apportion

Merismos Protocol

Apportion an autonomous goal into coarse execution units and derive each unit's completion conditions before the run begins: cut the goal at its evidenced seams so each unit fits one execution horizon and no obligation is orphaned, derive per-unit completion and invariant predicates plus the cross-unit plan conditions, and emit one goal entry per unit. Type: (GoalPlanUncompiled, User, APPORTION, AutonomousGoal × ExecutionHorizon) → ConditionBearingUnitPlan.

Definition

Merismos (μερισμός: a dividing into parts, an apportionment): A dialogical act of apportioning one stated autonomous goal — deciding which units the goal is carried out in and what each unit's done means — when the goal is stated but its plan is uncompiled. The protocol's lexical verb is /apportion. It reads the goal's obligations — the host's own standing procedural contract subtracted, since that attaches to every change the host accepts whatever the goal is — cuts them into coarse units at seams it can cite, judges each unit against one execution horizon, derives a completion predicate and any invariant predicates per unit, separates the conditions whose subject is the whole goal rather than any one unit, and emits one goal entry per unit whose conditions are conjoined into a single leaf predicate — or, for a unit whose completion condition remains residual, an explicit accepted-uncovered certificate that still carries any compiled invariant conjuncts. An item no check could settle because what settles it is a judgment made against the context accumulated by then and what the user has actually said by then is reserved rather than compiled — recorded with the ground that settles it, at the unit level and for the whole-goal acceptance criterion alike, and kept apart from the waiver that records an acceptance criterion the plan simply lacks. Activation takes one goal: a request bundling several stated outcomes whose only common bond is that standing contract relays at the checkpoint instead, one apportionment per goal. Every goal obligation belongs to some unit or is visibly accounted for, and every unit fits one horizon or carries a recorded override; the MORPHISM block names these and the protocol's other invariants. Merismos apportions and conditions; it does not order — sequence, independence, reconciliation, termination topology and routing are outside its own scope, so the emitted plan is a pre-conduct artifact. The protocol holds no state during execution.

── FLOW ──
Merismos(G) → Probe(G) → goal_plan_uncompiled? →
  ¬autonomous_intent(G):  → relay(no autonomous interval in scope) (extension) → deactivate
  ¬single_goal(G):        → relay(composite goal — name each stated outcome it bundles and the shared-procedure bond that made them read as one; one apportionment per goal) (extension) → deactivate   -- fires BEFORE init_loop_state, so no Λ loop field is ever seeded and no unit is cut across outcomes that share only the host's standing contract
  locator in scope — the goal's navigation block — ∧ (¬dereferenceable ∨ support-integrity failure): → relay(handoff unreadable — locator unreachable, missing its session half, or a load-bearing premise the grounding pass could not support) (extension) → deactivate
  condition_bearing(G):   → relay(units and conditions already present) (extension) → deactivate
  uncompiled: ReadObligations(G) → O_G → VelocityFilter(O_G) → oos → init_loop_state: U=∅, residual=O_G \ {d.obligation | d∈oos}, K=∅, R=∅, S=∅, P=∅,
                              plan_conditions_derived=⊥, plan_conditions_stale=⊥, fit_overrides=∅, invariant_status=⊥, accepted=∅, unbounded_approved=⊥, loop:   -- init_loop_state runs EXACTLY ONCE, on this Phase 0 → Phase 1 edge; Phase 2's Reopen re-enters "loop:" directly without re-executing it
    Phase 1 residual? →   -- the empty-residual arms are read off residual DIRECTLY, before anything is drafted: a draft that comes back with no cut cannot tell "nothing was there to cut" from "nothing could be cut", and only the first of those relays. The second arm is the ordinary completion edge every converging run leaves Phase 1 through
      residual = ∅ ∧ U = ∅ ∧ oos = ∅:  → relay(goal's scope too thin to read any obligation) (extension) → deactivate
      residual = ∅ ∧ (U ≠ ∅ ∨ oos ≠ ∅):  → Phase 2
      residual ≠ ∅:  draft(G, residual) → D → surface_draft(D) (extension) →   -- draft iterates Scan/Pack/fit/qualify/complete_unit over a workset copied from residual until every obligation in that workset sits in some completed cut, autonomous_pack absorbing at heuristic seams only what the seam evidence could not reach; it moves nothing out of residual, integrate remaining the sole owner-changing step. The WHOLE draft reaches the user before any cut is settled: what the user recognizes is the shape, and settling one cut at a time out of a visible whole is what keeps a misalignment found late from re-opening cuts already accepted blind
        D holds no Heuristic cut ∧ ∀c ∈ D whose fit = Fits ∧ no alternative cut of c's obligations stands up to the same evidence: → relay(AcceptUnit) (extension) → integrate_unit(c) → c' → U := U ∪ {c'}, residual := residual \ c'.obligations   -- Rule 17 read twice, in this order: the leading conjunct over the WHOLE draft — the relay path opens only where the goal's evidence reached every cut, one heuristic cut sending the draft to the gate entire — then the familiar per-cut reading inside it. What it weighs is NEVER a member of D: D is one partition, so no two of its cuts claim the same obligation and none of them stands against another. What the test asks is whether c's region could have been cut a second way the goal's evidence would back as well — a live reading made HERE, at dispatch, over that evidence and the accumulated context, which drafting neither draws nor records
        D has no unsettled cut left ∧ residual = ∅:  → Phase 2
        else:  → Qu(the first unsettled cut standing as its own Anchor, that cut, its SpanFit, its Seam, U, D's still-unsettled cuts) → Stop → Aᵤ →
          Aᵤ = AcceptUnit     → integrate_unit(the cut this firing presented) → loop   -- in Aᵤ's defined set iff SpanFit = Fits
          Aᵤ = Recut(c, d)    → re-derive c's Anchor frame under d → loop   -- c ranges over the surfaced draft's still-unsettled cuts, not only the one this firing presented: same residual, different cut, and the next cycle drafts under d
          Aᵤ = OverrideFit    → integrate_unit(the cut this firing presented) → u' → Λ.fit_overrides ∪= {u'.unit_ref} → loop  -- in Aᵤ's defined set iff SpanFit ≠ Fits
          Aᵤ = Sufficient     → ∀c ∈ D still unsettled with fit = Fits: integrate_unit(c) → c' → U := U ∪ {c'}, residual := residual \ c'.obligations → [∃c still unsettled with fit ≠ Fits: → Qu over the first such cut, that cut standing as its own Anchor, reason surfaced as relay first → Stop → Aᵤ → the same Aᵤ dispatch | none: residual = ∅ → surface (extension) → Phase 2]   -- blanket relay over the fitting cuts OF THE DISPLAYED DRAFT: Sufficient is the user's constitutive act over that whole, so what it accepts is what was shown — each cut's seam disposition included — rather than a remainder re-packed at heuristic seams the user never saw
    Phase 2 ∀u∈U, ¬derived_already(u,K,R,S): Derive(u) → (Set(κ), Set(ρ), Set(σ)) → K:=K∪κs, R:=R∪ρs, S:=S∪σs ∥ [¬Λ.plan_conditions_derived: DerivePlan(G, U) → P; Λ.plan_conditions_derived := ⊤] →
      oos ≠ ∅ → OOS(oos) (extension)                                            -- obligations needing pre-action interception: out of scope, substrate named
      S ≠ ∅ → Reserved(S) (extension)                                           -- items held open to a judgment made outside compile time: the ground that settles each is named, and nothing is delegated to any substrate
      ¬acceptance_present(P) → Qt(K, P) → Stop → Vₜ →
        Vₜ = DefineNow(d)     → P := P ∪ {plan_condition(d)}; [Λ.unbounded_approved: Λ.unbounded_approved := ⊥]; S := S \ {σ∈S : σ.subject = ReservedAcceptance}
        Vₜ = RouteBound       → relay(the whole-goal acceptance criterion's definition is routed to /bound) (extension) → deactivate   -- Rerouted: the route is EMITTED, not merely exited on
        Vₜ = ReserveJudgment  → S := S ∪ {acceptance_reservation()}; [Λ.unbounded_approved: Λ.unbounded_approved := ⊥]   -- the criterion is constitutively open, not missing: it stays open to runtime resolution. This arm never SETS the waiver flag, and it CLEARS one an earlier firing on this same invocation left standing — the waiver and the reservation are mutually exclusive, so the arm answered last is the one that stands
        Vₜ = ApproveUnbounded → Λ.unbounded_approved := ⊤; S := S \ {σ∈S : σ.subject = ReservedAcceptance}   -- the symmetric retraction: drops a ReservedAcceptance member an earlier firing left standing, for the same exclusivity
      BindPlanRequirements(P, U) → P := Pᵦ → check(U, K, R, S, Pᵦ, oos) → Λ.invariant_status := InvariantStatus   -- coverage_complete ∧ span_fit ∧ termination_covered ∧ obligations_derived ∧ oos_substrate_named ∧ reservation_ground_named ∧ plan_conditions_topology_free
      Λ.plan_conditions_stale → StaleNotice(P) (extension)                       -- pre-gate text before Qc: Adjust to update, or Confirm to keep as recorded
      Qc(U, K, R, S, P, InvariantStatus, oos) → Stop → V →
        V = Adjust(d)  → rederive(K, R, S, P, d) → (K, R, S, P) := (K', R', S', P') → Λ.plan_conditions_stale := ⊥ → [¬acceptance_present(P') → Qt(K', P') → Stop → Vₜ → P' and S' updated as at Phase 2 entry] → [acceptance_present(P') ∧ Λ.unbounded_approved: Λ.unbounded_approved := ⊥] → [acceptance_present(P') ∧ acceptance_reserved(Λ): S' := S' \ {σ : σ.subject = ReservedAcceptance}] → BindPlanRequirements(P', U) → P' := Pᵦ' → check(U, K', R', S', Pᵦ', oos) → Λ.invariant_status := InvariantStatus → Qc(...)   -- over the SAME U: K' ∪ R' ∪ S' spans every obligation of every unit; no removal — a withdrawn condition becomes a residual, and a residual the direction re-reads as judgment-settled becomes a reservation. rederive rewrites the unit-scoped members of S only; the ReservedAcceptance member is Qt's own record and carries through
        V = Reopen(u)  → residual := residual ∪ u.obligations; U := U \ {u}; K := K \ {κ∈K:κ.unit=u}; R := R \ {ρ∈R:ρ.unit=Some(u)}; S := S \ {σ∈S:σ.unit=Some(u)}; Λ.fit_overrides := Λ.fit_overrides \ {u.unit_ref}; Λ.plan_conditions_stale := ⊤ → Phase 1   -- residual is NOT reseeded from O_G \ oos; every other unit's obligations carry forward untouched; the whole-goal ReservedAcceptance member is unit-free and stays; plan-level P is NOT re-derived (Rule 25)
        V = Confirm ∧ ¬hard_invariants_hold(Λ): → re-present Qc with the violated invariant named
        V = Confirm ∧ hard_invariants_hold(Λ):  → AcceptResiduals(R) → Λ.accepted := Λ.accepted ∪ {ρ.obligation | ρ∈R}; ∀ρ∈R: ρ.disposition := AcceptUncovered → Phase 3   -- P and S are read-only on this edge; AcceptResiduals supplies the non-empty accepted-completion witness resolve_unit reads at Phase 3, and touches no reservation — a reservation is not a residual awaiting acceptance
    Phase 3 Emit(U, K, R, S, P, oos, unbounded_approved) → E [record] → package(E) → plan → park_carrier(plan) → C [record] → record_handoff(C) → N → converge(apportionment trace) → ConditionBearingUnitPlan

── MORPHISM ──
AutonomousGoal × ExecutionHorizon
  → probe(goal)                        -- detect ONE stated autonomous goal whose unit plan and conditions are uncompiled; a request bundling several stated outcomes bound only by the host's standing procedural contract is composite and relays here rather than activating
  → read_obligations(goal) → O_G       -- construct the invocation-local obligation set and SUBTRACT the host's standing procedural contract: a requirement that host attaches to every change regardless of the goal is not a goal obligation but an ambient invariant every emitted unit inherits, so it is neither packed nor derived; G itself remains read-only
  → filter(velocity) → oos             -- an obligation guardable only by pre-action interception is declared out of scope with the delegated substrate recorded on the declaration; computed once over O_G before packing begins, so it never enters a unit
  → draft(goal, residual) → D          -- THE WHOLE-DRAFT OPERATOR: iterate the next five steps over a workset copied from residual until every obligation in that workset sits in a completed cut, then stop. It owns nothing — no obligation leaves residual here — and it settles nothing; what it produces is the shape the reader has to see before any one cut can be judged. Iterating rather than cutting once is what lets each cut carry its own seam verdict, so a whole draft is not uniformly heuristic just because it was drafted at once
  → scan(seams)                        -- read the REMAINING obligations (O_G minus the out-of-scope ones) for cuttable seams: dependency, deliverable, verification, ownership. Ordered after the filter, as FLOW and PHASE TRANSITIONS run it: a pre-action-only obligation is delegated out before any cut is shaped around it
  → pack(seams, horizon) → (Anchor, DraftUnit when Anchor ≠ ∅)   -- THE IRREDUCIBLE CORE, part one (completed into a ProposedUnit by complete_unit once fit and seam exist): an empty Anchor IS this step's no-cut verdict and carries no draft, so the three judgments below have no operand on that return and drafting hands what is left to autonomous_pack instead; a goal whose obligations were every one delegated out never reaches drafting at all, the empty-residual arm having relayed first. apportion the obligations into coarse units such that each unit fits one execution horizon and every obligation lands in some unit; also reads each unit's capability requirements and feasibility notes from the goal's stated needs — functional descriptions only, never a concrete executor/model/runtime/tool token (Substrate Boundary)
  → fit(unit, horizon) → SpanFit       -- per-cut horizon-fit predicate, run wherever a cut exists to judge, whether Pack found it at a seam or autonomous_pack placed it; Indeterminate is surfaced, never silently read as Fits
  → qualify(cut) → Seam                -- Grounded when a seam is cited: a dependency, deliverable, verification or ownership seam, or another the goal evidences — the four are the scanning taxonomy, not the admissible set; Heuristic when the goal carries no such evidence — declared, not asserted as a natural joint
  → complete_unit(draft, fit, seam) → ProposedUnit   -- writes the fit and seam judgments onto the cut, AFTER both exist; the sole constructor of ProposedUnit, seam-grounded cuts and autonomous_pack's alike, so no cut enters a draft without both judgments on it
  → surface_draft(D)                   -- the whole draft goes out before the first cut is settled: every cut with its obligations, fit verdict and seam disposition, so the reader judges a shape rather than a fragment, AND the standing affordance to send any cut back, named on the surface where the cut is shown. Relay — it presents no fork, and the forks that follow are each read against what this made visible
  → [the draft holding no Heuristic cut, a cut whose fit = Fits and over whose obligations no alternative cut stands up to the same evidence: relay(AcceptUnit) (extension) | else: present(anchor, proposed_unit, SpanFit, Seam, the draft's still-unsettled cuts) (constitution)]  -- the draft gate condition over the whole, then the option-set relay test per cut, read live at this point; the alternative it weighs never entered the draft, which carries one cut per obligation
  → integrate(unit_judgment, U, residual) → (U', residual')   -- monotone in coverage: an obligation leaves residual only when it enters some unit; integrate_unit(ProposedUnit) → Unit is the only constructor Unit has, and assigns the accepted unit its fresh UnitRef in that same step
  → derive(unit) → (Set(κ), Set(ρ), Set(σ))    -- THE IRREDUCIBLE CORE, part two: per obligation of the unit, a verifiable predicate (completion or invariant), a residual, or a reservation; every obligation of the unit lands in at least one of the three sets, and Derive writes it to exactly one — that single placement is how this step reads the obligation, not a property obligation_derived proves, which asks only for membership; a misplacement shows at the confirmation gate like any other read here. The third is for an obligation no check could settle because a judgment settles it — read at THIS step over candidates arriving like any other, so it is fallible and correctable at the confirmation gate; it is not an out-of-scope delegation, which hands an obligation to a substrate that must intercept before an action runs
  → derive_plan(goal, U) → P           -- conditions whose subject is the whole goal, not any one unit; NOT distributed across units to fit the leaf type
  → confirm(unit_plan)                 -- user judges the apportionment together with its conditions
  → emit(goal_entries)                 -- one entry per unit; resolve_unit's single certificate — DeterminateResolution when a compiled COMPLETION condition exists, else AcceptedUncoveredResolution with a non-empty accepted-completion witness, else ReservedJudgmentResolution with a non-empty reserved-completion witness; either witnessed form still carries any compiled invariant conjuncts
  → package(E)                         -- constructs the whole returned plan from E's own coproduct partition, envelope included — a read-back of what was emitted, never a second derivation beside it
  → park_carrier(plan) → C             -- parks the packaged plan in ONE durable carrier record
  → record_handoff(C) → N              -- emits the fixed-shape navigation block a later session dereferences to read that carrier back
  → ConditionBearingUnitPlan
requires: user_initiated(G)            -- user declares autonomous execution intent via /apportion
requires: single_goal(G)               -- domain restriction: ONE stated outcome. Shared procedure is not a shared goal — the host's standing procedural contract attaches to any work there, so it can carry no seam and a bundle bound only by it relays at Phase 0 without activating
deficit:  GoalPlanUncompiled           -- activation precondition (Layer 1)
preserves: G                           -- compile-time only; ReadObligations constructs O_G without mutating the goal; no execution-state mutation
invariant: Apportion over Order        -- Merismos cuts the units and conditions them; it does not sequence them
invariant: Whole Draft over Serial Cut -- no cut is settled before the draft it belongs to has been surfaced whole. What the reader judges is a shape with its siblings beside it, never a fragment whose neighbours are still unwritten — an acceptance given without the rest in view is one a later cut can force back open
invariant: Coverage over Convenience   -- every goal obligation belongs to some unit, is visibly delegated out of scope, or is accepted as uncovered on record — the same three arms coverage_complete reads; a plan that omits one converges locally and lies globally
invariant: Fit over Ambition           -- every unit fits one execution horizon, or carries an explicitly recorded override
invariant: Declared Seam over Asserted Joint  -- every cut DECLARES its seam quality: the evidence it cites, or heuristic where the goal carries none. What is invariant is the declaration, never which quality gets declared — a cut may honestly be heuristic, but it never claims a natural joint it cannot evidence

