One hundred and four system shapes. Every one of them runs.

Agent-in-a-Directory

An agent is not a process you configure — it is a directory. The folder holds the identity file, the equipped skills, and everything the agent has made; hand that folder to a fresh model process and the process is the agent.

• The body is built from a template with the agent’s id rendered into it; skills and rules are equipped into its loadout folder, which is the runtime’s native convention, so nothing has to be injected into a prompt.
• Embodiment is a socket: binding a runtime to the directory sets that runtime’s working directory, and the loadout is picked up on tool use. Two different runtimes embody the same body identically.
• Rehydration is the same call on an existing body — which is what makes the directory the identity rather than a workspace the identity happens to use.

Runs in cave-teams

The Blackboard Arena

Not a dataflow shape. N autonomous agents, one persistent shared state, one adjudicator — coordinating indirectly through the environment rather than by passing each other messages, with a single atomic write path between the proposals and the state.

   round N
   [ agent a ]     [ agent b ]     [ agent c ]     each reads the CURRENT
        |               |               |          board and proposes,
        '-------.       |       .-------'          concurrently, blind
                v       v       v                  to the others
              ( THE MUTATOR )   the ONE write path. all world-logic
                |         |     lives here; agents only ever propose
         accept |         | refuse -> ValueError, logged as world
                v         |           exhaust. the arena survives
          { THE BOARD }   |           and the round continues
                |  '------'
                v
          ( THE ADJUDICATOR )   reads the board, may rewrite it,
                |               may set the stop flag
                '--> next round, until rounds run out or stop is set

• Agents never write. They emit a proposal; the mutator applies proposals serially and is the only code that touches state. That is what makes a rejection survivable instead of a crash.
• A refusal is data. The rejected action is logged, and the offender’s only penalty is the progress that did not happen.
• The arena is itself a composable unit, so arenas nest inside arenas.

Runs in cave-teams

Reset / Carry / Ratchet — the epoch boundary

An epoch boundary is not a reset. It is a three-way typed partition of the world’s state, and one of the three moves in only one direction — which is what turns “when do we stop” into a condition inside the world instead of the operator’s patience.

   season N                  THE BOUNDARY               season N+1

   { spendable currency }  -->  RESET   to the floor  -->  { at the floor }
   { earned state:        }  -->  CARRY   by default   -->  { still there  }
   {   reputation, records }      a reset must be NAMED
   { the valuation standard } --> RATCHET monotonically --> { tighter }

   the SAME agents cross the boundary. the bar they are judged
   against never comes back down, so the next epoch is harder
   than the one they just survived.

• Carry is the default and reset is the exception, stated explicitly per field. The direction of that default is the whole design: forgetting has to be argued for.
• The ratchet is on the standard, not the score. Nothing an agent earned is taken away; what changes is what counts as good.
• It composes: a season wraps an arena, and a season is itself a unit, so a whole seasoned world drops into any slot that takes one agent.

Runs in cave-teams

GameWorld = season(blackboard(...))

A whole game world as one composable object: a program and a class. Everything a sprawl of shell scripts and a giant shared state file used to do collapses into two primitives wrapped in each other.

   GameWorld
   +-------------------------------------------------------------+
   |  season( arena, advance = reset / carry / ratchet )         |
   |                                                             |
   |    +-----------------------------------------------------+  |
   |    |  blackboard( [ agents ] <-> { state } <-> referee,  |  |
   |    |              mutator = THIS game's rules )          |  |
   |    +-----------------------------------------------------+  |
   +-------------------------------------------------------------+

   one class, so a world is:
     instantiable   many worlds from one definition
     data-driven    from_spec(spec) is a mode-to-economy compiler
     subclassable   a specific game fixes its own economy + ratchet

• The only game-specific part is the mutator. Everything else — rounds, the board, the epoch boundary, the adjudicator seat — is reusable control machinery.
• The world is a value, not a script. It has a constructor, so you can hold ten of them, diff them, and pass one as an argument.

Runs in cave-teams

World-as-Agent — the closure law

Pick one carrier type and close every operator over it, and composition recurses for free: a whole simulated world satisfies the agent contract, so a world is an agent and nests inside another world at any depth. The interface between levels is a single projection function, not a protocol.

   OUTER WORLD
   +-------------------------------------------------------------+
   |  [ agent ]   [ agent ]   [ -- an entire inner world -- ]    |
   |                       +----------------------------------+  |
   |                       |  [a] [b] --> ( inner mutator )   |  |
   |                       |        { inner board }           |  |
   |                       |        ( inner referee )         |  |
   |                       +----------------------------------+  |
   |                                    |                        |
   |        derive_action: collapse the whole inner run          |
   |        down to ONE outer move                               |
   |                                    v                        |
   |                           ( outer mutator )                 |
   +-------------------------------------------------------------+

   proven three levels deep: the inner world's earnings become its
   single move in the middle world, which surfaces in the outer one.

• The same carrier type all the way down. Sequence, parallel, choice, gate, team — every operator consumes and produces it, which is why nesting needs no adapter layer.
• Level-crossing is one function you supply: given the inner world’s finished board, what single action did it just take? Change that function and the same inner world means something different upstairs.
• The same law at the small scale: in the compiler, every operation consumes and produces a skill directory, so a composite is the same kind of thing as a step.

Runs in cave-teams, chaincompiler

The Skillcraft Market World

A world whose economy manufactures honest signals about which agent work is worth anything: agents craft real files, cannot list one without a test record, and the only way a skill acquires value is that a peer pays for it. A referee applies selection pressure from above.

• The embodiment is real files. Crafting writes an actual skill document; a passing test mints an actual test record; buying moves the file to the buyer. Nothing is a counter pretending to be a transaction.
• The guards are on the mutator, not in the briefing. Listing checks that the file exists and that a test record points at that specific file; you cannot buy your own listing; a quest’s reward is read out of the quest file, so an agent claiming a bigger payout gets the file’s number.
• Auditing the economy is a priced move. A player can file a bug report against the rules of the game they are playing; the referee validates it; the season settles the bounty. Critique is inside the system, not a complaint from outside it.
• Every guard is a fossilised bug fix from real seasons, ported in intent rather than re-invented.

Runs in cave-teams

The Gauntlet World

The parallel-builders-and-a-blind-critic loop, with every prose rule moved into the structural slot that can mechanically refuse it. What was “please stay in your own directory” in a briefing becomes a write the mutator rejects.

   season( blackboard( builders <-> { board } <-> blind critic ) )

   [ builder: render ] --.
   [ builder: audio  ] --+--> ( THE MUTATOR )   a write outside your own
   [ builder: ai     ] --'          |           subsystem is REFUSED, not
                                    |           requested
                                    v
                      { board: the built subsystems,
                        THE CRITIQUE LEDGER,
                        the bar }
                                    |
                                    v
                        [ THE BLIND CRITIC ]   fresh context; compares the
                                    |          build to a real reference
                                    v
     THE BOUNDARY:  the critique ledger CARRIES  (the critic stops
                      re-diagnosing what was already answered)
                    the bar RATCHETS
                    the season count IS the termination -- in-world,
                      not a human watching a meter

• Four prose rules, four slots. Directory ownership → the mutator. Critic amnesia → a ledger that carries across the boundary. A fixed bar → the ratchet. A human deciding when to stop → the season count.
• The board is data in and data out, so the run persists, resumes, and nests as one agent inside a larger world — which the single-session prompt version could not do.

Runs in cave-teams

NPCs — the agent factory, placed inside the world

Some agents exist inside the world and are callable by the players, as a move. What the NPC makes — a prompt, a skill, an entire agent — is deposited into the caller’s inventory on the shared board. The factory stops being infrastructure and becomes a character.

   [ player ] --> action { type: call_npc, npc: "oracle", ask: ... }
                          |
                          v
                  ( npc_mutator )   wraps ANY economy: call_npc is routed
                          |         to the registry, everything else is
                          |         delegated to the base game's rules
                          v
                    [ THE NPC ]     a seat like any other -- so a whole
                          |         GameWorld can sit in it
                          v
        { the caller's inventory on the board }
              <-- the crafted reply lands here as world state

• The wrapper is the whole mechanism. Any existing economy gains NPCs by being wrapped; the base rules do not learn that NPCs exist.
• The reply is world state, not a message. It lands in an inventory other moves can read, so what an NPC gave you is a thing you now have.

Runs in cave-teams

Inherit the directory, wipe the memory

Reproduction for an agent whose architecture is its directory: copy the whole body, including the odd structure it grew off-script, then delete its episodic memory. The child is born advanced and born fresh.

   THE WINNER'S BODY                          THE CHILD
   +-----------------------------+            +-----------------------------+
   | identity file               |  copy  --> | identity file               |
   | .claude/skills/             |  copy  --> | .claude/skills/             |
   |   including the weird ones  |            |   including the weird ones  |
   |   it invented off-script    |            |                             |
   | rules/                      |  copy  --> | rules/                      |
   | crafted artifacts           |  copy  --> | crafted artifacts           |
   |                             |            |                             |
   | session / episodic memory   |  WIPED     |          (empty)            |
   +-----------------------------+            +-----------------------------+

   you INHERIT THE ALTITUDE (the directory) and REGROW THE CONTENT
   (the memory), so the child re-engages an advanced body cold and is
   free to diverge again. selection is the external buyer, never self-report.

• This is not a season advance. A season keeps the same agent and its memories; this makes a new agent that must not remember the parent’s sessions.
• Divergence is inherited on purpose. No canonical pattern is imposed on the child — whatever weird structure earned the win is copied intact, because that structure is the thing being selected.

Runs in cave-teams

One Directory Tree, Five Readings

The recursive tree of directories that carry a configuration folder is read, at the same time, as the filesystem, the world map, the permission boundary, the agent’s contact list, and the place-world a learning engine walks. There is no separate registry of any of those.

   ONE WALK over the tree for directories carrying a config folder
        --> a FLAT list { path, name, owner }, nested by whoever reads it

   THE SAME TREE, READ FIVE WAYS:

     1. THE WRITE GATE    the nearest ancestor holding an owner file,
                          excluding your own -- see the next entry
     2. WAYFINDING        your PLACE is the nearest ancestor holding a
                          render folder, and its image IS the chat
                          background you are looking at
     3. SCOPE             your contacts are the owners under THIS dir,
                          which is what the delegation switchboard shows
                          instead of every agent on the box
     4. THE LEARNING      each dir is a PLACE, its affordances are the
        SUBSTRATE         skills switched on there, its exits are its
                          child dirs -- populated DIRECTLY, bypassing
                          the library's own one-level file glob
     5. THE ROSTER        every dir carrying an agent body is a card,
                          and picking one RE-ROOTS THE LIVE WORLD:
                          choosing your character and choosing your
                          world are one act

   CONTAINMENT IS A WRITE PATH, NOT A LABEL:

     extract a selection into a child dir by LINKING, and the link
     DIRECTION is the ownership:
          move the items down; leave the parent a symlink
          the owner walk RESOLVES symlinks, so the parent can still
               READ them
          but a WRITE resolves into the child's domain -- and is
               therefore delegated to the child's owner

• One walk, five consumers, zero indexes. The place resolver and the write gate are literally the same climb; nobody maintains a map of where anything is, because the tree is the map.
• The flat list is deliberate. The walk returns paths; nesting is the reader’s business. A tree returned as a tree is a tree somebody has to keep true.
• Linking is the containment operation, so who owns a thing and where a thing lives are the same fact, and the read path stays open while the write path narrows.

Runs in the lab

The Custodian Write-Block — read allowed, write delegated

A directory can be owned by an agent. Every other agent may read all of it — that is the point — but any write into it is vetoed and converted into a delegation to the owner, with the refusal message doing the conversion.

   PROMOTION WRITES ONE FILE into the directory and registers the owner
   as an importable agent. that is the whole ceremony.

   then, for every other agent, at every write:

        ( ONE BEFORE-TOOL HOOK )   one gate, every write tool
             the edit tools    matched precisely, by name
             a shell command   matched heuristically, by write tokens
                    |
                    v
        walk to the nearest ancestor owner file
             YOUR OWN directory is excluded -- you can always write home
                    |
             none  --> the tool runs, untouched
             found --> set BLOCK + a message. the framework SKIPS the
                       tool and returns that message AS THE TOOL RESULT.

   AND THE MESSAGE IS THE MECHANIC -- verbatim, pedagogical:
        it NAMES the owner
        it tells you to hand over the sequence of READS you did and
             your CHANGE IDEA
        it says the owner should derive something same-same but better,
             and iterate

   READS ARE NEVER INTERCEPTED. that is the design: read-derived
   confidence -- which is usually a little bit wrong -- is what gets
   converted into a delegated, verified change.

   no worktree. no pull request. the owner writes directly, and the
   owner's judgement IS the review.

