apportion

name	apportion
description	Apportion an autonomous goal into execution units carrying their own completion conditions. Type: (GoalPlanUncompiled, User, APPORTION, AutonomousGoal × ExecutionHorizon) → ConditionBearingUnitPlan

Merismos Protocol

Apportion an autonomous goal into coarse execution units and derive each unit's completion conditions before the run begins: cut the goal at its evidenced seams so each unit fits one execution horizon and no obligation is orphaned, derive per-unit completion and invariant predicates plus the cross-unit plan conditions, and emit one goal entry per unit. Type: (GoalPlanUncompiled, User, APPORTION, AutonomousGoal × ExecutionHorizon) → ConditionBearingUnitPlan.

Definition

Merismos (μερισμός: a dividing into parts, an apportionment): A dialogical act of apportioning one stated autonomous goal — deciding which units the goal is carried out in and what each unit's done means — when the goal is stated but its plan is uncompiled. The protocol's lexical verb is /apportion. It reads the goal's obligations — the host's own standing procedural contract subtracted, since that attaches to every change the host accepts whatever the goal is — cuts them into coarse units at seams it can cite, judges each unit against one execution horizon, derives a completion predicate and any invariant predicates per unit, separates the conditions whose subject is the whole goal rather than any one unit, and emits one goal entry per unit whose conditions are conjoined into a single leaf predicate — or, for a unit whose completion condition remains residual, an explicit accepted-uncovered certificate that still carries any compiled invariant conjuncts. An item no check could settle because what settles it is a judgment made against the context accumulated by then and what the user has actually said by then is reserved rather than compiled — recorded with the ground that settles it, at the unit level and for the whole-goal acceptance criterion alike, and kept apart from the waiver that records an acceptance criterion the plan simply lacks. Activation takes one goal: a request bundling several stated outcomes whose only common bond is that standing contract relays at the checkpoint instead, one apportionment per goal. Every goal obligation belongs to some unit or is visibly accounted for, and every unit fits one horizon or carries a recorded override; the MORPHISM block names these and the protocol's other invariants. Merismos apportions and conditions; it does not order — sequence, independence, reconciliation, termination topology and routing are outside its own scope, so the emitted plan is a pre-conduct artifact. The protocol holds no state during execution.

