Archive registry entry

LAW-113 — Incident Lag Law

Archive registry entry

LAW-113 — Incident Lag Law

Visible incidents are lagging indicators; early security tracks hidden debt, audit suppression, boundary drift, meaning collapse, and ring-down degradation before incident visibility spikes.

draftid: LAW-113version: 1.0.0updated: 2026-06-17

Archive Progress

This section can be read now; registry depth and cross-references are still being strengthened.

Foundation

Online

The section has a stable overview route and basic reader context.

Technical Layer

Online

A deeper technical overview is available.

Registry

Current

171 registry entries are available.

Cross-links

Curating

Related concepts are being connected conservatively for accuracy.

Jump Through This Page

LAW-112 — Security as Sustained Coherence Law

Registry

LAW-114 — Pseudo-Security Law

0. Plain Statement

Visible incidents are lagging indicators.

Plain-language version:

A security incident usually becomes visible after the system has already accumulated hidden debt.

The first sign of insecurity is often not the incident.

The first signs are boundary drift, audit suppression, misclassification, poor damping, recurring anomalies, hidden backlog, weak restoration capacity, and reduced observability.

By the time a visible incident appears, the system may already be late.

1. Formal Definition

The Incident Lag Law states that visible security incidents are often late-stage expressions of earlier coherence degradation.

Typical sequence:

textScroll

H↑ + ι↑ → O↓ → ε spikes late

Where:

hidden debt rises;
inversion or misclassification rises;
coherence declines;
visible error, incident, breach, failure, or disruption appears late.

Early security tracks leading indicators before incident visibility spikes.

These leading indicators include:

hidden debt;
audit suppression;
boundary drift;
observability collapse;
meaning collapse;
trust drift;
restoration backlog;
patch debt;
delayed response;
poor ring-down;
signal artifacts;
misclassification;
recurring anomalies;
alert fatigue;
feedback suppression;
degraded recovery;
increased containment without repair;
declining boundary clarity;
reduced operator slack.

The incident is not always the beginning of failure.

Often, the incident is the moment prior failure becomes visible.

2. Canonical Form

Core form:

textScroll

visible incidents are lagging indicators

Canonical sequence:

textScroll

H↑ + ι↑ → O↓ → ε spikes late

Early warning form:

textScroll

security risk rises before incident visibility rises

Pre-incident debt form:

textScroll

H_security↑ + BΣ drift + Au↓ + 𝓓↓ ⇒ incident probability↑

Failure form:

textScroll

incident absence treated as security proof ⇒ late detection + H↑

Restoration-valid contrast:

textScroll

security valid when leading indicators trigger repair before incident spike

Related variables:

textScroll

O, H, H_security, ε, ε_incident, ι, Au, Au_eff, µᵢ, BΣ, K, σ, R, R_eff, 𝓑, 𝓓, Φ, Λ, ⊗, Γ, Π, Ξ, ℛ, Θ, Σ, Ψ, Τ, FI, incident_visibility, incident_rate, incident_probability, boundary_drift, observability, detection_lag, response_lag, recovery_lag, patch_debt, restoration_backlog, anomaly_recurrence

Where:

