table (IMG:derivation-garantees-states) gives exactly two formulas:

| Derivation | Formula | Writes | |---|---|---| | CreatedDate Default Value | afn:now() | createdDate | | CreatedBy Default Value | pmda:User() | createdBy |

afn:now() is the Apache Jena ARQ function that returns the current wall-clock time. pmda:User() returns the identity of the acting user. Both are ambient inputs: neither is a function of the model or of the object data, and replaying the same event sequence produces different stored data every time.

This is the most important thing found in the images so far, and it is not a misunderstanding on Guil's part. Stamping createdDate and createdBy is what every business application does, it is obviously useful, and there is no other construct in PCIML in which to put it. The method needs the capability. What it lacks is any separation between "a Derivation that computes from data" and "a Derivation that captures ambient context".

So this assertion is not withdrawn — it is the right engineering requirement, and PO-0004 is unachievable without it — but it now has a known cost, and the cost must be stated rather than discovered:

Adopting PM-DET-0020 means diverging from the sources' worked example. The divergence that preserves the capability is to make ambient values inputs to the event rather than calls inside the Derivation: the event carries the timestamp and the acting agent, the Derivation reads them as data, and replay supplies the recorded values. That is the same feature with a determinism-preserving shape, and it is a DESIGN decision we are making rather than a reading of the sources. It needs an ADR before the kernel is written, and Q-G-0034 asks Guil whether ambient formulas were intended to be the general case or just a convenience for these two audit fields.

---