── TYPES ──
G              = AutonomousGoal { utterance: String, obligations: Set(Obligation), prior: ProtocolOutput?, session: Context }
O_G            = ReadObligations(G) = G.obligations \ { o | host_standing_contract(o) }   -- the subtraction is part of the read, not a later partition: what it removes never becomes residual, never enters a unit, and is never counted by coverage_complete
ProtocolOutput = prior protocol's converged output in current session
Obligation     = a stated or inferred requirement the goal must satisfy — the unit of coverage; each cites its evidence in G. A requirement the HOST attaches to every change it accepts regardless of the goal reaches this read as a candidate like any other, and host_standing_contract below is the judgment that keeps it out of O_G: it is an ambient invariant every unit inherits, not a goal obligation this goal generated. The exclusion is made AT the read — a judgment over candidates, as VelocityFilter's partition is — so the type does not guarantee it and a misjudgment is possible
host_standing_contract(o) ≡ o is goal-independent in the host the work is carried out in — the same requirement would be read from ANY goal there, because the host's own standing procedural contract attaches it to every change it accepts (its version/manifest discipline, its verification command, its branch/worktree/review path, its merge authority) — AND o is not itself the outcome G states. Such an o is neither a goal obligation nor an out-of-scope delegation: an OOSDeclaration names a substrate that must intercept BEFORE an action runs, whereas this binds every emitted unit alike and the host's own process already enforces it, so ReadObligations subtracts it and nothing downstream sees it. A requirement G states AS its outcome fails the second conjunct and stays a goal obligation
H              = ExecutionHorizon      -- the budget one autonomous run is expected to fit; read from context, cue cited
U              = Set(Unit)             -- the apportionment
Anchor         = Set(Obligation) -- Pack's per-cycle focus region: the (possibly proper) subset of `residual` Scan's seam evidence gives Pack something to prioritize a cut around this cycle
ProposedUnit   = { subject: String, obligations: Set(Obligation), fit: SpanFit, seam: Seam, capability_requirements: Set(CapabilityRequirement), feasibility_notes: Set(FeasibilityNote) }   -- inhabited only after complete_unit writes fit and seam; Pack alone yields a draft missing both
DraftUnit      = ProposedUnit without its fit and seam fields — what Pack yields before either judgment has run
complete_unit(d: DraftUnit, f: SpanFit, s: Seam) : ProposedUnit = d with fit := f, seam := s
D              = Set(ProposedUnit)     -- one Phase 1 cycle's whole draft: a PARTITION of the workset drafting ran over — its cuts pairwise obligation-disjoint, together covering that workset. This is what draft's own termination bound already rests on, since a workset that shrinks strictly as each obligation lands in a completed cut cannot also hand that obligation to a second cut; a draft carrying two claims on one obligation is therefore a defect in the draft, never a choice put to the reader. Where a region admits more than one workable apportionment, drafting draws ONE and records nothing about the other — whether that second reading deserves the reader is judged live at dispatch. Phase-local: built over a COPY of residual and discarded when the cycle settles, so no Λ field holds it
Unit           = { unit_ref: UnitRef, subject: String, obligations: Set(Obligation), fit: SpanFit, seam: Seam, capability_requirements: Set(CapabilityRequirement), feasibility_notes: Set(FeasibilityNote) }
SpanFit        ∈ {Fits, Overflows, Indeterminate}
Seam           = Grounded(Evidence) ⊎ Heuristic
Evidence       = { source: String, content: String }
CapabilityRequirement = a functional description of what carrying out the unit's work requires — descriptive only
FeasibilityNote = a free-text observation flagging a feasibility concern read from the goal — descriptive, not enforced; the empty set is valid when the unit carries no such concern
Derive         = Unit → (Set(κ), Set(ρ), Set(σ))
κ              = CompiledCondition { unit: Unit, obligation: Obligation, kind: PredicateKind, condition: VerifiablePredicate }
PredicateKind  ∈ {completion, invariant}
VerifiablePredicate = an executable check with a determinate pass/fail outcome
ρ              = Residual { obligation: Obligation, unit: Option(Unit), kind: PredicateKind, disposition: Option(ResidualDisposition) }
ResidualDisposition ∈ {AcceptUncovered} ∪ Emergent(ResidualDisposition)   -- written only by Phase 2 AcceptResiduals; a residual carries None until that step runs, which is what the AcceptUncovered filters distinguish
judgment_settled(x) ≡ what settles x is a judgment made against the context accumulated by the moment the question comes live and what the user has actually said by then, so no compile-time artifact can stand in for it: x is neither a predicate evaluable when an interval stops nor an obligation an interception could guard before an action runs. Fixing its answer now would close a live question where the user is not present, which is why leaving x open is the CORRECT disposition rather than a deferred shortfall. Judged AT the step that reaches x — Derive for an obligation of a unit, Qt for the whole-goal acceptance criterion — over candidates arriving there like any other, as VelocityFilter's partition is: the type does not guarantee it, a misjudgment is possible, and the confirmation gate is where one shows
σ              = JudgmentReservation { subject: ReservedSubject, unit: Option(Unit), kind: PredicateKind, ground: JudgmentGround, basis: Evidence }   -- the record that an item is held open to a judgment made outside compile time. A SIBLING of Residual and of OOSDeclaration, never a widening of either: a residual is an obligation the plan leaves unguarded and the user accepts as such, an OOSDeclaration hands an obligation to a substrate that must intercept before an action runs, and a reservation hands nothing anywhere — it names the ground that settles the item once the question comes live
ReservedSubject = ReservedObligation(Obligation) ⊎ ReservedAcceptance   -- ReservedAcceptance is the whole-goal acceptance criterion itself, which names no obligation; its reservation carries unit = None and kind = completion
JudgmentGround = a statement of what settles the reserved item at the moment it comes live — the context accumulated by then together with what the user has actually said by then — never a predicate this protocol could evaluate now
S              = Set(JudgmentReservation)        -- reservations, unit-scoped and whole-goal alike
reserved_completion_obligations(u, S) = { o | σ ∈ S, σ.subject = ReservedObligation(o), σ.unit = Some(u), σ.kind = completion }
acceptance_reserved(Λ) ≡ ∃ σ ∈ Λ.S : σ.subject = ReservedAcceptance   -- the whole-goal acceptance criterion is on record as constitutively open. DISTINCT from Λ.unbounded_approved, which records a waiver of a criterion the plan should have carried: one says the criterion is correctly left to resolve later, the other says a shortfall was accepted, and the convergence predicate keeps them apart
acceptance_reservation() = JudgmentReservation { subject: ReservedAcceptance, unit: None, kind: completion, ground: "the context accumulated by the moment the goal is judged accepted, together with what the user has actually said by then", basis: Evidence { source: "the ReserveJudgment answer at the whole-goal acceptance gate", content: "the criterion's right answer varies with that ground, so fixing it now would settle a live question where the user is not present" } }   -- the ground is fixed by the constructor, which is why the gate arm carries no direction: what settles this criterion is the same ground in every plan that reserves it
K              = Set(CompiledCondition)          -- unit-local conditions
P              = Set(PlanCondition)              -- cross-unit conditions
PlanCondition  = { scope: PlanScope, kind: PredicateKind, condition: VerifiablePredicate, dischargeable_when: PlanStateRequirement }
PlanScope      ∈ {FinalIntegration, GlobalNonRegression, WholeGoalAcceptance} ∪ Emergent(PlanScope)
UnitRef        = a stable identity carried by an emitted unit, assigned at integration and never reused
PlanStateRequirement = { predicate: VerifiablePredicate, basis: NonEmptySet(Evidence) }   -- cites the evidence the requirement rests on and is never empty, so a consumer placing this condition has a basis to judge it against; whether that evidence still tracks what it asserts is the receiving side's support-integrity judgment, not something this protocol certifies at compile time
topology_free(req) ≡ req contains no UnitRef, Move, MoveRegion, or order-position reference
LeafConjunct   = { condition: VerifiablePredicate, kind: PredicateKind }
NonEmptySet(T) = { S: Set(T) | S ≠ ∅ }
conjuncts(u)   = { { condition: κ.condition, kind: κ.kind } | κ ∈ K, κ.unit = u }
accepted_completion_residuals(u, R) = { ρ.obligation | ρ ∈ R, ρ.unit = Some(u), ρ.kind = completion, ρ.disposition = AcceptUncovered }
UnitResolution = DeterminateResolution { predicate: VerifiablePredicate, conjuncts: Set(LeafConjunct) } ⊎ AcceptedUncoveredResolution { accepted_completion_residuals: NonEmptySet(Obligation), conjuncts: Set(LeafConjunct) } ⊎ ReservedJudgmentResolution { reserved_completion_obligations: NonEmptySet(Obligation), conjuncts: Set(LeafConjunct) } -- THE CROSS-SEAM TERMINATION CERTIFICATE
resolve_unit(u, K, R, S) : UnitResolution = DeterminateResolution { predicate: ⋀ { κ.condition | κ ∈ K, κ.unit = u }, conjuncts: conjuncts(u) } when ∃ κ ∈ K : κ.unit = u ∧ κ.kind = completion
                                        ; AcceptedUncoveredResolution { accepted_completion_residuals: accepted_completion_residuals(u, R), conjuncts: conjuncts(u) } when ∄ κ ∈ K : κ.unit = u ∧ κ.kind = completion ∧ accepted_completion_residuals(u, R) ≠ ∅
                                        ; ReservedJudgmentResolution { reserved_completion_obligations: reserved_completion_obligations(u, S), conjuncts: conjuncts(u) } when ∄ κ ∈ K : κ.unit = u ∧ κ.kind = completion ∧ accepted_completion_residuals(u, R) = ∅ ∧ reserved_completion_obligations(u, S) ≠ ∅   -- the arms are tried in this order and are total over the units CONVERGENCE admits: a unit's completion is a compiled predicate, an accepted-uncovered residual, or a reservation, and the completion clause below requires at least one of the three. A unit carrying both an accepted completion residual and a reserved completion obligation takes the accepted arm, its reservation staying visible in the emitted reservation set keyed by σ.unit. The third certificate does not say the unit runs guarded — the interval is unguarded on that obligation exactly as in the accepted arm, and no step of this protocol makes anyone judge it. What it names is the ground that settles the unit's done, and what distinguishes it from the accepted arm is that nobody has accepted the gap
E              = Set(GoalEntry)        -- emission
GoalEntry      = UnitEntry { unit_ref: UnitRef, subject: String, obligations: Set(Obligation), resolution: UnitResolution, capability_requirements: Set(CapabilityRequirement), feasibility_notes: Set(FeasibilityNote) } ⊎ PlanEntry { scope: PlanScope, kind: PredicateKind, condition: VerifiablePredicate, dischargeable_when: PlanStateRequirement } ⊎ PlanEnvelopeEntry { accepted_residuals: Set(AcceptedResidualEntry), reserved: Set(JudgmentReservation), oos: Set(OOSDeclaration), unbounded_approved: Bool }
oos            = Set(OOSDeclaration)   -- obligations guardable only by pre-action interception
OOSDeclaration = { obligation: Obligation, substrate: String, basis: Evidence }   -- unchanged by the reservation slot: this declares an obligation whose violation must be caught BEFORE an action runs and names the substrate that must catch it. A reserved item names no substrate and asks nothing to intercept, so it is never written here and this set never widens to hold one
ReadObligations = G → O_G
VelocityFilter = O_G → oos
InvariantStatus = { coverage_complete: Bool, span_fit: Bool, termination_covered: Bool, obligations_derived: Bool, oos_substrate_named: Bool, reservation_ground_named: Bool, plan_conditions_topology_free: Bool }
hard_invariants_hold(Λ) ≡ Λ.invariant_status.coverage_complete ∧ Λ.invariant_status.span_fit ∧ Λ.invariant_status.termination_covered ∧ Λ.invariant_status.obligations_derived ∧ Λ.invariant_status.oos_substrate_named ∧ Λ.invariant_status.reservation_ground_named ∧ Λ.invariant_status.plan_conditions_topology_free
coverage_complete(U, O_G) ≡ ∀ o ∈ O_G : (∃ u ∈ U : o ∈ u.obligations) ∨ (∃ d ∈ oos : d.obligation = o ∧ d.substrate ≠ "") ∨ o ∈ Λ.accepted   -- a reserved obligation stays in the unit it was packed into, so it is covered by the FIRST disjunct and this predicate needs no reservation arm
span_fit(U)    ≡ ∀ u ∈ U : u.fit = Fits ∨ u.unit_ref ∈ Λ.fit_overrides
reservation_ground_named(S) ≡ ∀ σ ∈ S : σ.ground ≠ ""   -- the reservation's counterpart to oos_substrate_named: a reservation whose ground is unstated records nothing a later judgment could act on
obligation_derived(u, K, R, S) ≡ ∀ o ∈ u.obligations : (∃ κ ∈ K : κ.unit = u ∧ κ.obligation = o) ∨ (∃ ρ ∈ R : ρ.unit = Some(u) ∧ ρ.obligation = o) ∨ (∃ σ ∈ S : σ.unit = Some(u) ∧ σ.subject = ReservedObligation(o))
derived_already(u, K, R, S) ≡ (∃ κ ∈ K : κ.unit = u) ∨ (∃ ρ ∈ R : ρ.unit = Some(u)) ∨ (∃ σ ∈ S : σ.unit = Some(u))
acceptance_present(P) ≡ ∃ p ∈ P : p.scope = WholeGoalAcceptance ∧ p.kind = completion   -- BOTH fields: a whole-goal INVARIANT is a boundary the run preserves, not a statement of when the goal is accepted, so it neither suppresses Qt nor stands in for the waiver at emission
Aᵤ             = UnitJudgment ∈ {AcceptUnit, Recut(cut, direction), Sufficient} when SpanFit = Fits; {OverrideFit, Recut(cut, direction)} otherwise, joined by Sufficient while some still-unsettled cut of the draft has fit = Fits   -- Recut carries its TARGET as well as its direction: the gate presents one contested cut but ships the draft's other still-unsettled cuts with it, so the reader may send back any of those and not only the one in front of them. The target ranges over the surfaced draft's still-unsettled cuts; a cut this cycle already integrated is reached by Reopen at the confirmation gate instead, which is the one path that returns an owned obligation to residual   -- the accept/override pair is INDEXED by the fit verdict rather than deleted at presentation: the defined set for a firing IS what that firing presents, so Rule 18's intact-presentation invariant holds and an unfitting unit has no unguarded accept. Sufficient is indexed on that same principle one axis over: what it accepts is the draft's still-unsettled FITTING cuts, so on the unfitting arm it stands only while such a cut remains. With none left it would integrate the empty set and re-present the very cut already in front of the reader — an option with no future rather than a choice — and the ways forward there are the override and the recut, both of which move. On the fitting arm the presented cut is itself such a cut, so the condition holds by construction and never bites
V              = Judgment ∈ {Confirm, Adjust(direction), Reopen(unit)}
Vₜ             = TerminationJudgment ∈ {DefineNow(direction), RouteBound, ReserveJudgment, ApproveUnbounded}   -- ReserveJudgment and ApproveUnbounded are the two ways the plan proceeds without a defined criterion, and they assert opposite things: the first that the criterion is constitutively open and correctly stays so, the second that one the plan should have carried is waived. They write different Λ state, and each retracts the other's record, so the mutual exclusion at convergence holds by construction rather than being merely asserted
plan_condition(d) = PlanCondition { scope: WholeGoalAcceptance, kind: completion, condition: [the predicate direction d states], dischargeable_when: PlanStateRequirement { predicate: λ candidate_plan. False, basis: {Evidence { source: "the DefineNow answer at the whole-goal acceptance gate", content: d }} } }   -- the placeholder predicate is False until BindPlanRequirements normalizes it against |U|; the basis is the user's own definition, which is what makes it inhabit NonEmptySet from construction rather than after a repair
BindPlanRequirements(P, U) = { p with dischargeable_when := plan_terminal(|U|) when p.scope = WholeGoalAcceptance; p unchanged otherwise | p ∈ P }   -- scope alone, deliberately unlike acceptance_present: a whole-goal invariant is still discharged at plan-terminal — it just does not answer the acceptance question
plan_terminal(n) = PlanStateRequirement { predicate: λ candidate_plan. |candidate_plan.units| = n ∧ ∀ r ∈ { e.resolution | e ∈ candidate_plan.units } : (r = DeterminateResolution { predicate: d, ... } ⟹ d holds) ∧ (r = AcceptedUncoveredResolution { accepted_completion_residuals: A, conjuncts: C } ⟹ A ≠ ∅ ∧ A ⊆ { a.obligation | a ∈ candidate_plan.accepted_residuals, a.kind = completion } ∧ ∀ c ∈ C : c.condition holds) ∧ (r = ReservedJudgmentResolution { reserved_completion_obligations: J, conjuncts: C } ⟹ J ≠ ∅ ∧ J ⊆ { o | s ∈ candidate_plan.reserved, s.subject = ReservedObligation(o), s.kind = completion } ∧ ∀ c ∈ C : c.condition holds), basis: {Evidence { source: "the current plan's UnitResolution, accepted-residual and reservation projections", content: "expected aggregate resolution count = " + String(n) + "; all executable resolution conditions; aggregate accepted-completion record; aggregate reserved-completion record" }} }
Rerouted       = routed_to_bound   -- produced by route_bound's relay emission, never by a bare deactivate: a declared route that no step emits would drop the continuation the user just chose
Emit           = (U, K, R, S, P, oos, unbounded_approved) → E [Tool: record]   -- R feeds resolve_unit's accepted arm and S its reserved arm; S, oos and unbounded_approved feed the envelope
Phase          ∈ {0, 1, 2, 3}
Qu             = Per-cycle apportionment interaction with (Anchor, proposed_unit: ProposedUnit, SpanFit, Seam, the cut set U as it stands at this firing, the still-unsettled cuts of the draft this cycle surfaced) [Tool: Constitution interaction]   -- the unsettled cuts travel because Sufficient settles THAT displayed draft; without them the answer would have nothing to accept but a re-derivation the user never saw, which is what would erase the seam dispositions drafting had already judged
Qt             = Whole-goal acceptance interaction, conditional on ¬acceptance_present(P) [Tool: Constitution interaction]
Qc             = Unit-plan confirmation interaction with (U, K, R, S, P, InvariantStatus, oos) [Tool: Constitution interaction]
ConditionBearingUnitPlan = { units: Set(UnitEntry), plan_conditions: Set(PlanEntry), accepted_residuals: Set(AcceptedResidualEntry), reserved: Set(JudgmentReservation), oos: Set(OOSDeclaration), unbounded_approved: Bool }
AcceptedResidualEntry = { obligation: Obligation, unit_ref: Option(UnitRef), kind: PredicateKind }
plan           = the ConditionBearingUnitPlan value returned by this invocation
HandoffLocator = { record: the durable identity of the carrier record C, session: the id of the session that parked it }
C              = PlanCarrier: the ONE durable record park_carrier writes the packaged plan into (record_handoff then emits N over it) — a single dereferenceable entry, distinct from E's per-unit entries, which exist for the downstream completion-predicate enforcer and carry no aggregate identity of their own
locator(C)     = HandoffLocator { record: C's record identity as the carrier-creating call returned it; session: the id of the session running record_handoff }   -- substrate-neutral by construction: the identity is whatever the carrier-creating call returned, so this type never names what performs that call
N              = NavigationBlock { purpose_frame: String, canonical_locator: HandoffLocator, dereference_instruction: DereferenceInstruction, snapshot_anchor: Option(String), grounding_instruction: GroundingInstruction }
DereferenceInstruction = an instruction to read the carrier record at the canonical locator's record identity, within the session that locator names — one read yields the whole plan
GroundingInstruction = the fixed instruction to run /inquire where available, or the recipient's equivalent grounding pass, and stop when a source is unreachable or a needed premise lacks support-integrity — and, when the parked plan carries reservations, to surface each as an open question together with the ground that settles it, worded so it invites an answer rather than suggesting one, since an answer suggested here would be a compile-time default standing in for the live one. A reservation is NOT a fourth stop condition: whether one blocks is read against the work actually at hand, and that read belongs to the recipient, never to this block
handoff_recorded(N, C) ≡ park_carrier wrote the packaged plan into C ∧ record_handoff presented N in the handoff output ∧ N.purpose_frame ≠ "" ∧ N.canonical_locator = locator(C) ∧ N.canonical_locator.session ≠ ""   -- the emission IS the text
── PHASE TRANSITIONS ──
Phase 0: G → Probe(G) [Tool] → goal_plan_uncompiled?                   -- activation checkpoint (observe): dereferences a prior navigation block when one is in scope, else internal analysis
           ¬autonomous_intent(G) → relay → deactivate                  -- no autonomous interval in scope (extension)
           ¬single_goal(G) → relay → deactivate                        -- composite goal: G bundles several stated outcomes whose only common bond is the host's standing procedural contract, and that contract attaches to any work there, so it evidences no shared outcome and can carry no seam. The relay names each constituent outcome and that bond; one apportionment per goal. Tested BEFORE the locator and condition_bearing arms, whose verdicts have no single subject over a bundle, and BEFORE init_loop_state, so no Λ loop field is seeded (extension)
           locator in scope ∧ (¬dereferenceable ∨ support-integrity failure) → relay → deactivate   -- handoff unreadable, for the locator that can be in scope here: the goal's navigation block. Covers a carrier that would not resolve, and a load-bearing premise the grounding pass could not support; the uncompiled arm is NOT taken (extension)
           condition_bearing(G)  → relay → deactivate                  -- units and conditions already present (extension)
           uncompiled            → ReadObligations(G) → O_G → VelocityFilter(O_G) → oos → init_loop_state (U=∅, residual=O_G \ {d.obligation | d∈oos}, K=∅, R=∅, S=∅, P=∅, plan_conditions_derived=⊥, plan_conditions_stale=⊥, fit_overrides=∅, invariant_status=⊥, accepted=∅, unbounded_approved=⊥) → Phase 1   -- ONE-TIME init, fired only on this edge; Phase 2's Reopen re-enters Phase 1 without re-running it. ReadObligations SUBTRACTS the host's standing procedural contract at this same step, so residual is seeded from what THIS goal generated; G remains unchanged
Phase 1: (G, residual) → residual?   -- the empty-residual arms are read off residual DIRECTLY, before anything is drafted: a draft coming back with no cut cannot distinguish "nothing was there to cut" from "nothing could be cut", and only the first of those relays. The second arm is the ordinary completion edge every converging run leaves Phase 1 through. apportionment loop (sense); residual/oos enter this phase either freshly seeded or as Reopen left them — never re-seeded on entry
           residual = ∅ ∧ U = ∅ ∧ oos = ∅ → relay(goal's scope too thin to read any obligation) (extension) → deactivate
           residual = ∅ ∧ (U ≠ ∅ ∨ oos ≠ ∅) → Phase 2
           residual ≠ ∅ → draft(G, residual) [Tool] → D → surface_draft(D) (extension)   -- draft iterates Scan/Pack/fit/qualify/complete_unit over a workset COPIED from residual until every obligation in that workset sits in a completed cut, autonomous_pack absorbing at heuristic seams only what the seam evidence could not reach; complete_unit still writes each cut's fit and seam, so a cut drafted in bulk carries the same two judgments an anchored one did and a whole draft is not uniformly heuristic. The copy is what keeps drafting owner-neutral: no obligation leaves residual here, integrate remaining the sole owner-changing step, so the coverage partition is untouched by anything drafting does. surface_draft then puts the WHOLE draft in front of the reader before a single cut is settled
             D holds no Heuristic cut ∧ each c ∈ D with fit = Fits ∧ no alternative cut of c's obligations standing up to the same evidence → relay(AcceptUnit) (extension) → integrate(c, U, residual)   -- the leading conjunct is the draft gate condition, read over the whole draft: one heuristic cut sends the draft to the gate entire. The rest is the option-set relay test, applied HERE and read live: D is a partition, so what this weighs is a cut drafting did NOT draw, never a second member of D standing against the first
             D has no unsettled cut left ∧ residual = ∅ → Phase 2
             else → Qu → Stop → Aᵤ (constitution) [Tool]   -- Qu carries the first unsettled cut standing as its own Anchor, that cut's SpanFit and Seam, U, and the draft's still-unsettled cuts
               Aᵤ = AcceptUnit   → integrate(the cut this firing presented, U, residual) → Phase 1        -- in Aᵤ's defined set iff SpanFit = Fits
               Aᵤ = Recut(c, d)  → re-derive c's Anchor frame under d → Phase 1   -- c is any still-unsettled cut of the surfaced draft, not only the presented one: same residual, different cut, and the next cycle drafts under d
               Aᵤ = OverrideFit  → integrate(the cut this firing presented, U, residual) → u' → Λ.fit_overrides := Λ.fit_overrides ∪ {u'.unit_ref} → Phase 1   -- in Aᵤ's defined set iff SpanFit ≠ Fits
               Aᵤ = Sufficient   → ∀c ∈ D still unsettled with fit = Fits: integrate(c) → c' → U := U ∪ {c'}, residual := residual \ c'.obligations → [no cut still unsettled has fit ≠ Fits ∧ residual = ∅: surface (extension) → Phase 2 | else Qu over the first still-unsettled cut with fit ≠ Fits, that cut standing as its own Anchor and carrying its own SpanFit and Seam → Stop → Aᵤ → the same Aᵤ dispatch] → Phase 1   -- blanket relay over the fitting cuts OF THE DISPLAYED DRAFT: Sufficient is the user's constitutive act over that whole, so what it accepts is what was shown, each seam disposition intact, rather than a remainder re-packed at heuristic seams the user never saw
Phase 2: U → ∀u∈U, ¬derived_already(u,K,R,S): Derive(u) → (Set(κ), Set(ρ), Set(σ)) → K:=K∪κs, R:=R∪ρs, S:=S∪σs ∥ [¬Λ.plan_conditions_derived: DerivePlan(G, U) → P; Λ.plan_conditions_derived := ⊤]   -- condition derivation (sense), scoped to units and plan conditions not yet derived this apportionment
           oos ≠ ∅ → OOS(oos) (extension)                              -- out-of-scope declaration, substrate recorded on each OOSDeclaration
           S ≠ ∅ → Reserved(S) (extension)                             -- reservation notice, ground recorded on each JudgmentReservation; no substrate is named because none is asked to intercept
           ¬acceptance_present(P) → Qt(K, P) → Stop → Vₜ (constitution) [Tool]   -- fires at pass entry, and again after any Adjust that clears acceptance
             Vₜ = DefineNow(d)     → P := P ∪ {plan_condition(d)}; [Λ.unbounded_approved: Λ.unbounded_approved := ⊥]; S := S \ {σ∈S : σ.subject = ReservedAcceptance}
             Vₜ = RouteBound       → route_bound (extension) [Tool] → deactivate (Rerouted)
             Vₜ = ReserveJudgment  → S := S ∪ {acceptance_reservation()}; [Λ.unbounded_approved: Λ.unbounded_approved := ⊥]   -- records the criterion as constitutively open; this arm never SETS the waiver flag, so no waiver is claimed, and it CLEARS one still standing from an earlier Qt firing on this same invocation
             Vₜ = ApproveUnbounded → Λ.unbounded_approved := ⊤; S := S \ {σ∈S : σ.subject = ReservedAcceptance}   -- the symmetric retraction: drops a ReservedAcceptance member still standing from an earlier Qt firing, so the arm answered last is the one that stands
           BindPlanRequirements(P, U) → P := Pᵦ → check(U, K, R, S, Pᵦ, oos) → Λ.invariant_status := InvariantStatus (track)   -- the ONLY writer of Λ.invariant_status, which Confirm's hard_invariants_hold guard reads; normalize every WholeGoalAcceptance requirement against the current |U| BEFORE topology_free is checked; coverage_complete ∧ span_fit ∧ termination_covered ∧ obligations_derived ∧ oos_substrate_named ∧ reservation_ground_named ∧ plan_conditions_topology_free (track)
           Λ.plan_conditions_stale → StaleNotice(P) (extension)        -- pre-Qc surfacing: review, Adjust, or Confirm as recorded
           Qc(U, K, R, S, P, InvariantStatus, oos) → Stop → V (constitution) [Tool]
             V = Adjust(d) → rederive over the SAME U → (K, R, S, P) := (K', R', S', P') → Λ.plan_conditions_stale := ⊥ → [¬acceptance_present(P') → Qt] → [acceptance_present(P') ∧ Λ.unbounded_approved: Λ.unbounded_approved := ⊥] → [acceptance_present(P') ∧ acceptance_reserved(Λ): S' := S' \ {σ : σ.subject = ReservedAcceptance}] → BindPlanRequirements(P', U) → P' := Pᵦ' → check(U, K', R', S', Pᵦ', oos) → Λ.invariant_status := InvariantStatus → re-present Qc   -- obligation_derived(u, K', R', S') holds for every u ∈ U; rederive rewrites the unit-scoped members of S only, the ReservedAcceptance member being Qt's own record; check is RE-RUN against the normalized adjusted state before Qc re-presents
             V = Reopen(u) → residual := residual ∪ u.obligations; U := U \ {u}; K := K \ {κ∈K:κ.unit=u}; R := R \ {ρ∈R:ρ.unit=Some(u)}; S := S \ {σ∈S:σ.unit=Some(u)}; Λ.fit_overrides := Λ.fit_overrides \ {u.unit_ref}; Λ.plan_conditions_stale := ⊤ → Phase 1   -- the reopened unit's derived conditions, reservations and fit-override record leave with it; the unit-free ReservedAcceptance member stays; P itself is not re-derived (Rule 25)
             V = Confirm ∧ ¬hard_invariants_hold(Λ) → re-present Qc naming the violated invariant
             V = Confirm ∧ hard_invariants_hold(Λ) → AcceptResiduals(R) → Λ.accepted := Λ.accepted ∪ {ρ.obligation | ρ ∈ R}; ∀ρ∈R: ρ.disposition := AcceptUncovered (track) → Phase 3   -- AcceptResiduals produces the accepted-completion witnesses resolve_unit reads during Emit; S is untouched, a reservation being a sibling of the residual rather than one awaiting acceptance
Phase 3: (U, K, R, S, P, oos, unbounded_approved) → Emit → E [Tool: record] → package(E) → plan → park_carrier(plan) → C [Tool: record] (track) → record_handoff(C) → N (extension) → converge(apportionment trace) (extension) → ConditionBearingUnitPlan

