= The CRDT vision: a foundation where the traps do not compile
:toc: macro
:toclevels: 2
Written 2026-07-06 (S111), while absorbing the exploration epoch (S97 to
S110), and updated the same day as its implementation round (S112 to S118)
landed the witness ledger and the first four arcs below; the scheduled
order-of-magnitude re-measure ran 2026-07-07 (S181), and the arcs have been
amended slice-by-slice as they fired since (arc 5's snapshot half S197, arc 9
S183/S200, arc 10 S191, arc 11's five phases S194 to S202; through
2026-07-10). Of the epoch's deliberately thin record, only the S97-S126
archive entries remain as owner-held debt; statuses and the horizons axes
have been paid slice-by-slice since. This document is the forward charter
that epoch earned:
what minerva is now aimed at, which avenues carry *measured* firing signals
rather than taste, and the standard a new surface must meet to enter. It is a companion to
xref:horizons.adoc[horizons] (which owns the avenue-by-avenue map and its
intake discipline) and to xref:target_arch/index.adoc[the target
architecture] (which owns what must not change). Where those documents and
this one disagree, they win; this one is the aim, not the law.
toc::[]
== What minerva has become
Through S96 the crate was a causal-ordering library: stamp, vector, buffer,
producer, watermark, have-set. The exploration epoch composed those into a
CRDT foundation, and the composition is the point. One kernel (`Dotted<S>`
over the open `DotStore` axis, xref:prd/0015-metis-causal-store-algebra.adoc[PRD
0015]) carries the survivor law once, and everything else is an instance or a
read: `DotSet` is presence, `DotMap<K, S>` is composition, `DotFun<V>` is
payload, `Rhapsody` is sequence (xref:prd/0017-metis-rhapsody-sequence-store.adoc[PRD
0017], with `condense` as the claims-gated GC), `Composer` is the write facade
that mints dots and frames deltas, and `Purview` is the gossip targeting read
(what each peer is owed, from evidence of what each peer has). The proof that
the composition is real and not a brochure lives in the test suite: the S110
studio, a complete three-replica collaborative editor assembled from the
shipped surface alone, instrumented, whose measurements are the signals this
document schedules against.
Two movements have landed since this section was written, both through the
gates it set, and they are the trajectory in miniature. First, the
foundation grew *structure*: the structured-document stages of
xref:prd/0019-metis-structured-document-horizon.adoc[PRD 0019], each
through its own gate (the `Node` kind closure fired by stage A's recorded
probe evidence; the `Scholia` mark store and the `Metatheses` move machine
each fired by the named consumer's filed ask or field-pinned defect),
ending in the maintained collation (PRD 0022 R7, rulings R-30 to R-32),
with the snapshot codec (arc 5's half, PRD 0023) shipping beside them on
the recorded bootstrap numbers. Second, *the representation went honest at
scale*: the substructure program (arcs 10 and 11 below, S191 to S202)
re-realized every derived plane as a cost shell under one law per shell
(exact agreement with its contract form), the identity plane speaking the
snapshot wire's own maximal chain-run factoring and the other planes
coalescing on the same honest-traffic runs, taking the whole ordering
state to roughly 6 bytes per character at 65k chars (about 393 KiB where
the S194 plane alone had stood at 68 bytes per character); the collation's
residuals were then cured in the same spirit (S203 to S205: the region
splice making replay fragment-priced, the paged possession pass making the
visibility comparison page-priced, with the linear surviving-testimony
record scan the residual PRD 0022 still records)
(xref:metis-shell-discipline.adoc[the shell-discipline note] owns the
pattern and its table). The why, unchanged from the day this was written:
every firing was a measurement or a consumer's recorded need, never taste,
and the two extended thesis sentences held through all of it (the machine
never chose, and each hazard the movements met became a type, a witness, or
a typed refusal rather than a discipline).
== The thesis, extended one sentence
The standing thesis is *the machine never chooses*. The epoch earned a second
sentence: *the hazard becomes a type*. Distributed-systems folklore is a
catalogue of disciplines ("never report a high-water as a cut", "never act
globally on a restricted comparison", "never claim stability you only
observed locally"), and a discipline is exactly the thing that fails at 3 a.m.
in someone else's deployment. The epoch's pattern is to retire disciplines by
construction:
* A liveness high-water and a gap-free cut are the same vector at every
boundary; PRD 0011 R8 could only *state* the difference. `Cut` now
constructs it: its only constructors are the provably gap-free reads
(`Cut::floor_of`, `Cut::delivered_by`, `Cut::common_of`, closed under
`meet`/`merge`/`restrict`), and a network-decoded vector has no path in.
