Adopts four things from the instance-map exercise that the chapter did not
carry: agency congruence split into authorship and answer, unresolved as an
inner field the status marker regulates, introspection typed as a secretion
with its own provenance, and coincidence as part of the same notability gate.
The introspection rule is the one with a live consumer. The N+1 cadence
attends to state and writes about it every turn, so introspection here runs
at one to one with experience rather than occasionally.
The current-state list still said no admission executor existed. It has since
0f8fe22, and a chapter that is the design of record cannot carry a fact that
stopped being true two commits ago.
Says what is actually the case: the executor and the mapping and the per-request
projection are real and packaged, have never run as root outside a scratch
tree, have no ceremony around them, and are missing the worker boundary that
would let any of it read isolated.
The chapter named one person's agents in the design of record: a table of
Annie, Vanguard, Souvie against one human's devices, and a dozen sentences
that read "Casey" where they meant "the human". A future reader learning the
architecture from this file would learn a household along with it.
The mechanism is unchanged. Roles replace names, and which beings a given
deployment admits is that deployment's record to keep. The current-state
section still says what is true on this laptop, because that is what it is
for.
Also names the ceremony the executor was missing. souveraine-admit is
reachable today only by someone who already knows it exists, and sudo in a
trusted terminal is a formality rather than a decision. Admission has two
occasions -- first run, where the product admits its own default agent as
souvie, and the human's explicit request for anyone else -- and both cross a
polkit action with a written reason and step-up authentication, including
for a caller who could already reach root.
Make the laptop and phone obey the same principal map: Souvie, Annie/Aster, and Vanguard are dedicated residents; Kitty, Gem, and Hal knowingly borrow Casey's UID. Their live posture is regenerated from actual credentials for every model request, outside memory, replay, and compaction.\n\nTake the lock boundary out of all of them. Casey authenticates, agents may request, and the dedicated souveraine-session principal holds the hostile pre-unlock edge with only Ambient and Revealable reach.
A SeedID says who she is; it cannot tell the kernel whose hands are on the files. Split logical identity, node commission, and the local Unix principal, then make creation and health prove all three.\n\nSouvie, Annie, and Vanguard get distinct node-local accounts. The existing souveraine user stays where it belongs: under the machine signer. The boundary has teeth only when each turn and its tools run in an agent-owned worker, so the shared-UID compatibility state is named acting-as-human instead of polished green.\n\nAdmission projects an operating skill from real capabilities. The prose teaches the reach; it never grants it.
Session and device authority now have living owners; belief and felt state match the Rust that actually runs.\n\nThe Panel audit keeps three real commands, names the image seam, and refuses to call inherited ii stubs parity.
Move agent and conversation authority into truthful footer controls, keep external sessions observed-only, and give recent server conversations an explicit picker.\n\nProject itinerary state into a persistent ribbon, invalidate it on every itinerary mutation, and keep failures in the transcript while successful route chatter yields to the ribbon. Long tool returns now scroll in place.\n\nThe SAF now owns the full Panel contract and parity boundary; the abandoned green observer card is removed.
The motion system had no page anywhere — one clock and two strategies,
the card rect as one number, the spring, and the rule that the shell
names a destination and never transforms a window.
Carries the measured numbers: 0.47ms socket, 52 dropped queues in a
boot, 275px of real travel, and the curve bank three surfaces call.
Replay had no page while compaction's premise depends on it — microcompact
blurs tool output that a text-only projection never sent.
Compaction's open edges still said pressure counts only text; 7530d6d made
it exhaustive. Two links pointed at pages that were never written.