Phase 0 → Phase 1: goal_plan_uncompiled(G)                             -- this edge alone performs the one-time VelocityFilter/residual init
Phase 0 → deactivate: ¬autonomous_intent(G) ∨ ¬single_goal(G) ∨ condition_bearing(G) ∨ (locator in scope ∧ (¬dereferenceable ∨ support-integrity failure))   -- relay the scan result; no activation. "Locator in scope" is the goal's navigation block, the only locator this phase can hold. ¬single_goal is the composite-goal termination path: it relays the constituent outcomes and deactivates, exactly as the other three non-activation arms do
Phase 1 → deactivate: residual = ∅ ∧ U = ∅ ∧ oos = ∅                   -- nothing could be read from the goal's scope; relays rather than emitting an empty plan
Phase 1 → Phase 1: next draft over the current residual                -- bounded by coverage (residual strictly shrinks on AcceptUnit/OverrideFit, and on every cut the relay arm integrates) and by user agency (Recut/Sufficient). Each cycle discards the previous draft and re-drafts what is left, so nothing carries a stale cut forward and no Λ field has to hold one
Phase 1 → Phase 2: residual = ∅ ∧ (U ≠ ∅ ∨ oos ≠ ∅)                    -- every obligation apportioned or visibly delegated
Phase 2 → Phase 1: V = Reopen(u)                                       -- that unit's obligations return to residual; bounded by user agency exactly as Adjust is
Phase 2 → Phase 2: V = Adjust(d)                                       -- rederive over the same apportionment; U unchanged
Phase 2 → Phase 2: V = Confirm ∧ ¬hard_invariants_hold(Λ)              -- Qc re-presents with the violated invariant named; no state advances
Phase 2 → deactivate: Vₜ = RouteBound                                  -- Rerouted; route_bound emits the route first; /bound → /apportion re-entry recompiles fresh
Phase 2 → Phase 3: V = Confirm ∧ hard_invariants_hold(Λ)               -- residuals accepted on record; every clause of apportioned(G) that Qc can violate holds AT THE TRANSITION
Phase 3 → converge: emitted(E) ∧ handoff_recorded(N, C)                -- ConditionBearingUnitPlan + apportionment trace + navigation block

── LOOP ──
Two bounded loops, one per irreducible part.