The refusal is itself tested: a `compile_fail` doctest is the crate's
witness that the wrong program is not writable.
* Comparing restrictions and acting on the verdict globally (the PRD 0013
created-order hazard) was a documented one-way-witness discipline. Branded
scopes (`with_scope`, `Scoped<'brand, T>`) make the cross-scope comparison
fail to unify at compile time; the one verdict that lawfully travels
(concurrency reflects globally) is the one method returning unbranded, and
the escape hatch is named `forget` so the diff says what it does.
* `Rhapsody::condense` takes the caller's stability claim, but the mechanism
refuses the harms the claim cannot license: sterility, the visible-dot
contradiction, gossip-cycle idempotence, with the over-claim's stranded
anchors pinned by a test that demonstrates the harm.
The vision, stated plainly: *a local-first foundation where every classical
CRDT and anti-entropy trap is either a typed refusal, a witness type, or a
compile error, and where each such guarantee is legible in one place*. The
witness ledger below is that place's seed. Nothing in this extends the
machine's authority; a witness never chooses, it only refuses to launder.
== The witness ledger
The traps the type system already closes, and the ones it should. A future
session adding a witness appends a row; a session tempted to guard a new
hazard with prose reads this table first and asks whether a constructor
could own it instead.
[cols="3,2,3",options="header"]
|===
| Hazard (the folklore rule) | Status | Guardian
| A high-water reported as a cut | closed (S108) | `Cut`: gap-free reads are
the only constructors; decode cannot mint one
| Restriction verdicts acted on globally | closed (S109) | `Scoped<'brand>`:
cross-brand comparison does not compile; `forget` is the audited exit
| Condense over-claim reaching the mechanism's own invariants | closed
(S107) | `condense` refusals: sterility, visible-dot, idempotence; the
residual harm (stranded anchors) is the claim's documented price
| A minted dot re-derived instead of received (the doomed-dot footgun) |
closed (S112) | `Composer::compose` returns its minted dot; the payload can
only be keyed under the dot the merged state carries, so the re-derivation
is gone
| An over-claimed `Purview` row silently under-shipping | closed (S112) |
`Received`: rows rise only from a context the replica provably received,
minted by `Composer::absorb`, carrying its sender so peer misattribution is
also unrepresentable; `Received::trust` is the audited escape
| A decoded vector embedded as gap-free (`DotSet::from_cut` takes a bare
vector) | closed (S113) | `DotSet::from_witnessed(&Cut)` is the public
embedding; the bare-vector `from_cut` dropped to `pub(crate)`, unreachable
from a decode path
| A condense claim built by hand from a global oracle scan | closed (S115) |
`Retired` / `Retirement`: the removal dual of `Stability`; `condense` takes
the witness, so a bare `DotSet` no longer compiles; `Retired::trust` is the
audited escape for a caller-gathered oracle claim
| Concurrent backward runs interleave character-by-character (the RGA
anomaly, reproduced under honest ranks, not just adversarial ones) | closed
(S127) | `Anchor::Before` (xref:prd/0018-metis-rhapsody-sided-anchor.adoc[PRD
0018]): the sided anchor gives insert-before the same subtree isolation
insert-after had, so grouping is structural; before-the-origin is
unrepresentable; the FugueMax corner is the recorded residual (R6)
| A last-writer-wins kind silently discarding a concurrently edited subtree
(and its window twin: a kind reassignment spread over deltas a peer can
interleave) | closed (S190) | `Node`
(xref:prd/0020-metis-node-kind-closure.adoc[PRD 0020]): the merge is
product-lawed so nothing is discarded, the plurality is surfaced
(`kinds_present`, with `sole`'s typed `KindPlurality` refusal against
cross-kind reads), and re-kinding is one covered delta superseding
`observed()`, so the stale-subtree window is unbuildable; both losing
kind laws and the sum dissolution are shaped tests, and the closure
argument is xref:metis-store-algebra.adoc[the store-algebra note]'s
| A position-anchored span drifting under concurrent inserts (the
annotation bolds the wrong words), and its quiet twins: crossed ends
silently swapped, an absent boundary read as the document edge | closed
(S195) | `Verge` / `Rhapsody::extent` / `Scholia`
(xref:prd/0021-metis-scholia-mark-store.adoc[PRD 0021]): span ends are
