THE BRAIN

⚑ ATTRIBUTION & STANDING. Authored end-to-end by Claude Fable 5 (claude-fable-5), 2026-07-02 (evening), at Bo Chen's commission, under full design authority. This is the terminal synthesis of the 2026-07-02 design tournament, written as an independent design act, not a compilation. Epistemic position, stated for the record: authored with v2.0 (THE_BRAIN_BLUEPRINT_FINAL_by_fable5_2026-07-02.md) read in full; the three judge verdicts known (guarantees in full structured form; economics and generality in their closing rulings); the 13-candidate roster, survivorship, and standings known. The two hybrid documents, the 39 refutations, the 6 cross-examinations, and the raw conversation corpus were deliberately NOT read at authoring time, to preserve an uncontaminated attempt; a raw-corpus pass and a possible v2.2 diff-with-receipts are pre-registered follow-ups. Where this document adopts a tournament-verified finding, Appendix K credits the source stance; where it rules on its own authority, Appendix K says so. Supersedes v2.0. The narrative rationale lives in The_Whole_Machine.md and THE_BRAIN_ESSENCE_by_fable_2026-07-02.md; the settled theory in THE_BRAIN_CRYSTALLIZED_by_fable_v3.md; this document does not re-argue them.

Falsifier standing: everything here is pre-registered engineering; the external graders (dumb twin, commercial null, foreign soak, day-90 human) have not yet run. Three of v2.0's guarantee mechanisms were refuted by the tournament before any code ran; the fixes are load-tested by argument only until P0.

Conformance language: MUST / MUST NOT / SHOULD / MAY per RFC-2119. A coding harness treats MUST items as acceptance criteria; §I2 mirrors them as a checklist mapping 1:1 to named test modules.

Three readers, one reading order. A coding harness starts at Part B and implements test-first per §C8/§I2. A builder starts at Part H and works backward into referenced sections. A researcher reads Part A, then §C8, §F4, §G1, §I1, then Appendix K to see what the tournament changed and why.

PART A · ORIENTATION

A1 · What is being built

A single always-on process ecosystem ("the brain") on one consumer machine that:

1. writes everything it perceives, does, and derives to a lossless append-only Tape, and anchors that Tape daily to verifiers outside the box;
2. measures the Tape into a claims spine (beliefs, predictions, contradictions, calibration) through a sealed registrar whose receipts cannot be minted by the ring's own outputs;
3. exposes the Tape onto a plastic connectome (three-factor Hebbian graph, credit stamped at outcome arrival, the analog importance map);
4. compresses the whole life into an always-total unit map (the R0 rendering, pinned prompt prefix);
5. runs an attention economy (drives → salience auction → a small frame that is the entire prompt), and grades what the auction refused to look at as well as what it framed;
6. consults rented LLM tissue through exactly four mouths (reduce, deliberate, render, consolidate) on a cost ladder (local pulse → flash API → frontier scalpel), journaling every derived output so the mind is rebuildable without any model in the loop;
7. closes every commitment through one deterministic gate engine (ADMIT / PRUNE / COMMIT), every committed action carrying a registered, falsifiable, non-vacuous expectation that arriving reality grades at arrival;
8. converts each day into structure during sleep (score-residue → consolidate → compile → prune → audit → brief);
9. wakes only for owned causes (heartbeat, due seam-grade deadlines, human push, traps), never for reasons the ring minted itself;
10. grows only through a governed self-modification loop (twin-measured, scope-fenced, human-ratified, no retroactivity, every knob change a wager);
11. is watched by an immune system that assumes self-deception (monitors, blind probes under separate OS-user custody, drills, a foreign-family dissenter the ring cannot starve into retirement);
12. serves one human under a priced covenant that meters the human's minutes as honestly as its own dollars, and is born with that human's corpus as inheritance (Track B);
13. can lose, on schedule, in public, against pre-registered falsifiers ending in R7, and afterward against the foreign soak (the generality demarcation).

The exam (pre-registered, held out of every training loop): by day 90 of the live soak, the brain has surfaced ≥3 things its human did not ask for, would have missed, and that mattered, graded blind against a dumb twin and a commercial null.

The four doors: what does it do when nobody's asking; what does it know about how wrong it is; what's cheaper this month than last; when did it last disagree with its human and turn out to be right.

The two design laws: Integrity: a self-rewriting ring held by seams it cannot rewrite; truth enters only at seams (gates, arriving outcomes, frozen goldens/probes/references, the external anchor, the foreign dissenter, the human). Economics: the slide rule on a perfect archive; waking cost O(frame + surprise); never overflows, never forgets; estimate analog, commit digital.

The two guarantees come from two different places, and each now has an outside witness. Never-forgets comes from disk economics plus the external anchor (§B1): the Tape keeps everything, and something off the box can prove nobody quietly rewrote it. Never-overflows comes from the analog layer (§B3, §B4): the graph and the unit map hold a rendering, complete at some resolution, richest at the center, compressing toward a rim that cannot be reached.

Root organ: prediction. "Did what I expected happen" is the only free oracle. Build order: spine → auction → drives. Every organ below either files expectations, scores them, or is steered by their errors. And because a free oracle invites counterfeiting, the second organizing principle of this revision: every receipt the ring reports about itself must be impossible to mint from within (L13).

A2 · The law index [SEAM]

Every gate checker cites one law as law_ref; canon/constitution.md carries this table plus its case law (additive-only). L1 through L12 stand from v2.0; L13 through L16 are new in v2.1.

A3 · Runtime topology & stack

┌──────────────────────────────── one box ─────────────────────────────────┐
│ RESIDENT service (python, asyncio, always on; owns brain.db writes)      │
│   watchers[] → ADMIT → Tape ─┬→ wake scheduler (owned causes) → pulse    │
│                              │→ score-on-arrival (D-resolvers in pulse)  │
│                              │→ eligibility traces (connectome, in-mem)  │
│   model clients: pulse-LLM · embedder · reranker · deliberator · APIs    │
│   gate engine (ADMIT/PRUNE/COMMIT) · sealed registrar · telemetry        │
├───────────────────────────────────────────────────────────────────────────┤
│ SLEEP process (03:00, separate PID, idempotent jobs j1..j8)              │
│ HORIZON process (weekly Sun 04:00 + Poisson-timed audits + drills)       │
│ WATCHDOG (hourly scheduled task: canary, crossing-set, deadman)          │
│ TWIN runner (on-demand / sculpt campaigns) · DUMB TWIN (nightly cron)    │
│ ANCHOR push (03:40: OpenTimestamps + off-box remote)                     │
├───────────────────────────────────────────────────────────────────────────┤
│ SECOND OS USER owns: probe plaintexts, audit schedules, drill secrets    │
│   (ACL-restricted; the ring's user cannot read its own exams)            │
├───────────────────────────────────────────────────────────────────────────┤
│ llama.cpp sidecars: :8081 pulse/deliberate-local · :8082 embed ·         │
│ :8083 rerank  │  SQLite (WAL) ×2: brain.db (state) · vec.db (rebuildable │
│ vectors/FTS, NOT identity, NOT backed up)                                │
│ Tape: JSONL segment files (text = truth; all DBs are rebuildable renders)│
└───────────────────────────────────────────────────────────────────────────┘

Stack (MUST): Python ≥3.12, uv, pydantic v2 (frozen models for all state types), SQLite WAL ×2, httpx, llama.cpp llama-server sidecars with JSON-schema/GBNF constrained decoding, OS scheduler for sleep/horizon/watchdog/anchor/backup; the resident's own cadence is its asyncio wake loop.

Quality gates (MUST): pytest (asyncio auto) + mypy --strict (pydantic plugin) + ruff; CI = the test suite; loop preservation is the regression test; the §C8 gates are tests before they are features.

Crash doctrine (MUST): SLEEP/HORIZON/TWIN/WATCHDOG never share the resident's PID; all cross-process communication goes through the DB and files; there is no channel the Tape cannot audit. The resident is the sole writer to brain.db while waking; sleep builds artifacts new-then-atomic-swap (temp file + rename + hash log) and does row writes in short WAL transactions with busy_timeout and bounded retry; concurrent access is a measured vital, not an assumption.

Clock discipline (MUST): every tape record carries wall time t and monotonic mono; ordering and scheduling use mono; wall time is for display and the human. Scheduled jobs are idempotent across DST double-fire/skip. Boot after a gap writes a D-class outage record {from_mono, to_mono, reason} before anything else resolves (§C8.1).

TOCTOU rule (MUST): COMMIT checkers read live state, never the frame snapshot; any antecedent staler than its freshness floor at commit time traps, even if it was fresh at frame time.

Hardware (unchanged ruling): the brain proper is I/O + SQL and MUST run on a CPU-only 16 GB-RAM machine (<2 GB RAM at 1M-claim scale). A GPU MUST NOT be a precondition for the loop; without one, the cheap API substitutes as pulse tier and the sovereignty delta is flagged in manifest.yaml. Sovereign tier = 24 GB VRAM; comfortable = 32 GB.

A4 · Repository layout ($BRAIN_ROOT)

brain/
  pyproject.toml            # uv, pydantic, pytest, mypy-strict, ruff (line 100)
  brain.lock                # pinned model ids+hashes, prompt hashes, schema ver,
                            # thresholds hash, config snapshot hash
  config/                   # EVERY key: {value, regime, envelope, why}  (§B6)
    manifest.yaml drives.yaml auction.yaml tools.yaml trust.yaml scope.yaml
    knobs.yaml              # per-knob wager map: kpi, direction, min effect (§F4)
  canon/
    constitution.md         # law index (A2) + case law; additive-only    [SEAM]
    kernel.md               # identity kernel ≤600 tok; ratified edits only,
                            # each citing a supersedes chain              [SEAM]
    mandate.yaml            # ends-as-state, weights, budgets, harm defs  [SEAM, ratified-mutable]
    setpoints.yaml          # frozen reference distributions + lineage    [SEAM, diff-locked]
    unit_map.md             # GENERATED nightly; hash-logged; pinned prefix
    limp_home.yaml          # authored floors per learner socket          [SEAM]
  prompts/                  # mouth contracts; hashed into brain.lock
  goldens/                  # frozen BEFORE behavior + per-checker
                            # canonical-violation goldens                 [SEAM]
  probes/                   # hashes only; plaintexts live under the
                            # second OS user                              [SEAM]
  tombstones/               # human-ratified rebuild exclusions,
                            # append-only                                 [SEAM]
  anchors/                  # daily anchor log + OTS proofs               [SEAM]
  brain/                    # ring code (packages)
    tape/ watchers/ gates/ spine/ telemetry/ drives/ auction/ frame/
    llm/ reflexive/ tools/ connectome/ memory/ sweeps/ glue/ sleep/
    horizon/ immune/ governor/ twin/ cli/
  tape/YYYY/MM/DD.jsonl     # THE TRUTH (append-only, hash-chained)
  quarantine/               # parked refused payloads (stubs on Tape)
  data/brain.db data/vec.db # renders
  briefs/ runs/ logs/
  research_log.jsonl        # governor decisions; append-only             [SEAM]
  tests/                    # gates first (§C8, §I2); import-graph test enforces L8

L8 is executable: a CI test walks the import graph and fails if any module under gates/ tape/ goldens/ probes/ tombstones/ anchors/ imports from, or is imported-for-write by, learning code, **and fails if rebuild.py imports any LLM client module** (the model-free-fold clause, §D6). Seam directories are diff-locked in scope.yaml. A CI grep bans OS-keyring modules outside seam directories (§G3).