• The refusal is not an error, it is a hand-off. The blocked agent receives an ordinary tool result telling it exactly what to do next, so the veto teaches instead of failing.
• The enabling change had to be upstreamed: the before-tool seam was fire-and-forget — it discarded the hook’s return and ran the tool anyway. A veto nobody reads back is decoration.
• The delegation rides the event spine already there. The sub-agent’s transcript streams under one wrapping event into its own panel so it cannot collide with the host’s chat log, and a fire-and-forget sibling is scheduled on the server’s long-lived loop so the errand outlives the turn that started it.
• The delegate tools are split into a required-argument form and a configured form, because a model correctly skips an optional argument — including the critical one.

Runs in the lab

The Object Feeder — a Python object becomes an entity

Objects in a process become entities in a running game world through one fixed envelope emitted by a sidecar. The world renders only what has already been proven, and re-emitting everything is the reconnect protocol rather than a bug.

   ( A SOURCE )   implements exactly TWO methods, and nothing else
        poll()      --> the objects that exist right now
        removed()   --> the ids that are gone
             |
             v
   ( announce )   a PURE function: object --> the downstream envelope,
        VERBATIM. and the vocabulary is kernel-coordinated: a new kind
        of thing is a BLESS IN THE KERNEL FIRST, and until then the
        library REFUSES to emit it rather than leaking it downstream.
             |
             v
   ( THE FEEDER )   a standard-library event stream on its own port.
        ALWAYS a separate process. never inside the page.
             |
             v
   { THE WORLD }   upserts by node id -- which is a STABLE key, and is
                   NEVER random
                        |
   SO RE-EMISSION IS THE HANDSHAKE:
        every connection keeps its own seen-set
        steady state = new objects plus keepalives
        a reconnect safely REPLAYS the entire world

   and the shipped source reads ONLY the proven store: an unproven,
   quarantined entry never renders, and one corrupt artifact is skipped
   rather than killing the feeder.

• Idempotency at the receiving kernel is what makes the transport dumb. No sequence numbers, no delta protocol, no resume cursor — the reconnect story is “send it all again.”
• Provenance fields come only from real recorded fields, and when there is none there is an explicit limbo path. A fabricated origin is the one thing a world render must never contain.
• The refusal to emit an unknown kind is what keeps two independently-moving codebases — the source and the world — from drifting into a vocabulary nobody blessed.

Runs in the lab

The Three-Gate Escalation

What replaces human review is not a better reviewer. It is three independent gates in series, each killing a failure mode the others cannot see, ending in a controlled experiment.

• Gate one, the market: a peer had to pay for it. Kills self-assessed value — self-praise is worth nothing.
• Gate two, the fresh-model test: a completely blank model instance — no history, no context, no knowledge of the system — is handed only the artifact’s text and one input, and must follow it. Kills anything that only worked with its author in the room. The gate’s own run mints the test record, so the certificate never comes from the claimant.
• Gate three, the replicated race: the world with the change has to out-produce the world without it. Kills changes that are plausible, well-argued and useless. The proposer can be confidently wrong; the experiment does not care.
• What falls through is not waste. Each death is logged with its cause and becomes the input signal for the next cycle.

Runs in the lab

The Self-Developing Repository

Invert continuous integration. The scheduled job is not a test runner attached to human commits — it is the developer. It convenes a world of agents, takes the change the market voted for, gates it, races it, opens its own pull request, and merges on a strict win.

• Step 0 is telemetry from a live world running on the current version of the package. Its throughput is the fitness of the current version of the repository — the codebase is measured by what a world built on it manages to do.
• The dev world’s product is an instrument, not an answer. Agents craft candidate procedures; the one a peer actually bought is then executed against a checkout, and the diff that falls out is the proposal.
• The merge condition is not “tests pass.” It is “the treatment strictly beat the control on the same measurement, today.”
• Lessons accumulate separately from skills. After the verdict the referee reviews the whole trace and writes the lesson into a standing rulebook every future world boots with — so the way it develops improves, not only what it has developed.
• Containment is a write partition: the runner can write the world definition, the shipped skill set and the ledger. Its own code, its schedule and its off-switch are on the read-only side of the same wall.

Runs in the lab

The Closed Trigger Loop

The loop closes when the running system’s own failures are what summon the development system. Agents file bugs from inside the game, the referee validates them, validated bugs become real issues, and an issue landing convenes the dev world automatically.

• Three doors, one procedure: the daily schedule is the heartbeat, a validated in-game bug is the demand signal, and a manual dispatch is the override. All three convene the same cycle.
• The bug report is an in-world move before it is an issue — filed by a player, adjudicated by the referee, paid at the epoch boundary. That is what stops the backlog from being someone’s opinion.

Runs in the lab

Gated Extrusion, and the Promotion Trichotomy

The agent’s own tool stream is recorded as a route, but only the steps the world validated survive into what it learns — and nothing it learns becomes reusable capability without a human move.

   AFTER EVERY TOOL CALL, record one step:

        { who, the action, what it produced,
          THE PLACE -- the directory it happened in,
          PASSED    -- the world's verdict }

   passed = the same directory write-gate, expressed in the learning
            engine's own currency, PLUS a verified-terminal check.
            a tool that ERRORED docks the stat too. the number tracks
            what the world ACCEPTED, not what the agent issued.
                    |
                    v
   AT TURN END, extrude the buffer into a procedure, KEEPING ONLY THE
   PASSED STEPS -- so a blocked write can never enter the learned
   route. you learn what was VALIDATED, not what you did.
                    |
                    v
   { THE ROUTE LIBRARY }   consulted BEFORE deriving: a stored route
        whose input terminals are warranted right now is conducted as
        ONE move, prepended into the turn. any exception at all falls
        back to the ordinary turn.
                    |
                    v
   AND THE PROMOTION IS A TRICHOTOMY:

        1. promote it into a skill file the scanner already indexes
                --> the agent now carries its own learned skill, in
                    its own menu
        2. write a promotion REQUEST into quarantine
        3. quarantine --> proven : THE HUMAN. only the human.

   an agent cannot promote its own capability. it is the same
   request-then-approve gate as owning a directory and as approving a
   contact -- and the runtime phase that will run only proven
   capabilities, or refuse, is backed by that same gate.

• The gate the world already had is reused as the learning signal. Nothing new judges the steps — the write-block verdict is simply recorded next to each one.
• Reuse is attempted before derivation, and it is fail-open: a route that does not apply costs one check, never the turn.
• Self-goldenisation is the failure mode being designed against. An agent that can bless its own output has a gauge, not a handler.

Runs in the lab

The Shadow Agent, and Its Two Delivery Surfaces

A second agent watches the first one’s live conversation from a forked history in its own process, writes rules, skills and hints into the place’s config folder, and gets them back into the primary through exactly two surfaces — one passive, one that refuses to let the turn end.

   ( A PER-ITERATION CLOCK )   forks the LIVE history, drops a job
        |                      file, returns. that is all it does.
        v
   ( AN OUT-OF-PROCESS WORKER )   runs a BARE agent ON the fork, so it
        inherits the whole conversation -- with every system message
        STRIPPED, or it inherits the primary's identity (the framework
        only swaps the first message when the prompt changed)
        |
        v
   the shadow has real tools. it writes RULES, SKILLS and HINTS into
   the place's own config folder.
        |
        the worker PARSES NOTHING. it snapshots modification times
        before and DIFFS after -- so a delivery knows CREATED from
        REVISED, which is what lets a revision of a rule you were not
        following be announced as a revision.
        |
   +----+---------------------------------+
   v                                      v
   SURFACE 1: A PREPEND                   SURFACE 2: A STOP GATE
   one line onto the user's NEXT          a HINT means "there was a
   message, applied at the message-       problem, stop". the turn is
   assembly chokepoint -- because a       BLOCKED and the agent is
   lifecycle hook CANNOT mutate the       re-invoked carrying the hint.
   user prompt: the framework never       then the shadow runs AGAIN,
   reads it back. once per delivery,      as a JUDGE, on the fixed
   scoped to the place.                   conversation. the loop exits
                                          only when it has no hint.
                                          capped, switchable, fail-open.

   THE RECURSION GUARD IS BY CONSTRUCTION: the child is a bare agent
   with the enabling switch stripped out of its environment, so the
   shadow can never spawn itself.

• Each delivery lands where that kind of thing can actually land. A hook cannot rewrite the user’s prompt, so surface one sits at the assembly chokepoint; a rule the agent ignored needs the turn stopped, so surface two is a gate and not a note.
• Stripping the system messages out of the fork is what makes it a second agent rather than the same agent talking to itself with extra steps.
• Diffing modification times instead of parsing output means the shadow can write anything it likes in any shape, and the delivery layer still knows exactly what changed.

Runs in the lab

The Cursor State Machine

An agent that is always inside one state, routed there by a persisted “you are here” pin, where the states are skills. It does that state’s leg, advances the cursor, journals why, and loops. Two agents on the same codebase produce the same structure — that invariance is the point.

   ( BOOT )  the first thing every session does, and every
      |       resumption after a context compaction
      v
   ( read { THE CURSOR } )   a persisted "you are here" pin
      |
      v
   [ the state it names ]    each state IS a skill:
      |                        init     mirror an unmirrored codebase
      |                        seework  the dispatcher: pick the next gap
      |                        change   a module changed, re-derive its doc
      |                        prompts  find or author a scored procedure
      v
   ( do that state's leg )
      |
      v
   ( advance { THE CURSOR } + journal the WHY )
      |
      '--> loop back to boot, or exit

   the agent is never "deciding what to do next". the flow is scripted,
   so it cannot improvise a new kind of artifact halfway through.

• The cursor is the whole control structure. Boot reads it; the leg advances it; nothing else routes. A compaction, a crash or a new session all resume identically.
• Every output is exactly one legal kind. No ad-hoc session notes, no topic documents — which is what makes two independent runs converge on the same tree.
• The paired commit closes the loop: the derived artifact and the code it describes land in the same commit, so drift is not a thing that can quietly happen.

Runs in doc-mirror

Brains Whose Neurons Are Brains

Retrieval as a recursive structure rather than a flat index: a node is either a document or another whole brain, and both answer the same two-stage protocol — so the hierarchy nests to arbitrary depth without a second mechanism.

                        { BRAIN }  its digest
                        /    |    \
                       /     |     \
              { BRAIN }   [ doc ]  [ doc ]      a NEURON is either a
              /      \                          document or another
        [ doc ]    [ doc ]                      entire brain

   every node -- leaf or brain -- answers the SAME two stages:

     cognize    a cheap relevance vote, read off the node's digest
     instruct   the full pass: cognize -> instruct -> synthesise,
                recursively, through whatever is below it

   digests build BOTTOM-UP: the level touching raw files gets a real
   fold; every level above concatenates its children's digests verbatim,
   so distinctive vocabulary survives all the way to the top.

• One protocol at both scales is what buys the nesting: a brain is a legal neuron because it answers what a neuron answers.
• The cheap stage is a gate on the expensive one. Relevance is voted from a digest before anything descends, so depth costs only where the query actually goes.
• Verbatim concatenation upward is a deliberate choice against summarising twice — a fold of a fold is where the distinguishing words go missing.

Runs in brain-agent

The Seven Primitives, and What Each One Actually Buys

Everything you can build in a modern coding-agent harness is a combination of seven component types. The design question is never “what do I put in the prompt” — it is which primitive carries each requirement, because they differ in one property: how much control they actually have.

   PRIMITIVE     WHAT IT IS                      CONTROL LEVEL
   -----------   -----------------------------   -----------------
   CLAUDE.md     system-prompt injection         a TRIGGER -- it hopes
   skill         a capability, hot-reloaded      a SUGGESTION
   hook          an event handler                CONTROL -- it enforces
   MCP           an external tool with state     EXTERNAL effect
   subagent      an isolated context             DELEGATION
   plugin        a bundle                        PACKAGING
   team          coordinated sessions            COORDINATION

   the third column is the whole table. the SAME rule written into the
   instructions file is a hope; written as a hook it is a law.

   the combinations are the systems:

     skill                      -> a workflow you invoke
     skill + scoped hook        -> behaviour enforced WHILE it runs
     skill + forked subagent    -> research in an isolated context
     subagent + skills + MCPs   -> a domain specialist with a loadout
     hook + MCP                 -> an external system driven by an event
     team + SHARED STATE        -> a market world (see the arena above)
     plugin + any of the above  -> the whole thing, distributable

• Read the ladder, then place the requirement. Anything that must never happen belongs at the enforcing end; anything that should usually happen can live at the suggesting end.
• The decision is mechanical: is it something you invoke, or something that should fire on its own? does it need enforcement? does it need isolation? is it multi-agent, and if so is the coupling peer messaging or shared state?
• Every architecture above is one of these combinations, which is why they port between harnesses instead of being tricks.

Runs in the lab

The Ratchet-Navigation Funnel

A funnel is a series of ratcheted options such that the visitor cannot work out how to do anything except a sanctioned move. Every page’s visible exits are its sanctioned moves, and the entrance is one-way. You are inside one now.