immutable identity boundaries (a deleted element still bounds through
its tombstone slot), the projection's verdicts are total (`Covered` with
emptiness honest, `Inverted` and `Dangling` surfaced, never repaired),
and expansion is the side choice at mint, so no behavior field and no
schema exists
| A move composed as delete-plus-reinsert forking identity (a concurrent
edit strands at the destroyed copy's order slot), and its twin: two
concurrent moves forming an anchor cycle that silently detaches both |
closed (S196) | `Metatheses` / `Rhapsody::recension`
(xref:prd/0022-metis-metathesis-move-machine.adoc[PRD 0022]): a move is a
second placement testimony for the existing identity, so the fork is
unbuildable through this path; the recension applies births first (never
refused), then moves in `Kairos` order, refusing cycle-formers (only
moves) deterministically, surfaced in `refused()` and detaching nothing;
the record never chooses, the winner is the fixed public rank
|===
Every row in the ledger is now closed. The next session adding a
CRDT-facing hazard appends a row and asks, per the standard below, whether a
constructor could own it before reaching for prose. The ledger's seam-by-seam
companion is xref:metis-trust-grades.adoc[the trust-grade column] (S129):
where the ledger records the hazards closed, the column records the grade
every consuming seam accepts and the audited doors between grades, so a new
surface declares its row in both.
== The staged arcs, each with its measured signal
Axis 7 of xref:horizons.adoc[horizons] holds the rule: performance avenues
fire on measurement, never on taste. The studio was built to be that
measurement, so these arcs enter with their numbers attached. Since S130 the
studio's shape counters have a wall-time companion, the criterion rig in
`bench/` (its noise discipline and bench-to-arc map live in
`bench/README.adoc`); an arc's firing number may come from either instrument,
under that discipline. Ordering is by
value against the numbers, and each stays subject to the R-6 counterweight
test at carving time. The S112 to S118 implementation round landed arcs 1
through 4 and the substrate half of arc 6; each shipped arc is now a pointer
at its slice, and the maintenance rule applies (a landed arc shrinks, a
changed number moves its arc).
Arc 1, incremental `order()`:: *Shipped (S116), scoped by the S181 probe.* A
maintained per-anchor child index, invalidated on the `&mut` write path
(`weave`, `causal_merge`, `condense`), invisible behind the unchanged
`order()` read and excluded from the rhapsody's identity so it never
travels. The per-keystroke index-construction cost dropped from a full
skeleton regroup to one bucket-insert comparison (quadratic to linear over
a typing session); the cached-equals-naive law is property-tested against
the op-tape generator. The order-of-magnitude probe (S181) then scoped the
win: it holds on the bare-store `&mut` path alone, because the composed
facade (`Composer::compose` / `absorb`, the only disciplined write path)
runs the pure `Dotted::merge`, whose `Rhapsody::causal_merge` clones the
whole skeleton and rebuilds the whole index through `from_parts` on every
keystroke. Arc 8 is the cure.
Arc 2, batched delta framing:: *Shipped (S113), with a correction on the
record.* The scan traced the measured overhead to `delta_for` seeding its
delta context from an empty have-set, so a lone dot above the peer's floor
parks as a 16-byte run. `Dotted::delta_for_since(&Cut)` floors the delta
context at a witnessed peer cut and reclaims that run (the per-keystroke
context frame drops 37 to 21 bytes), giving `Cut` its first mandatory
boundary. The correction: the literal contract (a *store-minimal* delta
with a floored frame) is unsound, and its own equivalence property proved
it (flooring over a below-cut survivor the delta does not ship makes the
peer read that survivor as seen-and-dropped and kill it). The shipped read
is therefore *whole-store* with the floored frame: it buys the frame win,
not a store trim, and stays sound against any peer whose floor is at least
the cut.
Arc 3, the compose receipt:: *Shipped (S112).* `Composer::compose` returns its
minted dot beside the delta, and `compose_super` reads the supersede-set
from the held store inside the facade; the re-derivation the studio
hand-proved is gone, and the doomed-dot footgun is uncompilable. The
cheapest witness in the ledger, landed first so every later consumer
inherits the shape.
