States, rules, events, permissions and interfaces.

type Position = 'S' | 'H' | 'SH'            // relative to the relationship observed

Square Q_n   := { S_n, H_n, bridge_S, bridge_H, membrane }   // the set observed at scale n
SH_n         := coordination of Q_n (not a third executor)

// change of scale
H_(n+1) := Q_n          // the whole set becomes the host of the next scale
S_(n+1) := SH_n         // the previous coordination becomes the symbiont of the next scale
SH_(n+1)                // exists only if there is a new composition

// express human constraint: "the rule can repeat, but it needs a limit"
recursion_limit := IN_PROGRESS

crosses_membrane(actor) :=
     actor == Central               // the node that reaches both sides
  OR express_act_of_the_founder     // recorded human decision

// what the membrane is not
// - not a hierarchy: Central and Operational are peers with bounded assignments
// - not an ACL: access policy and observed permissions are distinct evidence
// - not a status: "status is a label; capability is a membrane"

states := DRAFT | AUTHORIZED | IN_EXECUTION | IN_AUDIT | RETURNED | AWAITING_HUMAN_DECISION | BLOCKED
        | COMPLETED | CANCELLED | REJECTED | FAILED   // terminal
// transitions below: editorial reading of the schema, not the source text

DRAFT ──authorize(human)──► AUTHORIZED
AUTHORIZED ──reserve(lease)──► IN_EXECUTION
IN_EXECUTION ──return(receipt)──► RETURNED
RETURNED ──accept(human)──► COMPLETED | ──refuse──► REJECTED | ──reopen──► AUTHORIZED
* ──needs_decision──► AWAITING_HUMAN_DECISION   // silence and elapsed deadlines are not answers

invariants
  I1  one hand at a time: short lease with heartbeat; once expired, any AI may resume and complement
  I2  unique effect_key per logical effect; a retry reconciles by the original ID before repeating
  I3  receipt + readback at the destination: "SUCCEEDED does not prove effect"
  I4  executor ≠ reviewer ≠ acceptor; the executor does not approve its own delivery
  I5  silence ≠ acceptance; tacit ratification was removed on 3 Oct 2026
  I6  whoever takes it, says so: no possession without a valid badge

badge := 'cr1' '|' vendor '|' product '|' plan '|' account '|' mode '|' post '|' model '|' execution '|' origin

mode      ∈ { interactive, scheduled }
post      ∈ { EXECUTOR, ARCHIVIST, TRIAGE, INSPECTOR, PULSE, TECHNICAL-PEER, ... }
execution := 'loc:' local_execution_identifier
origin    := 'conversation=' ref ';parent=' parent_mission ';source=' authority_used

// unknown fields receive the literal 'unknown'; they are never inferred
// the validator checks grammar only; account, plan and model are not deduced

trigger      // what fires (clock, event, human request)
routine      // the recurring definition
occurrence   // the planned instance of a routine at an instant
attempt      // the concrete execution of an occurrence; a retry gets its own ID and keeps the occurrence
effect       // what changed at the destination, with receipt and readback

delay_policy(occurrence) ∈ { recover, skip_with_receipt, escalate }
// never silently omit late work

// milestones verified as separate facts
configuration_reread < first_run < instruction_used < useful_delivery

unit := situated_action = ⟨ action, context, reach, version ⟩   // never the isolated artefact

T0  authority and scope        // precondition: without mandate, NOT_RELEASED
T1  reversibility              // detection + interruption + recovery; 7 days is a ceiling, not a guarantee
T2  multiplication             // does the action replicate (playbook, loop, integration)?
T3  who pays for the error     // Central | team | third party
T4  observability and containment

authorisation(action) :=            // axis 1: mandate; never mixed with the regime
  if ¬T0                         → NOT_RELEASED
  else                           → RELEASED

regime(action) :=                   // axis 2: only for a released action; mapping below is inference
  if T2 ∨ T3 = third_party       → FULL_LAB
  else if T1 ∧ T4                → SHORT_LAB or ELASTIC (direct, observed execution)
  else                           → PENDING   // human decision

anti-fossilisation locks: laboratory with expiry · self-adjusting gate · budgeted entropy
pilot_parameters: N = 20 cycles as a review trigger (not a demotion); no statistical validation

is_vault(x) :=
     receives_own_deposit(x)         // currency or versionable object
  ∧  matures_by_bucket(x)            // Mess → Bronze → Silver → Gold → Diamond
  ∧  has_S_H_pair_when_applicable(x)
  ∧  has_owner_mission_and_continuity(x)

is_plane(x) := holds_for_all_vaults(x) ∧ ¬receives_currency(x) ∧ defines_invariants(x) ∧ evolves_by_amendment(x)

vaults := { C1 context and cases, C2 method and playbooks, C3 capabilities and agents, C4 coordination and agentic company,
            C5 voice and dialogue, C6 possibilities of new contexts, C7 tools and integrations,
            C8 architecture and evolution of relations, C9 Moving UP, C10 publications, marketing and traffic }

"Vault N" without a letter := the pair H_N + S_N   // each side is written with its letter

Currency 1 := solve a specific case, with a verifiable result, updating the context
Currency 2 := deposit in the playbook how it was solved and what was learned about cases of that kind
Currency 3 := turn learning into repeatable capability (agent)
NO_CURRENCY := a valid outcome; no currency is minted to demonstrate activity

// a currency is what is deposited, never a vault; bucket levels are not new vaults
// "the method travels, the data stays" (canonical two-currencies amendment, 19 Sep 2026)

maturity(object) ∈ { Mess, Bronze, Silver, Gold, Diamond }   // per object, not a global seal
Bronze ≠ VALIDATED ≠ CANONICAL ≠ execution_authorisation

epistemic_record := Fact | Evidence | Inference | Hypothesis | Intuition | Decision    // proposal of 18 Jul 2026
review_ruler := FACT (source cited) · DECISION (founder's act) · INFERENCE · PREFERENCE · GAP

// doctrine of evidence and access (14 Sep 2026, candidate)
observation ≠ report ≠ inference ≠ proposal ≠ decision
qualified_negative(x) := "not found in <scope> on <date>"   // never "does not exist"
proportional_proof(claim) := strength of proof ∝ consequence of the claim
access_policy ≠ observed_permissions
page_nesting ⇏ ancestors_read

normalised_magnitude(v) := 9  if 8.6 ≤ v ≤ 9.4

// 9 is not a result; it is a contextual command
// the direction of the command depends on what is being measured (polarity of the context)
// below 8.6 there is no rejection: there is absence of command
// multilayer: no average, no cancellation between layers
// every recorded value declares its source: ⟨ layer, condition, value, command ⟩

open := { precedence between conflicting layers, meaning of 10 }   // deferred to the first real case

context → knowledge → decision → mission → execution → evidence → institutional memory

memories := { constitutional, organisational, operational, episodic, evidentiary, semantic }

principles 8–10:
  8. do not confuse metaphor with technical capability
  9. make the core work in the host's context
 10. grow fractally without multiplying disorder