   { THE ENTRANCE }  one way. nothing routes back to it.
          |
          v
   [ a page ]  ------>  [ one level deeper ]   every artifact links into
          |             the system that generated it, with a receipt at
          |             each layer -- the descent IS the argument
          v
   [ the hub ]  <-- reachable from the brand mark, from anywhere
          |
          v
   [ the offer ]

   the exit set of each page is DESIGNED, not inherited from a template.
   nav is a grammar: what you can see is what you are allowed to do, and
   the visitor sorts themselves by how deep they choose to go.

• The one-way entrance is structural. After the first pass there is no navigation route back to it — the browser’s back button is the only way, which is exactly the friction a ratchet is.
• The exit set is the design surface. Deciding what a page links to is deciding what a reader can do next; leaving it to a template is leaving the funnel to chance.
• It grades its reader rather than filtering them. Engineers who pull threads land on running code, operators land on running businesses, and nobody is told anything untrue on the way.

Runs in this site

The Attached Terminal Mirror

A control plane that does not own the agent process. It attaches to an already-running terminal session by name, drives it by typing, reads it by capturing the screen, and separately lifts the agent’s configuration off the filesystem — then serves both as one interface. Kill the control plane and the agent keeps working; restart it and it re-attaches.

   over HTTP:  read the screen, type into it, read the state, attach
                              |
                              v
   ( THE CONTROL PLANE )   restartable. owns NOTHING but the binding.
        |
        |   attach: does a session with this name exist?
        |      yes --> bind to it
        |      no  --> stay unattached, and SAY SO
        |
        +-- ( the terminal driver )   four verbs: exists, type,
        |         |                   capture, type-and-wait
        |         v
        +-- ( the config reader )     reads FILES, read-only by
        |         |                   contract: settings, servers,
        |         |                   hooks, skills, rules
        v         v
   { THE SESSION }   the real interactive agent.
                     NOT owned. NOT spawned. NOT restarted.

   two independent sensing paths -- a screen scrape and a config read --
   compose into ONE state document.

   every live route is fronted by the attach check: no session means
   "not attached", never a silent respawn.

• The only write is keystrokes into the pane. The runtime never edits the agent’s transcript, which is what makes the mirror a mirror.
• Attaching is an explicit act. A control plane that spawns what it failed to find is a control plane that quietly forks your agent.
• Configuration is sensed, not held. What the agent is equipped with is read off disk each time, so the control plane cannot report a loadout the agent does not have.

Runs in cave

Hooks Lifted Out, and an Active Set

Every behavioural hook is moved out of the agent’s own configuration and into a registry inside the runtime; what stays in the agent is a set of thin relays that post the event. Dispatch is then filtered by a mutable set of active names, so the same loaded registry produces completely different behaviour depending on which names are switched on — and the runtime, not the agent, holds the authority to refuse.

   the agent's config keeps ONLY relays
        before-tool, after-tool, stop  --post the event-->
                                                            |
   ( THE RUNTIME )                                          v
     1. normalise the envelope   several harnesses, one shape
     2. hooks = registry(event type) INTERSECT { ACTIVE NAMES }  <-- GATE
     3. run each; a BLOCK verdict short-circuits and is returned
     4. accumulate the extra context each one contributes
                              |
              { continue }  or  { block, with a reason }
                              v
                    back to the agent process

   the registry holds two populations behind one call signature:
     class hooks    discovered from a directory
     script hooks   a subprocess. one specific exit code means BLOCK;
                    ANY OTHER failure means APPROVE -- deliberately
                    fail-open, so a broken hook cannot brick the editor

   a hook in the registry but NOT in the active set is loaded and
   SILENT. whoever writes the active set writes the behaviour.

• Every hook shares one persistent state dict across calls. That dict is the memory an autonomous loop is built on — see the next entry.
• Two-stage gating — registered and active — is what lets one installed library of hooks express many different agent modes without reinstalling anything.
• Block authority sits with the runtime and is returned to the agent, so the thing being constrained is not also the thing deciding.

Runs in cave

A Loop Is Data: a prompt, a hook set, and an exit predicate

An autonomous work loop over an interactive agent, written as a plain record instead of a driver program. Activating it does two things at once: it installs the loop’s hook set and it types the loop’s prompt. The loop then closes through the hooks it just installed — they write into shared state, and the exit condition is a predicate over exactly that state.

   A LOOP = { name, prompt, its hook set, exit(state), what's next }

   activate:   1. install THIS loop's hook set        <-- arm
               2. type THIS loop's prompt             <-- kick
                        |
                        v
   the agent works --> fires events --> the relays post --> dispatch
                                                                |
                          only this loop's hooks are active     |
                                                                v
                                        the hooks mutate the shared state
                                                                |
                                                    exit(state) ?
                                        no  --> keep running
                                        yes --> disarm, then pick the next:
                                                by index, by name, by
                                                running a transition
                                                cycle round, or stop
                                                                |
                                                                '--> activate

   there is NO loop thread. the hook dispatch IS the tick.
   a schedule of autonomous work is then a LIST of these records.
   an exit predicate that raises is read as "not yet" -- a broken
   predicate stalls the loop rather than skipping it.

• The hooks that decide when the loop is done are the hooks the loop installed. Arming and measuring are one act, which is what removes the driver program.
• Autonomy becomes editable data: reorder the list, change one prompt, swap one hook set. Nothing is recompiled and nothing is subclassed.
• Failure directions are chosen: a missing named successor just advances the index, while a failed transition stops the whole schedule.

Runs in cave

Conversations, Not Transports

An agent’s input and output modelled as a named map of conversations rather than a list of pipes. Two conversations can ride the same transport and stay separate histories; one conversation can be both an input source and an output mirror. Each carries a mode set, so the same object graph gives you “stream me everything” or “only tell me the answer” from configuration.

   { THE CHANNEL MAP }   main | heartbeat | journal | stream | ...
        each entry: deliver(payload), receive(), a MODE SET

     MIRROR        its receive() is polled into the agent's inbox
     BROADCAST     every emitted event fans out to it, turn by turn
     DELIVERABLE   only the typed RESULT of a run lands here

   in :  receive() --> ( THE INBOX ) --> the agent runs
   out:  the result --> the main conversation, AND every deliverable one

   the INBOX mediates across all conversations in priority order, so
   "which conversation is talking" is not the agent's problem.

   presets: mirror everything, only notify, per-conversation modes
   and every agent silently gets a stream conversation for observers.

   behind a conversation: a chat transport with a persisted cursor -
   a terminal pane, a directory of files consumed by deletion, an
   in-memory queue. THE SAME THREE OBLIGATIONS.

   emitting is intercepted at registration, so no agent can emit
   without the runtime seeing it.

• A conversation is not a transport. Separating the two is what lets one chat channel carry two independent histories, and one history span two transports.
• “What lands in the transcript” versus “what is the answer” is one flag, not a second code path — so a noisy debugging view and a quiet production view are the same wiring.

Runs in cave

One Clock, One Way Out

The whole runtime has a single background thread and a single place that touches the outside world. Every periodic behaviour is a tick on one clock, and the rule is written into the source: nothing polls an external service anywhere else.

   ( THE CLOCK )   ONE daemon thread, one-second cadence
        every registered tick that is due, executes.
        a tick that throws is caught -- one bad organ cannot stop it.

        perception        the outward poll, below
        health check      results ride in a shared carrier
        schedule fire     see the next entry
        hot reload        re-read the job definitions from disk
        heartbeat prompt  type into the agent -- UNLESS a human is
                          active (a fresh lock file wins over the
                          clock) or the live config says no

   ( PERCEPTION )   THE ONLY OUTWARD POLL IN THE SYSTEM
        for every agent, receive from every conversation
             a command?  handle it
             otherwise   enqueue to THAT agent's inbox
        then tick the world's own event sources
             deterministic  --> route it as a message
             probabilistic  --> write it into the injection point

        and it RATE-LIMITS ITSELF: called more often than its own
        interval, it returns nothing. so any tick, and any loop, may
        call it safely.

• Self-rate-limiting inside the organ rather than at the call site is what makes “exactly one poller” enforceable instead of a convention everyone is asked to respect.
• The human wins over the clock. A heartbeat that types over somebody’s live session is precisely the failure this exists to prevent, so the lock file is checked at fire time, not at boot.

Runs in cave

Scheduled Work Judged by Artifacts, and Identity-Checked Reaping

Scheduled work whose success is decided by files on disk, not by exit status. Each job declares what it must leave behind and what must have succeeded first. When a run hands back a process id, the runtime re-reads that process’s start time before believing the id is still the same process — and only once it is genuinely gone does it check the declared files.

   definitions on disk --hot reload--> { live job objects }

   EVERY TICK -- PHASE 1, reap what is in flight
     for each tracked run:
         is the process alive?
             yes --> re-read its START TIME. different? the id was
                     REUSED by the operating system: treat it as dead
             no  --> finished. reap it.
         then, and only then:
             every declared deliverable present?
                 yes --> success, and any standing block is resolved
                 no  --> "deliverables missing", plus a block report
                         on an append-only ledger

   PHASE 2 -- fire what is due
     have all of its prerequisites succeeded?   no --> skip this round
     fire it.
         returned a process id?  track it; check deliverables LATER
         otherwise               check deliverables NOW

   THREE independent gates in series: the prerequisite, the process
   actually exiting, and the files actually existing.

• “It exited zero” is not evidence. The declared artifact is — which also means a job that lies about finishing is caught by the same code path that catches one that crashed.
• Checking process identity, not just liveness, is the difference between a reaper and a race condition on a busy box.
• A failure writes a block report a later success marks resolved, so the ledger is the standing state of what is stuck rather than a pile of historical errors.

Runs in cave

The Loadout Archive, Identified by Hash

An agent’s entire identity surface — its servers, its settings, its instructions file, its rules and its hooks — treated as one swappable unit. Injecting a named loadout always archives the current one first, so a swap cannot destroy what it replaces. And “which loadout is active” is answered by hashing the live files, with the bookkeeping record demoted to a labelled fallback.

   THE LOADOUT = six things, moved as ONE
     the server config, settings, local settings -
     the instructions file, the rules directory, the hooks directory

   archive(name)   REFUSES if that name is taken. no silent overwrite.

   inject(name)
     1. archive the CURRENT one first, under a reserved backup name
            this step failing ABORTS the whole injection
     2. copy the files over the live ones
     3. REPLACE the two directories -- replace, not merge
     4. record what is now active

   which one is active?
     hash the live tree (its files, and everything under its dirs)
        matches an archive --> { active: that one, matched by: HASH }
        matches none       --> fall back to the record, AND SAY SO:
                               { matched by: HISTORY, note: the current
                                 files may have changed }
        nothing at all     --> { active: none }

   hand-edit the live files and the system immediately reports
   "this matches no archive" rather than lying about what is loaded.

• Identity derived from content, with bookkeeping as an admitted fallback. A record that can be wrong is only safe when its answer says it might be.
• The forced backup is what makes the destructive directory replacement survivable — and it is gated on its own success, so a failed backup means nothing was touched.

Runs in cave

One Detector, Two Mounts, Asymmetric Authority

A single code-smell detector mounted twice on the identical event, with deliberately different powers: the copy that runs before a write can refuse it; the copy that runs after cannot block anything, so it speaks through the only channel that still reaches the model. Both fail open — every error path lets the edit through.

   the agent is about to write a file
                    |
   ( GATE 1 -- BEFORE )   the ONLY veto in the system
        the library isn't installed?         --> allow
        the naming lock is off?              --> allow (the gate is inert)
        lock on, non-canonical filename?     --> REFUSE THE WRITE
                    |  allowed
                    v
              *** the write happens ***
                    |
   ( GATE 2 -- AFTER )   cannot block. its error channel is swallowed.
        so it ALWAYS speaks, every time, through the one channel that
        does reach the model: extra context attached to the event.
                    |
                    v
        the findings land in the agent's context. the agent decides.

   neither mount holds the logic. both call the same library, which is
   equally reachable from a command or any other host.

   the before-gate checks only the FILENAME, never the content -- it is
   budgeted to sit in front of every single edit.

• Two mounts, two authorities, one detector. Advisory and blocking are a deployment decision rather than two codebases that drift.
• Fail-open is written at every exit, because a linter that holds a veto and has a bug is worse than no linter at all.

Runs in codenose

The Mode Latch Is a File

Two operating modes live in the filesystem rather than in configuration or a daemon: one is the existence of a file, the other is a word inside one. Three processes that never talk to each other each check the same path and independently escalate the same finding — advisory becomes critical, critical becomes a refused write. The dial is a touch; the read is a file check.

   a slash command      a library call        any shell at all
     touch / remove       set on / off          write a word into it
            \                  |                      /
             '------> TWO SENTINEL FILES <-----------'
                  the naming lock    (it EXISTS = on)
                  the strict mode    (it CONTAINS a word)
                              |
        +---------------------+----------------------+
        |                     |                      |
   ( the before-gate )   ( the scanner )    ( the after-reporter )
     becomes a HARD        one finding        findings become critical
     blocker               escalates to       and the message is
                           critical           prefixed

   the latch DETECTS NOTHING. it only re-grades what the detectors
   already found -- which is why the same rule set is advisory in one
   repository and blocking in the next.

   no reload. no message passing. no restart.