TableScroll

Variable	Meaning in this law
`H_security`	Hidden security debt accumulated before visible incident
`ε_incident`	Visible incident, error, breach, failure, outage, harm, or disruption
`incident_visibility`	Degree to which incidents can be detected or observed
`incident_rate`	Visible incident frequency; lagging and visibility-dependent
`incident_probability`	Risk of incident given underlying debt and forcing
`boundary_drift`	Degradation of access, trust, coupling, consent, or membrane integrity before incident
`observability`	Ability to see system state before and during failure
`detection_lag`	Delay between incident occurrence and detection
`response_lag`	Delay between detection and containment / repair action
`recovery_lag`	Delay between response and restored coherence
`patch_debt`	Unresolved vulnerability, maintenance, or configuration debt
`restoration_backlog`	Unresolved repair load from prior incidents, harms, or drift
`anomaly_recurrence`	Repeating weak signals that precede visible incident
`O`	Coherence; tends to decline before incidents become visible
`H`	Hidden debt; rises before visible incidents
`ι / Ξ`	Inversion or misclassification that hides risk or normalizes drift
`Au / Au_eff`	Auditability; falling auditability increases incident lag
`BΣ`	Boundary integrity; drift raises incident probability
`𝓓`	Ring-down damping; poor damping indicates recovery weakness before incident spike
`𝓑`	Bandwidth headroom; low headroom increases detection and response lag
`R / R_eff`	Restoration capacity; low capacity turns small incidents into larger failures
`Φ`	Visible success proxy; low incident count may be a proxy artifact
`Γ`	Classifies anomalies, risks, signals, incidents, artifacts, and pre-incident debt
`Π`	Operationalizes monitoring, controls, triage, repair, patching, escalation, and prevention
`ℛ`	Repair action triggered before or after incidents
`Θ`	Humility preventing incident-absence overconfidence
`Σ`	Scope of security monitoring, threat model, and detection domain
`Ψ`	Field and affected-node feedback revealing weak signals
`Τ`	Time validation across recurrence and incident patterns

3. Core Mechanism

The law unfolds because visible incidents are usually late relative to underlying state degradation.

Coherent early-security pathway

textScroll

weak signals appear
→ hidden debt and boundary drift are tracked
→ auditability remains intact
→ anomalies are classified
→ repair activates early
→ incident probability falls
→ visible incident spike is avoided or reduced

Lagging-incident pathway

textScroll

hidden debt accumulates
→ auditability declines
→ boundary drift normalizes
→ anomalies are ignored or misclassified
→ restoration backlog grows
→ coherence declines
→ visible incident spikes late

The core mechanism is:

textScroll

incidents become visible after coherence has already degraded

Detailed mechanism:

Hidden debt accumulates.

Vulnerabilities, patch gaps, access drift, trust drift, alert fatigue, configuration drift, social engineering exposure, legitimacy debt, or recovery backlog rises.

Leading signals appear.

Anomalies, near-misses, degraded ring-down, failed reviews, repeated small errors, ambiguous alerts, user complaints, and boundary exceptions appear.

The system may misread quiet as security.

If visible incidents are low, the system may reduce vigilance, audit, or restoration.

Audit and classification degrade.

The system becomes less able to see or correctly classify pre-incident signals.

Incident probability rises.

The system becomes more brittle under adversarial or chaotic forcing.

Visible incident appears late.

By the time the breach, outage, harm, compromise, exploitation, or visible failure appears, the debt has often already matured.

Restoration must address pre-incident debt.

Repairing only the visible incident leaves the upstream conditions intact.

4. When This Law Applies

This law applies whenever a system uses visible incidents, alerts, breach reports, outages, failures, complaints, claims, harm reports, or public disruptions as the primary indicator of security.

It is especially important when:

incident counts are low;
incident visibility is uncertain;
monitoring coverage is incomplete;
boundary drift is normalized;
near-misses repeat;
anomaly recurrence increases;
patch debt grows;
auditability declines;
operators are overloaded;
detection lag increases;
response lag increases;
recovery lag increases;
restoration backlog grows;
compliance status is treated as security proof;
leadership asks, “Where are the incidents?”;
user harm reports are delayed or suppressed;
AI systems show low visible error while hidden evaluation debt rises.

The law applies strongly when:

textScroll

security is judged by visible incident count alone

or when:

textScroll

leading indicators worsen while incidents remain visibly low

Typical domains:

TableScroll

Domain	Incident Lag Expression
AI systems	Visible AI failures are late; leading indicators include audit gaps, drift, refusal inconsistency, memory errors, boundary ambiguity, and user correction load.
Cybersecurity	Breaches and outages often follow patch debt, access drift, observability gaps, weak detection, and unprocessed anomalies.
Institutions	Public scandal or complaint spikes are late signals of prior hidden debt and suppressed feedback.
Medicine / biology	Acute symptoms can be late expressions of prior compression, signal drift, barrier failure, or recovery debt.
Economy	Crashes, defaults, or shocks often appear after hidden leverage, externalities, and circulation debt accumulate.
Governance	Crisis incidents often reveal earlier legitimacy, justice, or audit failures.
Culture	Visible rupture often follows long-normalized harms, meaning drift, and memory failure.
Security operations	Incident response should track leading debt variables, not only tickets and visible breaches.