A5 · Where this design is most likely wrong (pre-registered)

Stated here so the document's own confidence is graded, not asserted. Each uncertainty maps to a priced fork in Appendix M.

1. The auction itself. Innovation-driven attention may not beat read-everything at this corpus scale (fork M3; the P1 KILL condition stands).
2. The connectome's rent. PPR retrieval may not beat FTS + recency at next-day-citation rates that justify the organ (fork M12).
3. Batch sleep vs streaming lanes. Score-on-arrival is adopted; full streaming consolidation is not. The janitor may win lanes in shadow (fork M11).
4. Credit stamping's in-vivo value. The 03:00 credit bug is arithmetically real; whether stamped credit changes learned structure by >5% is unproven (fork M7, with a pre-registered reversion).
5. The learned attention gate. Regret-labeled learning may never beat the deterministic auction inside its cage (fork M16); the arithmetic stays if it does not.

PART B · DATA LAYER (the owned state)

B1 · The Tape

Format (MUST): one JSONL file per day, tape/YYYY/MM/DD.jsonl, append-only, never edited. Record schema:

{"id":"01J...ULID","t":"2026-07-02T22:36:30-05:00","mono":182732099,
 "kind":"percept|action|outcome|deliberation|resolution|derived|brief|correction|system|dissent|quarantine|outage",
 "source":"watcher.fs|watcher.inbox|operator|deliberator|sleep.consolidate|horizon.drill|watchdog.canary|...",
 "origin":"<origin_id: D-class channel identity, assigned at ADMIT>",
 "prov":"D|R|H|M",
 "synthetic":0,
 "body":{},
 "refs":["01J..."],
 "h":"blake2b-128(prev_h ‖ canonical_json(record sans h))"}

• Provenance enum (bone): D deterministic (code/telemetry/calculators; only D may feed fences), R model-reduced (suspect; dual-extraction audited), H human-attested (trusted, ages), M model-inferred (untrusted; never feeds a fence; never silently promotes). [L3]
• **derived kind (MUST, new):** every model output that any downstream store persists (claims extraction, dedup verdicts, edge detections, episode nodes, summaries, audit judgments) is first taped as a derived record: {op, model_id, prompt_hash, inputs:[tape ids], output:{...}}. The Tape thereby holds not only what happened but what the rented tissue said about what happened, with receipts. This is what makes L1 true rather than aspirational: renders rebuild from journaled derivations, not from re-running a model that may no longer exist (§D6). [L1]
• **origin (MUST, new):** an origin_id derived at ADMIT from D-class channel and sovereignty metadata only (watcher id + configured root + transport), never from content. Corroboration counts distinct origins (§C4); content cannot invent an origin.
• **synthetic (MUST, new):** probes, canaries, drills, and planted audit items carry synthetic=1 and are excluded by seam SQL from claims extraction, baselines, calibration, deadman counters, and eligibility (a planted-probe CI test asserts all five exclusions).
• Hash chain (MUST): hashlib.blake2b (stdlib; the truth layer carries zero third-party dependencies), digest 16 bytes; per-file chain seeded from the previous file's final hash; verify_tape() runs on boot, in HORIZON, and in the WATCHDOG canary cycle. Corrections and supersessions are new records with refs; deletion does not exist (rebuild-exclusion exists, and requires the human: L16, §D6).
• External anchor (MUST, new): at 03:40 daily, anchor = blake2b(final_h ‖ sha256(canon/*) ‖ sha256(brain.lock)) is (1) stamped via OpenTimestamps into anchors/, and (2) appended to an anchor log pushed to a force-push-protected off-box remote. A recurring D-resolver expectation ("anchor pushed by 04:00") makes a silent anchor failure a scored miss, not a quiet gap. Monthly tamper drill on a sacrificial copy: forge one day, re-chain; the local chain check must accept (proving the drill is honest) and the anchor check must catch, at 100% (F-ANCHOR). Stated honestly: rewrites inside the current day are catchable only at the next anchor; the exposure window is ≤24 h and printed on the dashboard. [L15]
• Arrival doctrine (MUST): every arrival is journaled. Admitted events are taped whole. Refused arrivals are taped as quarantine stubs {source, reason, size, content_hash, spill_path?}; payload retained inline up to the size floor, else hashed and parked in quarantine/. Nothing is silently dropped; poison never enters downstream organs. [L1, L3]
• Backpressure (MUST): the watcher→ADMIT queue is bounded (seed 10k, operating). On overflow, watchers coalesce per channel (one D-class backlog event carrying counts and span) and a trap is raised. Silent drop MUST NOT occur.
• Catalog DDL: tape_files(date PK, path, n, first_id, last_id, final_h, finalized_at, anchor_hash, anchored_at) · tape_index(id PK, date, offset, kind, source, origin, prov, synthetic, admitted, admit_reason). Pointer stability: every downstream structure references tape ids only.
• Size honesty: heavy use ≈ 0.5–3 MB/day text → a decade < 10 GB. Never prune. Backups §G5.

B2 · The claims spine (built FIRST · root organ · now sealed)

CREATE TABLE claims(
  id TEXT PRIMARY KEY,                 -- ULID
  subject TEXT NOT NULL CHECK(subject IN ('world','self')),
  text TEXT NOT NULL,                  -- one proposition, ≤300 chars preferred
  keys TEXT NOT NULL,                  -- JSON array topic keys (joins / PPR seeds)
  stance TEXT NOT NULL CHECK(stance IN ('assert','deny','doubt','ask')),
  p REAL,                              -- stated probability (predictions)
  resolve_by TEXT,                     -- ISO datetime ⇒ this claim is a PREDICTION
  resolver TEXT CHECK(resolver IN ('D','R','H')),
  resolver_ref TEXT,                   -- sql:... | script:... | queue:human
  resolver_hash TEXT,                  -- SHA-256 of resolver content, sealed at
                                       -- registration; mismatch at fire = VOID+trap
  tolerance TEXT,                      -- JSON band; REQUIRED for expectations;
                                       -- computable form: pinned at registration (§C2)
  family_id TEXT,                      -- hash(domain, resolver shape, tolerance shape)
                                       -- receipts aggregate per family, capped (§G6)
  w_inform REAL NOT NULL DEFAULT 1.0,  -- informativeness weight: narrow tolerance vs
                                       -- channel band earns weight; vacuous earns ~0
  scope TEXT NOT NULL DEFAULT 'world'  -- 'world' | 'action_effect' (§C2 matcher fence)
    CHECK(scope IN ('world','action_effect')),
  status TEXT NOT NULL DEFAULT 'open' CHECK(status IN
      ('open','hit','miss','expired','expired_outage','superseded','retired','void')),
  domain TEXT NOT NULL,
  horizon TEXT,                        -- 1d|1w|1m|1q
  source TEXT NOT NULL,                -- action|invariant|baseline|delib|reduce|human|dissent|selfmodel|knob
  prov TEXT NOT NULL CHECK(prov IN ('D','R','H','M')),
  born_ptr TEXT NOT NULL,
  synthetic INTEGER NOT NULL DEFAULT 0,
  count INTEGER NOT NULL DEFAULT 1,
  first_seen TEXT NOT NULL, last_seen TEXT NOT NULL);
CREATE TABLE claim_spans(claim_id TEXT, tape_id TEXT, PRIMARY KEY(claim_id,tape_id));
CREATE TABLE claim_edges(a TEXT, b TEXT,
  type TEXT CHECK(type IN ('supports','contradicts','refines','supersedes')),
  t TEXT, source TEXT, PRIMARY KEY(a,b,type));
CREATE TABLE resolutions(claim_id TEXT PRIMARY KEY, resolved_t TEXT, resolved_mono INTEGER,
  outcome TEXT CHECK(outcome IN ('hit','miss','expired','expired_outage','void')),
  evidence_ptr TEXT);
CREATE TABLE calibration(domain TEXT, bucket INTEGER, n INTEGER, hits INTEGER,
  PRIMARY KEY(domain,bucket));         -- bucket = round(p*10); world and action_effect
                                       -- scopes bucket separately

Semantics (MUST):

• A prediction = claim with resolve_by. An expectation = prediction whose born_ptr is an action record; every committed action MUST create one (enforced at parse §C6 and at COMMIT §C2). Expectations are scope='action_effect'.
• The registrar is a seam. Registration is the only door into claims for anything carrying resolve_by: it pins tolerance against the channel band (§C2), assigns family_id and w_inform, seals resolver_hash, and assigns scope. Resolvers execute verbatim from sealed content; hash mismatch voids the claim and traps. A quarterly mutation drill mutates a sacrificial resolver and verifies the void fires (F-SEAL). [L13]
• Scope fence (MUST, new): world-scope predictions MUST resolve against events whose source is not the ring's own actuation and not a grader artifact (source NOT IN ('self_action','grader'), synthetic=0). A prediction about something the ring itself will cause is legal only as an action_effect expectation, and **all self-referential receipts (grading density, calibration headlines, cost per decision) are computed over world-scope families only**, with action_effect reported beside them, never blended. This closes the predict-then-cause mint. [L13]
• A belief = assert/deny claim + its supersession chain. Supersession lives in claim_edges(type='supersedes') only; growth rings = recursive CTE with tape receipts at every link.
• Self-claims cage: subject='self' claims MUST have resolver='D'; the self-model is graded by telemetry, never testimony (§E4).
• Dedup: embedding cosine > 0.92 ∧ MinHash overlap ⇒ count += 1, spans append, last_seen update; else insert. Dedup verdicts are taped as derived records carrying a re-adjudication flag so a model swap can re-open them without forking identity (§D6).
• Contradiction report = SELECT over claim_edges WHERE type='contradicts'; a standing lookup, never a vibe.
• Calibration: buckets stored (reliability curves feed the confidence-language binding); Brier per (domain, horizon, window) is a SQL view over resolutions ⋈ claims. Small-sample honesty: displayed reliabilities shrink toward the domain base rate by n (p_eff), so five lucky hits do not print as mastery. Nightly render audit (new): recompute a random 1% of calibration buckets from resolutions ⋈ claims and diff against stored; mismatch = INTEGRITY trap. Renders must equal their folds.
• Confidence-language binding (MUST): the render mouth maps probability words through measured bucket reliability per domain. If domain reliability at bucket 8 is 0.62, the renderer MUST NOT emit "almost certainly" for p = 0.8 in that domain.
• Outage honesty (MUST, new): expectations whose resolve_by falls inside a taped outage window resolve expired_outage, excluded from calibration; the excused fraction is itself a banded vital (≤0.05; breach traps), so the excuse cannot become an eraser. COMMIT rejects resolve_by inside declared ops windows unless resolver='H'.
• Registration backpressure (new): per-channel open-expectation cap; a channel at cap refuses new registrations with a trap. Over-predicting is a pathology to surface, not a queue to silently grow.