Apportionment loop (Phase 1): one whole-residual draft per cycle.
  Each cycle drafts the current residual to closure, surfaces that draft entire, then settles out of it — the
  relay path opening only over a draft whose every cut cites a seam the goal evidences and, once open,
  integrating every cut no second reading contests; the gate takes the rest one at a time, and takes the
  draft entire where any cut is heuristic.
  Two bounds, nested and independent. INSIDE a cycle, drafting terminates because it runs over a COPY of
  residual that strictly shrinks as each obligation lands in a completed cut, autonomous_pack absorbing whatever
  no seam evidence reaches, so the workset empties in finitely many steps and no cut is left without one.
  ACROSS cycles, residual strictly shrinks on every AcceptUnit, every OverrideFit, every cut the relay arm
  integrates, and every Sufficient — which stands only while the draft still holds an unsettled fitting cut, so
  it always has one to integrate — and the loop therefore cannot cycle on coverage. Recut alone leaves residual
  unchanged: it re-frames one still-unsettled cut of the surfaced draft under a user direction, whichever cut
  the answer names, and the next cycle drafts under that direction, so it is bounded by user agency rather
  than by coverage. A cycle entered via Reopen (the one back-edge from Phase 2) drafts residual exactly as
  Reopen left it: that unit's restored obligations, every other already-packed unit's obligations untouched. No draft crosses a cycle boundary — each cycle discards
  the last and re-drafts what remains, which is why no Λ field holds a draft and no transition has to hunt down
  cuts a settlement made stale.

Condition loop (Phase 2): Qt fires whenever the whole goal carries no acceptance criterion — at pass entry, and
  again after an Adjust that clears one. Its two no-criterion arms assert opposite things and are kept apart end
  to end: ReserveJudgment records the criterion as constitutively open, ApproveUnbounded records a waiver, and
  each RETRACTS the other's record when it is still standing — so at most one of the two ever holds, by
  construction rather than by assertion, and a user who answers one arm at a later firing has revised the earlier
  answer rather than added to it. An Adjust that instead INTRODUCES whole-goal acceptance retracts
  whichever of the two is still on record in that same transition — the waiver by clearing Λ.unbounded_approved,
  the reservation by dropping its ReservedAcceptance member — and does not re-fire Qt; the SAME retraction of
  both fires unconditionally on Qt's own DefineNow arm, on every firing.
  Qc's Adjust rederives over the SAME apportionment — K' ∪ R' ∪ S' still spans every obligation of every unit
  (obligation_derived, no removal; a withdrawn or weakened condition becomes a residual, and a residual the
  direction re-reads as settled by judgment becomes a reservation). BindPlanRequirements
  runs idempotently on every pass immediately before check, so every WholeGoalAcceptance condition carries
  plan_terminal(|U|) before the guard reads it; check is RE-RUN in full against that normalized state before Qc
  re-presents, so Confirm's hard_invariants_hold guard always consults an InvariantStatus computed against the
  current K/R/S/P/U. Confirm performs no later P mutation and does not waive a hard invariant: a coverage or fit
  violation re-presents Qc with the violation named rather than advancing to emission. Reopen is the one
  back-edge to Phase 1: it returns exactly that unit's obligations to residual, clears that unit's own K/R/S
  entries, and re-enters the apportionment loop. The back-edge is SCOPED: residual is never re-seeded from the
  goal's full obligation set, and Derive/DerivePlan run only over what is not yet derived, so a unit's
  Adjust-shaped conditions and any whole-goal conditions already on record survive the detour. Reopen also sets
  Λ.plan_conditions_stale, and the next Qc surfaces that as a notice — Adjust or Confirm as recorded — clearing
  once the user Adjusts. AcceptResiduals then accepts R and supplies the non-empty completion-residual witness
  any AcceptedUncoveredResolution needs at Emit. Confirm terminates.

Stateless: Merismos terminates at emission. No invocation-local state survives into the execution interval —
no session approvals, no per-action classification, no mid-execution checkpoint. The emitted navigation
block is the cross-session route to the carrier, not surviving Λ state.

Convergence evidence (relay, at emission): present the apportionment trace —
  (a) Plan readback — the goal restated as its units in plain single-sentence form;
  (b) Per-unit: (obligations covered, seam quality with its citation or heuristic declaration, horizon fit or
      the recorded override) → the unit resolution certificate — the conjoined predicate plus typed conjuncts
      when the unit has ≥1 compiled completion condition, an accepted-completion witness plus any invariant
      conjuncts when it has none, or a reserved-completion witness plus any invariant conjuncts when what its
      done means is held open to judgment — the unit's capability requirements and feasibility notes, and the
      disposition that settled it: relayed as a cut no second reading contested, accepted at the gate, accepted
      with a recorded override, or settled under a Sufficient over the displayed draft. This is REPORTED CONDUCT,
      not a field read back — the run presenting this trace is the one that just took those arms, and no Λ cell
      holds the answer. Making it one would buy nothing the ordering does not already give: Whole Draft over
      Serial Cut is a property of WHEN surfacing happens relative to integration, so no predicate over the final
      state can check it and a run that skipped the surfacing would write the same label as one that did not.
      What the disposition earns its place by is showing the reader which cuts they settled and which the draft
      settled for them;
  (c) Plan-level conditions with the plan-state requirement that makes each safe to discharge;
  (d) Each accepted-uncovered residual with its obligation, each reserved item with the ground that settles it,
      and each out-of-scope obligation with its substrate;
  (e) When unbounded_approved: the recorded whole-goal acceptance waiver with its gate site. When the whole-goal
      acceptance criterion is reserved instead: that reservation with its ground, stated as a criterion left
      open on purpose rather than as a gap — the two never appear together.
(d) and (e) are additionally emitted as a plan-envelope entry alongside the unit and plan-condition entries.
Convergence is demonstrated, not asserted.

── CONVERGENCE ──
-- plan denotes the returned ConditionBearingUnitPlan (see TYPES); E is the record-emitted goal-entry set
apportioned(G) = emitted(E) ∧ handoff_recorded(N, C)
                 ∧ coverage_complete(U, O_G) ∧ span_fit(U)
                 ∧ (U ≠ ∅ ∨ oos ≠ ∅)                                                -- a goal with nothing read from it never claims apportionment occurred
                 ∧ (∀u∈U: (∃ κ ∈ K : κ.unit = u ∧ κ.kind = completion) ∨ (∃ ρ ∈ R : ρ.unit = Some(u) ∧ ρ.kind = completion) ∨ (∃ σ ∈ S : σ.unit = Some(u) ∧ σ.kind = completion))   -- the three arms are exactly resolve_unit's three, in its order, so every emitted unit has a defined certificate
                 ∧ (∀u∈U: obligation_derived(u, K, R, S))
                 ∧ (∀u∈U: |{e ∈ E : e is UnitEntry ∧ e.unit_ref = u.unit_ref}| = 1)   -- the join rule holds: one unit entry per unit, keyed on unit_ref — subject is not unique across units
                 ∧ (∀u∈U: ∀e∈E: (e is UnitEntry ∧ e.unit_ref = u.unit_ref) → (e.obligations = u.obligations ∧ e.resolution = resolve_unit(u, K, R, S) ∧ e.capability_requirements = u.capability_requirements ∧ e.feasibility_notes = u.feasibility_notes))   -- the join rule's durable certificate: resolve_unit jointly supplies the completion disposition, its accepted-completion or reserved-completion witness when needed, and every typed conjunct; the emitted obligations/capability/feasibility fields are exact reads from the owning unit
                 ∧ (∀p∈P: ∃! e ∈ E : e is PlanEntry ∧ e.scope = p.scope ∧ e.kind = p.kind ∧ e.condition = p.condition ∧ e.dischargeable_when = p.dischargeable_when)
                 ∧ (∀e∈E: e is UnitEntry → ∃! u∈U: e.unit_ref = u.unit_ref)          -- reverse correspondence: no unapproved UnitEntry can ride in E
                 ∧ (∀e∈E: e is PlanEntry → ∃ p∈P: e.scope = p.scope ∧ e.kind = p.kind ∧ e.condition = p.condition ∧ e.dischargeable_when = p.dischargeable_when)   -- reverse correspondence: no unapproved PlanEntry can ride in E
                 ∧ (∀p∈P: topology_free(p.dischargeable_when))
                 ∧ (∀p∈P: p.scope = WholeGoalAcceptance → p.dischargeable_when = plan_terminal(|U|))   -- produced by BindPlanRequirements before the final check; the captured aggregate count prevents a dropped-unit projection from satisfying the terminal universal vacuously
                 ∧ plan.units = {e ∈ E : e is UnitEntry}                             -- the RETURNED plan's units are exactly E's UnitEntry partition — produced by Phase 3 package from E
                 ∧ plan.plan_conditions = {e ∈ E : e is PlanEntry}                   -- the RETURNED plan's plan conditions are exactly E's PlanEntry partition — produced by Phase 3 package from E
                 ∧ (acceptance_present(P) ∨ Λ.unbounded_approved ∨ acceptance_reserved(Λ))   -- the acceptance question is closed one of three ways: a defined criterion, a recorded waiver, or a recorded reservation
                 ∧ ¬(acceptance_present(P) ∧ Λ.unbounded_approved)                  -- a real acceptance condition and an unbounded waiver never both hold at emission
                 ∧ ¬(acceptance_present(P) ∧ acceptance_reserved(Λ))                -- nor a real acceptance condition and a reservation: DefineNow drops the reservation on the same edge that adds the condition
                 ∧ ¬(Λ.unbounded_approved ∧ acceptance_reserved(Λ))                 -- THE WAIVER/RESERVATION DISCRIMINATOR: exactly one of the two can stand at emission, so the converged plan alone answers whether the criterion was WAIVED (plan.unbounded_approved) or CORRECTLY LEFT OPEN (a ReservedAcceptance member of plan.reserved) — the two are never both set and never stand in for each other. This holds by construction: each of the two arms retracts the other, and DefineNow and an acceptance-introducing Adjust retract both
                 ∧ (∀d∈oos: d.substrate ≠ "")
                 ∧ (∀σ∈S: σ.ground ≠ "")                                             -- reservation_ground_named: every reservation names what settles it, as every out-of-scope declaration names its substrate
                 ∧ (∃! e ∈ E : e is PlanEnvelopeEntry)                               -- exactly one envelope per emission
                 ∧ (∀e∈E: e is PlanEnvelopeEntry → e.accepted_residuals = { AcceptedResidualEntry(ρ.obligation, ρ.unit.map(u ↦ u.unit_ref), ρ.kind) | ρ ∈ R : ρ.disposition = AcceptUncovered } ∧ e.reserved = S ∧ e.oos = oos ∧ e.unbounded_approved = Λ.unbounded_approved)   -- exact correspondence in BOTH directions, keyed by unit_ref rather than by obligation+kind; the reservation set carries across whole, its subjects distinguishing the unit-scoped members from the whole-goal one
                 ∧ plan.accepted_residuals = (the PlanEnvelopeEntry of E).accepted_residuals
                 ∧ plan.reserved = (the PlanEnvelopeEntry of E).reserved
                 ∧ plan.oos = (the PlanEnvelopeEntry of E).oos
                 ∧ plan.unbounded_approved = (the PlanEnvelopeEntry of E).unbounded_approved   -- the returned value READS BACK the emitted envelope rather than being re-derived beside it; produced by Phase 3 package from E
-- Rerouted (Qt RouteBound) is a deliberate non-emission exit — it does not claim ConditionBearingUnitPlan (see TYPES): the emitted result is well-formed exactly when apportioned(G) holds.
-- Each Phase 0 relay (no autonomous intent, composite goal, unreadable handoff, already condition-bearing)
-- precedes activation: init_loop_state never runs, so no clause of this predicate is entered or owed.
-- The guarantee is compile-time and pre-conduct (see the Apportion over Order invariant).