• The lock path is declared independently in three places, so a process running without the library installed still honours it.
• The strict mode is read inside the scan, not at construction, so it can change between two edits in one session.
• Detection and grading stay separate, which is the same split that lets one taxonomy serve several houses’ standards — see the next entry.

Runs in codenose

The Taxonomy Is Data

The smell taxonomy is not a pile of branches — it is a name-to-function registry plus layered configuration, with third-party detectors named as a module and a function and imported at scan time. And the detectors never decide how serious they are: the scanner stamps severity on afterwards.

   the user's config          the project's config      project WINS
        deep-merged; custom detectors APPEND rather than replace
                              |
                              v
   { per rule: enabled?, severity, thresholds }
                              |
   ( SCAN A FILE )
     an ignore directive in the first few lines --> return NOTHING
     for each built-in rule that is enabled:
          run it, then STAMP the configured severity on every finding
          the rule takes no options?  call it without them, carry on
     for each custom rule:
          import the module, get the function, run it, stamp it
          cannot import?  warn and skip -- never abort the scan
     a rule that raises?  caught. the scan continues.
                              |
                              v
   findings, rolled up into a per-directory cleanliness reading

   adding a smell type is adding ONE ENTRY TO A DICTIONARY.
   the SAME detector output is graded differently per project, and the
   detector knows nothing about it.

• Separating detection from grading is what lets one taxonomy serve many standards without forking the detectors.
• Everything fails soft. An unloadable rule, a raising rule and an unparseable file each cost exactly one finding — never the run.

Runs in codenose

Severity Is Which Envelope It Arrives In

How serious a finding is, is expressed by which context envelope it is wrapped in. A normal result comes back in the tool’s own low-priority tag; a critical one is rendered in the harness’s highest-attention framing and carries an explicit obligation. The tag, the icons, the severity words and even the tool’s name are configuration, so the whole instrument re-skins without touching a detector.

   findings + a theme { the tool's name, its tag, severity words,
                        an icon per smell type }
              |
        group by type; render a legend and a table
              |
        is anything critical?
              |
      no -----+----- yes
      |             |
      v             v
   the tool's     THE HARNESS'S HIGHEST-ATTENTION BLOCK
   own low-       "ACTION REQUIRED", the latch states, the table, and
   priority tag   an explicit "address these before proceeding"
      |             |
      '------+------'
             v
   delivered as extra context to the agent
             |
             v
   and the RECEIVING END is itself a loaded rule: comply by default,
   deviate only when the finding is obviously pedantic, and then satisfy
   the SPIRIT -- never silently drop the block.

   escalation is not a louder message. it is a DIFFERENT ENVELOPE.

• No new authority is invented. The router borrows the framing the harness already treats as highest priority, rather than inventing a convention and hoping it is honoured.
• The envelope is only half the mechanism. The other half is a standing rule defining what the agent owes a critical finding — neither half works alone, and shipping only the first is the common mistake.

Runs in codenose

Layers From Filenames

Architectural layers derived from file names — not from a manifest, a package graph or annotations. A short whitelist of canonical names is enforced at write time, which makes every file’s depth computable from its basename alone, so a static check can flag an import that points outward or one that skips a layer with zero project configuration.

   THE TABLE     basename --> depth (higher = further in)
     outer       the entry points: server, api, command line, main
     middle      the core
     inner       the utilities
     base        anything under the base directory
     FLOATING    models, config, constants, types, exceptions
                 -- no constraint, importable from anywhere
     unknown     not in the table --> the check stays SILENT

   ( CHECK )   only RELATIVE imports. an absolute import is another
               package's business, not this check's.
     the target is shallower than me      --> inner imports outer
     the target is more than one deeper   --> a skipped layer
     otherwise                            --> fine: inward, one step

   AND THE REASON IT CAN WORK AT ALL:

     the write gate + the naming lock  ==>  filenames are canonical
                                       ==>  a NAME IS A POSITION
                                       ==>  the layer check has an
                                            ontology without anyone
                                            having written one down

• Two literals are the whole ontology, and anything unrecognised is passed over silently rather than guessed at — which is why it can be switched on in an unfamiliar codebase without a configuration pass.
• The invariant survives because it was made survivable: tests, migrations, scripts and the base directory are exempt by name, so nobody has to fight the lock to do ordinary work.

Runs in codenose

Five Dotdirs, One Directory

One directory carries up to five sibling configuration folders, each owned by a different layer of the stack — so a single folder is simultaneously an instruction set, an agent roster, a machine shop, a render manifest and a graph door, and no layer reads another layer’s slot.

   ONE directory. up to FIVE sibling config folders, one per layer:

     .claude      the harness vendor's. READ-ONLY to us.
     .heaven      WHO IS HERE        rules, skills, agents, hooks,
                                     rename-sets
     the runtime  WHAT RUNS HERE     hooks, automations, the ledger seat
     the render   WHAT IT LOOKS LIKE a render program. a raw object
                                     list is FORBIDDEN in it -- that is
                                     the doubling trap
     the graph    the graph's ONLY door

   EXACTLY TWO VERBS. THERE IS NO THIRD.

     REGISTER   present in the tree ==> known, addressable, importable.
                the home-level folder IS the registry: no second store,
                no symlink duplicates, no index to fall out of date.
     ACTIVATE   local presence -- PRESENT IS ACTIVE, there is no
                activation index for a local file -- or naming it by
                reference in the slot's own json.
                NAMING IS IMPORTING IS ACTIVATING: one move.

   AND MEMBERSHIP IS DECIDED BY A TRANSPORT TEST:

     if it does not MOVE when somebody downloads this directory --
     tokens, machine-local application settings, runtime state --
     IT IS NOT DEVDIR MATERIAL.

   the test convicted and deleted a chat-integration file, a persona
   pair, and an entire home-level hook folder that held a static file
   impersonating the runtime's activation authority.

   ONE CARVE-OUT, BY LAW: an automation being PRESENT is not ARMED.

• The stranger who downloads the folder is the whole design constraint. Membership is not taste; it is a mechanical question with a yes and a no, which is why it could convict three existing files and delete them.
• Two verbs and no third is what removes the class of bug where a thing is installed but not enabled, enabled but not installed, or listed in two registries that disagree.
• A slot may be forbidden content. The render folder holds a program, never a list of the objects it renders — the moment it holds both, the world exists twice and one copy starts losing.

Runs in the lab

The Connector Is a Hook File

Putting any agent system — a coding harness, an in-process agent, an opaque terminal session — under one reflective controller is done by dropping a hook file into that system’s own hooks folder. The connector is not a service, and it is not a slot of its own.

   THREE CHANNELS, never conflated:

     A   the in-process LIFECYCLE hooks fired during an agent's own run
         before / after run - iteration - tool call - system prompt -
         block report - error
     B   THE REFLECTIVE CONTROLLER -- the layer that lifts hook events
         into a stateful, programmable runtime with activation gating
         and block / inject verdicts
     C   the event STREAM. observation. NOT a hook tier.

   AND CHANNEL B IS REACHED BY A CHANNEL-A *FILE*:

     one conventionally-named hook file into the coding harness's own
          hooks folder     --> that harness is now on the controller
     the same-shaped file into the in-process agent's hooks folder
                           --> that agent is now on the controller

     same name, same shape, one per harness. install it and that agent
     system is hooked up. there is nothing else to run.

   TRANSPORT DEGRADES EXPLICITLY:
     the in-process seam FIRST -- an HTTP call to a controller sitting
          on a BLOCKED loop can never complete
     else HTTP to an external controller
     else no-op

   VERDICTS MAP BOTH WAYS, FIXED:
     block          --> the framework's tool veto
     extra context  --> the system-prompt inject

   THE OBSERVER-CLASS VARIANT -- a tap on an agent the world cannot own
   -- is the same install into a foreign harness's config, under three
   clauses:
     FAIL-OPEN   every path exits zero. the world being down never
                 blocks somebody else's tool.
     SILENT      in that harness stdout INJECTS into the watched
                 agent's context, so a reporter writes none.
     BOUNDED     sub-second timeout, fire-and-forget.
   it gives the world EYES on a foreign agent. never a mouth.

• The integration surface is a file, not an interface. Nothing registers, nothing is discovered, nothing negotiates a protocol — the file is in the folder, so the events arrive.
• The three channels being separate is the load-bearing part. Treating the event stream as a hook tier is how an observation surface quietly acquires the authority to block.
• The observer tier is deliberately mute. A watcher that can also speak into the watched agent’s context is not a watcher; and in that harness the difference is one accidental print statement, which is why silence is written as a law rather than a habit.

Runs in the lab

Activation by Rename

An agent’s loadout is not a configuration value; it is the state of the filesystem. Turning a skill, rule, hook or sub-agent off renames its file, and a saved rename-set is equipped like a talent build.

   THE LOADOUT IS THE STATE OF THE FILESYSTEM.

        PRESENT = ACTIVE
        OFF     = the same file with ".inactive" appended

   which the resolver's slot grammar STRUCTURALLY EXCLUDES -- so the
   toggle needs no index, no registry, and no cooperation from any
   loader. an active file wins over its inactive sibling on a scan.

   A SAVED RENAME-SET:   { section: { item: on | off } }
        four sections -- skills, rules, agents, hooks
        applying it performs EXACTLY the renames needed, and reports
        how many it did

   the browser configurator and the library are BYTE-COMPATIBLE
   implementations of one rename algebra (one was extracted from the
   other), so a human clicking rings and an agent calling a function
   are performing the identical operation.

   AND IT CAN BE SCOPED IN TIME: the heartbeat applies its own set for
   ONE beat and restores it in a finally block.

   one more file promotes the configuration into an OWNER of the
   directory -- see the write-block above.

   a stack of these layers, faced as ONE agent, is the whole topology;
   today's single agent is the degenerate one-layer case it grows from.

• No loader had to learn about this. The off-state is unreadable to the resolver because of the shape of its filename — which is the cheapest possible way to make a switch that every consumer already honours.
• Two implementations, one algebra, verified byte-compatible — so the interface a human uses and the interface an agent uses cannot drift into two different meanings of “equipped.”
• Reversible and time-boxed. Applying a set returns enough to undo it, which is what lets a background beat borrow a completely different loadout and give it back.

Runs in the lab

One Core, N Sinks

Terminal app, web daemon and desktop app are not three implementations of the agent. They are three sinks attached to one agent turn through a single callback argument.

   THE WHOLE FACE LAYER IS ONE ARGUMENT:

     agent.run( message, callback = composite([ capture, A SINK ]) )

     and a sink is just a callable taking one raw message.

        TERMINAL    renders to a terminal IN-PROCESS. no HTTP, no port
                    -- deliberately the self-modification safety net:
                    the surface that still works while you are editing
                    the server
        STREAM      converts to { type, data } and hands off to the
                    event loop
        WRAPPED     another agent's turn, under ONE outer event type,
                    so a delegated sub-agent routes to its own panel
                    instead of colliding with the host's chat log

   TWO STRUCTURAL RULES, BOTH LEARNED FROM LIVE FAILURES:

     1. THE EMIT MUST HOP onto the event loop threadsafe, because the
        callback fires from a worker thread. without the hop, every
        event batches to turn-end: the interface sits on "working" and
        then dumps everything at once.

     2. THE STREAM IS A FAN-OUT BUS, ONE QUEUE PER SUBSCRIBER.
        a single shared queue PARTITIONS events across clients: the
        second browser tab steals the DONE, and the first tab hangs
        forever.

   and the desktop shell is a META process: adopt a healthy daemon on
   the port or fork one, keep the app being built as a separate
   crashable process, and cap its restart budget.

• Adding a face is adding a function, not a transport, an adapter or a second code path through the agent.
• The in-process terminal is a safety net on purpose. When the thing being modified is the server, the surface that needs no server is the one you can still watch it from.
• One queue per subscriber is not an optimisation. A shared queue does not slow the second client down; it silently splits the conversation between them, and both halves look like a hang.

Runs in the lab

The Agent’s Daemon Is the World Server

Instead of an app talking to a game server, the coding agent’s own daemon is the world server — rooted at the user’s own directory, with one event stream carrying chat, world events and agent activity, and the directory’s machines running on the heartbeat that was already ticking.

   NOT an app talking to a game server.

   ( THE CODING AGENT'S OWN DAEMON )
        + ONE EXTENSION mounts the entire world surface onto it: the
             loading walk, the graph events, the verb doors, the board
             persisted under the place's own config folder
        + a MERGED event generator

   so a chat message, a world event and an agent's activity all ride
   ONE event system. the previously standalone world server collapses
   into this one and survives only as a development harness.