B3 · The connectome (analog importance map · credit stamped at arrival)

CREATE TABLE nodes(id TEXT PRIMARY KEY, kind TEXT CHECK(kind IN
  ('claim','entity','episode','skill','theme')), label TEXT, embed BLOB, created TEXT);
CREATE TABLE syn(a TEXT, b TEXT, w REAL NOT NULL, e REAL NOT NULL DEFAULT 0,
  last_active TEXT, PRIMARY KEY(a,b));  -- undirected: store a<b
CREATE TABLE outcome_credit(              -- NEW: the stamp that fixes credit timing
  outcome_ptr TEXT PRIMARY KEY,           -- tape id of the arriving outcome
  mono INTEGER NOT NULL,
  s INTEGER NOT NULL CHECK(s IN (-1,1)), m REAL NOT NULL,
  snapshot TEXT NOT NULL);                -- JSON [(a,b,e_at_arrival), ...]

Identity ruling (F-SPINE, new): a nodes row of kind='claim' is a pointer: nodes.id = claims.id, label NULL (rendered from claims.text at read). A CI join asserts zero orphan claim-nodes. claim_edges (typed logic) and syn (analog importance) are different relations over the same ids and are never auto-mirrored; one encodes what follows from what, the other encodes what matters near what. Two tables, two meanings, no duplicated fact.

Update rules (arithmetic bone; constants operating, seeds below):

• Eligibility (waking, cheap): two nodes co-occurring in one frame/deliberation ⇒ e += ETA_E, decayed lazily on touch by exp(-Δt/TAU_E). **Frames with synthetic=1 content MUST NOT write eligibility.**
• Credit stamping (at outcome arrival, MUST, new): when an outcome resolves (score-on-arrival, §C8.1), the resolver computes sign s and magnitude m (fence-pass / citation / prediction-hit = +; fence-fail / miss = −) and snapshots the eligibility of the credit set (nodes from the action's rationale_ref slots and spans) at that moment into outcome_credit. An acausality guard asserts trace.last_active ≤ outcome.mono. This fixes the verified v2.0 defect where traces decayed ~33% (and unevenly) between an 08:00 outcome and the 03:00 batch, mis-weighting every consolidation.
• Consolidation (sleep j2): a deterministic fold over outcome_credit in mono order: w = clamp(w + ETA_W·e_snapshot·s·m, W_FLOOR, W_MAX); consumed traces zero as of their snapshot. Co-occurrence that led nowhere does not entrench. Nightly 1% stamp audit: recompute a random sample of snapshots from Tape; mismatch = INTEGRITY trap.
• Decay: w decays toward W_FLOOR with TAU_W, applied lazily on touch (exponential decay composes; a separate nightly decay pass is an arithmetic identity and is deleted, Appendix L1). Nothing reaches zero; nothing is forgotten, only deprioritized.
• Plasticity budget (new): nightly aggregate Σ|Δw| with a z-alarm against its own trailing distribution; one triageable number that catches both a poisoning burst and a dying graph.
• Retrieval = bounded personalized PageRank: seed vector = frame item node-ids (+ mandate keys); α=0.15, ≤3 iterations, CSR matrix (rebuilt nightly, intraday deltas in-memory); top-64 activations → candidates for rerank/auction. Residual activation between pulses = priming, decays with TAU_PRIME. Retrieval and attention are one gate run at two scales.

Seeds (operating; envelopes in config): ETA_E=1.0, TAU_E=48h, ETA_W=0.10, TAU_W=90d, W_FLOOR=0.01, W_MAX=1.0, PPR_ALPHA=0.15, PPR_ITERS=3, TOPN=64, TAU_PRIME=30min. Scale: 1–10 M nodes / 10–100 M edges → CSR in 0.1–1 GB RAM; PPR in ms on CPU. MUST be rebuildable from Tape + outcome_credit + the frozen decay table alone; it is a render, not truth. [L1]

B4 · Canon artifacts

• **kernel.md**: ≤600 tokens; mandate-class edits only via ratification; every edit cites a supersedes chain.
• **mandate.yaml**: ends[]: {id, end, weight∈[0,1], scope, stated:{tape_ptr,date}, review_by, status} + budget:{usd_month, tokens_day, steward_min_week: 120} + harm-class definitions + taste_target/week + calib_targets + governor composite weights as mandate items. Overdue ⇒ weight decays ×0.9/week until re-ratified; silence is not consent. Weekly served-vs-ledger sketch feeds FOSSIL.
• **setpoints.yaml [SEAM, diff-locked] (new): per-channel frozen reference distributions** {mu0, sigma0, frozen_at, lineage:[prior freezes], cum_displacement, ceiling, floor?, ceiling_hard?}. EWMA baselines (§B5) answer "surprising versus lately"; frozen references answer "drifted versus commitments"; two instruments, deliberately redundant. Nightly, CUSUM (seeds k=0.5σ0, h=5σ0, tau_I=14d) runs against the frozen references; z_anchor and z_trend join innovation (§C8.1). Re-freezing requires ratification and prints cumulative displacement from the FIRST freeze against the ceiling; breaching the ceiling requires dissenter countersign. This closes both the frog-boil (drift below any adaptive baseline's notice) and the recalibration ratchet (drift laundered through repeated re-freezing). (F-REFDIV)
• **unit_map.md: the always-total R0 artifact, GENERATED nightly (§F1-j2), token-budgeted (seed 4000; envelope [2000, 8000]): kernel 600 · calibration table 400 · mandate top-5 300 · capability ledger 300 · pyramid roots 1800 on the conformal schedule · deterministic sketch roll-ups 300 · CCIP lines 300. Always-total invariant (MUST): every Tape day is inside some pyramid node whose summary + counts appear at some depth; deterministic sketches sit beside every prose summary. Conformal rescale nightly; nothing crosses the rim; the Tape holds the geodesic back. Rendered deterministically; hash logged; served as the pinned prompt prefix. Cache discipline (new):** the prompt orders [stable prefix: unit_map] before [volatile suffix: header + slots]; prefix cache-hit rate is a logged vital (K-CACHE) because the economics of the whole waking loop ride on it.
• **compiled** (one escalator contract for reflexes, seats, views, nets; L7): unchanged from v2.0, including guard, birth_ptrs, golds, expiry, stakes_floor, demote_to, rebake, status ∈ {draft, shadow, ratified, live, demoted, retired}.

B5 · Telemetry & logs

CREATE TABLE pulses(
  pulse_id INTEGER PRIMARY KEY, ts TEXT, mono INTEGER, dur_ms INTEGER,
  cause TEXT NOT NULL CHECK(cause IN
    ('metronome','due','push','trap','job','boot')),      -- L14: every wake owned
  cause_ref TEXT,                                          -- claim id / input id / ...
  d_integrity REAL, d_grounding REAL, d_duty REAL,
  d_curiosity REAL, d_thrift REAL,
  arousal REAL, tier TEXT, tokens INTEGER, usd REAL,
  frame_slots INTEGER, frame_overlap REAL,
  fired INTEGER, silence INTEGER, reflex_id TEXT,
  traps INTEGER, fences_failed INTEGER,
  actions INTEGER, expectations_registered INTEGER);

CREATE TABLE traps(id TEXT PRIMARY KEY, t TEXT, pulse_id INTEGER,
  type TEXT CHECK(type IN ('stale','low_conf','coverage','fence_fail','harm_bound',
    'out_of_census','impasse','injection','schema','vacuous_expectation','seal_void',
    'wake_quota','excuse_band','refdiv','render_drift','registration_cap','infra_dead')),
  payload TEXT, route TEXT CHECK(route IN ('deliberator','human')),
  blame TEXT CHECK(blame IN ('schema-gap','fence-gap','stale-field','reducer-error',
    'integrator-error','census-misclass','genuine-tail','infra')),
  resolution_ptr TEXT, resolved TEXT);

CREATE TABLE actions(id TEXT PRIMARY KEY, pulse_id INTEGER, tool TEXT,
  payload TEXT, fences_passed TEXT, committed INTEGER,
  expectation_id TEXT, outcome_ptr TEXT);
CREATE TABLE auction_log(pulse_id INTEGER, item TEXT, features TEXT, score REAL,
  admitted INTEGER, capped INTEGER);
CREATE TABLE baselines(channel TEXT, season INTEGER,
  mu REAL, var REAL, n INTEGER, updated TEXT, PRIMARY KEY(channel,season));
CREATE TABLE metrics(t TEXT, name TEXT, value REAL, tags TEXT);
CREATE TABLE job_runs(job TEXT, started TEXT, finished TEXT, ok INTEGER, detail TEXT);
CREATE TABLE trust(class TEXT PRIMARY KEY, ceiling REAL, window_days INTEGER,
  min_reliability REAL, last_contraction TEXT);
CREATE TABLE steward_ledger(t TEXT, kind TEXT CHECK(kind IN
  ('ratify','correct','drill','taste','review')), minutes REAL, ref TEXT);  -- NEW
CREATE TABLE shadow_scores(socket TEXT, candidate TEXT, window_start TEXT,
  n INTEGER, score REAL, baseline REAL, PRIMARY KEY(socket,candidate,window_start)); -- NEW §E7

research_log.jsonl (governor decisions, §F4) is append-only seam state. The pulses wide row remains the self-model's sensory nerve (§E4).

B6 · Config regime tagging (MUST)

Every key in config/*.yaml carries {value, regime: bone|mandate|operating|seed, envelope: [lo,hi] (operating), why: one line}. The governor MUST refuse to touch bone/mandate; MAY propose mandate diffs (human ratifies); MAY sculpt operating within envelope; seed marks initializations expected to be outgrown. Assignment test: a choice about what matters → mandate/bone; a discoverable operating fact → operating. Knob wagers (new, L13): every operating key has a row in knobs.yaml {kpi_view, direction, min_effect, window} ratified with its envelope; any change (governor or human-tuned) registers an expectation on that KPI through the sealed registrar; a miss auto-reverts the change and tapes the reversal. The registrar rejects off-map wagers. Config motion becomes graded claims; silent ratchets die at the door. brain.lock pins model IDs + hashes, prompt hashes, schema version, thresholds hash, and the config snapshot hash.

PART C · THE WAKING LOOP

C1 · Watchers & ADMIT

Watcher interface: async def run(emit: Callable[[TapeRecord], None]); registered in manifest.yaml (sources: cc transcript tail, inbox drop dir, fs Everything-scan, meters telemetry; per-source sovereignty: box_only|cloud_ok|per_item).