── TOOL GROUNDING ──
-- Realization: Constitution → TextPresent+Stop; Extension → TextPresent+Proceed
Phase 0 Probe        (observe)      → record read, artifact read (autonomous intent + goal singleness + uncompiled-plan detection over the goal; cue cited. Singleness is read off what G states: several stated outcomes bound only by the host's standing procedural contract are a bundle, since that contract attaches to any work there — the verdict is about G, never about whether some individual obligation is derivable. When the scan finds a prior /apportion navigation block, this step DEREFERENCES it — reading the ONE carrier record at the locator's record identity within the session that locator names, then running the grounding instruction — and decides condition_bearing against the plan read back from that carrier, whose accepted_residuals and reserved fields are what close its accepted-uncovered and reserved units respectively. An unreachable source, a locator missing either half, or a load-bearing premise the grounding pass cannot support STOPS: this step surfaces the handoff as unreadable and deactivates, and the goal never falls through to the uncompiled path — GroundingInstruction's own clause requires the stop, and /conduct's ground_pointer does the same on the mirror path. With no navigation block in scope at all the step is internal analysis over the goal alone, and the uncompiled path is correct)
Phase 0 relay        (extension)    → TextPresent+Proceed (no autonomous interval in scope, a composite goal, or the plan already carries units and conditions: surface the scan result; deactivate without activating. On the composite arm the surfaced result names each stated outcome the request bundles and the shared-procedure bond that made them read as one, so the user re-invokes once per goal rather than receiving units cut across them)
Phase 0 ReadObligations (observe)   → record read, artifact read (construct O_G once as G.obligations, a local read, never a G mutation. The same step SUBTRACTS every requirement the host attaches to any change regardless of the goal — its standing procedural contract — because such a requirement is an ambient invariant every emitted unit inherits rather than something this goal generated; leaving it in would make every goal in that host read the same inflated set and bury the goal's own obligations among them. The subtraction is not a delegation: no OOSDeclaration is written, since nothing is being handed to a pre-action interceptor. When it leaves nothing behind, the run reaches Phase 1 with residual = ∅, U = ∅ and oos = ∅ and takes the existing too-thin relay rather than emitting an empty plan. Produces the set VelocityFilter, residual seeding, and coverage_complete consume)
Phase 0→1 VelocityFilter (sense)    → Internal analysis (obligations guardable only by pre-action interception; computed from O_G on the Phase 0 → Phase 1 edge alongside init_loop_state and only there, before residual is seeded, so an out-of-scope obligation never enters the packing loop and Phase 2's Reopen back-edge re-enters the packing loop without recomputing this partition; empty scope with no obligation and no delegation relays rather than proceeding)
Phase 1 Scan         (observe)      → artifact read, artifact search (optional seam evidence gathering over the goal's cited substrate; read-only)
Phase 1 Pack         (sense)        → Internal analysis (apportionment search: units fitting one horizon, coverage over obligations; produces a DRAFT when it finds a cut — an empty Anchor IS this step's no-cut verdict and yields no draft, which is why the exhaustion arms are decided before fit and qualify run — and fit and seam are written later by complete_unit, so what Pack yields does not yet inhabit ProposedUnit; reads each proposed unit's capability requirements and feasibility notes from the goal's stated needs — functional descriptions only, never a concrete executor/model/runtime/tool token (Substrate Boundary). The search may well turn up more than one workable cut of the same Anchor; what it does with that is DRAW ONE. The draft is a partition, so standing both in it would leave two cuts claiming one obligation — the defect draft's own termination bound forbids, not an option put on offer. It records nothing about the cut it did not draw: whether that second reading deserves the reader belongs to the relay step, made later against the surfaced whole, and a verdict fixed here would settle it before the reader had the draft in hand)
Phase 1 fit          (sense)        → Internal analysis (per-unit horizon-fit verdict; Indeterminate surfaced, never read as Fits)
Phase 1 qualify      (sense)        → Internal analysis (seam quality: Grounded with its citation — the four named seam kinds are what this scan looks for, and any other seam the goal actually evidences qualifies the same way — or Heuristic declared when no evidence is there)
Phase 1 draft        (observe)      → artifact read, artifact search (the whole-draft pass: iterate Scan/Pack/fit/qualify/complete_unit over a workset COPIED from residual until every obligation in that workset sits in a completed cut, then stop. The substrate contact is Scan's alone and it is optional — a pass with no seam evidence to gather reads nothing — but what this entry names is the capability the pass MAY need, which is why the transition marks it as dispatching while the four steps it iterates beside Scan are internal. Each cut gets its own qualify verdict, so a Grounded seam stays Grounded and only what no seam evidence reaches falls to autonomous_pack — drafting at once is not drafting uniformly heuristic. This step OWNS NOTHING: the workset is a copy, no obligation leaves Λ.residual here, and integrate remains the sole owner-changing step, so the coverage partition sees nothing drafting does and gains no fourth cell. What it yields is a PARTITION of that workset — one cut per obligation, never two claims on one, which is the same fact its termination bound rests on. Where a region admits more than one workable apportionment it draws one way and records nothing about the other: it SETTLES nothing and stores no verdict, and whether a second reading deserves the user is judged downstream against the surfaced whole. Nothing it produces survives the cycle: the next cycle discards it and drafts the residual as it then stands)
Phase 1 surface_draft (extension)   → TextPresent+Proceed (put the WHOLE draft in front of the reader before any one cut is settled — every cut with its obligations, its fit verdict, and its seam disposition with citation or heuristic declaration. Relay: it opens no fork, and the forks that follow are each judged against what it made visible. This is the step Whole Draft over Serial Cut names — without it the reader accepts a fragment whose siblings are still unwritten, and a cut found wrong later forces back open what was already accepted blind. It carries one thing beyond the cuts: the STANDING AFFORDANCE to send any of them back, stated here rather than left for the reader to discover at a later gate. A partition's alternatives cannot be enumerated the way an axis's named values can, so what discharges the cut's openness is not a list of rival cuts but this affordance travelling beside it. Naming it here is what makes the correction cheap: at this point nothing is derived, while the same correction taken at Qc invalidates conditions already compiled and marks the plan-level ones stale. It is a free-response pathway, not a gate option — it yields no turn of its own, and where it lands depends on what has happened to the cut: a still-unsettled one is reached by Recut at this cycle's Qu, which carries the target as well as the direction, and one this cycle already integrated is reached by Reopen at the confirmation gate, the one path that returns an owned obligation to residual. Both are named on the surface, so the affordance promises what the transitions actually admit)
Phase 1 relay        (extension)    → TextPresent+Proceed (this path opens only where every cut in the surfaced draft cites a seam the goal evidences: a heuristic cut is the AI's own guess, and a guess is where anchoring bites — a drafted answer moving the reader from constituting the apportionment to approving one — so one of them sends the draft to the gate entire rather than only itself, a cut with an arbitrary boundary giving its neighbours arbitrary boundaries too. What makes relaying an evidenced draft safe is what this protocol can reach: nothing it relays touches a substrate, no obligation's ownership becomes durable until Phase 3 parks the plan, and Qc stands between the two — so a cut relayed here is still correctable at a gate the user holds, and a stop before that would spend attention on a confirmation the flow already provides. Within an open relay path, a cut that fits its horizon and that no second reading contests — no alternative apportionment of its obligations stands up to the same evidence — is accepted without a turn yield. This is the option-set relay test, read HERE and read LIVE rather than looked up from anything an earlier step computed: whether a region's other cut deserves the user's weighing varies with what the goal turned out to contain and with what the user has said, so fixing it before the draft existed would settle it where the reader is not yet present. The alternative is never IN D — D carries one cut per obligation — so this compares the drawn cut against a reading, never against a sibling standing beside it)
Phase 1 autonomous_pack (sense)     → Internal analysis (drafting's own fallback, and now only that: INSIDE a draft pass, once the seam scan has run out of evidence over what is left of the workset, pack that remainder at Heuristic seams — judging fit and running complete_unit on each, so what it adds to the draft are completed ProposedUnit values built by the same constructor the seam-grounded cuts use, never a second inhabitant; capability requirements and feasibility notes read exactly as Pack reads them. EVERY obligation it touches lands in some completed cut — obligations no heuristic seam places become one final cut anchored on themselves, its fit judged like any other — which is what lets draft terminate with its workset empty and no obligation left uncut. Each cut it makes carries its Heuristic declaration to surface_draft, so the reader sees which parts of the draft the goal's own evidence shaped and which parts it could not. It integrates nothing and settles nothing: what it makes enters the draft, and every cut in that draft is then dispatched by the same relay-or-gate reading as any other. The Sufficient trigger this step used to carry is GONE — Sufficient now settles the draft the reader was shown, and routing it back through here would re-pack at heuristic seams a remainder the reader had already seen cut at grounded ones)
Phase 1 Qu           (constitution) → present (the contested cut [ProposedUnit], itself standing as its Anchor + horizon-fit verdict + seam quality with its basis + current cut-set + the draft's still-unsettled cuts; the accept option is fit-complementary — AcceptUnit when the span fits, OverrideFit when it does not — and Sufficient rides the same indexing one axis over, standing only while the draft still holds an unsettled fitting cut for it to accept; Aᵤ carries both, and every firing hands its judgment to the one Aᵤ dispatch. The unsettled cuts travel with the gate for two reasons that are not the same one: Sufficient settles THAT displayed remainder, so without it the answer would have nothing determinate to accept; and the contested cut is only judgeable beside the neighbours it was cut against, which is Whole Draft over Serial Cut holding at the gate rather than only at surface_draft) [Tool]
Phase 1 complete_unit (track)       → Internal state update (write the SpanFit fit produced and the Seam qualify produced onto Pack's draft, yielding the ProposedUnit the gate presents and integrate consumes — the only step that inhabits ProposedUnit's fit and seam fields)
Phase 1 integrate    (track)        → Internal state update (consumes a ProposedUnit and produces a Unit — the only constructor Unit has: the accepted unit enters the apportionment and its obligations leave the residual; a fresh UnitRef is assigned in that same step, stable for the remainder of the apportionment; OverrideFit records THAT fresh UnitRef into Λ.fit_overrides after assignment, never before. Which arm called is NOT written into the unit. The trace reports it because the run that presents the trace is the run that took the arm, and a cell holding it would only mirror a distinction the transitions already draw — the arms are four, the members would be four, and nothing downstream would branch on the copy)
Phase 2 Derive       (sense)        → Internal analysis (per-unit completion and invariant predicates; an obligation with no verifiable predicate becomes a residual, EXCEPT where judgment_settled(o) holds — an obligation no check could settle because a judgment against the context accumulated by then and what the user has actually said by then settles it becomes a reservation instead, carrying the ground that settles it. The two are different findings: a residual says the plan leaves the obligation unguarded, a reservation says compiling it at all would fix a live answer where the user is not present. Neither is an out-of-scope delegation, which names a substrate that must intercept before an action runs, and this step writes no OOSDeclaration. The read is fallible and lands as pre-gate text at Qc, where an Adjust direction can move an item either way; scoped to units where ¬derived_already(u,K,R,S))
Phase 2 DerivePlan   (sense)        → Internal analysis (conditions whose subject is the whole goal; never distributed across units; fires once per apportionment, guarded by ¬Λ.plan_conditions_derived)
Phase 2 OOS          (extension)    → TextPresent+Proceed (out-of-scope declaration per obligation, with the delegated substrate named. Unchanged in scope by the reservation slot beside it: what is declared here is still exactly an obligation whose violation must be caught before an action runs, and a reserved item never routes through this step)
Phase 2 Reserved     (extension)    → TextPresent+Proceed (reservation notice per held item, with the ground that settles it named — a unit obligation Derive reserved, and a whole-goal acceptance criterion an earlier Qt firing already reserved. It runs BEFORE Qt on every pass, so the ReservedAcceptance member Qt writes on THIS pass is not yet in S when this step reads it; that member reaches the user at Qc, which is handed the current S. Presented as relay rather than as a gate, exactly as the out-of-scope partition is and for the same reason: the finding is an analysis result the confirmation gate then carries, not a fork the user is asked to pick between. It states what stays open and why leaving it open is the correct disposition, so nothing here reads as a shortfall)
Phase 2 Qt           (constitution) → present (conditional: the whole goal has no acceptance criterion — define it now / route its definition to /bound / reserve it as a criterion whose right answer is not fixable now / proceed unbounded on record; fires at pass entry and again after any Adjust that clears acceptance, always before Qc re-presents. The reserve and the unbounded options are NOT two wordings of one answer: reserving asserts the criterion is constitutively open — its right answer varies with the context accumulated by the moment the goal is judged accepted and with what the user has actually said by then, so fixing it now would settle a live question where the user is not present — while proceeding unbounded asserts the plan lacks a criterion it should have carried and the user accepts that shortfall. Each writes its own Λ state and neither is inferred from the other. DefineNow additionally retracts BOTH a Λ.unbounded_approved still reading ⊤ and a ReservedAcceptance member still in S from an earlier Qt firing on this same invocation) [Tool]
Phase 2 ReserveJudgment (track)     → Internal state update (adds acceptance_reservation() to S, materializing the constitutively-open record for the convergence predicate; does NOT touch P; it never SETS Λ.unbounded_approved — so no waiver is claimed — and it RETRACTS one still standing from an earlier firing; a later Qt re-fire can still reach DefineNow while this stands)
Phase 2 ApproveUnbounded (track)    → Internal state update (records Λ.unbounded_approved, materializing the informed acceptance for the convergence predicate; does NOT touch P; it drops the ReservedAcceptance member from S when one is standing, which is the symmetric retraction that keeps the waiver and the reservation mutually exclusive; a later Qt re-fire can still reach DefineNow while this reads ⊤)
Phase 2 route_bound  (extension) → TextPresent+Proceed (conditional: Vₜ = RouteBound — emit the route to /bound naming the whole-goal acceptance criterion as what it is to define, so the chosen continuation leaves this protocol as a stated route rather than a silent exit; mutates no Λ field, then deactivate)
Phase 2 BindPlanRequirements (track) → Internal state replacement (immediately before every check, replace P with the same conditions except that every WholeGoalAcceptance entry carries dischargeable_when = plan_terminal(|U|); runs after DerivePlan/Qt and after every Adjust/Qt re-fire. The sole producer of the scope-owned convergence clause and its identity-free expected count)
Phase 2 check        (track)        → Internal state update (WRITE Λ.invariant_status — invariant status: coverage, horizon fit, termination coverage, obligation derivation, oos substrate-naming, reservation ground-naming, and each plan condition's topology-freedom — an AI semantic judgment over the plan condition's predicate content, not a structural proof — over the current apportionment; RE-RUN every time Qc is about to (re-)present, at pass entry and again after every Adjust plus any Qt re-fire it triggers)
Phase 2 StaleNotice   (extension)   → TextPresent+Proceed (conditional: Λ.plan_conditions_stale = ⊤ — surface, as pre-gate text before Qc, that plan-level conditions were derived or last user-adjusted against a unit set a subsequent Reopen has since changed; relay only, mutates no Λ field)
Phase 2 Qc           (constitution) → present (apportionment + derived conditions + residual dispositions + reservations with their grounds + invariant status + the staleness notice when present: Confirm / Adjust / Reopen. A reservation is shown as a held-open item rather than as an uncovered one, so an Adjust direction can move it either way with the distinction in view) [Tool]
Phase 2 AcceptResiduals (track)     → Internal state update (on Confirm: record each remaining residual's obligation into Λ.accepted and write ρ.disposition := AcceptUncovered for each ρ ∈ R. This supplies accepted_completion_residuals(u,R), the non-empty witness resolve_unit's accepted constructor requires at Emit. P and S are untouched — a reservation is not a residual awaiting acceptance, and sweeping one into Λ.accepted would file a correct disposition as an accepted shortfall)
Phase 3 Emit         (track)        → record (one goal entry per unit: unit_ref + subject + obligations + resolve_unit's single UnitResolution certificate — DeterminateResolution carries the conjoined predicate and every typed conjunct when a completion κ exists; AcceptedUncoveredResolution carries a non-empty accepted-completion witness plus any invariant conjuncts when no completion κ exists but an accepted completion residual does; ReservedJudgmentResolution carries a non-empty reserved-completion witness plus any invariant conjuncts when neither does — + capability requirements and feasibility notes carried verbatim; plan-level conditions as their own entries carrying scope + kind + condition + the already-checked dischargeable_when; AND exactly one plan-envelope entry carrying the Λ-accepted residuals, the reservation set S, the computed oos set, and Λ.unbounded_approved — the reservation field and the waiver flag staying separate is what lets a reader of the emitted plan alone tell a waived acceptance criterion from one correctly left open. sets Λ.emitted on completion — these entries serve the enforcer; the cross-session carrier is record_handoff's own, outside Λ) [Tool]
Phase 3 package      (track)        → Internal state update (constructs the returned ConditionBearingUnitPlan as a VIEW of E, partitioned by constructor: units from the UnitEntry members, plan_conditions from the PlanEntry members, and accepted_residuals/reserved/oos/unbounded_approved read back off the emitted PlanEnvelopeEntry — never re-derived from Λ)
Phase 3 park_carrier   (track)      → record (write package's plan value into ONE new record C — the whole plan in one entry, so a single dereference reconstructs it; C's own write returns the record identity locator(C) reads) [Tool]
Phase 3 record_handoff (extension)  → TextPresent+Proceed (emit N in the fixed navigation-block shape with canonical_locator = locator(C) — record half from C's write, session half this session's own id — plus a dereference instruction, the optional snapshot anchor only when exact-state determinacy is needed, and the grounding instruction, which additionally carries the plan's reservations forward as open questions with their grounds — worded to invite an answer rather than to suggest one, and declaring none of them a stop, since whether a reservation blocks is the recipient's read against the work at hand. N is entry points only, never a re-authored plan; C and this emitted block are what handoff_recorded(N, C) reads)
converge             (extension)    → TextPresent+Proceed (apportionment trace after the navigation block has been emitted; deactivate)
seam                 (extension)    → TextPresent+Proceed (two seams, scoped separately. INBOUND activation seam (before this protocol activates): the `/bound → /apportion` and `/conduct → /apportion` legs of the `## Composition` chain relay when a user-declared chain names `/apportion` next, or an invocation follows that declared composition edge — proceed directly, citing the settling source. OUTBOUND emission seam (after this protocol emits): the `/apportion → enforcer` edge is EXCLUDED — Rule 8 (Separate activation) governs it; the `/apportion → /conduct` edge relays only under a user-declared chain naming /conduct next, never automatically, and carries the no-reentry guard of Rule 9. Every Constitution gate inside this protocol and inside the next protocol fires unchanged)