── FLOW ──
Merismos(G) → Probe(G) → goal_plan_uncompiled? →
  ¬autonomous_intent(G):  → relay(no autonomous interval in scope) (extension) → deactivate
  ¬single_goal(G):        → relay(composite goal — name each stated outcome it bundles and the shared-procedure bond that made them read as one; one apportionment per goal) (extension) → deactivate   -- fires BEFORE init_loop_state, so no Λ loop field is ever seeded and no unit is cut across outcomes that share only the host's standing contract
  locator in scope — the goal's navigation block — ∧ (¬dereferenceable ∨ support-integrity failure): → relay(handoff unreadable — locator unreachable, missing its session half, or a load-bearing premise the grounding pass could not support) (extension) → deactivate
  condition_bearing(G):   → relay(units and conditions already present) (extension) → deactivate
  uncompiled: ReadObligations(G) → O_G → VelocityFilter(O_G) → oos → init_loop_state: U=∅, residual=O_G \ {d.obligation | d∈oos}, K=∅, R=∅, S=∅, P=∅,
                              plan_conditions_derived=⊥, plan_conditions_stale=⊥, fit_overrides=∅, invariant_status=⊥, accepted=∅, unbounded_approved=⊥, loop:   -- init_loop_state runs EXACTLY ONCE, on this Phase 0 → Phase 1 edge; Phase 2's Reopen re-enters "loop:" directly without re-executing it
    Phase 1 residual? →   -- the empty-residual arms are read off residual DIRECTLY, before anything is drafted: a draft that comes back with no cut cannot tell "nothing was there to cut" from "nothing could be cut", and only the first of those relays. The second arm is the ordinary completion edge every converging run leaves Phase 1 through
      residual = ∅ ∧ U = ∅ ∧ oos = ∅:  → relay(goal's scope too thin to read any obligation) (extension) → deactivate
      residual = ∅ ∧ (U ≠ ∅ ∨ oos ≠ ∅):  → Phase 2
      residual ≠ ∅:  draft(G, residual) → D → surface_draft(D) (extension) →   -- draft iterates Scan/Pack/fit/qualify/complete_unit over a workset copied from residual until every obligation in that workset sits in some completed cut, autonomous_pack absorbing at heuristic seams only what the seam evidence could not reach; it moves nothing out of residual, integrate remaining the sole owner-changing step. The WHOLE draft reaches the user before any cut is settled: what the user recognizes is the shape, and settling one cut at a time out of a visible whole is what keeps a misalignment found late from re-opening cuts already accepted blind
        D holds no Heuristic cut ∧ ∀c ∈ D whose fit = Fits ∧ no alternative cut of c's obligations stands up to the same evidence: → relay(AcceptUnit) (extension) → integrate_unit(c) → c' → U := U ∪ {c'}, residual := residual \ c'.obligations   -- `Whole-draft relay test` read twice, in this order: the leading conjunct over the WHOLE draft — the relay path opens only where the goal's evidence reached every cut, one heuristic cut sending the draft to the gate entire — then the familiar per-cut reading inside it. What it weighs is NEVER a member of D: D is one partition, so no two of its cuts claim the same obligation and none of them stands against another. What the test asks is whether c's region could have been cut a second way the goal's evidence would back as well — a live reading made HERE, at dispatch, over that evidence and the accumulated context, which drafting neither draws nor records
        D has no unsettled cut left ∧ residual = ∅:  → Phase 2
        else:  → Qu(the first unsettled cut standing as its own Anchor, that cut, its SpanFit, its Seam, U, D's still-unsettled cuts) → Stop → Aᵤ →
          Aᵤ = AcceptUnit     → integrate_unit(the cut this firing presented) → loop   -- in Aᵤ's defined set iff SpanFit = Fits
          Aᵤ = Recut(c, d)    → re-derive c's Anchor frame under d → loop   -- c ranges over the surfaced draft's still-unsettled cuts, not only the one this firing presented: same residual, different cut, and the next cycle drafts under d
          Aᵤ = OverrideFit    → integrate_unit(the cut this firing presented) → u' → Λ.fit_overrides ∪= {u'.unit_ref} → loop  -- in Aᵤ's defined set iff SpanFit ≠ Fits
          Aᵤ = Sufficient     → ∀c ∈ D still unsettled with fit = Fits: integrate_unit(c) → c' → U := U ∪ {c'}, residual := residual \ c'.obligations → [∃c still unsettled with fit ≠ Fits: → Qu over the first such cut, that cut standing as its own Anchor, reason surfaced as relay first → Stop → Aᵤ → the same Aᵤ dispatch | none: residual = ∅ → surface (extension) → Phase 2]   -- blanket relay over the fitting cuts OF THE DISPLAYED DRAFT: Sufficient is the user's constitutive act over that whole, so what it accepts is what was shown — each cut's seam disposition included — rather than a remainder re-packed at heuristic seams the user never saw
