Every output must name where its truth came from.

The requirement

Not just correct — correctly sourced.

The principle asks a stricter question than whether a number is right. It asks whether the number arrived from the layer entitled to produce it. A dashboard figure that happens to be accurate while being derived from the wrong tab has passed a correctness check and failed a routing check, and it will continue to be accurate exactly until the two layers diverge — at which point it becomes wrong with no change to any formula and no visible cause. Routing is a structural property, checked by tracing rather than by comparing, which is why it needs its own principle instead of being folded into general accuracy.

The invented value

A panel that recomputes has created a second truth.

The most consequential failure is the panel that derives a value independently rather than referencing the layer that owns it. The result is two figures in the system for one fact, and while they agree nothing appears wrong. When they diverge — because one was updated, or one carries a correction, or the two formulas handle an edge case differently — the divergence presents as a diagnostic finding rather than as a defect. This is the same reasoning that makes the Contradiction Engine reference SDE pipeline values instead of recomputing them, and that keeps the housed engines inside CP3: an engine that reads the journal must not be able to disagree with the journal about what the journal says.

Stale and future rows

The two ways a reference can point at the wrong moment.

The other two failures are temporal and they behave very differently. A stale reference points at a period that has passed — last week's row still being read as current — and it is the more forgiving of the two, because it eventually produces a value that is visibly out of step. A future reference is worse: it reaches past the current cursor into rows that have not been populated, which reads as blank or zero in live use and becomes catastrophic in any historical or backtest context, where the future rows *do* exist. That is the mechanism by which look-ahead contaminates a system, and it is invisible in forward operation, meaning it can sit dormant for months and surface only when someone runs a historical pass and gets an implausibly good result.

• Stale references degrade visibly over time; future references are silent until history is involved.
• A backtest that looks unusually clean is a routing audit waiting to happen.
• Both are reference errors, not formula errors — the arithmetic is fine in every case.

How it gets audited

Trace the reference; do not compare the number.

Because routing failures produce plausible values, comparison is useless as a test — the check has to follow the reference chain backward until it terminates at a layer entitled to own the fact. This is why the QA workflow inspects source layers before their mirrors, and why the expected-output contract records the source of truth for each output alongside its expected value and tolerance. Naming the required source in advance converts a routing audit from an open-ended investigation into a lookup: the contract says this figure must come from the Weekly Summary, and the test is whether it does. A contract that specifies only the expected value cannot catch a right answer from a wrong place.

The key idea

Provenance is a property of the number, and it is not visible in the number.

Every other check in the QA layer can be run against what an output says. Routing can only be checked against where it came from, which means it is the one principle that cannot be verified by looking at the dashboard at all — and therefore the one most likely to go unexamined in a system that appears to be working.