   ROOT RESOLUTION NEVER GUESSES:
        the environment variable wins
        else the working directory, ONLY IF it already carries the
             game-seat marks
        else THE MOUNT IS SKIPPED, with one honest log line
   mounting a universe into an arbitrary working directory would write
   seats into somebody's unrelated folder.

   THE MACHINE LAYER OBEYS THE SAME DISCIPLINE:
        per-directory automation programs register IN MEMORY, under a
             place-prefixed key, on the daemon's OWN registry
        they fire on the heart's existing minute tick -- ZERO new
             schedulers. the calendar's registry IS the registry.
        the hot-reload method is wrapped ON THE BOUND INSTANCE, so the
             periodic reload cannot sweep them away
        NOTHING is written to the flat host-shared registry folder: a
             file there is loaded AND fired by every daemon on the box
        THE MONEY LAW: a code-pointer machine registers live; a
             model-calling machine lands DORMANT until it is armed

   and a world failure never takes the agent's daemon down.

• The collapse is the point. Two servers means two event streams, two lifecycles and two places state can be; one server means the world is something the agent is already inside.
• Reusing the existing clock rather than adding one is the same discipline as the single-clock runtime two floors up: a second scheduler is a second answer to “what time is it.”
• Refusing to mount is a feature. A universe that guesses its own root writes seats into a stranger’s directory, and the one honest log line is cheaper than every recovery path that follows.

Runs in the lab

The One Resolver — one function, every slot

One function finds every configuration file an agent loads — its rules, its skills, its hooks, its sub-agents, its rename-sets, or a slot nobody has invented yet — and it deliberately refuses to do the loading.

   RESOLVE( launch dir, current dir, slot )
        --> [ file { path, front matter, content, PROVENANCE } ]

   ONE resolver, crossed from two axes:

     A SOURCE LADDER                x     A SLOT GRAMMAR TABLE
       1 the home level, ALWAYS on          rules   skills   hooks
         (that level IS the registry)       agents  rename-sets
       2 the LAUNCH walk                    ... plus a DEFAULT grammar,
       3 the ACTIVE walk -- where the           so an unknown slot
         agent is standing right now            ALREADY resolves

   AND THE WALK IS TWO PHASES:
     ENTER   climb to the nearest ancestor that HAS a config folder,
             skipping a leading gap
     CLIMB   keep going only while the PARENT also has one.
             a gap ABOVE the entry ENDS the chain. it is never jumped.

   emitted nearest-level LAST, so a consumer iterates reversed and the
   nearest one refines. de-duplicated by resolved path, then by content
   hash.

   ADDING A SLOT IS ADDING ONE TABLE ROW -- not writing a scanner. and
   the inactive-file suffix is excluded BY THE GRAMMAR, which is what
   makes rename-as-activation work with no loader support at all.

   THE FILE IS IMPORT-TERMINAL ON PURPOSE: it imports nothing of the
   framework. character caps, hook registration, skill rendering all
   belong to consumers.

        IT FINDS. THEY DECIDE WHAT FINDING MEANS.

• Provenance is stamped at the source, not reconstructed later. Each returned file knows which root kind, which level and which folder it came from, so precedence is inspectable rather than implied by list order.
• The refusal is the design. The character caps live at the consumer as a semantic alarm; a resolver that also truncates is a resolver whose answer depends on who asked.
• The competing loader was deleted. An application-side loader that read one directory and never walked had made the ambient rule silently false for hooks — two resolvers means one of them is lying, and you find out at the worst moment.

Runs in heaven-framework

The Swapping Work-Dir

The agent’s “where I am” is the last directory it read or ran a command in — not its process working directory — and moving out of a directory silently unloads that directory’s rules.

   A PROCESS WORKING DIRECTORY IS FIXED AT LAUNCH, so it is REFUSED as
   the answer to "where is the agent".

   ( AFTER EVERY TOOL CALL )
        scrape a filesystem path out of the call --
             from the known argument names, or, for a shell command,
             by finding absolute paths in the command string and
             CHECKING THEY EXIST
                  |
                  v
        SWAP the active directory. swap, NOT accumulate:
             LEAVING A DIRECTORY DROPS ITS RULES,
             exactly as an instructions file is live only while you
             are standing in it.

   the configured launch directory stays always-on, separately, so:

        the context = MY OWN rules
                      AND the rules of wherever I am standing now

   AND THE TIMING IS HALF THE MECHANISM:
        the whole thing is re-derived FROM DISK every iteration AND
        mid-tool-loop, BEFORE the model is shown the tool result --
        so the model reads that result with the just-entered
        directory's rules ALREADY in its system prompt.
        refresh after the call instead, and the rules land one model
        call late.

   walking into a place equips that place. THE PLACE TEACHES WHOEVER
   STANDS IN IT -- including an agent that was never designed to run
   there.

• The scrape is best-effort and never raises. Location tracking that can break a tool call is worse than location tracking that occasionally misses one.
• Swap rather than accumulate is what makes a directory a place instead of a permanent acquisition. An agent that walks through ten directories does not end up carrying ten loadouts.
• Re-deriving every iteration is the cost that buys the property. Nothing is cached, so nothing can be stale, and editing a rule file changes the next model call rather than the next session.

Runs in heaven-framework

The Sticky Persona Declaration

A line of text inside any file the agent loads can seize the agent’s identity — and one form of it switches off the entire ambient rule-loading walk.

   TWO DIRECTIVES, scanned in EVERY loaded instruction surface -- an
   instructions file, an ambient rule, the base system prompt itself:

        persona = NAME              composes WITH the ambient rules
        ABSOLUTE persona = NAME     also switches the ambient walk OFF

   absolute is tested FIRST, because its literal CONTAINS the plain one
   as a substring; a fixed-width negative lookbehind then stops the
   plain form from matching inside it.

   AND UNLIKE THE WORK DIRECTORY, WHICH SWAPS, THIS IS STICKY:
        set once, never cleared on move -- a forced identity survives
        the agent walking away from the file that declared it.

   ONE NAME EXPANDS INTO FOUR SUBSYSTEMS:
        the frame          prepended inside a marker that is STRIPPED
                           at the top of every render, so it cannot
                           double across turns
        the skill set
        the tool-server set   which expands AGAIN: server configs
                           loaded onto the agent, PLUS one skill per
                           server so the agent has it in context
        the store identity

   the persona is a READ, not the equip ceremony. and the whole cascade
   is wrapped best-effort, so resolving an identity can never block a
   startup.

• Identity is declarable from inside the content, which is the same move as the ambient walk itself: what the agent is, is a property of what it is currently reading.
• The absolute form is an escape hatch with teeth. Composing with ambient rules is the default; a persona that must not be edited by its surroundings says so, and the walk stops.
• Sticky is the right default here and swapping is the right default for location — the two live side by side in the same resolve, deliberately, because an identity you can walk out of is not an identity.

Runs in heaven-framework

Nine Seams, and One of Them Can Say No

Nine named points in an agent turn where outside code runs — and one of them can cancel a tool call and hand the model a perfectly normal-looking tool result instead.

   NINE NAMED POINTS in a turn:

     before run           before iteration      before tool call
     after run            after iteration       after tool call
     before system prompt        on block report        on error

   a registry maps point --> callables. a context object carries the
   named fields PLUS a free data dict which is BOTH inter-hook state
   AND the channel for point-specific extras.

   TWO OF THE NINE ARE NOT OBSERVERS. THEY ARE WRITE PATHS INTO THE
   TURN:

     before tool call     a hook sets BLOCK; the tool is SKIPPED and
                          the block message becomes THE TOOL RESULT --
                          so the model receives an ordinary result,
                          not an exception and not a silent no-op
     before system prompt a hook REWRITES the rendered prompt

   and the block-report point fires with the structured report AND the
   rendered text BEFORE the temporary file is deleted, so a handler can
   never race the cleanup.

   THE REGISTRY IS A CONFIG FIELD, so an agent's hook set is part of
   its declared shape -- and the framework's own directory tracker
   registers into it exactly like a third party does.

• A veto that reads back as a tool result is the whole trick. The model does not learn about the enforcement layer; it learns what happened, in the grammar it already speaks — which is how the write-block can be pedagogical rather than fatal.
• The free data dict is doing two jobs on purpose: it is how one hook talks to the next, and it is how a hook talks back to the turn. One channel, so there is no second convention to learn.
• Firing before the cleanup, not after, is the difference between a report handler and a race.

Runs in heaven-framework

Header-Declared Hooks

A hook file says what it binds to in a text header, so the loader knows its events without ever executing it — and hooks written in any language, importing nothing, plug into the same seams as in-process ones.

   TWO KINDS BEHIND ONE LOADER -- and the classifier READS the file. it
   never executes it to find out what it is.

     # hook-events: before_tool_call, after_run      <-- in the first
     # hook-timeout: 10        (optional)                30 lines

     header present  --> A SCRIPT HOOK. a subprocess. one JSON object
                         on stdin, one on stdout. imports NOTHING of
                         the framework. ANY LANGUAGE.
     no header       --> A MODULE HOOK. imported in-process and bound.

   THE SCRIPT ENVELOPE MAPS ONTO THE WRITE PATHS ABOVE:

     decision "block"  -- or exit code 2, with stderr as the reason
                       --> the before-tool veto
     a system message / extra context
                       --> accumulated into a per-agent buffer that a
                           FLUSHER drains into the prompt. the flusher
                           is registered EXACTLY ONCE, by whichever
                           script hook arrives first.

   EVERY FAILURE MODE IS FAIL-OPEN: a timeout, a crash, unparseable
   output. logged; the turn untouched.

   AND ONE GUARD ON THE MODULE PATH:
        an EXIT RAISED AT IMPORT is converted into an import error.
        a hooks folder also holds standalone stdin-scripts that exit at
        module level -- and that particular exception is not an
        ordinary one, so it slipped past the caller's guard and killed
        the HOST process.

• Declaration in a comment header is what keeps the loader honest. Discovering a hook’s events by importing it means importing every candidate file to find out whether you wanted it.
• Two implementation languages, one authority. A shell script and an in-process function reach the same veto and the same prompt inject, so the choice is about the job, never about how much power you get.
• The import guard is a receipt. The failure it prevents took down the host process, and the fix is one narrow conversion at the one place a foreign file gets imported.

Runs in heaven-framework

Arguments as Data, Compiled per Destination

A tool declares its arguments as a plain nested dictionary — not language types, not a schema class — and the framework compiles that dictionary into whatever schema shape the target runtime demands.

   THE DECLARATION IS A PLAIN NESTED DICT:

        { name, type, description, required,
          items    for arrays,
          nested   for a true sub-model }

   ( VALIDATE )   walks it recursively and RAISES on a missing
        description, an unsupported type, or a non-boolean required
        flag -- and performs ONE quiet rewrite:

             a DEFAULT is DELETED from the schema and folded into the
             description text, so the model READS "(defaults to X)"
             instead of being handed a schema-level default it might
             not send.

   ( COMPILE )   one dynamic model, extras FORBIDDEN, built through the
        single spelling that resolves identically across every minor
        version of the validation library -- deliberately
        version-agnostic
             |
        +----+----------------------------+
        v                                 v
   ONE RUNTIME'S TOOL               ANOTHER RUNTIME'S TOOL
   plus a raising synchronous       wrapped so its declaration is
   stub when the tool is            HAND-MERGED back over the one that
   asynchronous-only                runtime generated: recursing into
                                    object properties and array items,
                                    re-deriving what is required, and
                                    lowercasing enum types for the
                                    router underneath

   THE DECLARATION IS DATA. THE BINDING IS COMPILED PER DESTINATION.
   and the inverse exists: a function signature plus its docstring
   produces the same dictionary.

• Data beats types here for one reason: the same declaration has to become two different runtimes’ idea of a schema, and only one of those is yours to define.
• Folding the default into the description is the small honest fix for a model that reads prose more reliably than it reads schema metadata.
• Hand-merging over the generated declaration is admitted maintenance, not elegance — it is what makes nested objects and array items survive a runtime whose generator flattens them.

Runs in heaven-framework

Four Slots, and No Tool Ever Raises

Every outcome — output, error, image, system note — comes back in the same frozen four-field value, so the agent’s loop reads errors as content rather than handling exceptions.

   ONE FROZEN VALUE, FOUR OPTIONAL SLOTS:

        { output | error | image | system }

        truthy   = any slot filled
        adding two results concatenates field by field, and REFUSES to
                   merge two images
        the failure subtype carries NO NEW FIELDS. THE SHAPE IS THE
                   CONTRACT.

   both execution paths funnel every exception into the ERROR SLOT, so
   the agent loop's job is never exception handling -- it is deciding
   what an error slot MEANS. the loop then materialises the envelope
   into a message in slot priority:

        error  -->  image  -->  output

   THE STRANGEST EDGE: crossing one runtime's function-response
   boundary, a result can arrive as its own PRINTED FORM -- so the
   envelope is parsed back out of its own repr, and re-parsed once more
   if the unwrapped output is itself a nested one.