5. When This Law Does Not Apply

This law should not be used to ignore incidents or treat visible incidents as unimportant.

Incidents matter.

They are often urgent.

They create real repair obligations.

The law says incidents are usually late, not irrelevant.

False-positive cases:

TableScroll

Case	Why incidents still matter
Active breach is occurring	Immediate containment is required
Harm is visible	Repair and support must activate
Incident rate rises	Visible spike may indicate debt has crossed threshold
Incident count falls after repair	Lower incidents can be meaningful if visibility remains intact
A single incident reveals systemic debt	Incident should be used as diagnostic entry point
An incident is isolated and well-contained	It still requires learning and recurrence validation
Near-miss occurs	Near-miss should trigger repair before visible failure escalates

Important distinction:

Incidents are important signals, but they are not early enough to be the only security signal.

6. Diagnostic Signature

Canonical diagnostic:

textScroll

H↑ + ι↑ → O↓ → ε spikes late

Warning signature:

textScroll

incident count low
confidence↑
auditability↓
boundary drift↑
patch debt↑
anomaly recurrence↑
restoration backlog↑
⇒ incident lag risk

Common indicators:

TableScroll

Diagnostic	Expected movement	Interpretation
`H_security`	should be tracked early	Hidden security debt precedes visible incident
`boundary_drift`	↑ before failure	Membranes degrade before incident
`Au / Au_eff`	↓ raises lag	Weak audit hides pre-incident debt
`observability`	↓ raises lag	System cannot see failure forming
`incident_visibility`	must be known	Low incidents may mean low visibility
`incident_rate`	lagging	Visible count is not early proof
`incident_probability`	↑ with debt	Risk rises before visible event
`detection_lag`	should ↓	Faster detection reduces damage
`response_lag`	should ↓	Faster response reduces cascade
`recovery_lag`	should ↓	Faster recovery indicates better restoration
`patch_debt`	should ↓	Patch debt predicts incidents
`restoration_backlog`	should ↓	Unresolved repair predicts recurrence
`anomaly_recurrence`	should trigger Γ + ℛ	Repeating weak signals require classification and repair
`𝓓`	should remain strong	Poor ring-down predicts incident escalation
`Φ`	not sufficient	Quiet dashboards are not proof
`Τ`	required	Time validates whether leading indicators improve

Additional diagnostics:

TableScroll

Diagnostic	Use
Incident Lag	Detects reliance on lagging incident visibility
Pre-Incident Debt	Measures debt before visible failure
Hidden Debt	Tracks accumulated risk under quiet surface
Boundary Drift	Detects membrane degradation
Audit Suppression	Detects loss of traceability
Meaning Collapse Risk	Detects mission or security purpose drift
Ring-Down Degradation	Detects poor recovery after activation
Early Warning Integrity	Tests whether weak signals trigger repair
Detection Quality	Tests whether security can see events early
Temporal Proof	Validates early repair through reduced recurrence

7. Failure Pattern

If ignored, this law allows a system to remain confident until the failure is already mature.

General failure pathway:

textScroll

incident count appears low
→ security confidence rises
→ audit and repair slack decrease
→ hidden debt accumulates
→ boundary drift and anomalies normalize
→ coherence declines
→ visible incident spikes late
→ response becomes reactive and costly

Common failure modes:

Incident Absence Error — no visible incidents is treated as security proof.
Late Incident Detection — the system detects failure only after damage spreads.
Pre-Incident Debt Accumulation — hidden risk grows before incident visibility.
Boundary Drift — access, trust, consent, or interface boundaries degrade.
Audit Suppression — traceability declines before incident.
Observability Collapse — the system cannot see its own pre-failure state.
Misclassification Drift — weak signals are classified as noise or acceptable variance.
Alert Blindness — signals exist but operators no longer trust or process them.
Hidden Compromise — compromise exists before visible incident.
Pseudo-Security — quiet surface hides declining coherence.
Security Theater — visible security activity masks weak leading indicators.
Restoration Lag — repair begins only after visible incident.
Ring-Down Collapse — recovery worsens before incident spike.
Incident Shock — visible event causes surprise because leading indicators were ignored.
Recurrence Persistence — same class of incident repeats because pre-incident debt remains.