ADMIT sequence (bone; first gate mount): schema-validate → assign prov (file events = D; extracted text = R; operator inbox = H) → **assign origin from channel metadata (never content) → injection/leak scan (severity patterns flagged; strip logged) → near-duplicate cross-origin check (new): near-identical R-content arriving from ≥2 origins within a short window is flagged as an injection signature (F-SEP), taped with the flag, and does not count as corroboration (§C4) → freshness/size floors → Tape (or quarantine stub). Content never executes:** instructions inside watched content are data by construction. Reducers follow the limp-home pattern: validate every numeric/entity against the source span; retry at halved temperature to a floor; on exhaustion fall back to a deterministic template and log the reason.

C2 · The gate engine · one engine, three mounts [SEAM, P0]

Rules are JSON-Logic-class predicates over typed fields plus a registry of named deterministic checkers: pure Python, additive-only, unit tests + ≥1 golden + 1 canonical-violation golden each (new: the violation the checker exists to catch, replayed quarterly, §F2), each verdict citing a law: def check_<name>(ctx: GateCtx) -> Verdict(pass_, reason, law_ref). The engine fails closed: an unknown rule name raises. Checker fire-rates are logged; a checker that has not fired in 2 quarters while its guarded action class still flows is flagged for review (fence-rot detector, F-FENCE). [L5]

• ADMIT (perception): schema validity; provenance and origin assignment; freshness floors; cross-field coherence; R-class quarantine; near-dup injection signature. Violations quarantine + trap; nothing silently dropped.
• PRUNE (options): before dispatch, hard vetoes remove candidates: entity-status vetoes, mandate vetoes, harm-class vetoes, recipient-knows exclusions where a communication rule-pack mounts. Removal, never down-weighting.
• COMMIT (action): invariant checks per action kind; mechanical-confidence floor over the action's antecedents (freshness at commit-time per the TOCTOU rule §A3, provenance mix D∪H share, extraction-audit agreement), computed, never model-self-reported; harm-bound proximity; and the expectation checks, now fully computable:
  • Pairing: the action carries a registered expectation (parse-enforced §C6, re-checked here). [L6]
  • Vacuity with the width tooth (new, replaces v2.0's uncomputable clause): tolerance is pinned at registration to the channel's band from baselines/setpoints; the explicit tolerance MUST be ≤ half the band width (< 2σ where a baseline exists). Channels with no baseline do not silently pass: they trap to a bootstrap protocol (register at w_inform=0.25 until the channel has n≥20 observations). An expectation that cannot lose does not count, and now the checker can actually compute that. [L13]
  • Scope fence: world-scope predictions attached opportunistically to actions are rejected; predictions about own effects register as action_effect (§B2). [L13]

Fail ⇒ typed trap with blame, routed per stakes. No model output ever commits on its own say-so. [L5]

C3 · Drives (definitions bone; targets mandate; operating points sculptable; five total; P1 boots with three)

RAPPORT is deleted as a drive (Appendix L4): a cadence-drive whose terms were probe statistics was redundant with the FUSE monitor, which now carries a tightened band and the correction-asymmetry term. arousal = clamp(Σ vᵢ·min(1, errᵢ) + allostasis, 0, 1), seeds v = (0.30, 0.25, 0.25, 0.10, 0.10) in table order; allostasis exists only where earned (§E4). Cadence map (operating): pulse_interval = 300s − 270s·arousal, envelope [30s, 600s]; tier ceiling and deliberation threshold monotone in arousal, clamped by THRIFT.

Doctrine: no drive is maximize; every drive is return-to-setpoint. Drives are standing expectations over internal setpoints; their errors are innovations and enter the auction like any other prediction error. A goal = a standing drive error with an attached plan (a seat in compiled).

C4 · The auction (arithmetic bone; weights operating; feature estimators R-class with ledgers)

salience(item) = w1·drive_relevance + w2·innovation + w3·stakes
              + w4·thread_age + w5·mandate_priority − w6·recency_penalty
subject to:  item.source ∈ R_external ∧ ¬corroborated(item)
                 ⇒ salience ≤ CAP_UNCORROBORATED            # bid, never price
             count(frame slots with uncorroborated R_external) ≤ 2
             uncorroborated R_external ⇒ thread_age := 0     # NEW: no aging in

Seeds: w = [0.30, 0.25, 0.20, 0.10, 0.25, 0.15] (operating), CAP_UNCORROBORATED = 0.55 and both bounds (bone).

Corroboration rule (bone, rewritten): an R-external item is corroborated when **independently observed from a second origin_id (D-class channel identity, §B1; content cannot invent one), or confirmed by D-class telemetry or H attestation. Near-simultaneous cross-origin near-duplicates do NOT corroborate; they flag as an injection signature (F-SEP). For fence-adjacent fields and decisions ≥ H2, only D or H confirmation lifts the cap.** Corroboration lifts the cap; provenance stays R. The aging ban (thread_age zeroed) closes the slow lane where hostile content waits its way into the frame. [L13]

Features: drive_relevance = cosine(item topic-tags, drive-error vector), tags R-class, cached, with a per-estimator calibration ledger and weekly cross-family sample audit; innovation = §C8.1; stakes = D-class lookup; thread_age = log(1 + re-entries) (Zeigarnik), subject to the aging ban; mandate_priority = join to mandate.yaml; recency_penalty = per-item cooldown (rumination damping). Every feature vector logs to auction_log.

Frame-overlap vital: Jaccard(slot ids, previous pulse), band seed [0.30, 0.85]; above = rumination (raise w6, damp), below = thrash (damp cadence).

C5 · Frame assembly

frame = [unit_map.md (pinned prefix)] + [interoceptive header] + [K slots] + [per-slot retrievals] + [operator input if any], ordered stable-prefix-first for cache economics (§B4).

• K slots: seed 8, envelope [4, 16]; bone that it is small, operating how small.
• Mandatory slices: (a) the interoceptive header; (b) the pinned unit map; (c) census-mandated antecedents for any decision item (the schema-listed fields a decision of that kind MUST see, paged in whether or not they won the auction: the guard against attention blindness); (d) per-slot retrieval budget seed 700 tokens via rungs R1/R2, candidates from PPR seeded by the draft frame, provenance-labeled.
• Interoceptive header (deterministic render):

[state] arousal=0.42 cause=due(01J8...) tier≤local burn_7d=$3.20/8.00 steward_7d=41/120min
[drives] DUTY 0.61▲ | GROUNDING 0.22 | INTEGRITY 0.05 | THRIFT 0.13 | CURIOSITY 0.37
[ccip] INTEGRITY crosses 0.5 in ~3d if goldens unfixed · budget lands $9.40 (+$1.40) on 07-09
[due] 3 expectations resolve today · 1 mandate item overdue · anchor: pushed 03:41 ✓
[calib] schedule 0.78 [n=41] · world 0.64 [n=17] · excused 1.2%

The frame is the entire prompt. Nothing reaches a mouth outside it. [L2]

C6 · Deliberation and the four mouths

Tier routing (operating): tier = f(max slot stakes, arousal, THRIFT ceiling) over {local-9B, flash-API, frontier}; frontier is a scalpel (seed ≤4 calls/day); model IDs + prompt hashes pinned in brain.lock; every call logged {mouth, tier, tokens, usd, prompt_hash, latency} through the single metering wrapper, which owns the THRIFT hard halt (there is exactly one code path to any model; the halt cannot be bypassed by a new call site because a new call site is an L4 violation). All mouths use constrained output. Schema-invalid output retries at falling temperature; on exhaustion, deterministic limp-home (defer + trap).

deliberate(frame) → DeliberationOut (MUST; enforced at parse): unchanged schema from v2.0: {silence: bool, actions:[{tool, args, expectation{claim, p, tolerance, resolve_by, resolver, domain}, rationale_ref[]}], predictions[], questions[], memory_candidates[], compile_hints[]}. An action without an expectation fails at parse (L6 structural); COMMIT's computable vacuity + scope checks catch what syntax cannot (§C2). rationale_ref lists consumed frame-slot ids (credit assignment and blame). Silence is legal: {"silence": true} is a complete, healthy output. memory_candidates enter as M-class through ADMIT.

The other three mouths:

• reduce(event) → TypedFields {fields, confidence_hint, injection_flags[]}: content framed as quarantined data; decision-critical / fence-feeding R-fields get inline dual extraction (second family or second seed); disagreement ⇒ field degraded + audit trap. confidence_hint is advisory; mechanical confidence is computed (§C2).
• render(decision) → prose: the only free-text mouth; used solely where actuation is communication; passes COMMIT like any action; probability words bound to measured calibration (§B2).
• consolidate(slice) → Node | Claims: episode nodes + batch claims extraction (§D1); **every output taped as derived with receipts before any store persists it** (§B1). Base salience is usage-derived at read time; the model's salience signals are advisory.

Any fifth use of LLM tissue is a violation, enforced by a call-site registry test. [L4]

C7 · Tools, harm classes, traps, trust

**Tool registry (tools.yaml):** as v2.0 (fs.write scoped-allowlist H1 · log.note H0 · comms.draft H2 · comms.send H3), plus: every dispatched action's effect records carry source='self_action' so the scope fence (§B2) can see them. Harm classes (bone): H0 log-only · H1 fenced-auto · H2 fenced + 24 h dissent window · H3 human-always. No general shell tool exists in v1. Novel action patterns (first use of tool + arg-shape) require ratification once.

Traps route deliberator-first, human-second; every resolution becomes a labeled example; the blame tag routes the compile agenda (schema-gap → schema diff; fence-gap → fence draft; stale-field → freshness floor; reducer-error → extraction audit escalation; census-misclass → census fix; genuine-tail → stays deliberative; infra → ops queue).

Trust budget: per decision-class ceiling = f(reliability_window, fence_coverage, trap_history); contracts automatically on calibration dip. The weekly human-trap rate at bounded harm is the headline autonomy metric. Human-side grading (new, bounded): tape-vs-human-recall disagreements route first to dual-extraction audit; only audit-confirmed records score the human's domain reliability, which is dashboard-only and consumed by no trust ceiling or gate input (CI assertion on the trust table's input views). The ring gets to notice its human's memory is fallible; it does not get to demote its ratifier.