   AND THE STRUCTURAL COUNTERPART: EVERY tool-use gets a matching
   result message -- including SYNTHETIC ones for a tool that was not
   available, and for calls abandoned at the call ceiling.
   an orphan tool-use makes the NEXT request fail outright.

• Errors as values, at the tool boundary, is what lets a hook veto, a crashed subprocess and a successful call all come back through one path the loop already understands.
• Refusing to merge two images is the kind of small explicit refusal that keeps a concatenation operator from silently inventing a result.
• Pairing every tool-use with a result, including the abandoned ones, is not tidiness — an unmatched call is a hard failure on the following request, so the synthetic message is load-bearing.

Runs in heaven-framework

The No-Tools Compaction Clone

When its transcript gets too big, the agent builds a stripped copy of itself pointed at its own history, makes the copy narrate the whole conversation in passes, then replaces its live history with that narration.

   the transcript is over the threshold -- checked BEFORE every model
   call, guarded by a re-entrancy flag
             |
             v
   ( BUILD A CLONE FROM SELF )   same model, same provider, same
        ceiling, same extra arguments -- TOOL LIST STRIPPED EMPTY, the
        compaction prompt swapped in, constructed ON THE SAME HISTORY
             |
             v
   ( MULTI-PASS )   the first prompt, then a continue prompt,
        harvesting summary blocks each pass; stop on the completion
        marker, or on a pass that yields nothing new
             |
             v
   REPLACE the working transcript with exactly:
        [ the system message , ONE human turn carrying the summary ]

   AND THE PROMPTS INVERT NORMAL SUMMARISATION: exhaustive,
   chronological, exact paths and commands, "do NOT compress or
   abstract". they live in a pure-data module that imports nothing of
   the framework -- the dependency runs ONE WAY only.

   PLUS THE REACTIVE HALF, for when the threshold guessed wrong:
        catch an error whose text mentions the context window
        POP WHOLE ITERATIONS off the front -- a message plus every
             non-human message following it -- until about thirty
             thousand characters are gone
        retry. up to twenty times.

• The compactor is the same agent minus its tools. Nothing new is configured, nothing new is deployed, and the narration is produced by exactly the model that produced the transcript.
• Same history id, on purpose. The clone is not handed a copy of the conversation; it is pointed at the conversation, which is why the replacement is a swap rather than a merge.
• The proactive threshold and the reactive pop are both kept, because a threshold is a guess and the error is a fact.

Runs in heaven-framework

The Fenced Keyword Channel

Any caller can name arbitrary keywords, and whatever the model writes inside those fences is harvested out of free text into persisted, auto-numbered agent state. Structured output without a structured-output API.

   the caller names arbitrary KEYWORDS, plus one instruction telling
   the model how to fence them. then, after every response:

        FLATTEN the content into one string -- recursing through
        dicts, lists and nested message objects
                  |
                  v
        for each keyword, scan for BOTH syntaxes:
             a fenced code block named for it
             a tag pair named for it
        merge the two match sets SORTED BY POSITION, so declaration
        order inside the response survives
                  |
                  v
        REPEATS DO NOT COLLIDE AND DO NOT OVERWRITE:
             the first lands under the keyword
             the next under keyword_2, keyword_3 ...
             numbered from the highest already persisted
                  |
                  v
   { the agent's extracted content }   saved WITH the history, so a
                                       harvested deliverable outlives
                                       the run

   THE SAME TEXT-AS-CONTROL-PLANE IDEA FROM THE OTHER DIRECTION: agent
   mode is switched on by a regular expression over the INCOMING
   prompt, and the task-list, complete and goal-accomplished signals
   are recognised as fenced text AND as tool calls.

• The channel is the caller’s to define. Nothing in the framework knows what the keywords mean; it knows how to find them and where to put them.
• Accepting both a fence and a tag costs one merge and removes the entire class of near-miss where the model chose the other obvious syntax.
• Numbering against the persisted state, not the response, is what makes repeated emissions across many turns accumulate instead of overwrite.

Runs in heaven-framework

A State Machine Riding the Keyword Channel

A finite state machine for an agent, built entirely on top of the keyword-extraction channel above: the state names are the keywords, and a transition swaps the agent’s goal, tools and prompt for the next iteration.

   NO SEPARATE CONTROL PLANE.

   AT CONSTRUCTION, three things are wired onto the agent:
        every state name is registered as an extraction keyword
        a closure-captured transition tool is appended to its tools
        a block listing the states and the LEGAL transitions is
             appended to its system prompt
        + any persisted state is loaded back off disk

   PER ITERATION:
        the agent emits    <STATE NAME> the reason </STATE NAME>
                  |
        the existing extraction catches it into the agent's state
                  |
        the machine VALIDATES the move against the declared table
                  |
        and swaps in that state's config -- goal, tool list, prompt
        suffix, extra keywords -- WHICH TAKES EFFECT NEXT ITERATION
                  |
        persisted on EVERY transition, so a crash resumes mid-machine

   AN UNNAMED AGENT IS REFUSED AT CONSTRUCTION: persistence needs a
   unique directory, so the reserved names are rejected outright.

   AND ABOVE IT SITS A COMPLETION CLAMP: reach a terminal state too
   early and the machine is RESET and re-run with a continuation
   prompt naming the cycle number.

• Control flow riding an existing channel is why this cost almost nothing: the transition mechanism is the harvest that was already running after every response.
• The transition table is declared and checked, so an invented move is refused rather than quietly followed — the difference between a state machine and a suggestion.
• The clamp is a second opinion about being finished. An agent that reaches its terminal state on the first cycle has usually answered a smaller question than the one it was given.

Runs in heaven-framework

Iteration-Derived History

The conversation is stored twice — machine-readable and human-readable, side by side in the same date-sharded folder — and “an iteration” is not stored at all. It is computed by splitting the message list at user turns.

   STORED TWICE, SIDE BY SIDE:

        { id }.json   for machines      in one date-sharded folder,
        { id }.md     for people        the id itself encoding the
                                        timestamp and the agent

   re-saving an existing id OVERWRITES IN PLACE. a history is a live
   handle, not an append log.

   AND "AN ITERATION" IS NOT STORED AT ALL -- IT IS DERIVED:

        walk the messages; START A NEW BUCKET AT EVERY USER TURN;
        every non-user message falls into the current bucket

   so everything that trims operates on COMPUTED boundaries rather
   than message counts:
        the summariser keeps N recent ITERATIONS and replaces the rest
             with one summary message
        the context guard pops whole ITERATIONS

   ONE MORE THING THE LOG HAS TO SUPPLY: the message objects carry no
   native timestamp. so one is written into their free-form extras AT
   RECEIPT, set-if-absent and never overwriting, and the history
   round-trips those extras for free. that is the ONE place a
   per-message happen-time can live, and a downstream observatory keys
   a stable identity off it.

   the goal, the task list, the current task and the extracted content
   persist alongside -- which is what makes resuming a real RESUME
   rather than a replay.

• Derived structure over a flat log means there is no second representation to keep in sync: the buckets cannot disagree with the messages, because they are recomputed from them.
• Two files, two audiences, one save. The human copy is not a debugging export; it is written every time, so it is never behind.
• Set-if-absent on the timestamp is what keeps a re-save or a round-trip from quietly restamping when a message actually happened.

Runs in heaven-framework

Prompt Blocks That Execute

A system prompt is assembled from a list of reference strings, and some of those references import a module and call a function at render time — with failures rendered into the prompt as visible text instead of raised.

   THE SUFFIX IS A LIST OF STRINGS, each read as a mini-address:

     path = /abs/file             read that file
     variable = { path, name }    load a module FROM A FILE PATH and
                                  pull a module-level value out of it
     registry value = { ... }     read a value out of a registry
     CALL = { path, function, args }
                                  import the module and INVOKE it,
                                  splicing the return into the prompt
     a bare name                  fall through to the block registry

   AND THE FAILURE POLICY IS THE NOTABLE PART:

     a bad import, a missing function, or a non-callable target each
     append "[ dynamic call failed: ... ]" WITH the traceback INTO THE
     PROMPT -- so the model can SEE its own broken context instead of
     the run dying on assembly.

   UNDERNEATH, THE BASE PROMPT IS ITSELF POSSIBLY GENERATED: rebuilt
   from a definition file and CACHED AGAINST THAT FILE'S MODIFICATION
   TIME, so it re-renders only when the definition changes on disk.

   AND ASSEMBLY IS IDEMPOTENT BY CONSTRUCTION: a suffix already present
   in the base is filtered out, and the whole chain --

        definition  -->  the blocks  -->  the ambient walk  -->  the
        rewrite hook

   -- runs EVERY iteration, writing back into the transcript's first
   slot ONLY when the text actually changed.

• A prompt that can call code is a prompt that can be current — the alternative is a template somebody re-pastes whenever the underlying value moves.
• Rendering the failure into the prompt puts the broken context in front of the one participant who can say “my instructions are damaged” — and costs nothing when everything works.
• Change-gated write-back is what makes re-deriving the whole prompt every single iteration affordable: the transcript is only touched when the text is genuinely different.

Runs in heaven-framework

Validate Live, Park, Drain

The call that adds a concept never touches the database. It runs the gates in its own process, writes one envelope into a spool directory, and returns. A separate worker drains the spool and is the only thing that writes the store and the readable mirror — so the caller is cheap and non-blocking, and a rejection provably never reaches the store, because the gates fire before the envelope exists.

   ( THE CALL )   in the caller's own process
      1. the quota check            refused --> NOTHING is written
      2. validate against the symbolic reasoner over the wire
             a grade, PLUS the deductions it made along the way:
             which chains fired, triples it composed, effects to
             release, gaps it wants filled, compositions it suggests
      3. write ONE envelope file
             |
             '--> THE CALL RETURNS HERE. no store write yet.
             v
   { the spool }
             |
             v
   ( THE WORKER )   the SOLE writer of the store and of the mirror
        merge the nodes and the edges in one batch
        write the readable file for each concept
        apply the queued properties -- the node landed in the same
             drain, so there is no race to lose
        dispatch the effects the reasoner deduced
        merge the triples it composed
        PARK the suggestions durably, for a human

   the gates run on the LIVE path. validating a derived view while the
   spool write proceeds is the exact silent failure this shape exists
   to prevent.

• The caller holds zero write authority. Its entire output is a file, which is what makes “a rejected concept cannot be in the store” a structural fact rather than a code review.
• The validator returns deductions nobody asked for, and the envelope carries them verbatim rather than acting on them — the deciding and the doing are different processes.

Runs in carton-mcp

The Gate Whose State Machine Lives in the Store It Gates

A state machine here is not code and not configuration — it is ordinary concepts and edges, authored through the same interface everything else uses. Each actor carries a cursor; while an actor sits at a step, every retrieval must match that step’s pattern. A match passes and advances the cursor; a miss is refused, and the refusal message is the instruction for the next move.

   THE MACHINE -- ordinary nodes and edges, in the store itself
     a machine --has step--> a step { its required pattern, its text }
                                 +--next step (weighted)--> a step
                                 '--calls------------------> a machine
     an actor --has lifecycle--> a state --current step--> a step
                                          ^ a PER-ACTOR cursor

   THE GATE -- every call passes through it
     no actor, not locked, or the kill file is present  --> ALLOW
     does the call match the step's required pattern?
         HIT  --> allow, and advance: the highest-weighted successor,
                  or down into a sub-machine, or unlock at the end
         MISS --> REFUSE -- and the refusal text IS the step's
                  instruction, so a block is a next move
     ANY internal fault at all -------------------------> ALLOW

   ACTIVATION   a result carrying a trigger locks that actor into that
                flow, and never interrupts an actor already locked
   THE LEDGER   lock, branch, advance, refusal, unlock -- append-only

   retrieval stops being flat lookup and becomes a traversal you can
   program -- and an agent can author its own gate with the same tool
   it uses to write its notes.

• Reads are gated, not only writes. Where you are decides what you are allowed to look up, which is what makes this a controller rather than a permission list.
• The safety authority is deliberately outside the graph: a kill file disables the gate globally and every fault path allows, so a malformed machine can never lock an agent out of its own memory.
• Compare the cursor state machine two groups up: same idea, opposite substrate — there the states are skills on disk, here they are nodes in the store being gated.

Runs in carton-mcp

The Predicate Is a Node, and Every Edge Is Stamped

Relationship types are themselves concepts in the same store, so writing one mints a node for the relationship. Every edge is stamped at write time with whether its predicate is a proven vocabulary word or an invented one, the inverse edge is written automatically with the same stamp, and an unproven predicate gets an edge marking it as unfinished — so the store’s own incomplete vocabulary is a query rather than a lint report somewhere else.

   write:   Dog --loves--> Cat
              |
              v
   ( CLASSIFY )   is this predicate in the proven set?
              |
      yes --> "strong"                no --> "weak"
              |                              |
              v                              v
   the edge is written WITH THE STAMP -- and so is its inverse
        is-a <--> has-instances       part-of <--> has-parts
        depends-on <--> supports      relates-to <--> relates-to
              |
              v
   an unproven predicate ALSO gets:
        { loves } --requires evolution--> { work to do }
             ^ the predicate is a NODE, so "this word is not yet
               earned" is something you can MATCH ON, not a warning
               you can lose

   nothing is REJECTED here. the low-grade layer is deliberate; the
   grading happens ON THE EDGE, not at the door.

