The Intent Pipeline

Reference strip: movements · deletions · invariants · risks · open questions · companion gap map: ARCHITECTURE-WATCH.md · convergence spec: spec-intent-convergence.md

The law (already ratified — now applied whole): typed records are the system's only truth-bearers. Everything else is a projection that reads and never decides. Meaning enters once, at a door, and is recorded.

This document adds no new principle. It takes three laws you have already ratified — the projection law, code-never-decides, the reader at every door — and applies them to the whole pipeline instead of just its verdicts. The genome is this law applied to state. The intent is this law applied to change. One principle, two tenses, joined by the journal: a spent intent fossilizes into the genome's history. The genome is genesis plus the integral of every intent ever ruled.

Two tenses of one law

	State — the genome	Change — the intent
the record	fact + anchors, typed	intent proposal, digest-bound
identity	the record is the fact	the digest is the intent — change one character and it names a different intent
places	anchors: where the fact lives	extent: the places the change touches
meaning enters	once, at a door — genesis, insert; a reader rules, recorded	once, at a door — the human's one ruling, recorded as authorization
projections	served pages, previews — the producer reads records	rebuild scope, deploy scope, verdicts, receipts — stages read the intent
the held line	served bytes = recorded bytes	reversibility = the mirror intent, inherited not bolted on

↘ go deeper — why reversibility is inherited

An intent is a well-defined diff between two genome states, given identity by its digest (subject + exact before/after + sorted target set). Because the diff is total and typed, its inverse exists by construction — the mirror intent swaps before/after over the same target set. The walk proved byte-perfect reversibility on every capability because the architecture was already secretly this shape; the pass makes the shape explicit and universal.

The disease this frame ends

One disease, five costumes — all found this session: a stage that re-derives what an upstream record already holds.

The ruling, re-derived
The per-fact loop re-asked the human's one answer 1,600 times. Cured: intent authorization.

The extent, re-derived
Every wish rebuilds all 178 pages — 66% of the walk's 40m40s — though the intent states exactly which places changed. The never-engaging "incremental eligibility check" is the same disease posing as its own cure: guessing at a recorded thing.

The context, re-derived
The wrapper re-learns the world on every spawn — heavy bootstrap × 3 spawns × 3 attempts.

The verdict, re-derived
Code reading meaning out of sentences with regex. Two sites cured; the last dies in the claim-lane dissolve.

The bytes, re-derived
The publish gate re-computes expected bytes from format names instead of reading the writer's record. Named residual, own ticket.

The three movements — each one finishes applying the law

Movement 1 — the intent's IDENTITY is complete. Everything is an intent proposal (your ruling, 2026-08-08). A one-place heading edit and a 1,600-place sweep become the same object, differing only in how many places it names. One store, one confirm grammar, one checker; the single-fact special case is deleted. Already in motion — spec written, build gated behind the landings.
↘ go deeper — the builder's cut

One staging store (the intent store); every proposal id is the content digest, re-resolved at spend, consumed on use, self-neutralizing after apply. The old single-fact store's records refuse fail-closed with a re-stage message — no silent conversion, a confirm is a signature. The single-fact outcome code collapses into the intent code. Full spec with numbered proofs and deletion greps: spec-intent-convergence.md. Builder: the coordinator's own hands; adversary: an independent second instance.
Movement 2 — the intent's PLACES drive production. The producer's input becomes the intent's extent: re-produce exactly the pages holding the intent's places. The 26-minutes-of-rebuild-per-wish term dies by construction — not cached away, deleted. The eligibility guesswork is removed, not fixed. Deploy scope becomes the same projection: deploy what was re-produced. This is the load-bearing movement — its one real question is extent completeness, below.
↘ go deeper — the builder's cut

Prerequisite landed: the producer serves records (the flip, pushed), which is what makes extent-driven production a read instead of a computation. Build: the produce step takes the intent object; its page set = pages holding target places, plus structurally-shared surfaces enumerated from the genome (shared fragments are themselves placed facts — the extent knows them). Before the flip is trusted: a dependency census proving no page's bytes depend on a fact without a place on that page; any exception is modeled as a place (the genome's own answer) or the movement narrows honestly. The existing incremental path and its eligibility check are deleted in the same diff.
Movement 3 — the intent's PROVENANCE is unbroken. One resident pass: the pipeline runs the intent through its stages in a single process, book loaded once. Every stage writes its typed receipt to the journal before its effects are visible — silence becomes structurally impossible. The daemon thins to a door: receive the wish, mint the intent, hand it to the engine, relay typed outcomes. The book lease and the watchdog stop being patches and become the door's contract.
↘ go deeper — the builder's cut

Kills, with receipts from the latency investigation: the 3-heavy-spawns-per-attempt chain (each paying the repo's ~100s loaded bootstrap), the 120s ask ceiling (hit once during the walk), and the silent-orphan class that turned 1 attempt into 3. Residency rule: reload-on-lease-acquire is the simple honest default for staleness and crash recovery — receipts-first applies to the engine's own lifecycle. Evidence this movement is needed: this very session lost process output to dead pipes five separate times; the channel, not the agents, is the defect. Subsumes: the wrapper tickets, the lease/watchdog chip, the ask-step ceiling.