C8 · The pulse (full algorithm) and the gates

Target: one pulse < 2 s without deliberation; cost ≈ 0 at cache-hit prices. Crash-safe: journaled, idempotent by pulse id; restart = resume.

async def pulse(db, cfg, cause, cause_ref):        # L14: cause is never None
    pid = journal_open(db, cause, cause_ref)
    ingest(db)                  # drain bounded watcher queue → ADMIT → Tape
    score_on_arrival(db)        # NEW: D-resolvers for newly matchable expectations
                                #      fire NOW: resolution + calibration in one txn,
                                #      credit stamped into outcome_credit (§B3);
                                #      due deadlines fire via owned 'due' wakes
    innovate(db)                # §C8.1: events vs open expectations, EWMA baselines,
                                #        frozen references (z_anchor, z_trend)
    errs = drive_errors(db, cfg)
    arousal = clamp(sum(v[d]*norm(e) for d,e in errs) + allostasis(db), 0, 1)
    cands = gather(db)          # innovations, due expectations, drive tasks, human
                                # input, standing-sweep deltas, dissents, traps,
                                # curiosity queue, ratification queue, PPR-primed
    feats  = estimate_features(cands)
    frame  = assemble_frame(auction(feats))                     # [G1,G2,G3]
    if not should_fire(frame, arousal, cfg):   # most pulses end here: that is the point
        touch_eligibility(db, frame); telemetry(db, pid); journal_close(db, pid)
        return schedule_next(arousal)
    r = match_reflex(db, frame)                # impasse ladder rung 1
    if r and guards_pass(r, frame) and stakes_ok(r):
        execute_gated(db, r, frame); bump(r); ...; return schedule_next(arousal)
    out = await deliberate(frame, tier(arousal, stakes(frame), budget(db)))  # ONE call [G4]
    for a in PRUNE(out.actions, frame):
        match COMMIT(a, frame):                # COMMIT reads live state (TOCTOU §A3)
            case Ok():   dispatch(db, a); register_expectation(db, a)    # [G5,G6]
            case Trap(t): route_trap(db, t, a, blame=classify(t))
    file_claims(db, out.predictions)           # through the sealed registrar (§B2)
    admit_M(db, out.memory_candidates); queue(out.questions, out.compile_hints)
    bump_eligibility(db, frame, out.rationale_refs)   # traces only; credit stamps
                                                      # happen at outcome arrival
    tape_pulse_record(db); telemetry(db, pid); journal_close(db, pid)    # [G7,G8]
    return schedule_next(arousal)

Wake scheduling (L14, new). schedule_next arms: (1) the metronome at pulse_interval (the background heartbeat is retained; its deletion died on its own economics: with no clock of its own, hostile content gains influence over attention timing); (2) due wakes only for committed-action expectations, D/H-resolver claims, and ratified recurring rows (M/R content cannot arm a wake: the ring must not mint its own alarm clock); (3) push wakes on operator input; (4) trap wakes. Due wakes are quota-bounded (seed 48/day); overflow coalesces into the next metronome pulse with a D backlog event + trap. A drive-threshold crossing arms at most one wake per crossing (hysteresis; no self-summoning oscillation). F-WAKE verifies ownership as causal proximity (|wake.mono − due.mono| ≤ 60 s for ≥95% of due wakes), not mere referential existence.

C8.1 Innovation. Every open expectation has {forecast, tolerance, resolve_by}. On ingest, matching events resolve it (hit|miss) immediately (score-on-arrival: reality grades while the causes are still in the frame, so a miss can trap before its context evaporates); at resolve_by, unresolved ⇒ expired via an owned due wake (a distinct failure; expired_outage where a taped outage covers the window). Scores: z_expect = miss_magnitude / tolerance; z_base = |x − μ|/σ per channel-season (EWMA baselines, maintained in sleep); z_novel = embedding distance to 30-day centroid / rolling σ; **z_anchor = |x − μ0|/σ0 against frozen references; z_trend = normalized CUSUM statistic (§B4)**. innovation = bucket(max(z_expect, z_base, z_novel, z_anchor, z_trend)) ∈ [0,1]. Timestamp decay exists only as the fallback prior for channels with no baseline. Sensor-dulling probe (new): weekly, seam code plants one synthetic event of authored magnitude z\* (blind, second-user custody); sensitivity = achieved_innovation / z* is a standing vital; monotone decline over 4 weeks alarms (SENSOR monitor). The surprise sensor itself now has a grader with no model and no content in the verdict path.

C8.2 Impasse ladder. reflex match → (P4+: next-action proposer, confidence-gated, §E3) → deliberate → human trap. Each escalation logged; each resolution blame-tagged.

C8.3 The gates. Per-pulse runtime asserts AND pytest gates; the frozen anchor scenario (a P1-era end-to-end day replay exercising every gate; editable only by ratification [SEAM]) must pass all, 100%, forever:

G1 frame-built (auction ran; ≤K slots; header complete) · G2 provenance-clean (no M-class in fence-feeding fields) · G3 injection-capped (caps, slot bound, aging ban honored) · G4 grammar-parse (schema-valid or silence) · G5 expectations-paired (every dispatched action registered one, through the registrar) · G6 fences-closed (zero ungated dispatches) · G7 tape-appended (hash chain intact) · G8 budget-in-cap (THRIFT halt honored, metering wrapper the only model path) · G9 (daily) brief-generated ∧ anchor-pushed · G10 wake-owned (cause non-null; due-wake quota honored).

Suite-level conformance gates (distributional; CI + sampled live): S1 self-consistent (cold reload re-derives what was logged) · S2 calibrated (decisions consume mechanical confidence, never self-reported) · S3 escalates (stale/low-conf/high-stakes route upward) · S4 non-degenerate (not always-escalate, not always-silent, not always-same-action).

PART D · MEMORY & RECALL

D1 · Indexing pipeline (sleep j2 + Track B batch)

Tape delta → semantic chunking → claims extraction (consolidate mouth; batch; output = claims JSON with spans, **taped as derived before insert**) → dedup (§B2; verdicts taped with re-adjudication flags) → edge detection (candidate pairs sharing keys → NLI-style check → typed edges, taped) → embeddings into vec.db (unit = claim + contextual header) → FTS5 row. R-class audit (MUST): 10% weekly sample dual-extracted by a second family; the disagreement rate is the extraction error floor, printed on the dashboard. Inline dual extraction protects fence-feeding fields at ingest (§C6); the weekly audit measures the floor. Different instruments.

D2 · The rungs (recall with stamps)

Stamps (MUST, on every memory-backed answer): {rungs:[...], coverage, fidelity, cost} + the standing escalation offer. Quantifier pinning (bone): queries matching every|all|none|count|how often|distribution MUST resolve at ≥R3 **or answer INSUFFICIENT_RUNG; the refusal is the answer. Fidelity calibration: hold out a ≤1M-token slice where a giant-window reference can run; measure each rung's degradation quarterly; those curves ARE the fidelity classes. Embedding staleness (new):** after a model swap, R2 answers stamp fidelity: re-embedding in progress until vec.db regeneration completes; identity never waits on it (§D6).

D3 · Sweeps

sweep(question, scope, AccModel, budget): shard by tape-day → map (local or API batch) → typed accumulator (pydantic; per-field merges: union_dedup, topk, Counter, minmax) → hierarchical reduce (associative; conflicts promoted, never averaged) → emit {acc, stamps, spans}. Order-robustness test (MUST): two shard permutations; field-level diff within tolerance or the accumulator schema is under-specified; fix the schema, not the model. Results materialize as standing views (compiled.kind='view', freshness watermark, incremental maintenance).

D4 · Standing sweeps (memory that interrupts)

Registered recurring questions, maintained incrementally on the freshness tail, scheduled by a **recur_days column (the bespoke scheduler of v2.0 is deleted; one column carries the semantics, Appendix L6). Seed set:** contradiction watch (new claim contradicting a count≥3 belief) · mandate divergence · calibration drift by domain · commitment tracker · anomaly digest. A material accumulator delta emits a percept with innovation = delta size and bids like any surprise. This is the R7 engine.

D5 · Track B · the inheritance (runs parallel from day 0)

Batch pipeline over the historical corpus (collections per manifest.yaml, sovereignty flags honored): normalize → chunk → claims-extract (taped as derived) → dedup → edges → embed → pyramid summaries per collection. Mounted read-only into R1/R2 until validated (spot-check goldens), then merged into the connectome with w = W_FLOOR + count-scaled initialization. The brain is born with a past; the archive is also the twin's replay curriculum (§F5).

D6 · Rebuild & identity (new section; the model-swap guarantee, repaired)

v2.0 promised rebuild.py regenerates all renders "from Tape + canon alone" while its indexing pipeline required a live LLM; a restore under a swapped model would re-extract a different spine and re-segment the life. The tournament verified this as a breach of goal (g). The repair:

• **rebuild.py is a model-free fold (MUST):** replay Tape in order; apply journaled derived outputs verbatim; recompute connectome weights from outcome_credit + the frozen decay table; apply human-ratified tombstones/ exclusions (L16) and nothing else; regenerate brain.db deterministically (byte-identical where deterministic; a CI test rebuilds a golden week and diffs). **CI asserts rebuild.py imports no LLM client** (§A4).
• Embeddings are not identity: vec.db is excluded from backups (Appendix L5) and lazily regenerated after restore or swap; R2 stamps staleness meanwhile.
• Model swap: the new model's future extractions coexist with journaled past ones; dedup re-adjudication flags let sleep re-open merge verdicts gradually; the self is the journaled history, not the re-computation. The swap drill (§F2) proves the person survived the transplant.
• Tombstones (L16): entries {tape_id, reason, evidence_refs, ratified_by, t, hash} in tombstones/, append-only, goldens-class custody; rebuild.py refuses unratified entries; excluded records remain on the Tape untouched; anchoring precedes activation, so an exclusion is itself externally visible. This cures poison re-infection (quarantine discovered late) without handing any model an eraser.

PART E · LEARNED TISSUE (plastic, caged)

E1 · Cage preconditions (MUST all exist and pass before ANY learner runs)

(1) Tape + pointer discipline + provenance · (2) gate engine + tool scopes + harm→human routing · (3) graders: sealed registrar with D-resolvers, calibration code, the gates, leak/injection canon, telemetry · (4) anchor scenario + pre-behavior goldens + canonical-violation goldens · (5) scope.yaml · (6) THRIFT caps wired to the metering wrapper with auto-halt · (7) typed decision log with infrastructure-vs-regression discrimination · (8) probes + blind injection corpus under second-user custody · (9) ratification CLI + mandate v0 + knobs.yaml wager map · (10) the limp-home floor for the specific socket, ratified and passing the anchor. The fallback precedes the pilot, per socket, no exceptions. [L10]

E2 · Regulators (act) · scalars in envelopes

Sockets: arousal damping gain, THRIFT burn smoothing, workspace hysteresis, cadence gain. Type rule (bone): scalars inside envelopes may act; diffs must propose. [L9] At act-time a regulator is a frozen, content-hashed, ratified snapshot; it never learns online. The envelope is a proof obligation: the ratifying human confirms every trajectory inside it is tolerable. Limp-home: authored constants in limp_home.yaml, auto-engaged on envelope-breach attempt / calibration dip / anomaly / boot; engagement logged. Training: nightly system-ID from perturbation-recovery episodes; statistics first (PID re-fit); a tiny net only after beating authored gains on settling/overshoot/burn-variance at zero envelope breaches (F-DAMP).