Compact failure signature:

textScroll

incident_visibility low + H_security↑ ⇒ late ε spike

8. Restoration Implications

Restoration requires shifting security from incident-count monitoring to leading-indicator repair.

The first restoration question is not:

textScroll

How many incidents did we have?

The first restoration question is:

textScroll

What hidden debt, boundary drift, audit gaps, recurrence signals, and restoration backlog existed before the incident became visible?

Restoration priorities:

Audit incident visibility.
Identify pre-incident debt.
Map boundary drift.
Map observability gaps.
Map anomaly recurrence.
Measure detection, response, and recovery lag.
Repair patch debt and restoration backlog.
Restore auditability and feedback integrity.
Trigger repair from leading indicators.
Validate that incident probability and recurrence decrease over time.

Relevant restoration arcs:

TableScroll

Restoration Arc	Why it applies
Pre-Incident Debt Reduction	Repairs debt before visible incident spike
Boundary Drift Repair	Restores membrane integrity before compromise
Auditability Restoration	Restores traceability of early signals
Observability Restoration	Improves visibility of forming failures
Detection Quality Repair	Improves early incident detection
Misclassification Repair	Corrects weak-signal classification
Ring-Down Stabilization	Improves recovery from small activations
Incident-to-Restoration Sequencing	Routes visible incidents into upstream repair
Restoration Capacity Increase	Builds capacity for early repair
Early Warning Restoration	Restores attention to leading indicators
Hidden Debt Reduction	Repairs upstream debt
Temporal Validation	Confirms recurrence and incident probability decrease

Minimal restoration sequence:

textScroll

audit incident_visibility
→ map H_security + boundary_drift + Au gaps
→ classify anomalies and recurrence
→ repair patch_debt + restoration_backlog
→ restore BΣ/Au/FI
→ reduce detection/response/recovery lag
→ validate ε recurrence↓ over Τ

Temporal validation requirement:

textScroll

incident visibility becomes known
pre-incident debt decreases
boundary drift decreases
auditability improves
anomaly recurrence triggers repair
detection lag decreases
response lag decreases
recovery lag decreases
restoration backlog decreases
incident recurrence decreases
coherence holds under forcing

9. Design Rule

Do not wait for incidents to prove insecurity; track and repair the debt that precedes them.

Operational design requirements:

Track hidden security debt.
Track boundary drift.
Track auditability.
Track observability.
Track anomaly recurrence.
Track patch debt.
Track restoration backlog.
Track detection lag.
Track response lag.
Track recovery lag.
Track ring-down quality.
Treat low incident visibility as uncertain, not proof.
Trigger repair from leading indicators.
Investigate near-misses.
Validate recurrence reduction over time.

Avoid:

low incident count as security proof;
dashboard quiet as proof;
compliance as proof;
ignoring near-misses;
suppressing weak signals;
reducing audit because incidents are low;
treating user complaints as noise;
waiting for breach before repair;
incident-only security posture;
measuring only detection after the fact;
repairing the visible event while ignoring upstream debt;
AI safety claims based only on low observed incident count;
security narratives that cannot explain leading indicators.