Arc 4, anchoring semantics:: *Shipped (S116), sharpened twice, closed
(S127).* The measured "catX" surprise is not an anchor bug: the anchor was
correct (the visually-left element), but a fresh replica's low clock rank
sorted the new element below the incumbent sibling under the
rank-descending order. The cure is the rank discipline (mint above the
anchor's current children), and `anchor_for_visual_insert` was kept as the
deliberate law seam where the Fugue refinement would land. S127 then
sharpened the residual question the hard way (backward runs interleave
under *honest* ranks, no adversary needed, because a single anchor
collapses every insert-before into one bucket) and landed the refinement
through that exact seam: the sided anchor,
xref:prd/0018-metis-rhapsody-sided-anchor.adoc[PRD 0018] (ruling R-13).
The reasoning is xref:metis-rhapsody-anchoring.adoc[the rhapsody-anchoring
note] with its S127 addenda; the FugueMax corner is the arc's remaining
recorded residual, gated on a measured anomaly at a field consumer.
Arc 5, run compression and path compression:: *Snapshot half fired and
shipped (S197, ruling R-25,
xref:prd/0023-metis-rhapsody-snapshot-frame.adoc[PRD 0023]); context
frames stay parked; path compression stays unfired.* The history: the
scheduled re-measure ran (S181, 65,536 chars): the context frame stays
flat at scale (a floored per-keystroke context frame is 37 bytes
against a 65k document), so context-frame run compression stays parked
with its verdict strengthened; what the re-measure surfaced on the wire
is the late-joiner snapshot, the v2 frame linear at 42 bytes per
dot-anchored locus, 2,752,526 bytes for the 65k document. Field numbers
(2026-07-07, the alma long-session profile, its COLLAB-6): a bootstrap
of 817,331 bytes grow-only against 247,727 under a retention cadence,
confirming ~42 B/locus in the field. S197 shipped the cure in the shape
this arc pre-recorded: the run-compressed *sibling* codec
(`to_snapshot_bytes` / `from_snapshot_bytes`, own version byte, ruling
R-8), maximal chain runs as one fixed-width 46-byte row plus a six-byte
rank step per interior element (the S189 fixed-width decision; the rank
column speaks the clock fold's successor rule, agreement Kani-proven),
canonical form forced by the split-chain refusal so byte identity
survives the compression, and the validating scan the rung's second
dual-homed Creusot core (proven total, 74 certificates). Measured on
the probe's honest two-author document, exact: 434,222 bytes against
2,752,542 (6.3x at 65k chars; single-author approaches the 7x
asymptote), with the factoring-agreement arm asserting the codec's
chain law and the coalescing instrument name the same 1,024 runs. The
embedding registry starts empty (pre-adoption is the cheap day, spent
deliberately). What stays in this arc: the *path-compression* half
(the uncollectable-residue shape: ~25% of interior-churn deletions are
fertile, live anchors through them, no retirement round reclaims them,
growing linearly), still unfired, still the sharper half of the
record, though its in-memory price fell with arc 11 phase two (a
chain-interior tombstone now rides as a four-byte inline step, so the
residue's byte cost is dominated by the child-index share until phase
three); the count still grows linearly, and any genuine excision
faces the locus-immutability obstruction (a dot's locus is testimony,
minted once, so a rewrite is either new testimony, the metathesis
shape, or a coordinated claim, the retirement shape) that a firing
ruling must answer. The arc 11 phase-two interlock recorded in PRD
0023 is discharged (S199, ruling R-26): the coalesced plane imports
the codec's own `chain_step` / `apply_chain_step`, so one chain
derivation decides wire runs and memory runs by construction.
Arc 6, the `Dot` newtype:: *Substrate landed (S118), domain decision required
before the release rename.* The
verified `Span` substrate (`Dot`-shaped station runs, coalesce, split, all
heap-free scalar arithmetic) shipped as `pub(crate)` with five Kani proofs
(the inventory is now 20), so the arithmetic the wire codec and the
intersect walk lean on has one machine-checked home ahead of its public
consumers. The public `Dot` rename over the bare `(u32, u64)` tuple is the
breaking half, so it still rides the 0.2.0 compatibility boundary (axis 1),
one time, never mid-herd. S291's cut audit makes its unresolved type-model
question explicit: canonical codecs round-trip zero-index coordinates while
event dots require nonzero indices, so the release must decide whether
`Dot` names the whole coordinate domain or only valid event identity before
migrating the open `DotStore` axis. Until then no new surface should widen
the tuple's footprint without noting it.