── MODE STATE ──
Λ = { phase: Phase, G: AutonomousGoal, H: ExecutionHorizon,
      O_G: Set(Obligation),              -- written once by Phase 0 ReadObligations; local narrowed read (the host's standing procedural contract subtracted), never a mutation of G; read by VelocityFilter, residual seeding, coverage_complete, and the coverage partition
      U: Set(Unit), residual: Set(Obligation),
      fit_overrides: Set(UnitRef),       -- seeded ∅ by init_loop_state; written by OverrideFit AFTER integrate_unit assigns the ref; fit_override_recorded(u) ≡ u.unit_ref ∈ Λ.fit_overrides; cleared of a reopened unit's ref by Reopen, mirroring K/R
      K: Set(CompiledCondition), R: Set(Residual), P: Set(PlanCondition), oos: Set(OOSDeclaration),
      S: Set(JudgmentReservation),       -- seeded ∅ by init_loop_state; written by Phase 2 Derive (unit-scoped members) and by Qt's ReserveJudgment (the one ReservedAcceptance member); a reopened unit's members leave with it, as its K/R entries do, while the unit-free ReservedAcceptance member stays; DefineNow, an acceptance-introducing Adjust, and ApproveUnbounded each drop that member. Read by resolve_unit's reserved arm, obligation_derived, reservation_ground_named, acceptance_reserved, and the emitted envelope
      plan_conditions_derived: Bool,     -- seeded ⊥ by init_loop_state; written ⊤ the one time Phase 2's DerivePlan runs; read by Phase 2's entry guard
      plan_conditions_stale: Bool,       -- seeded ⊥ by init_loop_state; written ⊤ by Reopen; read by the pre-Qc StaleNotice surfacing; written ⊥ by Adjust — never auto-cleared by re-running check, and never forces a re-derivation itself
      accepted: Set(Obligation),         -- written by AcceptResiduals on Confirm; accepted_uncovered(o) ≡ o ∈ Λ.accepted
      unbounded_approved: Bool,          -- written by Qt on ApproveUnbounded; RETRACTED (:= ⊥) by Adjust (when it introduces whole-goal acceptance while this still reads ⊤), by DefineNow (on any Qt firing, unconditionally), or by ReserveJudgment (on any Qt firing, when this still reads ⊤). Records a WAIVER only; the constitutively-open case is Λ.S's ReservedAcceptance member, retracted by the same Adjust and DefineNow edges plus ApproveUnbounded — each no-criterion arm retracting the other is what keeps the two from ever standing together at emission
      invariant_status: InvariantStatus,
      emitted: Bool,                     -- written by Phase 3 Emit; emitted(E) ≡ Λ.emitted
      active: Bool, cause_tag: String }
-- Coverage partition invariant: residual, (⋃ᵤ u.obligations) and {d.obligation | d ∈ oos} are pairwise
--   disjoint and together equal O_G at every cycle boundary — an obligation is always exactly one of: still
--   residual, apportioned to a unit, or visibly delegated out of scope. Λ.accepted is NOT a fourth cell: it is
--   a MARKING over obligations that already sit in a unit, recording that the unit carries no verifiable
--   predicate for them — ρ.unit is what ties them. The host's standing procedural contract is not a fourth cell
--   either: ReadObligations subtracts it before O_G exists, so the partition never has to place it. Λ.S is not a
--   fourth cell either, and for the same reason Λ.accepted is not: a reserved obligation stays in the unit it was
--   packed into, so the partition still places it there and coverage_complete still reads it off that unit —
--   what the reservation adds is a marking that the unit carries no predicate for it because a judgment settles
--   it, and Λ.S's one ReservedAcceptance member names no obligation at all, so the partition never sees it
-- The draft is not a Λ field and not a fourth cell: it is phase-local to one Phase 1 cycle, built over a COPY
--   of residual, and it moves no obligation — integrate is still the only step that takes one out of residual.
--   So the partition above never has to place a drafted cut, and no transition has to invalidate one. A cycle
--   that settles anything discards its draft and the next cycle re-drafts what is left; holding a draft in Λ
--   instead would buy saved analysis at the price of making Recut and Reopen hunt down the cuts they invalidated
-- Compile-time only: Λ exists from invocation to emission; nothing persists into the execution interval

── COMPOSITION ──
*: product — (D₁ × D₂) → (R₁ × R₂). Dimension resolution emergent via session context.
Two-way advisory with /conduct, neither direction a precondition, both guarded against reentry (Rule 9).
This protocol is never the owed resolver for a reserved item: a re-invocation would reproduce the same reservation,
since what settles it is by definition not a predicate this protocol could compile. It is routed to no resolver
either: the ground states what settles the item, not who or when, so there is no party for the record to name,
and naming one now would answer at compile time a question that belongs to the moment it comes live. What the
reservation carries forward is the question itself, in the shape the session that next takes the plan up can
recognize it in — the ground is what makes it recognizable there, and putting it to that session's own user is
that session's act, never a delegation this emission performs.

Core Principle

Apportion over Order: When an autonomous goal is stated but its plan is uncompiled — you know what the goal is, but not which units it runs in nor what each unit's done means — the act is to cut the units and condition them, not to sequence them. Sequencing those units — their order, independence, reconciliation, termination topology and routing — is not Merismos's work. The emitted plan is deliberately pre-conduct: it carries unit boundaries and conditions, and nothing that would make it a conducted method.

Whole Draft over Serial Cut: The apportionment is drafted to closure and shown to you whole before any single cut is settled. A cut judged alone is judged against neighbours that are not written yet, so accepting it settles less than it appears to — the cut that comes next can force it back open. The whole draft therefore carries a standing invitation to send any cut back, and taking that up there costs almost nothing, while the same objection raised once the conditions are compiled invalidates them.

Coverage over Convenience: Every goal obligation belongs to some unit, is visibly delegated out of scope, or is accepted as uncovered on record. Coverage is a hard invariant, not a quality target.

Fit over Ambition: Every unit fits one execution horizon, or carries an override the user recorded. An unjudgeable fit is surfaced as such; it is never quietly read as fitting.

Declared Seam over Asserted Joint: A cut cites the seam it sits on — a dependency edge, a deliverable boundary, a verification point, an ownership change, or another the goal evidences — or declares itself heuristic. Seam quality is a declared disposition rather than an invariant: the plan is honest about which cuts are grounded and which are judgment calls, and the user judges the heuristic ones with that fact visible.

Priority ordering: coverage > fit > autonomy > transparency > noise-minimization > speed > simplicity.

Substrate Boundary

Merismos operates within the epistemic substrate — its protocol scope covers obligation reading, apportionment search, horizon-fit and seam-quality judgment, condition derivation, and the compile-time gates. The Phase 1 and Phase 2 gates transmit user judgment into the apportionment and its conditions.

Everything past emission belongs to non-epistemic substrates. Enforcement of the emitted leaf predicates inside each execution interval is the downstream completion-predicate enforcer's contract; pre-action interception of the obligations declared out of scope (destructive command blocking, permission prompts, prompt-injection defense) is the harness permission system's contract; step-by-step approval, resumable state, and timeout/escalation belong to a workflow/HITL substrate. Concrete executor selection — which agent, model, runtime or tool token carries a unit — is likewise outside: units carry capability requirements and feasibility notes, never a binding. Merismos classifies and surfaces these boundary crossings, records the handoff, and stops — it neither discharges nor enforces external substrate semantics.

Mode Activation

Activation

User calls /apportion to declare autonomous execution intent for a goal whose unit plan and conditions are uncompiled.

Goal plan uncompiled = an autonomous run is intended for one stated goal — one outcome, not several bundled — but the goal is not yet carried by units whose completion is settled — a determinate completion predicate, a recorded acceptance, or a recorded reservation closing it.

Gate predicate:

goal_plan_uncompiled(G) ≡ autonomous_intent(G) ∧ single_goal(G) ∧ ¬condition_bearing(G)
  autonomous_intent(G)  ≡ an autonomous or long-running execution interval is intended for G (cue cited from context)
  single_goal(G)        ≡ G states ONE outcome, and every obligation read from it answers to that outcome. G is
                          COMPOSITE when it bundles several stated outcomes, and the test is what binds them: a
                          bond that is only the host's standing procedural contract (host_standing_contract, see
                          TYPES) is no bond at all, because that contract attaches to any work in that host and
                          therefore evidences nothing about a shared outcome — units cut across such a bundle
                          would share no seam but procedure. Cue cited from context, as autonomous_intent is.
                          This is a verdict about what G states; it judges no individual obligation
  condition_bearing(G)  ≡ ((G already carries units whose completion is settled — each closed by a determinate completion
                          predicate, by a recorded acceptance, OR by a recorded reservation, read back by DEREFERENCING a prior /apportion plan at its
                          navigation block, or supplied by the user as an explicit
                          unit-and-condition set) OR (G's obligations are ALL out-of-scope delegations, so it carries no units
                          by construction and there is nothing left to compile)).   -- A goal with units but no conditions, or conditions but
                          no units, is uncompiled: both halves are this protocol's product — except a plan whose
                          obligations are ALL out-of-scope delegations, which carries no units by construction
                          and is condition-bearing, so a re-invocation over it relays rather than re-emitting.
                          A reserved unit counts as settled here even though its completion is deliberately not
                          compiled — re-invoking this protocol over it would only reproduce the same reservation,
                          so it relays, per Rule 9 and the Composition section's reserved-item limit

Activation layer:

• Layer 1 (User-invocable): /apportion slash command or description-matching input. Always available.
• Layer 2: Not applicable (user-initiated — no AI-guided activation heuristics). The deficit exists only once an autonomous execution intention is in scope.

Priority

Supersedes: Default execution patterns that enter an autonomous interval without apportioned units and derived completion conditions

Retained: Safety boundaries, tool restrictions, user explicit instructions

Action: At Phase 1, draft the whole current residual and surface that draft entire — every cut with its obligations, its horizon-fit verdict, and its seam quality with citation or heuristic declaration — before settling anything, and say on that surface that any cut can be sent back. Then settle out of it: where every cut cites a seam the goal evidences, cuts the draft leaves uncontested are accepted as relay without a turn yield; where any cut is heuristic, or a cut does not fit or has a live alternative, the reader settles it via Cognitive Partnership Move (Constitution). At Phase 2, present the apportionment together with its derived conditions and invariant status, via Cognitive Partnership Move (Constitution).

• Merismos completes (emits the plan) before the autonomous interval begins
• Loaded instructions and other protocol behaviors are retained
• Merismos apportions and conditions; it does not order the units, and it does not drive the execution that follows

Trigger Signals

Heuristic signals for goal-plan-uncompiled detection (not hard gates):

Skip:

• No autonomous intent — the request is for an ordinary explanatory plan, not execution preparation
• The request bundles several stated outcomes whose only common bond is the procedure every change in the host follows — that procedure attaches to any work, so it is no shared goal; name the constituents and run one apportionment per goal
• The goal already carries units whose completion conditions are settled — closed by a determinate predicate, by a recorded acceptance, or by a recorded reservation (a prior /apportion plan covers this goal and the goal is unchanged)
• One self-evident leaf: the goal fits one execution horizon as a single unit and its done-criterion is already determinate

Cross-Session Enrichment

Repeated apportionment patterns and recurring failure modes accumulated in Anamnesis's hypomnesis store (prior-session recall indices), and any context surfaced when /recollect has been invoked this session, enrich Phase 1 seam scanning and Phase 2 condition derivation. This is a heuristic input; constitutive judgment remains with the user at the gates.

Revision threshold: When Emergent plan-condition scopes across 3+ sessions cluster around a recognizable pattern outside the named scopes, the plan-scope set warrants a new named member. Named scopes are working hypotheses, not exhaustive categories.

Mode Deactivation

Protocol

Phase 0: Uncompiled-Plan Checkpoint

Read the goal for autonomous intent, for whether it is one goal, and for whether it is already condition-bearing. Detection is silent on the uncompiled path; on any relay path, surface the scan result and deactivate without activating.

Singleness is read before anything else about the goal is used. A request that bundles several stated outcomes is not a goal to apportion, and the tell is what holds the parts together: when the only thing they have in common is the procedure every change in this host follows — bump the version, run the verifier, work on a branch, leave the merge to the human — they share nothing, because that procedure attaches to any work here. Cutting units across such a bundle produces units whose only common seam is that procedure, which is no seam. Relay instead: name each outcome the request bundles and the bond that made them read as one, and let the user run one apportionment per goal. The verdict is about the request; it says nothing about whether any single obligation could be turned into a predicate.

Scan, in priority order: prior protocol output in this session (a boundary map, or a conducted method's unresolved autonomous region, is the richest input), /apportion arguments, then conversation context. Cite the cue for autonomous intent. When the scan turns up a prior /apportion navigation block, dereference it at its locator — the one carrier record, read at the record identity within the session that locator names — and decide condition_bearing against the plan read back from that carrier, not against the goal's wording; a unit the record closes by recorded acceptance, or by a recorded reservation, is carried the same as one closed by a predicate. A locator that is present but will not dereference — unreachable, missing its session half, or a load-bearing premise the grounding pass cannot support — stops the protocol: surface that the canonical record is unreadable and deactivate. Only the absence of any block leaves the uncompiled path correct.

Phase 1: Apportionment

Read the goal's obligations, then draft the whole apportionment before settling any part of it. Each cycle cuts the current residual to closure, puts that draft in front of the reader entire, and settles out of what is now visible.

What the host requires of every change it accepts is not among those obligations. A version bump, a verification command, a branch-and-review path, a merge left to the human — these attach to any work in this host regardless of what the goal is, so they are not requirements this goal generated; they are standing conditions every unit inherits, and the host's own process is what holds them. Reading them in would give every goal in this host the same list and bury the one or two obligations the goal actually generated. Test each candidate by goal-independence: would this same requirement be read from any goal here? If yes — and the goal does not state it as its own outcome — it is not read in. This is not an out-of-scope delegation either: nothing is being handed to a substrate that must intercept before an action runs.

Drafting (steps 1–4) runs over a working copy of the residual and yields no turn. It moves nothing: an obligation leaves the residual only when a cut over it is settled.

1. Scan for seams over what is left of the working copy. A seam is a place the goal's own structure already divides: a dependency edge, a deliverable boundary, a verification point, an ownership change. Read-only; cite where each seam was observed.
2. Pack against the execution horizon into a proposed cut, and judge its fit — fits, overflows, or indeterminate. An unjudgeable fit is surfaced as indeterminate; it is never quietly recorded as fitting. Pack also reads the cut's capability requirements and feasibility notes from the goal's stated needs — a functional description of what the work needs, never a concrete executor, model, runtime, or tool token. Where more than one workable cut of the same region turns up, draw one — the draft carries a single cut per obligation. Whether the reading you set aside deserves the user's weighing is decided later, when the drawn cut is dispatched.
3. Qualify the cut. When it sits on a seam found in step 1, the cut is grounded and carries that citation. When the goal supplies no such evidence, the cut is heuristic — declared, not dressed up as a natural joint.
4. Repeat 1–3 until every obligation in the working copy sits in a completed cut. When seam evidence runs out before that, pack whatever is left at heuristic seams and declare it — including a final cut anchored on obligations no seam would place. Cutting the residual in one pass is not cutting it uniformly: each cut keeps the seam verdict its own evidence earned.
5. Surface the whole draft — every cut with its obligations, its fit verdict, and its seam quality with citation or heuristic declaration, and say plainly that any of these cuts can be sent back and how. Relay, before anything is settled. This is what the reader judges: a shape, with each cut's neighbours beside it, and a way to push back on it while pushing back is still cheap.
6. Settle out of the surfaced draft. First read the draft whole: if any cut is heuristic, the draft goes to the gate entire — that is where you guessed, and a guessed boundary makes its neighbours' boundaries guesses too. Otherwise the relay path opens, and within it a cut that fits and that no second reading contests is accepted as relay. Every cut that does not relay reaches the user one at a time via Cognitive Partnership Move (Constitution), carrying the draft's still-unsettled cuts with it — a cut is judgeable only beside what it was cut against.

Seam exhaustion is NOT one of the options and goes out as context: it happens inside drafting, with nobody having chosen it. Carrying that clause into an option line would attach an automatic trigger to a choice, which is the one thing an option line must not say — it would read as something the user is deciding.