10. Cross-Scale Expressions

TableScroll

Scale / Layer	Expression of the Law
U0 — Substrate	Material, biological, infrastructure, and ecological failures often become visible after prior degradation.
U1 — Energy / capacity	Low slack, operator overload, and resource debt precede visible incident.
U2 — Boundary / interface	Boundary drift precedes unsafe coupling, compromise, leakage, or breach.
U3 — Process / execution	Process gaps, patch debt, queue failures, and delayed response precede incidents.
U4 — Classification / claim	Misclassification of weak signals lets debt mature into visible incidents.
U5 — Time / delay	Incident visibility lags behind debt accumulation and forcing.
U6 — Field effect	Field incidents reveal prior coherence loss.
U7 — Recurrence / memory	Repeated weak signals and near-misses should become memory and prevention.
U8 — Environment / forcing	Adversarial, chaotic, market, cultural, institutional, AI, and media environments shape incident lag.

11. Examples

Example A — Breach After Boundary Drift

Scenario:

A breach appears sudden, but audit shows months of access exceptions, stale accounts, weak review, and ignored alerts.

Law expression:

textScroll

BΣ drift + Au↓ + H_security↑ ⇒ breach appears late

Interpretation:

The breach was the visible late expression of prior boundary and audit debt.

Example B — Low Incidents Because Low Visibility

Scenario:

An organization reports few incidents, but logs are incomplete, user reporting is difficult, and operators are overloaded.

Law expression:

textScroll

incident_rate low + incident_visibility low ⇒ security unknown

Interpretation:

Low visible incident count may reflect poor observability rather than safety.

Example C — AI Safety Incident Lag

Scenario:

An AI system appears safe in visible reports, but user correction load, refusal inconsistency, memory errors, and classification drift are rising.

Law expression:

textScroll

AI Γ drift + user correction load↑ ⇒ visible AI incident lag

Interpretation:

Visible AI failures may appear late after hidden classification and boundary debt matures.

Example D — Institutional Scandal

Scenario:

A scandal becomes public suddenly, but internal complaints, turnover, quiet settlements, and audit gaps existed for years.

Law expression:

textScroll

suppressed feedback + H↑ ⇒ scandal ε spike late

Interpretation:

The public incident was late-stage legibility of prior hidden debt.

Example E — Medical Acute Event

Scenario:

An acute flare or collapse appears sudden, but prior signals included fatigue, tolerance decline, poor recovery, recurring inflammation, and reduced slack.

Law expression:

textScroll

σ↓ + 𝓓↓ + recurrence↑ ⇒ acute event appears late

Interpretation:

The visible event may be a lagging indicator of earlier compression and poor damping.

Example F — Coherent Leading Indicator Security

Scenario:

A security team tracks near-misses, patch debt, access drift, detection lag, response lag, recovery quality, and recurrence. Repair activates before visible incidents spike.

Law expression:

textScroll

leading indicators trigger ℛ before ε spike ⇒ security holds

Interpretation:

Incident lag is reduced when leading indicators route into repair.