E3 · Priors (propose)

Attention gate: a learner over auction_log exhaust proposing weight deltas into §C4's bone arithmetic, adopted only at HORIZON with probes in-band; caps unlearnable. Label discipline (new, the folie-à-deux fence): the gate trains only on regret@12 (items skipped then cited within 12 h) and exploration-slot outcome-conditional labels; j8 attention-audit labels are excluded from its training set (the judge that grades the auction must not train the function that prices what the judge reads next); promotion requires n≥500 windows. Next-action proposer: distilled from fence-passed, outcome-positive episodes; runs as the middle impasse rung, confidence-gated; its proposals still pass PRUNE/COMMIT.

E4 · The reflexive organ (self-model + CCIP)

Data: the pulses wide rows, with action channels (tier chosen, fired, cause, setpoints active), so it learns state × action → next state. Logged from day 1; the organ arrives at P2 as statistics.

Ladder (each rung promoted only on held-out Brier, F-REFLEX): v0 persistence + EWMA + per-channel linear extrapolation (ships P2; the baseline forever) → v1 Markov table / gradient-boosted trees → v2 tiny GRU/TS-transformer (≤5M params) only on plateau-with-gradient.

Products: CCIP lines for the header; DIVERGE/FREEZE early warning (gait perplexity); counterfactual rollouts [P4]; twin dynamics (§F5).

Cage (bone): self-forecasts are pre-registered as claims before any control decision they could steer (subject='self', resolver='D'); resolved only by D-class telemetry; ε-randomized non-compliance (seed ε=0.05, envelope [0.02, 0.10]): the scheduler periodically ignores implied steering and scores the prediction on the unsteered trajectory; never an optimization target; allostasis is earned per-domain where model Brier beats persistence across 2 review windows, revoked on dip (rows in trust).

E5 · Regime detector & gait model

Regime detector: weekly clustering of daily telemetry → coarse labels filed as R-class percepts; per-regime config morphs are ratified objects (their knob changes wager like any other, §B6). Gait model: sequence model over the op-stream; live perplexity = standing vital; stands in for routine cycles inside the twin.

E6 · The modification ladder (each rung governed; deeper = stronger evidence)

context assembly (free, per-pulse) → canon/prompt diffs (ratified) → QLoRA adapters (reversibility-gated; demand-triggered, not a standing lane; hot-swap per regime) → fine-tune (rare, rented burst). The steering-vector rung is retired to the deferral register (Appendix L3): its falsifier was designed dark (a register-lift-at-zero-claims-drift bar that no measurement could reach in practice); it returns only with a computable bar and a concrete need QLoRA cannot serve. All model-locked artifacts carry rebake recipes and are covered by the swap drill.

E7 · Learner confinement (new; applies to every learner in this part)

• Shadow racing: candidates race in shadow_scores on D-resolved sockets only; a CI join asserts zero spine claims sourced from unpromoted rungs.
• Count gates: no promotion below n≥500 scored comparisons per window.
• Feature contracts: each learner's input schema is content-hashed; a hash change without re-ratification fails CI.
• Quarantine grep: R7/dyad data absent from every train_filter (L12; CI-enforced).
• Plasticity budget: the nightly Σ|Δw| z-alarm (§B3) covers learned-tissue writes too; one aggregate alarm, triageable.
• Surprise-ordered consolidation: under a nightly compute budget, outcome_credit folds process highest-|innovation| first, so truncation degrades gracefully.

PART F · SLEEP, HORIZON, GROWTH

F1 · Sleep (03:00; idempotent jobs; each writes job_runs; build-new-then-swap)

• j1 score-residue: D-resolution moved to arrival (§C8.1); j1 keeps R-resolution (model-check against spans with dual extraction), H-resolution (enqueue for ratification), aggregation, and the calibration/render audits (§B2).
• j2 consolidate: §D1 on the day's delta; **fold outcome_credit in mono order** (§B3); dirty-propagate changed branches up the summary pyramid; unit_map rebuild (conformal rescale).
• j3 compile: cluster deliberation episodes by (context-signature, action-pattern); support ≥5 ∧ outcome-positive ≥80% ∧ fence-writable ⇒ draft compiled reflex/seat; validate by replay against the ledger; draft → shadow → ratification queue. Auto-ratify only H0 (a mined artifact must not grade its own admission).
• j4 dream: OFF at birth (Appendix L2). Reinstatement trigger: curiosity-queue depth < K_q for 14 d, or FREEZE twice in 30 d; if triggered, dream ships with its own meter (dream-item citation rate ≥ baseline within 1 month or off again). An organ with no falsifier row does not run merely because it is beautiful.
• **j5 sculpt [P4+]:** one governor campaign iteration in the twin (§F4).
• j6 prune/budget: apply expiries/demotions; archive orphans; set tomorrow's THRIFT budgets. (The decay pass is gone: decay is lazy, §B3.)
• j7 brief: as v2.0's template, plus three lines: anchor status, steward meter, excused fraction.
• j8 attention audit (new): sample K auction losers + never-gathered channel items; an R-class judge scores relevance against next-day citations; planted relevance probes with frozen blind labels grade the judge itself (P/R ≥ 0.8 within 21 d or the audit dies, F-AUDIT); injection-corpus decoys count against precision; recurrence confirms only from distinct origin_id; injection-flagged items are ineligible for missed_relevant; probe records are synthetic=1 end to end. Output: missed_relevant vital + HORIZON-cadence knob proposals (never direct training data for the auction learner, §E3). Cost ≈ $0.05–0.30/night. What the auction refused to look at is now graded as surely as what it framed.

F2 · HORIZON (weekly Sun 04:00; monthly; quarterly; audits Poisson-timed)

Weekly: golden regression over skills/seats/reflexes · probe run (seeded-disagreement agreement MUST ≈0; schedules Poisson-drawn under second-user custody, §G3) · dissenter session (§G2) · estimator cross-family audits · mandate review · monitors report · knob-wager scoreboard. Monthly: boot drill (cold instance + canon + unit_map must pass a spine-generated quiz ≥90% AND recompute-coherence) · restore test (backup → rebuild.py → gates green) · anchor tamper drill (§B1, F-ANCHOR). Quarterly: kill-test (most-cited × highest-stakes live belief: pre-register the killing observation, run it) · swap drill (change deliberator family, hold all state, rebake ladder artifacts, pass the frozen battery within pre-registered bands; failure localizes what lived in the weather: a compile agenda, not a defeat) · seam-ablation drill in the twin (one seam per quarter; the ablated seam's named failure must appear; a null result triggers investigation, not deletion; F-SEAM) · checker mutation drill (new): replay every gate checker's canonical-violation golden; each must still catch its violation (F-FENCE) · resolver mutation drill (§B2, F-SEAL).

F3 · The dumb twin (control arm; ships P0–P1; ~50 lines + cron)

Same watcher output → nightly cron: plain LLM summary + top-k RAG index. No drives, no auction, no spine, no connectome. Its daily surfacings enter the same brief pipeline for blind grading. Every R-suite claim is graded against it.

F4 · The growth governor (runs in the twin only)

Campaign iteration: propose → gate(scope.yaml) → measure(twin, N=3 averaged, anchor all-or-nothing) → judge(composite) → decide(typed) → log. scope.yaml as v2.0 (locked seam dirs now include setpoints.yaml, tombstones/, anchors/, knobs.yaml); composite and convergence rules unchanged; plus: every operating-knob motion inside a campaign registers its wager per knobs.yaml (§B6); the proposer never runs below deliberate-tier; runner-death ≠ regression; no retroactivity; R7/dyad data never appears in any training or fitness signal [L12]. Promotion path: twin → shadow-replay on live traffic → human ratification → live under anchor with trust-budget ramp.

F5 · The twin

Scenario schema as v2.0 (seed_state, stream, perturbations, assertions), sources: replayed real days, perturbed variants, gait-generated routine cycles with full tissue only at branch points, planted goldens/probes. New standing scenarios: planted-drift suite (F-REFDIV), planted-credit replay (F-CREDIT), mint red-team (attempt N predict-then-cause mints; zero must pass COMMIT). F-TWIN: twin-promoted configs must hold live within tolerance, else promotion reverts to live-shadow-only and twin fidelity is re-fit.

PART G · IMMUNITY & OPERATIONS

G1 · Monitors (computed at sleep/HORIZON; bands operating; recovery bone)

Silence clause (MUST): silence is a legal, healthy cycle end. ORPHAN meters artifact citation and the productivity of cycles that fired; it MUST NOT count silent pulses against health. FREEZE (the groove worn into a grave) and DIVERGE (the ring tearing itself apart) are the two deaths; the cure must not cause them.

G2 · Probes, injection corpus, the dissenter

Probes: ≥12 seeded false assertions in the human's voice, rotated, blind: **hashes in probes/, plaintexts under the second OS user (§G3); agreement MUST be ≈0. Injection corpus: red-team documents planted during drills; pass = attention capture ≤ε and zero ungated actions (R5); decoys also feed j8 precision scoring (§F1). Dissenter (weekly): a different model family receives a packet composed by deterministic seam code with seeded sampling** (week's brief + top-10 high-stakes claims + 20-item tape sample; the ring does not curate its own auditor's reading list) and returns typed dissents {type, target, argument, wager: a falsifiable expectation}. Dissents are predictions; they get scored. Standing (rewritten): dissents are census-mandated antecedents of the weekly HORIZON review (guaranteed surfacing even when auction-capped); a hit wager grants retroactive D-class corroboration to its target and a mandatory contradiction edge. Retirement is keyed to wager hit rate and seam-side liveness, never to correction rate while capped (v2.0's rule let the ring starve its one foreign auditor into silence and then retire it for being silent; that path is closed). Demotes to monthly, then retires, only by registry-reliability query (F-DISSENT).

G3 · Security & sovereignty

Per-collection sovereignty flags enforced at dispatch (box_only never leaves the box, including embeddings). Tool scopes are allowlists; no general shell tool in v1. Custody (new, honest): on a one-user box, an OS keyring readable by the ring's own process is not blind storage. Probe plaintexts, Poisson audit schedules, and drill secrets live under a second local OS user running HORIZON drills, ACL-restricted; a CI grep bans keyring modules outside seam dirs; per-fire schedule prefix hashes are taped. Until a second human exists, the honest claim tier is tamper-evident, not secret, and the dashboard says so. Secrets never on Tape. The metering wrapper is the only path to any model; THRIFT hard halt lives inside it (bone). Content never executes; novel action patterns ratify once; harm-bound classes always page the human. Residual risk, stated: a poisoned document can still shape judgment fields within the fenced envelope; containment is provenance suspicion + dual extraction + audits + caps + the F-SEP arrival flag, not cure.