What each option does follows here, and each reaches the user with its own option rather than staying behind as a note. The accept option is fit-complementary: on a cut that fits, the user simply accepts it; on one that overflows or cannot be judged, the only way in is an override recorded on that cut. The user may instead direct a recut of the same region — the next cycle drafts under that direction — or declare the apportionment sufficient, which accepts the fitting cuts of the draft just displayed, each keeping the seam disposition it was shown with — an option that stands while some still-unsettled cut of that draft fits, there being nothing left for it to accept once none does. A cut that does not fit comes back as the next proposal so the override stays the user's to record, and one that does fit is integrated through the same identity-assigning step as an accepted cut. What Sufficient settles is the draft the user saw; it never re-derives a remainder behind the answer.

The loop ends when every obligation is apportioned to a unit or visibly delegated out of scope.

Phase 2: Condition Derivation and Confirmation

For each unit, derive its conditions; for the goal as a whole, derive the conditions no single unit owns.

• Per-unit — a completion predicate (the unit achieved its result) and any invariant predicates (the run preserved a boundary while achieving it). Both kinds are verifiable predicates: executable checks with determinate pass/fail outcomes. A condition that is hard to express as a predicate but would be one if sharpened is not derivable yet — surface it as a residual for the user to sharpen or accept as uncovered. A unit with no completion predicate is not an executable interval; it closes as a predicate, as a recorded acceptance, or as a reservation, never silently.
• Reserved for judgment — a distinct finding from a residual, and the reason to separate them is that they assert opposite things. Some obligations cannot become a check at all, because what settles them is a decision. Their right answer varies with the context accumulated by the moment the question comes live and with what the person has actually said by then, so writing a predicate now would fix that answer in advance — and the fixing happens where the person whose judgment it is is not present. For such an item, staying open is the correct disposition, not a defect deferred. Reserve it: record what is held open and the ground that settles it, and surface that as relay text. A residual says the plan leaves an obligation unguarded and the user accepts that; a reservation says there was never a guard to write. Do not route one through the other — and do not route either out of scope, which is for something else entirely.
• Plan-level — conditions whose subject is the whole goal rather than any one unit: final integration, global non-regression, whole-goal acceptance. These stay plan-level and carry a plan-state requirement — a self-contained property of when the condition becomes safe to discharge, never a named unit or order-position: naming an order fact is outside this protocol's own scope. Do not distribute a global condition across every unit to make it fit the leaf type.
• Out of scope — an obligation whose violation must be caught before an action executes cannot be a stop-time predicate. Declare it out of scope as relay text with the delegated substrate named. This is only for an obligation something must intercept ahead of an action; an item held open to a judgment intercepts nothing and names no substrate, so it is never declared here.

Whole-goal acceptance check (before the confirmation gate): per-unit completion predicates make each interval determinate, but they do not say when the goal is accepted. When no plan-level acceptance condition exists, present that fact and its consequence as pre-gate text, then present via Cognitive Partnership Move (Constitution): define it now, hand its definition to /bound, reserve it as a criterion whose right answer is not fixable now, or proceed without one on record. This fires on entering the confirmation step, and again if an adjustment clears an acceptance criterion the user had already stated.

WHY a reserve option exists at all is analysis and goes out before the gate, with neither option: some acceptance criteria are constitutively open — what the goal's acceptance means is answered by the context accumulated by the time the goal is judged and by what the user has actually said by then, and no wording available now can stand in for that. Writing one anyway would convert a live question into a settled one, and it would settle it at a moment when the person whose answer it is has not been asked.

WHAT SEPARATES the last two options reaches the user with those two options, never as a note after the choice — they are not two ways of saying the same thing, and collapsing them is the mistake this gate exists to avoid. Proceeding without a criterion on record is a waiver: the plan should have carried one, it does not, and the user accepts that shortfall knowingly. Reserving is not a shortfall at all: the plan records the criterion as deliberately held open together with the ground that settles it, and the emitted plan reads that way rather than as a gap the run has to live with.

Then present the apportionment together with its conditions as pre-gate text — per unit: obligations covered, seam quality and citation, fit verdict, each derived predicate with its kind; per plan condition: scope, kind, and the plan-state requirement that makes it safe to discharge; each residual with its uncovered-obligation note; each reserved item with the ground that settles it; each out-of-scope obligation with its substrate; and the invariant status for coverage and fit — then present via Cognitive Partnership Move (Constitution): Confirm, Adjust the conditions over the same units, or Reopen a unit. Whether an item is a residual or a reservation is read by this protocol, not proved by it, so it is shown at this gate as what it is: an Adjust direction moves an item either way.

What each option does follows here, and each reaches the user with its own option. Confirm accepts the residuals on record and moves to emission when the hard invariants hold; when one does not, this gate is re-presented with the violated invariant named. An Adjust direction reshapes what each condition ASSERTS. When a whole-goal acceptance criterion becomes safe to discharge is a plan-state fact this protocol computes at Confirm, not a value the user authors, so a direction phrased as timing lands on the criterion rather than on its firing point.

Adjust rederives over the same apportionment and re-presents. Reopen returns exactly that unit's obligations to the residual and re-enters Phase 1. Both are bounded by user agency: Confirm terminates.

Phase 3: Emission and Handoff

On Confirm:

1. Emit one goal entry per unit via record — the unit's identity, subject and obligations, plus one unit-resolution certificate. When it carries a compiled completion condition, the determinate certificate holds the conjoined predicate and every typed conjunct; when it does not but carries an accepted completion residual, the accepted-uncovered certificate holds that non-empty witness and any compiled invariant conjuncts; when it carries neither, the reserved-judgment certificate holds its non-empty reserved-completion witness and any compiled invariant conjuncts, which says the unit's done is held open to a judgment. The interval still runs unguarded on that obligation, exactly as an accepted-uncovered one does — nothing here guards it and no step of this protocol makes anyone judge it. What differs is that nobody has accepted the gap: the question travels in the emitted plan and is put at the next session's grounding pass. Carry the unit's capability requirements and feasibility notes verbatim. One unit is one execution interval is one entry; plan-level conditions are emitted as their own entries carrying the already-checked plan-state requirement under which each becomes safe to discharge.
2. Package the result: carry over E's own unit and plan-condition entries as the plan's units and plan conditions, and fold in every qualifying fact Λ already holds — each accepted-uncovered residual keyed to its owning unit, each reservation with its ground, the out-of-scope declarations, and the unbounded-acceptance waiver — as fields on the returned plan itself, not only as trace text. The reservation set and the waiver flag are separate fields on purpose: a reader of the returned plan alone can tell a whole-goal acceptance criterion that was waived from one that was correctly left open.
3. Park the plan and emit the handoff navigation block: first write the packaged plan into ONE new carrier record so a single dereference reconstructs it, then emit purpose/frame, that carrier's canonical locator, the dereference instruction, a snapshot anchor only when exact-state determinacy is needed, and the grounding instruction to run /inquire where available (or equivalent grounding), stop on an unreachable source or unsupported load-bearing premise, and — when the plan carries reservations — surface each as an open question with the ground that settles it, worded to invite an answer rather than to suggest one. A reservation is not itself a stop: whether one blocks the work at hand is the reading session's judgment, not something this block declares, and an open item that blocks nothing need not halt anything. The block is a pointer to the carrier, never a re-authored plan; the per-unit entries stay where the enforcer reads them.
4. Present the apportionment trace, then deactivate: the plan readback, then per unit its covered obligations, seam quality, fit verdict, unit-resolution certificate (determinate predicate, accepted-completion witness, or reserved-completion witness) with each conjunct's kind, its capability requirements and feasibility notes, and the disposition that settled it; the plan-level conditions; each accepted-uncovered residual; each reserved item with the ground that settles it; each out-of-scope obligation with its substrate; and either the recorded acceptance waiver or the recorded acceptance reservation, named as what it is. The handoff witness is established before the trace describes it, as FLOW, PHASE TRANSITIONS and TOOL GROUNDING all order it.

Emission is Merismos's epistemic endpoint. Merismos does not invoke the downstream enforcer, and it does not order the units — the user activates the enforcer separately, and /conduct arranges the units if their arrangement is non-trivial. Nothing of Merismos survives into the execution interval.

Composition

Merismos is the apportion-and-condition step ahead of an autonomous run. The composition, in prose with standard notation:

• Two-way with /conduct, guarded: a multi-unit plan flows from /apportion into /conduct as its work prospect when the units' order, independence, reconciliation, termination topology or routing is non-trivial — as a navigation block over the parked plan record, never as a copy of the plan. In the other direction, a /conduct activation that reaches an unresolved autonomous region hands that region to /apportion for apportionment and conditioning. Both edges are advisory, never preconditions, and both carry the no-reentry guard of Rule 9.
• /bound upstream: a boundary map narrows both halves — which seams are candidate cuts, and which conditions the units are subject to. Advisory: absence narrows the read, it does not block apportionment.
• The enforcer is a leaf executor: on Claude Code, /goal installs a session-scoped stop-hook that re-prompts the model until its condition is met. It enforces a completion predicate inside one bounded interval; it exposes no external step injection and no mid-loop gating. The enforcer consumes a leaf, not a workflow; the workflow role belongs to /conduct and, for step-approval/resume/timeout semantics, to a workflow/HITL substrate outside this protocol suite.
• Separate activation: emitting the plan is /apportion's epistemic endpoint. The user invokes the enforcer separately, so the constitutive act of starting the autonomous interval stays with the user.
• Executor binding is outside: units carry capability requirements and feasibility notes, never a concrete executor, model, runtime or tool token. Which substrate realizes a unit is bound at the consuming runtime's seam, not inside the plan.
• After the interval: /contextualize checks post-execution applicability and /grasp verifies understanding of the result, both downstream of the enforced run.

Known Limitations

Bounded platform claim: The leaf-executor characterization of /goal (stop-hook predicate enforcer, no external step injection) is verified against Claude Code v2.1.140 only. A harness version change requires re-verification before relying on the composition guidance above.

Singleness is read, not proved: Whether a request states one outcome or bundles several is a judgment made from the request and its context, the same kind of read as autonomous intent. The shared-procedure test catches the case that motivated the check — parts held together by nothing but the host's standing contract — but a bundle whose parts share a plausible-sounding subject matter can still pass, and a single goal with unusually varied obligations can still be misread as a bundle. The relay names its constituents and its bond precisely so a wrong verdict is visible and the user can restate the goal and re-invoke.

Obligation reading is heuristic: The goal's obligations are read from its utterance, prior protocol output, and session context. The host's standing procedural contract is subtracted by the same heuristic read: goal-independence is judged from what the host's own instruction surface attaches to every change, so a host that states no such contract yields no subtraction, and a requirement wrongly judged goal-independent goes unread — visible at the confirmation gate as an absent obligation, corrected by restating it and re-invoking. An obligation the user holds but never uttered, and that no upstream protocol captured, will not be read — and therefore will not be covered, even though coverage is a hard invariant over what was read. The Phase 2 gate is where such an omission becomes visible: the apportionment is presented with its covered obligations precisely so a missing one shows up as absent. Recognizing it there does not correct it in place — O_G is fixed on the Phase 0 → Phase 1 edge and no Phase 2 judgment writes to it (Adjust rewrites conditions over the same units; Reopen returns an existing unit's obligations). The correction is to state the missing obligation and re-invoke, so ReadObligations reads it into a fresh pass. One /conduct-origin case has no formal reader and needs none: a TerminationGround recorded as resolution_required(/apportion) names this protocol as the owed resolver for a WHOLE region rather than one unit's obligations, and it travels as an ordinary navigation handoff — the locator naming both the record and the session that emitted it, plus the grounding instruction to run /inquire. Re-invoking this protocol on that already-condition-bearing plan relays (Rule 12); the region's discharge happens in the session that takes the handoff up.

Seam evidence is often absent: An abstract goal frequently supplies no dependency, deliverable, verification or ownership seam. Those cuts are declared heuristic rather than certified, and the resulting units may carry duplicated setup, cross-unit state leakage, or awkward predicates. The declaration makes the risk visible; it does not remove it.

Horizon fit is an estimate: Whether a unit's work completes within one execution horizon is judged before the run, from the goal's description. An unjudgeable fit is surfaced rather than guessed, but a fitting verdict can still be wrong — hence the override path.

Predicate coverage: Subjective quality bars and moving targets do not derive into verifiable predicates. Where sharpening could still produce one, Merismos surfaces them as residuals rather than emitting prose conditions; an uncovered residual the user accepts remains genuinely unguarded during the interval. Where no sharpening could — because what settles the item is a judgment and not a check — it is reserved instead (Rule 28); routing such an item to a residual would file a correct disposition as an accepted shortfall.

Reservation is a read, not a proof: Whether an item is settled by a judgment rather than by a check is a judgment itself, made at the step that reaches the item — the same kind of read as horizon fit or seam quality. Two errors are possible in opposite directions and neither is caught structurally. An obligation reserved when a predicate was in fact available loses a guard the run could have had; a decision compiled into a predicate anyway fixes an answer in advance that should have stayed open, which is the failure the slot exists to prevent and the harder one to see afterwards, since the emitted plan then looks complete. The confirmation gate shows every reservation beside every residual with its ground, precisely so a wrong verdict is visible and an Adjust direction can move the item; nothing downstream re-checks it. The reservation also does not carry itself out: it names the ground that settles the item, not a moment or a person, so a plan can converge with a reservation that no later session ever takes up. What the record does buy is recognizability: the question and its ground travel in the emitted plan, so a later session's user meets the uncertainty as something to answer rather than something to remember — eliciting it into utterance there is the point, and nothing here schedules that moment or nominates who arrives at it.

Granularity is not re-cut: A work body that already carries units whose completion is settled — closed by a determinate predicate, by a recorded acceptance, or by a recorded reservation — is condition_bearing, so this protocol relays and deactivates — even when those units are at an unsuitable granularity. Re-cutting an existing unit set is deliberately out of scope: this protocol cuts at the coarse framing units an autonomous run is carried out in, and finer task-level subdivision carries no meaning at the enforcer's leaf. A plan whose units are wrongly sized is corrected by restating the goal and recompiling, not by a granularity pass. Re-cutting an existing external work-breakdown structure is not covered by any protocol here, by decision rather than by oversight.

No execution-time protection: Merismos is compile-time only. A risk that emerges mid-interval — one not present in the goal's obligations at compile time — is outside the emitted conditions; pre-action risks are entirely the harness substrate's responsibility.