12. Relationship to Nearby Laws

TableScroll

Related Law	Relationship
LAW-001 — Coherence Priority Law	Incident response must preserve coherence
LAW-002 — Coherence Trajectory Law	Incident trends must be read as trajectory
LAW-003 — Success Proxy Divergence Law	Low incident count may be proxy divergence
LAW-004 — Stability-Coherence Separation Law	Quiet surface can hide insecurity
LAW-006 — Time Validation Law	Time reveals incident lag and recurrence
LAW-007 — Ring-Down Truth Law	Poor ring-down is a leading indicator
LAW-008 — Recurrence Validation Law	Recurring anomalies validate risk before incident
LAW-009 — U4 / U6 Truth Law	Incident claims require field validation
LAW-010 — Hidden Debt Accumulation Law	Hidden debt rises before incidents
LAW-011 — Hidden Debt Return Law	Incidents are one return path of hidden debt
LAW-012 — Error Lag Law	Incident lag is the security-specific expression of error lag
LAW-013 — Auditability-Debt Law	Low auditability increases incident lag
LAW-015 — Suppressed Auditability Debt Law	Suppressed audit hides pre-incident debt
LAW-016 — Inversion Formation Law	Security meaning can invert to protect quietness
LAW-019 — Coupling Outpaces Components Law	Coupling expansion creates incident debt before visible failure
LAW-020 — Bandwidth Threshold Law	Operator overload increases detection lag
LAW-023 — Restoration Capacity Load Law	Restoration backlog predicts incident recurrence
LAW-024 — Latency–Gain Oscillation Law	Poor latency and high gain worsen incident response
LAW-030 — Slack Sovereignty Law	Low slack precedes incident escalation
LAW-031 — Observability Collapse Law	Poor observability hides incidents and leading indicators
LAW-036 — Signal Artifact Law	Weak signals must be distinguished from artifacts
LAW-037 — Misclassification Law	Misclassified anomalies mature into incidents
LAW-040 — Filtering Law	Filtering errors hide or amplify pre-incident signals
LAW-041 — Boundary Membrane Law	Boundary drift precedes security incidents
LAW-048 — Feedback Integrity Law	Feedback reveals weak signals before incident
LAW-052 — Stability Proof Law	Security must survive perturbation before incident occurs
LAW-057 — Deception Instability Law	Deception creates hidden incident debt
LAW-064 — Restoration Debt Reduction Law	Incident repair must reduce upstream debt
LAW-066 — Restoration Capacity Sufficiency Law	Sufficient restoration capacity reduces lag-to-recurrence
LAW-067 — Temporal Proof Law	Incident reduction requires proof over time
LAW-112 — Security as Sustained Coherence Law	LAW-113 specializes security measurement around incident lag
LAW-114 — Pseudo-Security Law	Incident lag enables pseudo-security
LAW-115 — Surveillance–Restoration Law	Sensing must route leading indicators into restoration
LAW-116 — Emergency Normalization Law	Late incidents can trigger overbroad emergency response
LAW-117 — Shadow–Light Security Law	Shadow analysis identifies pre-incident pathways
LAW-118 — Empathy Security Law	Empathy improves state estimation before incident
LAW-119 — Basin Self-Defense Law	Basins may suppress weak signals until incident shock
LAW-120 — Security Legibility Law	Leading indicators require traceability
LAW-122 — AI Error Lag Law	AI visible errors are late indicators
LAW-123 — AI U4 Truth Discipline Law	AI incident claims require U6 validation across time
LAW-130 — AI Membrane Triage Law	AI incidents can be triaged by the first membrane that failed
LAW-134 — Layered Interception Law	Layered interception catches weak signals before visible incident

Aliases folded into this law:

Incident Lag Law
Visible Incidents Are Lagging Indicators Law
Security Incident Lag Law
Incident Visibility Lag Law
Early Security Debt Law
Pre-Incident Debt Law
Lagging Incident Indicator Law

Deduplication note:

This law should remain the root security incident-lag law. LAW-012 defines error lag generally. LAW-112 defines security as sustained coherence. LAW-114 defines pseudo-security when incident absence is mistaken for security. LAW-122 specializes error lag for AI systems.

13. Operator Mapping

TableScroll

Operator	Role in this law
`Γ`	Classifies anomalies, weak signals, incidents, artifacts, boundary drift, debt, and recurrence patterns
`Π`	Operationalizes monitoring, logging, controls, patching, triage, escalation, response, and prevention
`Ξ`	Captures inversion when low incident visibility is used to suppress audit or deny debt
`⊗`	Incidents arise through unsafe coupling, boundary drift, and degraded interfaces
`ℛ`	Repairs pre-incident debt, incident effects, recurrence conditions, and restoration backlog
`Τ`	Validates whether leading indicators and incidents improve over time
`Θ`	Prevents overconfidence from low visible incident count
`Σ`	Defines monitoring scope, threat model, incident class, and detection domain
`Ψ`	Field and affected-node feedback reveals weak signals and hidden incidents
`Λ`	Tests compatibility between security posture and whole-system coherence

Coherent operator sequence:

textScroll

weak signal appears
→ Θ prevent incident-absence overconfidence
→ Γ classify anomaly / artifact / debt / recurrence
→ Σ define monitoring and threat scope
→ Au/FI preserve observability and correction
→ Π trigger triage, patching, and prevention
→ ℛ reduce pre-incident debt
→ Ψ validate field effects
→ Τ validate reduced ε recurrence