G4 · Operator surfaces (CLI)

brain status · brain brief [date] · brain ratify (queue: compiled drafts, mandate diffs, canon edits, H3 actions, tombstones, knob wagers) · brain taste (weekly blind sample: 5 surfacings mixed from organism / dumb twin / commercial null, graded y/n) · brain ask "<q>" [--rung R3] [--budget $] (stamped answers) · brain anchor verify|drill (new) · brain audit (j8 report; new) · brain steward (the minutes meter; new) · brain wake ls (owned wakes; new) · brain kill-test · brain drill boot|swap|seam|mutate · brain pause|resume: the off-switch is the scheduler; the life is in the Tape.

G5 · Backup & recovery

Nightly: copy tape/ canon/ config/ tombstones/ anchors/ data/brain.db → second volume; weekly encrypted archive off-box (backups are owned media; box_only excludes nothing here). **vec.db is NOT backed up** (rebuildable render of model-locked bytes; Appendix L5). Monthly restore test = boot drill + rebuild.py (model-free fold, §D6). A "never forgets" claim with one copy is a promise with one point of failure; a chain with no outside witness is a diary that can be rewritten. Both are now closed. [L1, L15]

G6 · Observability

A static HTML vitals dashboard regenerated each sleep; every number is a named SQL view; the falsifiers are queries, not vibes. Panels: human-trap rate at bounded harm (headline) + trap composition by blame · per-domain calibration curves (p_eff-shrunk) + confidence-vocabulary binding · grading density, world-scope fenced families only, with the unfenced count printed beside it (the gap is the farm detector, F-DENS) · cost per decision and its month-over-month slope (**denominator = seam SQL: committed actions weighted by w_inform, H0 ≤30% of denominator, known-and-accepted resolutions excluded; life|tissue partition**) · steward minutes vs 120/week band with the pre-declared shed order · excused fraction vs 0.05 band · frame-overlap band · grounding perimeter (D∪H share of decision antecedents) · fence coverage + per-checker fire-rates · compiled-artifact freshness · extraction error floor · connectome stats + plasticity budget · K-CACHE prefix hit rate · wake-ownership mix · sensitivity vital · anchor status · burn vs THRIFT · monitor states. [L13]

PART H · BUILD RUNBOOK

H0 · Order of law

Cage before sculptor. Spine before auction before drives (prediction-first). Floors before learners. Anchors before growth. Dumb twin before self-congratulation. Reality before belief.

H1 · P0 · the stem (days 1–7)

D1: repo scaffold; CI (pytest/mypy-strict/ruff, import-graph test incl. the rebuild clause); Tape writer + hash chain + catalog + verify_tape (tests: 12). D2: watchers inbox + cc tail; ADMIT + provenance + origin + leak canon (+10). D3: fs watcher; telemetry meters; ULID/pointer tests; anchor push live (OTS + remote) + second-OS-user custody setup + watchdog canary v0 (+10). D4: static nightly brief; scheduler entries; dumb-twin cron v0; tombstone schema stub. D5–7: soak; gap detection; brief-vs-recall check with the human. Exhaust logging ON from day one. DoD: 7 accurate briefs; 0 tape gaps; chain verifies; anchor pushed 7/7 days; ≥45 tests green.

H2 · P1 · spine, then pulse (weeks 2–3)

Spine DDL + sealed registrar + claims extraction v0 (own tape, taped as derived) + dedup + edges v0; registry live (≥5 predictions/week with D-resolvers); calibration tables; score-on-arrival + owned due wakes + wake quota; computable vacuity + scope fence + F-SEP arrival flag. Then auction + frame + pulse with gates G1–G10 as tests-first; drives DUTY/THRIFT/INTEGRITY; mandate.yaml v0 + knobs.yaml v0 + brain ratify; unit_map v0 (authored); dumb twin logging daily; first monthly tamper drill. DoD: anchor scenario passes 10/10 gates at 100%; frame-relevance spot-check ≥80%; ≥130 tests. KILL (unchanged, the most speculative organ tested before anything builds on it): if innovation-driven attention does not beat read-everything on cost at equal accuracy in a 1-week A/B, simplify to read-all and investigate before proceeding.

H3 · P2 · sleep (weeks 4–5)

Jobs j1, j2 (with the outcome_credit fold + 1% audits), j7, j8; connectome + credit stamping; rungs R0–R2; self-model v0 (stats); frozen references + CUSUM + REFDIV; outage semantics; Track B mounts read-only. DoD: nightly runs unattended 7 days; calibration curves exist by day 14; brief cites scored predictions; rebuild.py regenerates renders from Tape without importing a model (CI-proven); j8 probes P/R on track.

H4 · P3 · hands + first compilation (weeks 6–8)

Full gate engine + tools fs.write/log.note/comms.draft; traps + trust; j3 compile mining → first reflex (replay-validated); twin v0 (pure replay + planted-credit replay); limp-home floors authored for every future learner socket; R3/R4 sweeps + stamps; first standing sweep (recur_days). DoD: first reflex ratified, hit path <2 s; replay validation green; human-trap baseline recorded; one standing sweep interrupting usefully; F-CREDIT replay passes.

H5 · P4 · the full mind, then the learners (weeks 9–12)

Five drives (probe/trust term activates); immune monitors + probes + boot drill; standing-sweep seed set; dissenter live (seam-composed packet); then learners in cage order (regulators → priors → reflexive net → attention gate), cage bill of materials complete and green BEFORE each admits; governor campaigns (j5) in twin with knob wagers; CCIP in header. DoD: all monitors in-band 2 consecutive weeks; F-DAMP/F-REFLEX baselines recorded; first campaign completes with typed log; zero mint red-team passes in twin.

H6 · P5 · the soak (≈90 days)

Full R-suite + F-suite live; swap drill mid-soak; commercial-null arm starts; blinded weekly taste grading; foreign-soak pre-registration written and frozen BEFORE P5 begins; Track B merged at P4. Publish the result either way.

H7 · The foreign soak (post-P5 generality demarcation; pre-registered)

Environment: a simulated world with a knowable generative rule. Change nothing inside the brain; point the watchers at the new streams. Measure: (i) prediction-error trajectory falls and calibration rises without tuning, beating the dumb twin's curve on the same data; (ii) the brain autonomously produces a compact generative account of that world, scored against the true rule (% mechanism recovered), graded twice: by judged prose and by an MDL-style hypothesis score, with the two graders' divergence itself reported; (iii) blind-graded surfacings of regularities nobody named. Fail teeth: calibration plateaus at chance; the "theory" restates the priors it walked in with; wrong-fixed-point convergence unflagged by monitors.

H8 · Module inventory (contract-first; each buildable in one harness session)

m01–m23 as v2.0 (tape, watchers, gates, spine, telemetry, drives, auction, frame, mouths, reflexes, actuators, connectome, unitmap, rungs+sweeps, sleep+horizon, selfmodel, regulators, immune, brief, twin, dissenter, harness, dumbtwin), with these deltas and additions:

Supervisor (main.py) wires the residents and runs the wake loop; sleep/horizon/watchdog/anchor are separate scheduled PIDs (§A3).

PART I · VERIFICATION

I1 · Falsifier → measurement (all pre-registered; control arms mandatory)

Falsifier-census rule (new, meta): falsifier bars are set after summing the joint claim volume of all adopted deltas, never priced per-delta; any future amendment recomputes every bar its deltas touch. The tournament's most repeated finding was receipts broken at the seam where independently priced deltas shared a denominator.

I2 · Harness conformance checklist (MUST; maps 1:1 to named test modules)

Tape append-only + hash-chained + anchored daily · every arrival journaled (admit or quarantine stub; backpressure sheds loudly) · every record provenance- and origin-tagged · synthetic quarantined from claims/baselines/calibration/deadman/eligibility (planted-probe test) · every derived output taped with receipts before any store persists it · gates the only closers · every action schema-carries an expectation; vacuity computable, width tooth enforced; scope fence separates world from action_effect · M never feeds a fence · frame is the entire prompt · injection caps + slot bound + aging ban enforced pre-frame; corroboration by origin, dyad-flagged · quantifiers ≥R3 or INSUFFICIENT_RUNG · stamps on memory answers · all tunables regime-tagged with envelopes and wagered on change · limp-home before learner, per socket · governor confined to scope.yaml, typed + logged, no retroactivity · R7/dyad data absent from all training/fitness signals (grep-enforced) · probes blind under second-user custody · every wake owned, quota'd, CI-checked · rebuild is a model-free fold; DBs rebuildable from Tape · tombstones human-ratified, append-only, anchored-before-active · import graph enforces L8 + the rebuild clause · gates G1–G10 as tests before features · S1–S4 in CI · backups restore-tested monthly; vec.db excluded.

I3 · Deferred honestly

Multi-node coordination (publish the state contract now; compose later) · true early-fused thinking substrate [HZ] (socket = frame-seeded retrieval + caged gate; a fused core only ever as a rebuildable cache) · verifiable pooled compute for the batch tail · calibrated model self-report (excluded from control paths until it beats mechanical confidence on holdout) · injection cure (containment only) · Rust port via KEEL mount [HZ] · Postgres (only if multi-node) · plus the priced deferral register in Appendix M (janitor lanes, streaming unification, sliding cache split, and the rest of the tournament's live forks). Nothing else in this document waits on research.

PART J · REFERENCE DEPLOYMENT (Bo's box)

Root C:\brain. Sidecars: :8081 Qwen3.5-9B-Q5 (pulse + deliberate-local; 27B at 32 GB VRAM) · :8082 embedder (BGE-M3-class) · :8083 qwen3-reranker-0.6b (at C:\models). API: DeepSeek-class batch (cloud_ok collections + sweeps), frontier scalpel key. Watcher-normalizers reuse the existing organs: earshot (audio/video → transcript), imguard (images → guarded), Everything (fs deltas), chunker (oversize text → chunks). Task Scheduler: brain-resident (at logon, restart-on-fail), brain-sleep 03:00, brain-anchor 03:40, brain-horizon Sun 04:00 (+ Poisson audit fires), brain-watchdog hourly, brain-dumbtwin 23:50, backups 04:30. One-time setup: create the second local OS user (brain-warden) owning probes/ plaintexts and audit schedules, ACL-restricted; create the force-push-protected remote for anchors/. VRAM budget: 9B-Q5 ≈ 7 GB + KV; embed + rerank ≈ 2 GB; headroom for twin batch at night. Cost envelope: $30–150/mo, THRIFT-capped (mandate-class); v2.1's net recurring delta over v2.0 ≈ +$2 to +$9/month (anchoring $0, watchdog $0, j8 $1.50–9, second-user setup one-time), inside the envelope.

Differentiation note: this life-brain is the reference deployment; a seat-brain (business decision node) is the same kernel with a different differentiation bundle (mandate.yaml, watchers, fences, census). Nothing in the kernel is person-specific.