Arc 7, the studio promoted:: The probe rebuilt replica-simulation scaffolding
that every future semantic test also wants. A `pub(crate)` testkit (replica
harness, deterministic delivery shim, measurement hooks) is the cheap cut;
a public testkit is framework-adjacent and waits for an out-of-tree
`DotStore` author to ask.
Arc 8, the in-place fold:: *Fired (S181) and shipped (S182, ruling R-14),
the order-of-magnitude probe's headline.* Through the shipped facade,
every keystroke and every received delta ran the pure `Dotted::merge`,
and the merge cost was linear in the document: the S181 sweep measured
the write path at 402 us per keystroke against a 4,096-char document,
1.75 ms at 16,384, 8.5 ms at 65,536 (a ~115 chars/s ceiling on an idle
release build), and the receive path at 358 us / 1.56 ms / 6.46 ms per
one-keystroke remote delta over the same sizes; the structural cause is
the whole-skeleton clone plus `from_parts` index rebuild inside
`Rhapsody::causal_merge` and the survivor re-enumeration inside
`DotSet::causal_merge`, where the bare `weave` path pays one bucket
insert. S182 shipped the cure behind the same surfaces: a provided
`DotStore::causal_merge_from` defaulting to the pure merge (the
`clone_from` precedent), overridden delta-bounded by `Rhapsody` (the
incremental `record_locus` insertion `weave` already used) and `DotSet`
(residual-edit fold over the compact station form), threaded through
`Dotted::merge_from` into the `Composer` write and receive flows, under
the one law that the in-place fold is observationally identical to
`causal_merge` (pinned per store, per pair, and in the foreign-store
harness). Re-measured on the same instruments: 0.67 us per keystroke at
65,536 chars (was 8.5 ms, ~12,700x, and now flat across 4k/16k/64k) and
~2.0 us per received remote keystroke (was 6.46 ms); the full test
suite's own wall time dropped ~12x as the incidental confirmation.
`DotMap` / `DotFun` keep the pure default until a number names them.
Arc 9, the windowed order read:: *Fired (S181) and shipped (S183, ruling
R-15).* A full `order()` walk at 65,536 chars cost ~4.7 ms (re-measured
~6.3 ms on the S183 machine) and allocated the whole document order, the
dominant per-keystroke term once arc 8 landed. S183 shipped the windowed
read: `order_walk` (the lazy walk `order()` now collects, so the two
cannot drift) and `order_walk_after` (resume immediately after a placed
element, live or tombstone; a dot with no place refuses, the
`is_reachable` boundary), under the suffix law property-pinned over sided
and tombstoned histories. The mechanism that keeps the promise is the
*maintained placement set* (the S116 move applied to reachability, since a
forward-typed chain is as deep as the document and an `O(depth)` verify
would forfeit the win) plus the lazy ancestor climb (levels schedule only
as the frames below run dry). Re-measured on the bench: ~6.2 us to
~11.5 us per 100-element viewport across 4k/16k/64k, flat where
`order_cold` grows to 6.3 ms, ~550x at scale; with arc 8, every
per-keystroke editor term is now microseconds at source-file size. The
recorded residuals (the terminal-window drain, the reverse walk, and
the positional index) *retired in one structure* (S200, ruling R-27):
the order thread, arc 11 phase three, exactly the maintained in-order
thread R-15 named as the cure; PRD 0017's residual entry records the
discharge.
Arc 10, the owed-delta read:: *Fired and shipped (S191, ruling R-21).*
The instrument ran first (the `owed_at_size` bench sweep beside the
scale probe's fragment counts) and the number bit on both axes: the
bare owed read measured 794 us / 3.80 ms / 17.1 ms per probe against a
one-keystroke-behind peer at 4k/16k/64k chars, 16.6 ms against a peer
owed *nothing* (the steady-state floor every idle round pays, per
peer), and the one-keystroke fragment carried 65,536 loci in 2,752,542
bytes (the late-joiner snapshot re-shipped per probe), because the
S190-corrected `novel_to` soundly ships the skeleton whole under a
bare survivor context. S191 shipped the cure the vision pre-sketched,
the *witnessed owed read*: the peer states its recording possession
beside its context (`Rhapsody::woven()`, the maintained fifth derived
coordinate, the skeleton's key set as a have-set), and
`novel_to_witnessed` selects the skeleton by the witness residual
(`woven \ recording`), possession claimed directly where coverage
could prove nothing; `DotStore::support()` composes the survivor half
from the maintained compact forms; both default soundly (bare
`novel_to` / the `dots()` fold) so every existing and foreign store is
untouched, the S182 contract-versus-cost-seam pattern applied to
anti-entropy. Re-measured on the same instruments: ~440 ns one-behind
and ~76 ns caught-up per probe, flat across sizes (~42,000x and
~218,000x at 65k), and the one-keystroke fragment is 1 locus, 84
bytes. The witness is a claim whose failure directions are safe
(under-claim over-serves; over-claim starves only the claimant), the
witnessed heal re-pins the S190 outrun counterexample, and the field
consumer adopted the read the same session (alma COLLAB-3). The
recorded residual: the delta context's *removals* term still walks
`context \ support` per probe; a trim there is unsound by the
`delta_for` argument, so its cure, if a number ever names it, is its
own slice.