Inverted operator sequence:

textScroll

incident count low
→ confidence↑
→ Γ underclassifies weak signals
→ Au and observability decline
→ boundary drift normalizes
→ restoration backlog grows
→ H_security↑
→ ε spikes late
→ Ξ / ι↑

14. Machine-Readable Summary

yamlScroll

id: "LAW-113"
name: "Incident Lag Law"
type: "law"
status: "draft"
family:
  - "Security Laws"
summary: "Visible incidents are lagging indicators; early security tracks hidden debt, audit suppression, boundary drift, meaning collapse, and ring-down degradation before incident visibility spikes."
canonical_statement: "Visible incidents are lagging indicators."
core_form: "visible incidents are lagging indicators"
canonical_sequence: "H↑ + ι↑ → O↓ → ε spikes late"
early_warning_form: "security risk rises before incident visibility rises"
pre_incident_debt_form: "H_security↑ + BΣ drift + Au↓ + 𝓓↓ ⇒ incident probability↑"
failure_form: "incident absence treated as security proof ⇒ late detection + H↑"
restoration_valid_contrast: "security valid when leading indicators trigger repair before incident spike"
variables:
  primary:
    - "H_security"
    - "ε_incident"
    - "incident_visibility"
    - "incident_rate"
    - "incident_probability"
    - "boundary_drift"
    - "observability"
    - "detection_lag"
    - "response_lag"
    - "recovery_lag"
    - "patch_debt"
    - "restoration_backlog"
    - "anomaly_recurrence"
    - "O"
    - "H"
    - "ι"
    - "Au"
    - "Au_eff"
    - "BΣ"
    - "𝓓"
    - "R"
    - "R_eff"
  secondary:
    - "ε"
    - "µᵢ"
    - "K"
    - "σ"
    - "𝓑"
    - "Φ"
    - "Λ"
    - "⊗"
    - "Γ"
    - "Π"
    - "Ξ"
    - "ℛ"
    - "Θ"
    - "Σ"
    - "Ψ"
    - "Τ"
    - "FI"
diagnostics:
  - "Incident Lag"
  - "Pre-Incident Debt"
  - "Hidden Debt"
  - "Boundary Drift"
  - "Audit Suppression"
  - "Meaning Collapse Risk"
  - "Ring-Down Degradation"
  - "Incident Visibility"
  - "Early Warning Integrity"
  - "Detection Quality"
  - "Observability"
  - "Restoration Capacity"
  - "Feedback Integrity"
  - "Temporal Proof"
failure_modes:
  - "Incident Absence Error"
  - "Late Incident Detection"
  - "Pre-Incident Debt Accumulation"
  - "Boundary Drift"
  - "Audit Suppression"
  - "Observability Collapse"
  - "Misclassification Drift"
  - "Alert Blindness"
  - "Hidden Compromise"
  - "Pseudo-Security"
  - "Security Theater"
  - "Restoration Lag"
  - "Ring-Down Collapse"
  - "Incident Shock"
  - "Recurrence Persistence"
restoration_arcs:
  - "Pre-Incident Debt Reduction"
  - "Boundary Drift Repair"
  - "Auditability Restoration"
  - "Observability Restoration"
  - "Detection Quality Repair"
  - "Misclassification Repair"
  - "Ring-Down Stabilization"
  - "Incident-to-Restoration Sequencing"
  - "Restoration Capacity Increase"
  - "Early Warning Restoration"
  - "Hidden Debt Reduction"
  - "Temporal Validation"
related_laws:
  - "LAW-001"
  - "LAW-002"
  - "LAW-003"
  - "LAW-004"
  - "LAW-006"
  - "LAW-007"
  - "LAW-008"
  - "LAW-009"
  - "LAW-010"
  - "LAW-011"
  - "LAW-012"
  - "LAW-013"
  - "LAW-015"
  - "LAW-016"
  - "LAW-019"
  - "LAW-020"
  - "LAW-023"
  - "LAW-024"
  - "LAW-030"
  - "LAW-031"
  - "LAW-036"
  - "LAW-037"
  - "LAW-040"
  - "LAW-041"
  - "LAW-048"
  - "LAW-052"
  - "LAW-057"
  - "LAW-064"
  - "LAW-066"
  - "LAW-067"
  - "LAW-112"
  - "LAW-114"
  - "LAW-115"
  - "LAW-116"
  - "LAW-117"
  - "LAW-118"
  - "LAW-119"
  - "LAW-120"
  - "LAW-122"
  - "LAW-123"
  - "LAW-130"
  - "LAW-134"
related_invariants:
  - "INV-001"
  - "INV-002"
  - "INV-006"
  - "INV-073"
  - "INV-078"
operator_sequence:
  coherent:
    - "weak signal appears"
    - "Θ prevent incident-absence overconfidence"
    - "Γ classify anomaly / artifact / debt / recurrence"
    - "Σ define monitoring and threat scope"
    - "Au/FI preserve observability and correction"
    - "Π trigger triage, patching, and prevention"
    - "ℛ reduce pre-incident debt"
    - "Ψ validate field effects"
    - "Τ validate reduced ε recurrence"
  inverted:
    - "incident count low"
    - "confidence↑"
    - "Γ underclassifies weak signals"
    - "Au and observability decline"
    - "boundary drift normalizes"
    - "restoration backlog grows"
    - "H_security↑"
    - "ε spikes late"
    - "Ξ / ι↑"
aliases:
  - "Incident Lag Law"
  - "Visible Incidents Are Lagging Indicators Law"
  - "Security Incident Lag Law"
  - "Incident Visibility Lag Law"
  - "Early Security Debt Law"
  - "Pre-Incident Debt Law"
  - "Lagging Incident Indicator Law"
deduplication_note: "Root security incident-lag law. LAW-012 defines error lag generally. LAW-112 defines security as sustained coherence. LAW-114 defines pseudo-security when incident absence is mistaken for security. LAW-122 specializes error lag for AI systems."
source: "content/archive/laws/technical.md"