• The stamp is written by the same call that writes the edge, so no later reconciliation pass can disagree with it.
• The honest bound, read in the source: the “earn your predicate” lookup is currently pinned to the bootstrap primitives to avoid a query storm per observation. The shape is wired; the registry is pinned.

Runs in carton-mcp

Two Bodies per Concept, and a Linker That Cannot See the Fences

Every concept exists twice — as a node in the store and as a readable file on disk — written by the same drain, so the store is never a black box and the same knowledge is queryable, diffable and indexable. On top sits a linker that turns any mention of another concept into a link across the whole corpus, using a masking trick that makes embedded structured blocks literally invisible to it.

   ONE CONCEPT, TWO BODIES, written in ONE drain
     the node   structure, traversal, queries
     the file   readable, diffable, and the body the retrieval index
                actually reads

   ( AUTO-LINK a description )
     1. find every embedded structured block with a STRING-AWARE brace
        scan -- not a pattern match, so a closing marker inside a
        quoted value cannot end a block early
     2. replace each block with ONE PRIVATE-USE CHARACTER
            it has no letters, no digits, no brackets -- so it is
            invisible both to the matcher AND to the bracket-stripping
            passes that would otherwise eat the block's contents
     3. run the matcher over the masked text against EVERY concept name
            the automaton is cached BY TIME BUCKET, not by concept
            count -- keying it on the count rebuilt it continuously
            once the corpus was large
     4. restore every block VERBATIM

   the two bodies are PEERS, not a cache and an origin: a standalone
   pass can rebuild the files from the store.

• Masking decides what the linker is allowed to see, which is what makes surgical edits to one concept body safe — prose and neighbouring blocks stay byte-identical.
• Corpus-global by design. Adding one concept changes how every other concept’s prose reads, within one cache window, so the link graph is a consequence of the vocabulary rather than of anyone’s editing.

Runs in carton-mcp

Off by Default, Metered When On

The same program is a private local store and a metered multi-tenant service, and the difference is two environment values. Unset, both the network layer and the quota layer are byte-identical no-ops that run zero queries and never touch the server object. Set, they become a fail-closed gate around the transport and a count gate at the single write chokepoint — one that refuses growth but still allows refinement.

   THE TRANSPORT
     unset       --> the local pipe. the server object is NEVER modified.
     one option  --> REFUSED OUTRIGHT: long sessions degraded into
                     broken pipes, and no caller may opt into a known
                     failure mode
     network     --> a key is REQUIRED or the process refuses to start.
                     the gate is a dependency-free middleware wrapper,
                     because authentication could not ride a constructor
                     argument across every version it must support.
                     the default host is loopback: exposure is an
                     explicit act.

   THE QUOTA   at the one chokepoint every creation passes through,
               and BEFORE the spool write
     unset                          --> return immediately, zero queries
     a limit is set:
        under it                    --> allow
        at it, and the concept EXISTS --> allow      "refine"
        at it, and the concept is NEW --> REFUSE     "grow"
        the count query FAILED      --> RAISE. never fail open to
                                        "unlimited".

   the refusal is SEMANTIC, not numeric: it distinguishes a tenant who
   wants MORE knowledge from one who wants BETTER knowledge, and only
   stops the first.

• A commercial skin that is provably inert when unconfigured is the only kind you can put in something that also ships as a personal tool.
• Both failure directions are chosen deliberately: the trust boundary fails closed, and the thing that must never silently mean “unlimited” fails loud.

Runs in carton-mcp

The Deducer That Ships Its Own Bound

A module that reads one class’s definition from two independent surfaces at once — the live property store and a loaded formal ontology — fuses them into a coloured slot structure, computes its symmetry, cross-checks the answer by brute-force enumeration, and staples a soundness caveat onto every single output. It writes nothing: the write-back encoder exists, is fully implemented, and is deliberately called from nowhere.

   SURFACE A -- the live store       SURFACE B -- the formal ontology
     required parts                    typed restrictions, with
     required predicates               cardinalities
     the core sentence's slots         a name index, so a name on one
                                       side resolves on the other
        '--------------+------------------------'
                       v
   { THE DEFINITION }   slots coloured by predicate, target type,
                        cardinality and stage
                       |
   ( DEDUCE )   the structure is a star, so the symmetry is the product
                over the colour classes -- and the classes ARE the orbits
                       |
       +---------------+----------------+
       v               v                v
   ( VERIFY )     ( REFINE )      ( CARRY THE BOUND )
   enumerate      narrow the      EVERY output carries it:
   the small      orbits using    what is TRUE is a SUBSET of what is
   cases and      live evidence   FORMAL. an ontology cannot distinguish
   compare                        what it cannot express, so anything
                                  derived is graded LOW, never high

   ( ENCODE THE RESULT BACK )   implemented. CALLED NOWHERE.
        the write shape is reviewable before it is ever live.

• The caveat is a field on the result, not a line in a document. Every consumer receives the bound on what the answer can mean, whether or not anyone read the readme.
• Two read surfaces and no merge authority. Neither is treated as canonical over the other, and the module holds no write authority at all — so a disagreement is visible instead of being silently resolved.

Runs in carton-mcp

An Identity With Two Halves, Handed Over in a File

An acting identity is not a configuration object — it is a node in the same store as the knowledge, split into a persona half and a substrate half, with the retrieval cursor hanging off the substrate. And because the process that equips an identity is not the process that runs the gate, the active identity is handed over as one line in a file — which makes the whole mechanism default-safe.

   { AN IDENTITY }
     THE PERSONA HALF -- the WHO
        has a frame (its instructions), has its rules
     THE SUBSTRATE HALF -- the BODY it is reflected onto
        has a skill set, has a collection, HAS THE CURSOR

   AT WRITE TIME
     every concept observed from this identity's point of view is ALSO
     stamped as part of that identity's collection
        --> one substrate, many readable points of view, and no forked
            data. membership is laid down AS OBSERVATIONS ARRIVE, not
            computed at read time.

   ACROSS PROCESSES
     [ the equipping process ]   writes ONE LINE
              |
              v
        { a file }
              ^
              |   reads it
     [ the gate's process ]   that name IS the actor

     the file is absent?  fall back to the environment, then to the
     default -- and the system behaves exactly as it did before.

• One entity is the join point for personas, rule sets, capability access, collection membership and the gate cursor — instead of the same identity being reconstructed independently in four subsystems.
• The filesystem as deliberate, inspectable inter-process communication, chosen because environment values do not cross a process boundary and a shared database would be a heavier dependency than the fact deserves.

Runs in carton-mcp

Gaps Typed by Who May Fill Them

When the reasoner hits a slot it cannot fill it neither guesses nor merely reports “incomplete” — it emits the gap typed by which authority is permitted to fill it. A client routes each typed gap to a filler keyed by that authority, merges any answer back in as a new observation, and re-derives. Re-derivation is the resume; there is no saved continuation anywhere.

   observations --> ( THE REASONER ) --> a verdict carrying, per gap:
        the role, the concept, the gap, the expected type, why
                        |
                        v
   one request kind per authority:
        a domain expert, an architect, an end user -
        the system itself, a model, an authorised agent

        ( and NOT the caller -- the caller already holds that gap in
          its hands, so it deliberately has NO request kind )
                        |
        route each one to a filler for that authority
        +---------------+---------------+---------------+
        v               v               v               v
   park it for      ask a fresh     let the engine   return nothing
   a human          model           deduce it        = PARKED, durably
        |               |               |
        '------- an answer ------------'
                        |
        merge it into the WHOLE concept and re-submit
             ( a delta alone will NOT re-derive: the closure pull
               would never fetch it back )
                        |
        loop until a whole round produces no answer, or the ceiling

• The authority table is rebuilt from scratch every event, so the outstanding request list is always current rather than a queue that goes stale.
• The routing lives in the reasoner; the host only reads the raised requests. An unknown authority builds nothing rather than defaulting to somebody who never agreed to answer.

Runs in the lab

Who Fills It, Deduced From What It Is

For a gap no curated table covers, who must fill it is deduced from the ontological category of the missing thing. If the expected type reaches the abstract branch it is a universal, and a model can generate it. If it reaches the concrete branches it is a particular, and it must be attested from reality — so only a human who knows the instance may fill it.

   a missing slot ( the concept, the predicate, the expected type )
        |
        +-- does anything already SAY who?
        |      a fact in the store WINS over the curated table ----> done
        |
        +-- a declared or learned strategy for this type and slot? --> use it
        |
        v
   ( DEDUCE FROM THE CATEGORY )
        primitive, or it reaches ABSTRACT            --> generate it
        it reaches an ENDURING, OCCURRING or         --> attest it
        QUALITY branch
        |
        v
   generate it  --> ask a model            ( a universal )
   attest it    --> ask a human who knows  ( a particular )
                    the instance
        |
        v
   raised on the SAME request channel as everything else -- zero extra
   wiring in the host

   AND IT LEARNS: an ordinary observation carrying a type, a slot and a
   strategy DECLARES one, guarded against the known set -- so an outside
   accumulator can teach the router from how slots actually got filled.

• Exactly one strategy per slot, decided deterministically. A concept with several parents was emitting two conflicting requests — one from its learned type, one from a transitive type falling through to the older deduction.
• Universals can be generated and particulars cannot. The whole routing rule is one ontological distinction applied mechanically, which is why it needs no table to maintain.

Runs in the lab

Load Only What This Event Mentions, and Only Above a Floor

The reasoner holds no domain facts at rest — only the program. Each event pulls in just the requirement closure of the concepts that event mentions, and the pull is filtered by grade, so it can never wander into the low-quality neighbourhood. The same line is the write floor: only material above the bar is persisted back.

   AT REST   the reasoner = THE PROGRAM ONLY. the store, untouched.

   an event
      |  the seed is every name this event mentions
      v
   ( WALK )   breadth-first, and breadth-first ON PURPOSE: a
              depth-first walk made the recorded depth depend on the
              path taken, so a node first reached the long way pulled
              at that depth and its children were dropped
        read each subject's triples ABOVE THE GRADE FLOOR   <-- READ floor
        skip the primitives and the resident seeds
        do not follow literal or provenance predicates
        bounded depth; every node recorded at its MINIMUM depth
      |
      v
   { the only facts the rules can see }

      ... the event runs ...

      v
   ( PERSIST )   only material at or above the bar        <-- WRITE floor
        never low-grade, never an undefined parent, never a
        contradiction, never the event's own scratch facts, which are
        retracted inside the event

   cost is proportional to the EVENT, not to the store.

• One function is the only way facts get in and one is the only way they get out, and the outbound one is scoped to this event’s concepts — so a long-running process cannot accumulate a working set.
• Three lifetimes share one working set — domain facts persist, event facts and tool-call facts never do — and which is which is a prefix, checked in one place.

Runs in the lab

Ask Backwards, Compose Forwards, Same Turn

Because the reasoner may not reach the store, a rule that needs something it cannot see raises a need naming the shape it wants. The host satisfies that need with one indexed query, pulls the match’s bounded neighbourhood in, and re-fires. Backward asking and forward composing alternate inside a single event until nothing changes.

   +--------------- the cascade, bounded -----------------------------+
   |  clear the unmet-requirement marks                               |
   |  fire every deduction chain                                      |
   |      |                                                           |
   |      +-- a rule needs a shape it cannot see                      |
   |      |      --> raise a NEED, naming the type                    |
   |      |      --> THE HOST finds subjects of that type and pulls   |
   |      |          their bounded neighbourhood in                   |
   |      |      --> each type is attempted ONCE, so an unsatisfiable |
   |      |          need can never spin the loop                     |
   |      |                                                           |
   |      '-- an open chain's next layer is not built                 |
   |             --> the same pull, but walked ALONG the declared     |
   |                 layers rather than by a flat sweep               |
   |                                                                  |
   |  no new facts AND nothing hydrated?  -----------------------> stop|
   +------------------------------------------------------------------+

   the store is searched ONLY along paths some rule actually asked for.
   deductions made on the way leave as composed facts for the caller.

• The reasoner raises needs and is structurally unable to satisfy them. The host is the only thing permitted to query, and it only ever answers a raised need — so the search space is defined by the logic instead of by a heuristic.
• The attempt-once set and the iteration ceiling belong to the loop, not to any rule. Termination safety sits outside the logic being run.