Arc 11, the substructure program (the two-plane layout):: *All five
phases shipped (S194, ruling R-22; S199, ruling R-26; S200, ruling
R-27; S201, ruling R-28; S202, ruling R-29).* The interned identity plane landed behind
the unchanged `Rhapsody` facade (`rhapsody/identity/mod.rs`: per-station
fibers of 64-slot pages holding non-`Ord` interned handles into one
contiguous locus column, dense pages as a prefix vector, far pages as
bounded exceptions, the `DotSet` floor-plus-exceptions bet applied to
layout), under the shell discipline's rules: the map form stays the
contract vocabulary, the dual-form agreement pin is
`prop_plane_agrees_with_the_map_form`, layout stays out of equality
and hash, and the closed form moved from 80 B/char floored with map
overhead on top to 68 B/char with the locus column exact (5.24 MB
floor to 4.46 MB at 65k chars; the scale probe asserts the shell
undercuts the map form it replaced). Phase two (S199, ruling R-26)
then *run-coalesced* the plane: a page slot now holds either an
explicit column handle or an inline 31-bit rank step, so a
chain-interior element (consecutive dot, anchored after its
predecessor, rank stepping by the clock) pays four bytes and no
column entry at all, its locus materialized on read through the
snapshot codec's own chain law (`chain_step` / `apply_chain_step`,
the PRD 0023 interlock discharged: one derivation decides wire runs
and memory runs, and the closed-forms probe asserts the agreement
end to end, plane explicit entries == walk-derived maximal runs ==
the frame's run-count field, 1,024 at 65k chars). The measured
result, exact: the identity plane's 65k-char honest two-author
document costs 311,296 bytes against phase one's 3,407,872 (the
locus column term 3,145,728 to 49,152, the 64x chunk length this
arc's own coalescing instrument predicted), 1,359,872 against
4,456,448 with the child share still on top; and wall time moved the
right way everywhere it moved (order_cold ~28% faster, order_window
~25% faster, owed reads at scale ~4-7% faster, typing and decode
unchanged after the ascending fold learned to roll its chain
predecessor). Phase three (S200, ruling R-27) then shipped the
*order thread* (`rhapsody/thread/arena.rs`), the positional plane: a
counted arena tree over walk-contiguous dot-run fragments whose
cached `(slots, visible)` subtree monoids answer `order_len` in
`O(1)` and `order_at` / `offset_of` / the reverse walks in `O(log)`,
where each previously cost one whole `order()` pass (~4.5 ms at 65k;
after: ~9 ns / ~29 ns / ~2.4 us per 100-element scroll-up window,
flat across sizes). Slot fragments remain `O(run segments)` (one per
64-slot segment; the probe's 64-char runs tile the cap exactly), while
dynamic region boundaries keep insertion `O(log)` amortized across
independent deep seams (per-dot at landing; run-coalesced into
segments by phase five, S202). Arc 9's
three recorded residuals (the terminal drain, the reverse walk, the
positional index) retire in this one structure, exactly as this
arc's charter predicted; the measured DP price is on the record in
R-27 (after the endpoint forests: typing ~1.60/~1.76/~2.42 us per
keystroke at 4k/16k/64k; cloned-fixture in-place absorb
~4.60/~12.24/~49.37 us; one extra walk per whole-document
construction). The prior record, kept for
any further phase:
Measured struct sizes put the ordering state at a floor of ~128 bytes
per one-byte character (skeleton entry 64, child-index share 64, before
node overhead): at least ~8.4 MB in memory for a 65,536-char document,
the in-memory twin of arc 5's 42-bytes-per-locus wire number; the S192
probe pins the compiler-checked half of that closed form
(`size_of` floor 80 bytes per element: entry 64 plus child share 16,
map overhead on top; 5.24 MB floored at 65k chars). The coalescing
instrument measured honest two-author alternating traffic at exactly
one maximal same-author run per 64-char chunk (65,536 elements in
1,024 runs, 64 elements per run), so the run-coalesced skeleton buys