The queue, resequenced

Now — land what's in flight. Sweep merge · claim-lane dissolve harvest (judged against the dissolve bar) · carrier battery attribution · the self-test isolation cure + re-verdict. Nothing in flight is wasted by this frame; all of it is the frame.

Movement 1. The convergence capstone — coordinator's hands, independent adversary behind. Spec already written for your red pen.

Movement 2. Extent-driven production — new spec next. Subsumes the "why does eligibility return FULL" investigation: we delete the question instead of answering it.

Movement 3. The resident pass + door-thinning — new spec after. Subsumes the wrapper tickets, the lease/watchdog chip, the ask ceiling.

Standing residuals, after. Publish-gate receipt-reading · preview counterfactual · the encoding-migration ruling · the CSS splice surface.

What dies across the pass — deletion is the proof

the per-fact loops, both lanes

the single-fact staging store

the rebuild eligibility check

full-rebuild-per-wish as the default

the wrapper's spawn chain + 120s ask ceiling

the last prose-decision site

stdout as a load-bearing channel

The floor that must not move: byte-perfect reversibility on every capability · fail-closed refusals with typed codes · one wish one commit · the single-writer book · the guard's one pass over final state · truthful misses. Every movement re-proves these on the walk-class wishes before it rides a train.

How the cut stays complete — and stays cut

Finding everything misaligned is a two-engine job, split by our own law. Plato is the denominator: for every organ a movement retires, its backward reach graph enumerates all consumers, transitively — proven against the current tree or honestly fenced; no grep census (a numerator with no denominator) counts as a completeness proof. A reader classifies: structure can't tell re-derivation from legitimate computation, so the coordinator walks the enumerated list and rules each entry keep / migrate / cut, with a receipt. And teeth keep it cut: every movement lands with deletion proofs plus a standing train-gate check — a retired organ that gains a new caller turns the gate red. Alignment is enforced forward, not audited once.

↘ go deeper — jurisdiction honesty

Plato lives on the primary checkout and maps this repo; the daemon wrapper lives partly in the practice lane, outside the map. That slice censuses by grep-plus-read and is labeled as such in the movement's report. Plato also names its own blind spots (orphans, excluded files) — the census inherits those fences rather than claiming a totality it doesn't have.

Honest risks

Extent completeness (Movement 2's one real question). A page whose bytes depend on a fact without a place there would be missed. Two real examples: the derived-summary class — a search index or sitemap carrying every page's title/text with no anchors, so a headline edit updates the pages but search silently serves the old headline; and the produce-time-knob class — the social-share transform rewrites preview tags from a global deployment setting no extent can see. The cure in the genome's grammar: make the dependency a place (the sitemap's title line becomes an anchored place of the title fact — extent then just works). Places is the end state; blanket-regenerating the small derived artifacts each wish is the honest labeled interim; a silent skip is never acceptable. No census, no flip.

Residency (Movement 3). An engine holding the book in memory across wishes must never serve a stale world or lose a crash silently. Reload-on-lease-acquire and receipts-before-effects are the defaults; anything cleverer needs its own adversary.

Sequencing debt. Three movements on one door lane. No movement starts while its predecessor's territory is open, and each lands via a train with the full walk re-proven. Slower in calendar, honest in every step.

Your red pen — the three things only you can set

1 — Is this the frame? — RATIFIED.

Robert, 2026-08-08: "Ratified." The pass governs the next arc; the queue above replaces the ticket-stack ordering. Execution set with it: the coordinator builds Movement 1 (own hands, independent adversary behind) and authors Movements 2–3's specs; Plato runs first — the consumer census from the primary checkout is the build's first artifact, before any diff.

2 — Movement 2's narrowing rule (examples added at your request — see the risk card).

Updated recommendation, aligned with your do-it-right posture: model dependencies as places — that is the end state. Where the census finds members not yet modelable, those small derived artifacts (sitemap, search index, feed) regenerate on every wish as the honest, labeled interim. No silent skips, ever. Red-pen if you want a different rule.

3 — Calendar vs the announcement — RULED.

Your words, 2026-08-08: "We do it right and don't ship until it is." Recorded: Alie's start is gated behind the pass — movements landed, the walk re-proven, big sweeps in minutes, nothing silent. The walk report's "Alie can start" is corrected; the announcement is now a milestone after the re-walk, not a discretion call.