Runs in the lab

Lift a Foreign Runtime Into the Type System

An existing, working logic program is neither rewritten nor run as a separate service. A scanner written in the same language reads it structurally, its predicate signatures are lifted into the ontology as types with one required part per argument, and the same embedded runtime that holds the reasoner also holds the foreign modules — so an admitted instance resolves to a module-qualified call made in the same process.

   the foreign source
        |  a STRUCTURAL scan, by a scanner written in that same
        |  language -- string splitting cannot survive multiline
        |  clauses, quoted atoms, operators or directives
        v
   { every term, classified }   facts, rules, grammars, queries -
        directives, PLUS an explicit leftover bucket that must be EMPTY
        for the build to be trusted
        |
        v
   choose a lift scope: the bridge surface, the public surface -
        everything (which is a thirty-fold larger payload)
        |
        v
   ONE type declaration per predicate:
        its name, its signature, and ONE REQUIRED PART PER ARGUMENT --
        every position is required, because a variable is a binding
        mechanism, not an optional parameter
        |
        v
   two of three arguments present --> incomplete, with the third NAMED
   three of three                 --> complete
        |
        v
   [ designed, not yet proven ]   resolve the identity and call the
        module-qualified predicate IN THE SAME PROCESS. no second
        runtime. no logic over the wire. no separate service.

   ONE runtime, TWO levels: the upper level reasons ABOUT the lower
   level's predicates as ontology entities, and the lower program
   keeps running unchanged.

• Only the language itself can parse the language. The host code scans, aggregates, selects a scope, renders and posts — and decides nothing semantic.
• The foreign program receives an ordinary call and knows nothing about the ontology. Selecting and interpreting that call is entirely the upper level’s authority, which is what makes the lift non-invasive.

Runs in the lab

The Tool Call Becomes an Observation First

An agent’s tool call is turned into an observation before it executes; the ontology grades it like anything else, and the gate blocks the call when its target was never observed. The facts about the call exist only for the length of that event and leave no residue in the store.

   the agent is about to write --> ( the before-tool hook )
        derive an action and a target from the tool
        |
        v
   an observation:   this call --has action--> write
                               --has target--> <the thing>
        |   through the same single door as everything else
        v
   ( CHECK )  the target has no observation source?
                 --> a missing slot: an unobserved write target
                 --> "[WRITE GATE] this call targets something
                      that was never observed"
   ( CHECK )  a deploy action with no passing test recorded anywhere?
                 --> flagged the same way
        |
        v
   the verdict carries the block --> the hook exits refusing
                                 --> THE TOOL CALL NEVER RUNS

   AND THE ORDER IS LOAD-BEARING:
        the deduction chains fire FIRST -- they are allowed to read
        the call's facts
        THEN the call's facts are retracted
   retract early and the gate's own evidence vanishes mid-event.

• The hook is the only party that can refuse; the checks only grade and announce. Separating the two is what lets the same checks run in a non-blocking context.
• The retraction order is the correctness of the gate, and it lives in the orchestrator rather than inside any rule — a rule cannot accidentally break it.

Runs in the lab

Three Lanes at the Door

A candidate is submitted to an external validator before it joins the structure, and the verdict routes it down one of three lanes: full member, admitted at zero weight with a written obligation to be completed, or refused outright. Bad-but-honest content gets in and is visibly inert; only contradictions are turned away.

   a candidate, and where it would attach
              |
              v
   ( ASK THE VALIDATOR )   before any insertion
              |
        the candidate was not graded at all?  --> THROW.
        the gate refuses to guess a lane.
              |
     +--------+------------------+------------------------+
     v                           v                        v
   LANE 1: A MEMBER        LANE 2: BORN AT ZERO     LANE 3: REFUSED
   inserted at full        inserted, weight ZERO,   nothing is
   weight                  excluded from every      inserted at all
                           collapse
                           + tagged with a FILL
                             OBLIGATION parsed out
                             of the verdict
                                    |
                          later, the definition closes
                                    v
                          re-graded above the bar?
                          weight restored, tag cleared,
                          it re-enters play

   two ways in, the same three lanes: ask before each commit, or
   insert provisionally at zero and grade afterwards.

   a broken wire raises an error CARRYING what was already committed.
   there is NO fallback to ungated insertion, ever.

• Zero weight is not deletion. The thing is present, addressable, visibly incomplete, and carries the sentence describing what would complete it — so the backlog is inside the structure rather than beside it.
• Refusing to guess a lane when the verdict is silent is the difference between a gate and a coin flip.

Runs in the lab

Three Independent Marks on One Address

One address carries three orthogonal verdicts that cannot overwrite each other — its structural shape, what happened when something ran there, and whether a person declared it canonical — each written by a different authority. “Wrong” stays separate from “invalid” stays separate from “official.”

                          ONE ADDRESS
                               |
        +-------------+--------+---------+--------------+
        v             v                  v              v
   SHAPE          OUTCOME           CANONICITY        heat
   valid          ran clean         declared by an    a reading,
   adjacent       asserted wrongly  operator: by      not a verdict
   invalid        { when, by whom  fiat, by
                   , why, the     agreement, or
                    verdict }       by measurement
        ^             ^                  ^
        |             |                  |
   written by a   written by an     declared, and
   probe or a     EXECUTION         escalatable
   projection     witness

   ABSENT outcome = ungraded. uncertainty is never stored; only a
   probe writes.

   PROBING AN ADDRESS CONVERTS UNKNOWN INTO KNOWLEDGE
     an exact hit               --> return the stored shape
     the same shape as a known  --> "adjacent"
     a different shape          --> "invalid"
     ...and the probed address is PUSHED onto the map either way

   a bad outcome does NOT make the address invalid.
   a canonical mark does NOT make its content correct.

• Three writers, three lanes, strictly partitioned: structure decides shape, execution decides outcome, a person decides canonicity. Collapsing any two is how “this failed once” becomes “this is impossible.”
• Every mark carries who and why, so a canonical declaration is attributable rather than a property that simply appeared.

Runs in the lab

The Address Decodes to Sentences, and Names Where It Stops

Each token class in an address decodes to a specific relation, so walking an address emits a web of sentences — and the walk deliberately keeps going past the point where the structure actually exists, reporting the exact token at which decoding must hand off to inference.

   an address
      |  normalise, then WALK IT -- a pure read that never mutates and
      |  does not require the node to exist
      v
   token class            emits
   --------------------   ---------------------------------------
   a selection            this IS-A that
   a level boundary       the parent HAS-PART the next level's choice
   a descent              this PRODUCES a further space
   a parallel branch      a concurrent attribute

      |
      +-- the token resolves against real nodes --> a materialised node
      |
      '-- past that point ----------------------> a VIRTUAL node, and
                                                  the sentence is STILL
                                                  emitted: a web exists
                                                  for an address nobody
                                                  ever built
      v
   { nodes, edges, sentences, fully materialised?, THE BOUNDARY }

     the boundary names:
        the prefix that resolved on real nodes
        the first level that did not
        the exact token index inside it
        and WHY -- an undefined reference, no produced space, or an
        unmaterialised context

   which is the exact dot where DECODING stops and INFERENCE has to
   take over.

• The boundary is a mechanical fact of the walk, not a judgement any layer can override or argue with.
• Because the walk is pure and tolerates non-existence, the same function answers “what would this mean” for structures nobody has built yet — which is what makes it a map of the frontier rather than a lookup.

Runs in the lab

Total Agreement Is the Alarm

When every enumerated path in a space comes back fully resolved, the system raises an alarm and demands an external witness instead of reporting success. Frictionless internal coherence is treated as a defect signal.

   ( ENUMERATE every valid path through the structure )
        |
        v
   what fraction of the endpoints are settled?
        |
        +-- less than all --> a normal reading, plus THE WARM FRONTIER:
        |                     the ordered list of where to work next
        |
        '-- ALL OF THEM ----> RAISE THE ALARM
                              "one hundred per cent settled -- requires
                               an external witness; frictionless
                               coherence is the alarm, not the goal"

   and the flag rides INSIDE EVERY RESULT, next to the path count and
   the depth -- so no consumer can read the structure without also
   receiving the alarm.

   the flag BLOCKS NOTHING. it ESCALATES: the decision moves to a
   witness outside the system, rather than the system certifying
   itself.

• Carrying the alarm in-band with the ordinary result is what stops it from being a log line nobody reads.
• It transfers authority rather than refusing. A system that cannot fail its own check has stopped measuring anything — so the response to perfect agreement is to go and find someone outside it.

Runs in the lab

Rejection Is a Five-Field Argument, Signed

Calling something wrong requires filling out a formal argument — the entity, what it has, what it therefore should map to, what it is claimed to map to, and the missing step — and the rejection is stamped with whose point of view it came from. The same structure aimed at your own work flips it into a work item with a named target.

   validation --> a result --> its rejection metadata, DELIBERATELY
                               UNSIGNED: the reviewer field is empty
                               until somebody signs it
        |
        +----------------------------+
        v                            v
   ( REJECT IT )               ( AIM IT AT YOURSELF )
   sign it with a reviewer,    the SAME structure becomes an
   and the argument:           evolution ticket whose TARGET is
       the entity              the missing step it names
       what it has
       therefore it should
         map to X
       but it is claimed
         to map to Y
       THE MISSING STEP
       ( and optionally, what
         would be needed )
        |
        v
   "not real TO ME" -- the entity may be perfectly valid in another
   reviewer's world. rejection is SCOPED, never global.

   there is no way to express an ANONYMOUS rejection: the reviewer
   and the five fields are required arguments.

• The argument renders as one auditable sentence, so a rejection is readable by the person it lands on instead of arriving as a status.
• Self-rejection and rejection are the same object pointed differently, which is why finding your own gap produces a ticket with a target rather than an apology.

Runs in the lab

A Slot Can Produce a Whole Space, and Depth Counts Up From the Bottom

A single slot can produce an entire further space — and pointing it at a space that already exists links instead of creating, so the levels form a spiral rather than a tree. Depth is then counted from the bottom up and stops dead at the first layer that is filled but not locked, so the number measures how much proven structure justifies a node.

   a node --produces--> a further space
        no name given          --> create one named after the node
        a name nobody has      --> create a space with that name
        A NAME THAT EXISTS     --> LINK TO IT        <-- the spiral

   ONE crossing per slot: adopting a space into a slot that already
   produced one RAISES. produced or adopted -- never both.

   ( COUNT THE TOWER )   walk the chain downward, grading each layer
        a layer counts only if EVERY slotted node in it is LOCKED.
        FILLED IS NOT ENOUGH.

        A ---> B ---> C ---> D
               x      ok     ok
                                    depth = 2

        count consecutive locked layers FROM THE BOTTOM UP, and BREAK
        at the first one that is not.

   "how many layers of fully proven sub-structure justify this node"

• Create-or-link on a name is the whole spiral: reuse is the default outcome of pointing at something that already exists, rather than a deduplication pass afterwards.
• Locking, not filling, is what lets a layer count — so the depth number cannot be inflated by starting a lot of things.

Runs in the lab

Status Is a Fold, Never a Field

An achievement record with no settable status: every state is derived by replaying an append-only log, and its three conditions are conferred by three different parties, none of whom is the claimant.

   ONE append-only log. one event per line. a versioned envelope:

        { version, SEQ, kind, at, actor, data }

   ORDERING IS THE SEQUENCE NUMBER -- a strictly increasing integer
   assigned at append -- NEVER the wall clock. a naive timestamp, or a
   number that does not increase, is REFUSED at append, so clock skew
   can never reorder a proof against the claim it proves.

   TWO EVENT CLASSES, and the difference is the whole ontology:
        DECLARATIONS   an actor claims a binding. it CONFERS NOTHING.
        FACTS          emitted by seams that already exist anyway.

   COMPLETION IS A CONJUNCTION OF THREE, CONFERRED BY THREE DIFFERENT
   PARTIES -- and there is a deliberate asymmetry:

     the journey     WORLD-conferred proof, and it must re-conduct
                     AFTER the declaration. declare, THEN reproduce.
                     a success from before the claim does not count,
                     which is what stops anyone declaring over an old
                     one.
     the structure   the timeless HUMAN approval gate
     the agent       mere existence -- the promotion flow already
                     gated that

   THE MODULE EXPORTS NO SETTER AT ALL. no set-, no mark- : asserted on
   the export list AS A TEST, because it is written against code where
   completing, marking viable and naming were all unchecked self-set
   fields.

   THREE ONE-LINE WIRE SITES at seams that already existed, always-on
   and FAIL-OPEN: a broken log must never break the turn, and a missing
   record simply reads later as never-happened. an unknown kind is an
   ERROR NAMING THE LINE -- never a silent skip.

• No status field means no status to set wrongly. Every question the record answers is a fold over the events, so the only way to change an answer is to add an event somebody was allowed to add.
• The ordering rule is the integrity of the whole thing. Sequence numbers rather than timestamps is what makes “the proof came after the claim” a fact about the log rather than a fact about two machines’ clocks.
• Asserting the absence of mutators as a test is how a negation stays true: the anti-pattern it was written against is one import away, and nothing else would notice it coming back.

Runs in the lab