03 — how confidence is constructed
Confidence does not come from the model. It is built from two separate witnesses.
भरोसा मॉडल से नहीं आता। वह दो अलग गवाहों से बनाया जाता है।
Confidence is not read off the model — see §04 for why it cannot be. It is constructed here, from two signals that fail independently.
signal aCross-pass consensus
दो पढ़ाई की आपसी सहमति
The page is read twice from genuinely different pixels — not the same read asked for a different output format, which returns the same wrong number serialised differently. Two readings are paired on the line text with the digits stripped out: the amount is precisely what is in dispute, so it must never drive the match. Where they disagree, both survive in competingReadings and the entry is not resolved.
signal bThe arithmetic already on the page
जो जोड़ दुकानदार पहले ही लिख चुका है
Line items that sum to a written total mutually confirm each other — three figures agreeing is stronger evidence than any single read, and it costs nothing because the owner wrote the total anyway. A mismatch does not condemn the page; it localises which group is wrong.
They are never wrong together — which is why there are two.
दोनों एक साथ गलत नहीं होते — इसीलिए दो हैं।
A confidently misread digit sails through consensus and breaks the arithmetic. A page whose written total is itself wrong sails through the arithmetic and breaks nothing else. The two signals catch different failures, which is the only reason two are worth having. A value that fails either one is a card, not a balance.
what the two signals produce
✓verified · पक्काBoth passes agree, or the page’s own total confirms it
₹14,200
plain numeral · no chrome
≈uncertain · जाँच चाहिएThe two passes differ, or the sum does not reconcile
≈approximately, unverified: ₹9,120
≈ prefix · dotted underline
▨unreadable · पढ़ा नहीं गयाNot legible — deliberately not guessed
▨रकम पढ़ी नहीं गई
numeral suppressed entirely
Colour is never the only carrier. Every state also has a glyph and a distinct numeral treatment, so it survives deuteranopia, greyscale printing, and a cracked screen in daylight. The three figures above are illustrative of the treatment, not measurements.
what happens once there is a second page
Checking one page is easy. The real work is matching it against every page before it.
एक पन्ना जाँचना आसान है। असली काम पिछले पन्नों से मिलाना है।
Carry-forward, checked not copied
Page 2 opens with रमेश का पुराना हिसाब 1200. Sathi does not accept it — it checks that figure against the balance it computed for रमेश from page 1. They do not match.
≈approximately, unverified: ₹1,900≈delta · fired
carry-forward mismatch across the two pages · the card carries its crop
Two names queued, not resolved
Below the identity floor Sathi asks. Both questions look alike and are not: बबूल / बबलू are two spellings on the page — an answer merges a customer across every page. रमेश / रेशम is one line two passes read differently — an answer must fix that entry and nothing else.
treating the second as the first absorbed राकेश’s real ₹400 into रमेश’s balance · DECISIONS D40
The same entry, written twice
An entry copied onto consecutive days is never caught by hand, because nobody re-reads forty pages. Duplicate detection runs after every ingest and each hit carries both source crops and the delta it would move.
no count quoted here — the only count on record was measured on a fixture pair the demo no longer uses, and a superseded number is still a wrong one
Resolution runs the other way too: answering the page-1 card moves the page-2 carry-forward delta from ₹1,900 to ₹1,700 on screen. Corrections are written down and the superseded reading stays distinguishable from the current one — see scripts/verify_api.ts and DOCS/DECISIONS.md D33, D40.