roughly the chunk length on the order plane for collaborative
documents. The contested-bucket bench (`siblings_at_one_anchor`)
measured the maintained index's `O(b)` front-insert at ~1.7 us /
~5.6 us / ~19 us per insert against 4k/16k/64k siblings at ONE anchor:
linear as predicted, but reachable only by a pathological single-anchor
document (honest traffic above coalesces at 64 elements per run), so
the contested-bucket cure stays number-gated at a field consumer. The
program, phased and facade-preserving (the shell discipline note owns
the type rules): interning plus paged fiber vectors for the identity
plane (phase one, now shipped as above; dots are dense per-station
counters by construction, and the
`DotSet` floor form was the shipped precedent for exactly this bet),
then the run-coalesced skeleton with implicit interior anchors (rank
fidelity by the axis-12 successor rule, wire byte-identity pinned by
dual-form differentials; phase two, now shipped as above), then the
monoid-annotated run tree that retires arc 9's three residuals in one
O(log runs) structure (phase three, now shipped as above). Phase four
(S201, ruling R-28) then coalesced the last un-coalesced term, the
child-index share: the S116 sibling index's map form
(`BTreeMap<Anchor, Vec<Dot>>`, a map node plus a heap-allocated
one-element vector per chain-interior element) stays the contract
vocabulary, and the carried form (`rhapsody/children/mod.rs`) stores only
the exceptional buckets, deriving a chain interior's sole-child
bucket from the identity plane's own entry per read (a stepped slot
means "anchored `After` its predecessor" by the chain law, so the
probe is constant in the document and the child relation is never
stated twice). The
measured result, exact and probe-asserted: 1,024 explicit children
against 65,536 on the honest two-author document (the run-boundary
count, the same 1,024 the locus column, the thread fragments, and the
snapshot frame's run field name, the factoring agreement now asserted
across three planes and the wire), so the child share falls
1,048,576 to 16,384 bytes at 65k chars (64x, the chunk length) and
the whole ordering closed form 1,359,872 to 327,680 bytes (20.75 to
5 B/char), before counting the retired map-node and vector-header
overhead the closed form always floored away. Phase five
(S202, ruling R-29) then coalesced the endpoint forests themselves,
the price R-27 recorded and R-28 named dominant (60 B per placed
dot, ~3.93 MB at 65k chars, twelve times the rest of the ordering
state): successor-shaped ends edges are never stored (maximal
successor-edged spans are the link-cut forest's nodes, extents
derived from an `O(segments)` break set), the starts side allocates
lazily (`Before` relations only), and the honest document's region
state falls to one segment per maximal chain run: 65,536 bytes
against 3,932,160 (60x), probe-asserted, with the factoring
agreement's fifth voice (region segments == child-plane explicit
children == locus-column runs == thread fragments == the wire's run
count, all 1,024) and the S200 amplification guards re-run green.
The whole ordering state at 65k chars closes at ~393 KB where S200
left it at ~4.26 MB. Entered
phase by phase, each with the suite as oracle and its number moved:
R-22 (S194), R-26 (S199), R-27 (S200), R-28 (S201), R-29 (S202).
What remains in the program's territory, each against its own future
number: the contested-bucket cure (the `O(b)` explicit-bucket vector
insert, pathological-only, still number-gated at a field consumer),
and any caller-shaped thread annotation (byte widths, line counts), a
new axis facing its own ruling. The consumer profile that grounded
phase one has run (2026-07-07, the
alma long-session profile, its COLLAB-6): even under a retention cadence
a churned session retains 4.1x the living document in ordering loci
(13.5x grow-only), so the per-locus in-memory floor multiplies against
retained loci, not visible characters, and the identity plane's bytes
are the dominant term of a long-lived collaborative session's memory.