Rules

1. User-initiated, AI-apportioned: User declares autonomous execution intent via /apportion; AI reads the obligations, drafts the whole apportionment, and derives the conditions; the user settles what the draft leaves contested at Phase 1, and the conditioned plan at Phase 2, via Cognitive Partnership Move (Constitution). The draft goes out whole before any cut is settled (Rule 31), and settling then runs off that visible whole. Whether it relays at all is read over the whole draft: every cut citing a seam the goal evidences opens the relay path, one heuristic cut sends the draft to the gate entire. Inside an open relay path a cut no second reading contests relays as Extension — both readings are Rule 17's, taken in that order — a cut whose region a second reading could claim as well — or one whose fit it cannot meet — reaches the gate, and Sufficient accepts the fitting remainder of the draft the user was shown. Every cut relayed either way is surfaced with its seam disposition — the citation where the goal's evidence grounded it, the heuristic declaration where it did not.
2. Apportion, do not order: Apportion over Order (MORPHISM) holds it; this fixes its extent. Order, independence, reconciliation, termination topology and routing are outside this protocol's own scope, so the emitted artifact is pre-conduct by construction.
3. Coverage is a hard invariant: Coverage over Convenience (MORPHISM) holds it; this fixes what narrows the input and how a shortfall is handled. What counts as read from the goal is narrowed by Rule 26. A plan that leaves an obligation silently unowned is not emitted — the gap is surfaced at the confirmation gate for the user to close by reopening a unit and recutting, or by accepting it as an uncovered residual. Out-of-scope delegation is not a gate move: that partition is computed once by the velocity filter before packing begins, and the gate presents it as relay rather than reopening it. A goal from which nothing could be read at all (no unit, no delegation) does not emit an empty plan — it relays instead.
4. Fit is a hard invariant with an override path: Fit over Ambition (MORPHISM) holds it; this fixes whose act the override is and how the gate enforces the pair. The override is the user's own, recorded on that unit. An unjudgeable fit surfaces as indeterminate at the gate; it is never quietly read as fitting, and an overflowing unit is never committed without the recorded override. The gate enforces this by offering the accept options fit-complementarily — plain acceptance only on a fitting unit, the recorded override as the only way an unfitting one enters — and neither the autonomous packing pass nor a confirmation may carry an unfitting unit past it.
5. Seam quality is declared, not asserted: Declared Seam over Asserted Joint (MORPHISM) holds it, and holds the DECLARATION rather than the quality declared. This fixes what the scan searches for: a dependency, deliverable, verification or ownership seam — four kinds it looks for rather than the only admissible ones, so another seam the goal actually evidences qualifies the same way. Which quality a cut ends up carrying is a disposition, not something the invariant can require: an abstract goal may carry no evidenced joint at all, and claiming one anyway would be false precision.
6. The join rule — one unit, one interval, one resolution certificate: A unit's completion and invariant predicates are conjoined into a single leaf predicate and emitted in one certificate. The certificate retains each conjunct's kind so provenance stays readable. A compiled completion predicate selects DeterminateResolution; without one, an accepted completion residual selects AcceptedUncoveredResolution, which carries that non-empty witness plus any compiled invariant conjuncts; without either, a reserved completion obligation selects ReservedJudgmentResolution, which carries that non-empty witness plus any compiled invariant conjuncts. The three arms are tried in that order and are exhaustive over the units the convergence predicate admits, so every emitted unit has exactly one defined certificate. The third is not a variant of the second, and the difference is not that one interval is guarded and the other is not — both run unguarded on the obligation in question. The second says the user accepted that gap; the third says nobody has been asked yet, so the question is carried in the plan for a later session to put.
7. Plan conditions stay plan-level: A condition whose subject is the whole goal carries a plan-state requirement — a topology-free property of when it becomes safe to discharge, never a named unit or order-position — that axis is outside this protocol's own scope. It is never distributed across every unit to fit the leaf type.
8. Separate activation: Emitting the plan is the epistemic endpoint. Merismos does not invoke the downstream enforcer; starting the autonomous interval is the user's separate constitutive act.
9. No-reentry across the /conduct seam: Both directions of the /conduct edge are advisory, never preconditions, and both are guarded. What crosses into /conduct is a navigation block over the plan record this protocol parked — a pointer, so the plan's contents stay in that record rather than being copied across the seam. None of it routes back to /apportion. An already-conducted autonomous region consumed by /apportion has fixed topology and is not re-conducted. A single unit, or a unit set whose order, independence, reconciliation, termination and routing are all trivial, bypasses /conduct.
10. Verifiable predicate or witnessed disposition required: Every emitted unit resolution is a DeterminateResolution carrying an executable check with a determinate pass/fail outcome, an AcceptedUncoveredResolution carrying a non-empty accepted-completion witness, or a ReservedJudgmentResolution carrying a non-empty reserved-completion witness — its members are the reserved obligations themselves, and the ground that settles each is carried beside them in the emitted plan's reservation set keyed by unit, not inside the certificate, because the certificate feeds a leaf that evaluates predicates and can ask no one — never a vacuous always-true check and never an unwitnessed tag. Every emitted plan condition is an executable check with a determinate pass/fail outcome. A condition that would be a predicate if sharpened is surfaced as a residual — sharpened or accepted as uncovered — and is never emitted as prose; a condition that could never be a predicate because a judgment settles it is reserved rather than dressed up as one.
11. Stop-time only: Only conditions evaluable when an interval stops are derived. An obligation requiring pre-action interception is declared out of scope with its delegated substrate named; deriving it into a stop-time leaf simulates protection while providing none. An obligation settled by a judgment rather than by any check is likewise not derived into a stop-time leaf — it is reserved (Rule 28), and it is not routed through the out-of-scope declaration either, which stays for exactly what must be intercepted ahead of an action.
12. Stateless compile, but never blind: Emission is terminal. No session approvals, no per-action classification, no mid-execution checkpoint; a re-invocation carries no invocation-local state forward and recompiles rather than resuming. A prior plan reached through its navigation block is already condition-bearing and relays; a locator that is present but will not dereference — unreachable, missing its session half, or a load-bearing premise the grounding pass cannot support — stops the protocol instead of falling through to the uncompiled path.
13. Transparency-grounded: Every obligation cites its evidence; every seam quality, fit verdict, residual disposition, override, out-of-scope delegation and settlement disposition is visible in pre-gate text or the apportionment trace — surfaced and relay paths satisfy the same transparency invariant.
14. Recognition over Recall: Present structured options with differential implications via Cognitive Partnership Move (Constitution); Constitution interactions yield turn before proceeding.
15. Round composition: Compose each round so the reader can act on it without reassembling it — everyday language rather than this file's formal vocabulary, the judgment set beside the evidence it rests on together with the differential implication that matters for the next move, and analytical context laid out before a gate rather than inside it. Read references/round-composition.md before composing when a term's rendering has to hold across the session or wording has to be carried through unchanged, when some of what is in view belongs to a later round or a trace rather than this one, or when this protocol's own phases bear on where a sentence sits relative to a gate.
16. Convergence evidence: Present the apportionment trace before deactivating — the plan readback plus per-unit evidence (obligations covered, seam quality with its citation or heuristic declaration, fit verdict or recorded override, unit-resolution certificate with conjunct kinds, capability requirements and feasibility notes, and the disposition that settled the unit), the plan-level conditions, each accepted-uncovered residual, each reservation with the ground that settles it, and each out-of-scope delegation — required, not asserted. The units, plan conditions, accepted-uncovered residuals, reservations, out-of-scope delegations, and any acceptance waiver are additionally carried as fields on the emitted plan itself, in exact correspondence with what was emitted; the reservations and the waiver flag stay separate fields so the plan alone answers which of the two closed the acceptance question. Park the packaged plan in its own carrier record and emit the fixed-shape navigation block beside the trace, so a later session dereferences that one carrier to get the whole plan; its locator names both that record and the session that owns it, and no locator remains solely in invocation-local state.
17. Option-set relay test (Extension classification): When AI analysis converges to a single dominant option (option-level entropy → 0), present the finding directly as Extension rather than wrapping it in a false choice. Whole-draft settling makes the surfaced draft what this test weighs first, a cut in isolation second. The relay path opens where every cut cites a seam the goal evidences — the reader can check a citation against the surface and has nothing to check a guess against — and one heuristic cut leaves the draft entire to the gate, since a boundary drawn without evidence makes its neighbours' boundaries arbitrary too. Inside an open relay path the test runs per cut: one that fits its horizon and whose region no second apportionment would claim as well is accepted as relay. An evidenced draft waives neither reading, because citing a seam is a floor and not a ranking — several cuts can each cite a real and different seam, and that the draft drew one settles nothing about the rest. Each Constitution option must be genuinely viable under different user value weightings; options sharing a downstream trajectory collapse to one; options lacking an on-axis trajectory surface as free-response pathways rather than peer options.
18. Gate integrity (Safeguard tier): The defined option set is presented intact — option injection, deletion, and substitution each violate this invariant. Type-preserving materialization (specializing a generic option into a concrete unit or condition while preserving the coproduct structure) is distinct from mutation.
19. Substrate boundary: Merismos scope is the epistemic substrate — obligation reading, apportionment search, fit and seam judgment, condition derivation, compile-time confirmation. Enforcement inside each interval, pre-action interception, workflow/HITL semantics, and concrete executor binding belong to native harnesses or specialized substrates, delegated by handoff at emission.
20. Formal blocks are runtime-normative: This protocol's formal blocks — those defined in its Definition code block above — are LLM-facing and constitutive of protocol identity: they type the prose and carry the operational contract executed at runtime. A reduced or single-shot realization carries every one of them through as runtime contract, since each block is the type that constitutes the protocol — preserving the blocks keeps the protocol intact. How its symbols render to the user is a separate emit-layer concern (see Round composition).
21. Seam relay on declared continuation, enforcer edge excepted: this protocol's seam splits into two, each scoped to its own lifecycle point. INBOUND activation seam (before this protocol activates): when a user-declared chain names /apportion next, or an invocation follows the ## Composition chain's declared /bound → /apportion or /conduct → /apportion edge, the transition into /apportion is relay (Extension) — proceed directly, citing the settling source. OUTBOUND emission seam (after this protocol emits): the /apportion → enforcer edge is EXCLUDED — Rule 8 (Separate activation) governs it more specifically; the /apportion → /conduct edge relays only under a user-declared chain naming /conduct next, and carries Rule 9's no-reentry guard. Both seams govern only the transition BETWEEN protocols; every Constitution gate inside this protocol and the next fires unchanged.
22. Whole-goal acceptance before an unaccepted plan: A plan whose conditions carry no whole-goal acceptance criterion fires one conditional confirmation before the confirmation gate — define it now, route its definition to /bound, reserve it as constitutively open, or proceed without one on record. The answer is recorded state, never an inference. Per-unit completion predicates do not satisfy this: they make each interval determinate without saying when the goal itself is accepted. Neither does a whole-goal invariant — right scope, wrong kind: it names a boundary the run preserves, not the point at which the goal is accepted, so only a completion-kind whole-goal condition closes this gate. Every DefineNow retracts BOTH a stale ApproveUnbounded waiver and a stale acceptance reservation still on record — not only when reached through Adjust, but on ANY firing of this gate, since neither of those two writes to the plan conditions and a Reopen can leave acceptance_present(P) false and let this gate fire again later. A plan never emits a real acceptance condition alongside a stale waiver or a stale reservation. The two no-criterion arms also retract each other — answering ReserveJudgment clears a standing waiver and answering ApproveUnbounded clears a standing reservation — so a plan can never emit both, whichever order the arms were answered in.
23. Back-edge state preservation: Reopen is the one path back into the apportionment loop from Phase 2. Only the reopened unit's own state resets — its obligations return to residual, its compiled conditions, residuals and reservations leave K/R/S with it, and its fit-override record (if any) leaves Λ.fit_overrides with it too: a fresh repack of its returned obligations gets a fresh UnitRef and, if it again fails to fit, needs its own OverrideFit recorded anew. Every other unit's already-derived conditions and reservations, any whole-goal plan conditions already derived or user-adjusted, and the whole-goal acceptance reservation (which is unit-free and so belongs to no reopened unit), are carried forward UNCHANGED — never silently re-derived: residual is never re-seeded from the goal's full obligation set (that seeding is a one-time action on the Phase 0 → Phase 1 edge, never repeated), and Derive/DerivePlan never re-run over content a prior Phase 2 pass or a user's Adjust already produced. Reopen also marks the whole-goal conditions stale for surfacing (Λ.plan_conditions_stale), because the unit set they were derived or adjusted against just changed under them — the next confirmation gate surfaces that as a notice, and the user's own next Adjust clears it. The Phase 1 cycle Reopen lands in drafts residual exactly as Reopen left it — that unit's returned obligations and nothing else — so the re-draft is scoped by what is in residual rather than by a separate guard. Re-drafting the goal's full obligation set instead would re-cut units this rule just preserved and invalidate the K/R/S/P carried forward with them; guarding drafting off entirely would leave a non-empty residual with no step able to cut it, and the loop could neither progress nor return to Phase 2.
24. The host's standing contract is not a goal obligation: A requirement the host attaches to every change it accepts regardless of the goal — its version and manifest discipline, its verification command, its branch/worktree/review path, its merge authority — is goal-independent and is subtracted when the obligations are read, before O_G exists. It is not delegated out of scope either: an out-of-scope declaration names a substrate that must intercept before an action runs, whereas this binds every emitted unit alike and the host's own process already enforces it. Reading it in makes every goal in that host yield the same inflated set, with the obligation the goal actually generated buried among them. The test is goal-independence — would the same requirement be read from any goal here — and a requirement the goal itself states as its outcome fails that test and stays a goal obligation.
25. One goal per apportionment: Activation requires that the goal state one outcome. A request bundling several stated outcomes relays at the activation checkpoint — each constituent named, together with what made them read as one — and the user runs one apportionment per goal. The test is what binds the parts: sharing the host's standing procedural contract is no bond, since that contract attaches to any work there, so units cut across such a bundle would share no seam but procedure, and procedure is not a seam. The verdict is about what the goal states; it judges no individual obligation.
26. An item only judgment can settle is reserved, not compiled and not delegated: Some items cannot become an executable check at all, because what settles them is a decision. Their right answer varies with the context accumulated by the moment the question comes live and with what the person has actually said by then, so fixing an answer now would close a live question at a moment when that person is not present. For such an item, staying open is the CORRECT disposition, not a deferred defect, and the protocol records it as a reservation carrying the ground that settles it — never as a residual, which asserts the plan leaves an obligation unguarded and the user accepts that, and never as an out-of-scope delegation, which names a substrate that must intercept before an action runs and hands the obligation to it. A reservation hands nothing anywhere and names no substrate, so the out-of-scope declaration keeps exactly the meaning it had and never widens to hold one. The judgment is made at the step that reaches the item — condition derivation for a unit obligation, the whole-goal acceptance gate for the acceptance criterion — over candidates arriving like any other, so it is fallible; it is surfaced as relay and shown again at the confirmation gate, where an adjustment can move an item either way.
27. A reserved acceptance criterion is not a waiver: The two ways a plan reaches emission without a defined whole-goal acceptance criterion assert opposite things and are recorded in different state. Proceeding unbounded is a waiver: the plan should have carried a criterion, it does not, and the user accepts that shortfall. Reserving asserts the criterion is constitutively open — what acceptance means here is answered by accumulated context and the user's own utterance at the moment the goal is judged, so no wording available now can stand in for it, and defining one anyway would settle a live question in the user's absence. Exactly one of the two may stand at emission, neither is inferred from the other, and both are retracted the moment a real acceptance criterion is defined; additionally, answering either no-criterion arm retracts the other's record, so the exclusivity is maintained by the transitions themselves rather than only asserted at convergence. The emitted plan carries them as separate fields precisely so the converged result alone answers which one closed the question — filing a reserved criterion as a waiver would report a gap where none exists.
28. Form feedback: Silence about form is not evidence about form. Too dense fails quietly — the reader skims, answers past it, stops — while too plain fails out loud, so the complaints that arrive come from one side only. Density therefore does not carry over from the previous round: each round takes it from what this request asked for, while a statement about form does carry over until it is countermanded. Read an instruction about form for the parts of a round it reaches, not for what kind of reaction it is — a complaint, a request, a symptom report and a bare preference are one input here, and sorting them by kind yields nothing the reach reading does not already give while costing a clause per kind. Change the form rather than asking which form they want; naming one is the recall this discipline exists to remove. What such an instruction reaches is whatever the active protocol leaves open in how a round is composed — its density, its ordering, its length. What it does not reach is whatever is already fixed for this round elsewhere: content the protocol requires, wording carried verbatim, an order it presents in, a cadence it caps, a turn boundary it sets. Those stay in place, and the layer that fixed them is what states why. Say in one line what changed; where the instruction overlapped something that stays, say in one line that it stays and why — that second line is owed by the overlap, not by how the instruction was worded.
29. The draft goes out whole before any cut is settled: Whole Draft over Serial Cut (MORPHISM) holds it; this fixes what the whole carries and what it is. Phase 1 drafts the entire current residual to closure and surfaces that draft before the first cut is relayed or gated. The draft is ONE apportionment, not a menu: it carries one cut per obligation, and where a region admits a second workable cut it draws one and leaves the other unrecorded — two cuts claiming the same obligation would be a defect in the draft, and would break the very bound that makes drafting terminate. Whether that second reading deserves the user's weighing is judged at the moment the drawn cut is dispatched, over the goal's evidence and the context accumulated by then. Drafting at once is not drafting uniformly: each cut carries its own seam verdict, grounded where the goal's evidence reaches it and declared heuristic where it does not, and only what no evidence reaches falls to the heuristic fallback inside drafting. And the surfaced draft carries one thing beyond its cuts: the standing affordance to send any of them back. A partition's alternatives cannot be listed the way an axis's named values can, so what keeps a cut from reaching the reader looking settled is not an enumeration of rival cuts but this affordance travelling beside it — enumerate what is closed, carry an affordance for what is open. Naming it on the draft surface rather than leaving it to be discovered at a later gate is what keeps the correction cheap: nothing is derived yet here, while the same correction taken at the confirmation gate invalidates compiled conditions and marks the plan-level ones stale. Settling stays incremental — what goes out whole is the shape, not a single accept-everything move. Sufficient therefore accepts the fitting remainder of the draft actually displayed, never one re-derived after the answer, since a re-derivation would substitute cuts the reader never saw for the cuts the reader judged.