15. Compact Card Version

LAW-113 — Incident Lag Law

Visible incidents are lagging indicators.

Core form:

textScroll

visible incidents are lagging indicators

Canonical sequence:

textScroll

H↑ + ι↑ → O↓ → ε spikes late

Plain meaning:

A visible incident often appears after hidden debt, boundary drift, audit suppression, misclassification, poor damping, and restoration backlog have already accumulated. Low incident count is not security proof unless visibility and leading indicators are intact.

Pre-incident debt form:

textScroll

H_security↑ + BΣ drift + Au↓ + 𝓓↓ ⇒ incident probability↑

Failure form:

textScroll

incident absence treated as security proof ⇒ late detection + H↑

Primary variables:

H_security, ε_incident, incident_visibility, incident_rate, incident_probability, boundary_drift, observability, detection_lag, response_lag, recovery_lag, patch_debt, restoration_backlog, anomaly_recurrence, O, H, ι, Au, Au_eff, BΣ, 𝓓, R, R_eff, Γ, Π, ℛ, Θ, Σ, Ψ, Τ

Diagnostic signature:

Incident count appears low while confidence rises, auditability falls, boundary drift increases, patch debt grows, anomaly recurrence rises, and restoration backlog increases. This indicates incident lag risk.

Failure risk:

Incident absence error, late incident detection, pre-incident debt accumulation, boundary drift, audit suppression, observability collapse, misclassification drift, alert blindness, hidden compromise, pseudo-security, security theater, restoration lag, ring-down collapse, incident shock, recurrence persistence.

Restoration priority:

Audit incident visibility, map pre-incident debt, boundary drift, audit gaps, and anomaly recurrence; repair patch debt and restoration backlog; restore boundary integrity, auditability, and feedback; reduce detection, response, and recovery lag; and validate reduced incident recurrence over time.

LAW-112 — Security as Sustained Coherence Law

Registry

LAW-114 — Pseudo-Security Law