== What the vision refuses
The refusals are owned elsewhere and bind here unchanged:
xref:target_arch/non-goals.adoc[the non-goals],
xref:horizons.adoc[horizons]' anti-avenues, and xref:μή.adoc[μή] for the
working sessions. Three CRDT-specific corollaries are worth stating once:
* *No editor, no transport, no rich-text schema.* The studio lives in the
test suite precisely so the crate never ships one. Minerva provides the
stores, the reads, and the witnesses; the product is the caller's. The
schema clause was redrawn once, by ruling R-23 (S195, PRD 0021's mark
store): mark *mechanics* (identity-anchored sided spans, opaque tags,
the honest projection verdicts) are in; mark *meaning* (what a tag is,
nesting, formatting models, rendering, validation) stays out
permanently, and expansion behavior is structural (the side choice)
precisely so no behavior field re-opens the schema door.
* *No named-CRDT zoo.* The kernel plus the open `DotStore` axis is the bet
(ruling R-12 drew the boundary at payloads, not composition). A request
for "an OR-Map like the one in crate X" is answered with the composition
recipe, not a new type, until a law the axis cannot express arrives.
* *No silent policy in a merge.* Sibling display order, add-wins versus
remove-wins tuning, and undo semantics are caller decisions over the
survivor law's honest output. The kairotic tag (axis 8) is the designed
seam for display rank; design them together when the varying-tag consumer
arrives.
== The standard for entry
A new CRDT-facing surface enters this crate when it can fill in all four
sentences, and the first two are the epoch's additions to the standing R-6
test:
. *The measurement:* the number (from the studio, a fuzzer corpus, or a
consumer's profile) that says the pressure is real.
. *The witness question:* which row of the ledger it closes, or why the
hazard it introduces is guarded by construction rather than prose.
. *The law:* the algebraic statement its property tests pin, named against
the note that owns the algebra.
. *The counterweight:* the R-6 paragraph, written honestly, or the answer
is no.
== The working queue and the limb beyond it
Two S111 working notes sit one step upstream of this charter (both in
`docs/miscellany/`, local and untracked, per that directory's convention):
the *facade contracts* note is the ranked, implementation-ready queue the
eight-agent scan produced (thirteen contracts in three tiers, each with
signature, invariant, and owed tests), and the *speculative types* note is
the deliberately unlicensed second generation (the verified `Dot`/`Span`
substrate, the affine mint ticket, the receive/deliver staging brands, the
epoch-branded roster, the antichain witness, the retrodictive `Chronicle`,
the attested cut), each entry carrying its proof plan against the assurance
ladder and its counterweight draft. Entries promote from there through the
imagined-primitives charter into horizons on a signal, never directly into
code.
The limb itself now has a name: the *structured document horizon*,
chartered as xref:prd/0019-metis-structured-document-horizon.adoc[PRD 0019]
(S184, ruling R-16). It extends this vision one epoch out (the `DotStore`
axis closed under kinds, movement, and annotation, conflicts surfaced and
never resolved) and enters through the same discipline: the block-document
probe is its studio, its stages fire on measurements or a consumer's ask,
and each firing writes its own ruling against this document's standard for
entry. The discipline has now run end to end on both arms: stage A's
probe fired stage B's gate on a recorded gap (S186, ruling R-17), and
stage B shipped through the four-sentence standard as the sparse-product
`Node` (xref:prd/0020-metis-node-kind-closure.adoc[PRD 0020], S190, ruling
R-20), closing the ledger's kind row above; stage D then fired on the
consumer arm (alma COLLAB-7's filed range ask) and shipped as the mark
store (xref:prd/0021-metis-scholia-mark-store.adoc[PRD 0021], S195, ruling
R-23), closing the ledger's drift row, with the rich-text-schema sentence
redrawn explicitly as its charter demanded (the refusals section carries
the redraw). Stage C then fired on the consumer arm too: its *reorder*
half, pinned as a field correctness defect (alma COLLAB-8's stranded edit,
the day moves must preserve identity), shipped as movement-by-testimony
plus the recension replay
(xref:prd/0022-metis-metathesis-move-machine.adoc[PRD 0022], S196, ruling
R-24), closing the ledger's move row above; the subtree-across-containers
half is now the horizon's last gated stage.
== Maintaining this document
Re-read after every arc lands and after every studio re-measurement: an arc
that ships shrinks to a pointer at its PRD or slice, a number that changes
moves its arc, and a ledger row that closes names its witness and its
compile-fail test. The peristyle criterion applies here as everywhere: every
line must change what a future session does, and the day this document
describes more than it schedules, cut it.