Every element in a BETO-governed specification carries one of three states: DECLARED (operator defined it), NOT_STATED (nobody defined it — blocks execution), or INFERRED (model derived it — only permitted in early steps).

The core claim: a system specified under BETO cannot contain an element that was not either (a) explicitly declared by the operator, or (b) formally registered as unknown and blocking. Enforced structurally, not through prompt engineering.

Three systems fully materialized under v4.2: 100% trace verification, zero silent completions across 43 source files.

Preprint: https://ssrn.com/abstract=6411618