The Personal Model Must Be Visible

Chapters 24–27 built things the user authorised: communication policy, current modes, friction contracts, portable boundaries. But a second body of state has been accumulating alongside them — quieter, inferred, unexamined: what the system believes about the person. Probably-knows-cosine-similarity at 0.72. Prefers-tables-for-comparison at high confidence. Working on project X. Each belief shapes what appears, collapses, suppresses, or prioritises. None was ever shown. Portable authority without visible internal state leaves a hidden decision-maker inside the mediator — and this chapter removes it:

Any persistent belief about the user that can materially change what the system shows, suppresses, prioritises, or how it communicates should be inspectable, evidence-linked, correctable, and revocable.

Policy is authority the user granted. The model is inference the system holds. The namespaces stay visibly separate — “prefer tables for benchmarks (user-authored)” beside “probably already knows cosine similarity (interaction evidence, confidence 0.72)” — because confusing them launders guesses into commands. The system must never display an inference as though the user declared it: that is provenance fraud at the UI layer.

Entries with provenance and consequence

Every model entry carries evidence, uncertainty, scope, and — the chapter’s law — downstream consequence:

PersonalModelEntry {
    proposition · kind · scope · state · confidence
    evidence[] · created_at · last_confirmed · expiry
    downstream_uses[]
}

Kinds run EXPLICIT / DEMONSTRATED / INFERRED / UNCERTAIN / STALE, and the showing that matters names what the belief does: “introductory embedding explanations are collapsed; beginner material deprioritised” — with correct, show-anyway, stop-using, show-evidence attached. A visible model must expose both provenance and consequence; description without consequence is transparency theatre. Visibility, however, authorises nothing retrospectively: an inspectable, editable inference the system should never have created or retained is still unauthorised — editability is remedy, not permission. Entries therefore carry purpose, allowed uses, and expiry alongside evidence, and the rulings that matter most are conservative by default: high-impact, low-confidence states never act aggressively merely because they sit visible somewhere — the less likely an inference is to be inspected, the more conservative its default consequences. The demand is real, not hypothetical: Starke et al.’s cross-country contestation study (Information, Communication & Society, DOI 10.1080/1369118X.2024.2363926 — verified authors/venue/OA record; participant counts and opt-out fractions as user-supplied pending full-text access) finds meaningful appetite for contesting personalised systems including outright opt-out — contestability as interaction capability, not explanation garnish. Wozniak et al. (part-read, numbers held) adds that editable representations can beat opaque histories on quality, so visibility need not trade against performance; the federated user-controlled recommender line (UMAP 2025, user-supplied, pass verification) points the same way architecturally.

Traces, counterfactuals, and locality

“Why am I seeing this?” assembles the book’s accumulated evidence into one causal chain — subscription relation, task relevance, novelty, knowledge state, resolution, mode, presentation rule, and the specific model assumptions used, each inspectable — replacing “because this is relevant to you” with an auditable derivation. Beyond correction (wrong / scoped / downgraded / stop-using / forgotten), the chapter adds counterfactual inspection: personalised versus generic views, with-belief versus without-belief — the on/off-toggle literature’s point (Grafenstein et al., Telematics & Informatics Reports, verified by citation record) that comparison teaches what confidence numbers cannot. Organisation follows decision scope (KNOWLEDGE / COMMUNICATION / PROJECTS / SUBSCRIPTIONS / UNCERTAIN ASSUMPTIONS), never person-summaries — Chapters 22–24 killed the About-You profile and it stays dead; sensitive personality summaries appear only if a specific feature deliberately requires them. Propositions stay scoped and evidential: “evidence suggests you can currently explain cosine similarity in technical discussions” with evidence, scope, and last-confirmed attached — never bare “you know embeddings.” Corrections inherit Chapter 24’s locality (fixing Git-debugging terseness must not retune all explanation), and a health view (CONFIRMED/UNCERTAIN/STALE/CONFLICTING/UNUSED counts) surfaces high-impact low-confidence entries first — the dangerous ones. EXP-28 additionally measures errors detected without visiting the model UI, harm accrued before correction, behaviour under never-inspected models, unauthorised inference/retention cases, and broad-versus-scoped proposition accuracy — repair speed stays the headline; trust stays refused.

Testing repair, not trust

EXP-28 freezes the personalisation engine, plants deliberate model errors (false-known concepts, overgeneralised preferences, stale tasks, wrong projects, phantom interests, scope errors), and compares A hidden model through E evidence-bearing model with consequence trace and counterfactual preview. Headline: how quickly and locally can a user detect and repair a personalisation error before it propagates — detection and correction rates, time-to-repair, downstream repair, collateral and over-broad corrections, false confidence, change attribution, generic-restorability, unresolved hidden errors. “Trust” is refused as the metric; trust can rise for bad reasons, and a liked transparency screen that leaves errors propagating is a failure. Failure criteria: E ties B/C on repair (visibility/editability decorative); corrections propagate globally (locality broken); counterfactuals unused or misleading (comparison theatre); hidden-error residue equal across conditions (the dangerous state stays hidden everywhere). Artifacts: error-injection packs, repair traces, locality maps, residue audits. What success would not justify: assembly into a coherent Personal AI — visibility of state is not coherence of system, and Chapter 29 earns that separately.

Explicit policy, conditional learning, temporary modes, deliberate friction, portable boundaries, and now a visible personal model: the remaining question is whether these mechanisms still behave coherently when they all act at once.

References

• Starke, C. et al. Contesting personalized recommender systems (Inf., Comm. & Soc., DOI 10.1080/1369118X.2024.2363926). Verified authors/venue/OA; counts as user-supplied pending full text. Used: contestation appetite.
• Grafenstein et al. On/off personalisation comparison (Telematics & Informatics Reports, S2212473X25000586). Verified by citation record. Used: counterfactual-inspection precedent.
• Wozniak et al. (part-read, numbers held); UMAP federated (user-supplied, pass verification): architectural direction only.
• Ch 15 knowledge states; Ch 24 locality/exceptions; Ch 27 receipts: reused as model machinery.

Proposed experiment EXP-28: contestability under error injection

Status: PROPOSED. Per the design above (A–E, six error classes, repair-speed/locality headline, trust refused).