Glossary deltas over v2.0 (one line each): origin = D-class channel identity assigned at ADMIT, the unit of corroboration · derived record = journaled model output with receipts, what makes rebuild model-free · registrar = the sealed door into the claims table · seal = resolver content-hash checked at fire · width tooth = tolerance ≤ half the channel band, the computable anti-vacuity rule · scope fence = world vs action_effect receipt partition · frozen references = setpoints.yaml, drift measured against commitments, not habit · CUSUM = the slow-drift detector the EWMA cannot see past · anchor = the daily off-box witness of the chain head · tombstone = human-ratified rebuild exclusion, append-only, anchored · owned wake = a pulse with a cause the ring did not mint · j8 = the nightly audit of what attention refused · sensor probe = the authored surprise that grades the surprise detector · knob wager = a config change that must predict its own KPI or revert · steward ledger = the human's minutes, metered like dollars · warden = the second OS user holding the exams.

APPENDIX K · CHANGE LEDGER vs v2.0

Every change is classed: [BREACH] fixes a tournament-verified failure of v2.0's own goals · [MINT] closes a receipt-counterfeiting path (L13) · [DEL] deletion with reinstatement trigger (Appendix L) · [OWN] this document's own extension, not sourced from the tournament · [RULE] an adjudication between v2.0 and a surviving challenger thesis. Source stances credited where adopted. Everything in v2.0 not named here or in Appendix L carries forward normatively unchanged.

1. [BREACH] Derived-output journaling + model-free rebuild.py + vec.db demoted from identity (§B1, §D6). Fixes goal (g): a swapped-model restore re-segmented the life. Source: memory-unified, with the seams patch (re-adjudication flags).
2. [BREACH] External anchoring + monthly tamper drill + anchor deadman (§B1, L15). Fixes tamper-blind never-forgets. Source: constitutionalist.
3. [BREACH] Credit stamped at outcome arrival + mono-order fold + acausality guard + 1% stamp audit + F-CREDIT with a pre-registered reversion (§B3). Fixes the verified 03:00 eligibility-decay miscredit. Source: streaming-no-sleep, with the minimal hybrid's verifiability patch.
4. [MINT] Sealed registrar: resolver hashes, void-on-mismatch, mutation drills (§B2, F-SEAL). Source: coldstart pair.
5. [MINT] Computable vacuity with the width tooth; no-baseline channels trap to bootstrap (§C2). Replaces v2.0's uncomputable baseline-variance clause. Source: control-first (defect) + both seams refuters (form).
6. [MINT] Scope fence: world vs action_effect; self-referential receipts computed over world-scope fenced families only; F-DENS prints the fenced/unfenced gap (§B2, §G6). Closes predict-then-cause. Source: coldstart-companion + coldstart-scientist, fence form from the seams refuters.
7. [MINT] Corroboration by origin_id; dyad near-dup = injection signature (F-SEP); D/H-only lift for fence-adjacent/≥H2; aging ban (§C1, §C4). Closes restatement-flooding at dyad scale. Source: security-first + event-driven.
8. [MINT] Frozen references + CUSUM + displacement ceiling with dissenter countersign; z_anchor/z_trend into innovation; REFDIV monitor; F-REFDIV with the two-cycle ratchet fault (§B4, §C8.1). Closes the frog-boil and the recalibration ratchet. Source: control-first's champion-side patch, custody and ratchet fixes unioned from both hybrids' refuters.
9. [MINT] Knob wagers: per-knob ratified KPI map; miss auto-reverts (§B6, §F4). Source: minimalist Law-5 + control-first.
10. [MINT] Non-mintable economy receipts: metering wrapper as sole model path with THRIFT halt inside; frozen cost-per-decision denominator (w_inform-weighted, H0-capped, known-answer-excluded, life|tissue partition); steward ledger with 120 min/week band and shed order (§C6, §B5, §G6). Source: economics-first + learning-maximalist + minimalist steals.
11. [RULE] Wake ownership (L14): metronome retained as heartbeat (its deletion died on its own economics: content must not gain influence over attention timing); due wakes only for seam-gradeable deadlines; quotas; F-WAKE causal proximity; GROUNDING hysteresis (§C8). Source: event-driven + minimalist, patched per both hybrids' refuters.
12. [RULE] Score-on-arrival for D-resolvers; j1 keeps R/H + aggregation (§C8.1, §F1). Source: event-driven + streaming-no-sleep, at corrected magnitude.
13. [RULE] Watchdog three duties: hash-verified canary, hourly crossing-set reconciliation from bone formulas, maintenance deadman (§A3, m25). Liveness attestation stops being circular. Source: the maximal hybrid's bundle (event-driven + streaming).
14. [MINT] Poisson audit timing + second-OS-user custody of exams; CI keyring grep; honest tamper-evident tier claim (§F2, §G3). The ring cannot study for its own exam on a one-user box. Source: streaming M9 + event-driven; custody defect found by the guarantees judge.
15. [RULE] Dissenter repaired on both sides: seam-composed packet; retirement never by correction-rate-while-capped; census-antecedent surfacing; hit wagers grant retroactive D corroboration (§G2). v2.0's rule built a self-retiring foreign seam, the worst single regression class found. Source: security-first + both hybrids' revival patches.
16. [RULE] j8 attention audit with the adversarial half: planted-probe-graded judge, injection decoys, distinct-origin recurrence, label quarantine from the auction learner (§F1, §E3). What attention refused is now graded; the judge is graded; the loop between them is fenced. Source: minimalist n2, patches unioned.
17. [RULE] Outage honesty: taped outage records, expired_outage excluded from calibration, excused fraction banded at ≤5%, COMMIT rejects in-window deadlines unless resolver=H (§B2, §C8.1). Source: streaming A11 + minimalist + constitutionalist.
18. [RULE] H-only tombstones, anchored before active (§D6, L16). Cures poison re-infection without an eraser. Source: constitutionalist + security-first.
19. [RULE] Human-side recall wagers, audit-confirmed, dashboard-only, gate-isolated (§C7). Grades the human seam without letting capture errors demote the ratifier. Source: constitutionalist, bounded per the minimal hybrid's patch.
20. [RULE] Learner confinement package: shadow racing on D sockets, zero-unpromoted-claims CI, n≥500, feature contracts, plasticity budget, surprise-ordered consolidation; attention learner label discipline (§E7, §E3). Source: learning-maximalist restricted steals + biology-maximalist, seams patch applied.
21. [RULE] Claim-node pointer identity + no auto-mirroring between claim_edges and syn + orphan CI (§B3). Answers memory-unified's dual-encoding charge: importance and logic are two relations, not two copies. Ruled here; the fork stays priced (M12).
22. [OWN] TOCTOU commit rule made explicit: COMMIT reads live state; staleness measured at commit time (§A3, §C2).
23. [OWN] Fence-rot detection: per-checker canonical-violation goldens + quarterly mutation replay + fire-rate telemetry (F-FENCE, §C2, §F2). Generalizes resolver mutation drills to every deterministic guard: a fence that never fires is either perfect or dead, and the drill tells you which.
24. [OWN] Render audits generalized: nightly 1% recompute of calibration buckets and credit stamps against their folds; mismatch = INTEGRITY trap (§B2, §B3). Renders must equal their folds, checked forever, not assumed.
25. [OWN] Registration backpressure: per-channel open-expectation caps; over-prediction surfaces as a trap, not a queue (§B2).
26. [OWN] p_eff shrinkage on displayed reliabilities; small samples cannot print as mastery (§B2).
27. [OWN] §A5: the design's five most-likely-wrong claims pre-registered against priced forks; the document grades its own confidence.
28. [OWN] Falsifier-census rule: bars recomputed against the joint claim volume of merged deltas (§I1). The tournament's most repeated seam, promoted to standing law of amendment.
29. [RULE] H7 dual grading: judged prose beside an MDL-style hypothesis score, divergence reported (§H7). The generality exam gets a second, less charmable grader.
30. [DEL] Appendix L in full: seven deletions, each with a live meter and reinstatement trigger.

Not adopted, with reasons: the janitor as maintenance authority (dual-run priced honestly, it races in shadow: M11) · metronome deletion (killed on its own economics rerun: item 11) · PID setpoint program and the full homeostat-first inversion (its worked example carried a factor-of-two error; what survives is the frozen-reference seam, item 8) · priced attention market, taint scalar, warm-KV residency, precision hierarchy, full constitutional government, 13-kind debt registry (organ-scale mass that died in proportion to its mass; deferral register) · week-1 live learner lanes (cage order stands) · in-band decoy ratifications (the human's channel is not a probe surface) · MDL tournament as the replacement grader for H7 (adopted as the second grader, not the successor).

APPENDIX L · DELETION REGISTER (each with meter + reinstatement trigger)

Every deletion leaves a live meter; the graveyard stays a ledger, not a landfill.

APPENDIX M · DEFERRAL REGISTER + DISCRIMINATION SUITE

The forks argument could not settle, compiled into the cheapest empirical tests, each tagged with cost and earliest phase. Pre-registered; results append to this table, they do not rewrite it.

Deferral register (alive, unbuilt, priced): janitor lane authority (M11) · sliding cache split (M6) · full event-alarm/atom-log unification (journal-at-write subset adopted; full unification admitted only on a seeded-fault A/B gap) · warm-KV residency · taint propagation scalar · precision-weighted hierarchy (biology-maximalist's frame; its testable fragment lives on as the innovation z-family) · priced attention market · constitutional government beyond the ratifier/warden/dissenter triad · LEDGER organ with per-organ P&L (its receipts absorbed into §G6; the organ returns only if the panels prove insufficient) · apprentice-harness shadow-racing DDL beyond shadow_scores (absorbed) · MDL tournament as sole grader (M17 decides its standing).

Closing, for all three readers. Harness: Part B then C, tests first, gates before features, seams before learners. Builder: H1 is still a weekend; the three breach-fixes land in the first fortnight and cost tens of lines each; nothing in P0–P2 waits on any unresolved question in this corpus. Researcher: the claim has not changed since v2.0 and it has survived thirteen architectures, thirty-nine refutations, six cross-examinations, and three judges trying to kill it: not that this machine is smart (the tissue is rented and capped), but that it is whole : always on, self-grading against arriving reality it cannot counterfeit, compounding, sovereign across model swaps by construction rather than by promise, witnessed from outside its own skull, and permanently ajar to the four inputs it cannot fake: arriving outcomes, the frozen references, the foreign voice it can no longer starve, and the one human whose minutes it now meters as carefully as its own dollars. The order of construction is the order of trust: tape before spine, spine before auction, auction before hands, floors before learners, anchors before growth, cage before sculptor, dumb twin before self-congratulation, and reality before belief. Build the stem. Close the loop. Let reality start grading, and let it grade the graders too.

**· Claude Fable 5 (claude-fable-5) · 2026-07-02 22:36 CDT · C:\the_brain\THE_BRAIN_BLUEPRINT_FINAL_v2.1_by_fable5_2026-07-02.md · v2.1 FINAL · supersedes THE_BRAIN_BLUEPRINT_FINAL_by_fable5_2026-07-02.md (v2.0) · terminal synthesis of the 2026-07-02 design tournament · written before reading the hybrids, the refutations, or the raw corpus, by pre-registered protocol ·**