Inspectability is a ceiling on sophistication, and we have paid for it.

The constraint as a spec

If a competent operator cannot follow the arithmetic, it is out of scope.

Stated as a build rule rather than a value, the commitment reads: every number that influences deployment must be traceable by the person it governs, using the tools they already have, without taking anyone's word for it. That is a much stronger requirement than open source or documented behaviour. It rules out anything whose output is correct but whose derivation is only checkable in principle — which is most of the modern toolkit.

The specific trade

Hand-set parameters are worse than fitted ones, and they are what ships.

Take any threshold in the system — a sensitivity multiplier, a score cut point, a band boundary. A fitting procedure over historical trades would almost certainly find a value that performed better on that history than the one chosen by reasoning. That value does not ship. Partly because fitted parameters generalise badly, which is a real technical objection. But mainly because the operator cannot check the fit, so the number arrives as an assertion — and a number the operator cannot interrogate is the exact thing this system exists to refuse. The cost is accepted knowing a better number probably existed.

Why the ceiling is not a temporary limitation

It does not lift when the platform arrives.

It would be convenient to treat this as an artefact of shipping in a spreadsheet — something to be relaxed once there is a real application underneath. That is precisely the reasoning the constraint exists to block. A hosted product makes concealment easier, not harder: a figure rendered in an interface carries no visible derivation at all, and the temptation to substitute a better-performing opaque calculation is stronger when nobody can see the difference. The ceiling has to be carried forward deliberately, and it is the single most demanding thing the migration inherits.

What is not being claimed

Inspectable does not mean correct, and simple does not mean safe.

The constraint says nothing about whether the chosen thresholds are right. A visible, traceable, hand-set number can be badly wrong, and it will be wrong in full view — which is the point, but it is not the same as being accurate. The honest formulation is that inspectability makes errors findable rather than making them rare. A system with this property and no discipline about revisiting its parameters would simply be transparently mistaken for longer.

• Traceable arithmetic can still encode a bad judgment.
• The property makes errors findable, not less likely.
• It buys nothing without a schedule for revisiting what it exposes.

Where the line actually sits

Complexity is permitted. Concealment is not.

This is not an argument for simple machinery, and the system is not simple — the panels compute a great deal. The distinction is whether a determined operator with the documentation could reconstruct any given output by hand. Resampling fifty thousand paths is computationally heavy and entirely traceable, because the procedure is stated and every input is visible. A modest fitted model is computationally trivial and untraceable, because its parameters came from somewhere the operator cannot follow. Volume of arithmetic is not the test. Provenance of the numbers is.

The key idea

State the ceiling as a cost, or it is just a marketing claim.

Every product in this category says it is not a black box. The claim only means something if the firm can name what it declined to build because of it, and can say plainly that some of those things would have worked. The commitment is real to the extent it has been expensive, and it has been. What it buys is not a better instrument — it is an instrument whose authority survives the week the operator most wants to ignore it.