    Phase 2 ∀u∈U, ¬derived_already(u,K,R,S): Derive(u) → (Set(κ), Set(ρ), Set(σ)) → K:=K∪κs, R:=R∪ρs, S:=S∪σs ∥ [¬Λ.plan_conditions_derived: DerivePlan(G, U) → P; Λ.plan_conditions_derived := ⊤] →
      oos ≠ ∅ → OOS(oos) (extension)                                            -- obligations needing pre-action interception: out of scope, substrate named
      S ≠ ∅ → Reserved(S) (extension)                                           -- items held open to a judgment made outside compile time: the ground that settles each is named, and nothing is delegated to any substrate
      ¬acceptance_present(P) → Qt(K, P) → Stop → Vₜ →
        Vₜ = DefineNow(d)     → P := P ∪ {plan_condition(d)}; [Λ.unbounded_approved: Λ.unbounded_approved := ⊥]; S := S \ {σ∈S : σ.subject = ReservedAcceptance}
        Vₜ = RouteBound       → relay(the whole-goal acceptance criterion's definition is routed to /bound) (extension) → deactivate   -- Rerouted: the route is EMITTED, not merely exited on
        Vₜ = ReserveJudgment  → S := S ∪ {acceptance_reservation()}; [Λ.unbounded_approved: Λ.unbounded_approved := ⊥]   -- the criterion is constitutively open, not missing: it stays open to runtime resolution. This arm never SETS the waiver flag, and it CLEARS one an earlier firing on this same invocation left standing — the waiver and the reservation are mutually exclusive, so the arm answered last is the one that stands
        Vₜ = ApproveUnbounded → Λ.unbounded_approved := ⊤; S := S \ {σ∈S : σ.subject = ReservedAcceptance}   -- the symmetric retraction: drops a ReservedAcceptance member an earlier firing left standing, for the same exclusivity
      BindPlanRequirements(P, U) → P := Pᵦ → check(U, K, R, S, Pᵦ, oos) → Λ.invariant_status := InvariantStatus   -- coverage_complete ∧ span_fit ∧ termination_covered ∧ obligations_derived ∧ oos_substrate_named ∧ reservation_ground_named ∧ plan_conditions_topology_free
      Λ.plan_conditions_stale → StaleNotice(P) (extension)                       -- pre-gate text before Qc: Adjust to update, or Confirm to keep as recorded
      Qc(U, K, R, S, P, InvariantStatus, oos) → Stop → V →
        V = Adjust(d)  → rederive(K, R, S, P, d) → (K, R, S, P) := (K', R', S', P') → Λ.plan_conditions_stale := ⊥ → [¬acceptance_present(P') → Qt(K', P') → Stop → Vₜ → P' and S' updated as at Phase 2 entry] → [acceptance_present(P') ∧ Λ.unbounded_approved: Λ.unbounded_approved := ⊥] → [acceptance_present(P') ∧ acceptance_reserved(Λ): S' := S' \ {σ : σ.subject = ReservedAcceptance}] → BindPlanRequirements(P', U) → P' := Pᵦ' → check(U, K', R', S', Pᵦ', oos) → Λ.invariant_status := InvariantStatus → Qc(...)   -- over the SAME U: K' ∪ R' ∪ S' spans every obligation of every unit; no removal — a withdrawn condition becomes a residual, and a residual the direction re-reads as judgment-settled becomes a reservation. rederive rewrites the unit-scoped members of S only; the ReservedAcceptance member is Qt's own record and carries through
        V = Reopen(u)  → residual := residual ∪ u.obligations; U := U \ {u}; K := K \ {κ∈K:κ.unit=u}; R := R \ {ρ∈R:ρ.unit=Some(u)}; S := S \ {σ∈S:σ.unit=Some(u)}; Λ.fit_overrides := Λ.fit_overrides \ {u.unit_ref}; Λ.plan_conditions_stale := ⊤ → Phase 1   -- residual is NOT reseeded from O_G \ oos; every other unit's obligations carry forward untouched; the whole-goal ReservedAcceptance member is unit-free and stays; plan-level P is NOT re-derived (`Back-edge state preservation`)
        V = Confirm ∧ ¬hard_invariants_hold(Λ): → re-present Qc with the violated invariant named
        V = Confirm ∧ hard_invariants_hold(Λ):  → AcceptResiduals(R) → Λ.accepted := Λ.accepted ∪ {ρ.obligation | ρ∈R}; ∀ρ∈R: ρ.disposition := AcceptUncovered → Phase 3   -- P and S are read-only on this edge; AcceptResiduals supplies the non-empty accepted-completion witness resolve_unit reads at Phase 3, and touches no reservation — a reservation is not a residual awaiting acceptance
    Phase 3 Emit(U, K, R, S, P, oos, unbounded_approved) → E [record] → package(E) → plan → park_carrier(plan) → C [record] → record_handoff(C) → N → converge(apportionment trace) → ConditionBearingUnitPlan

── MORPHISM ──
AutonomousGoal × ExecutionHorizon
  → probe(goal)                        -- detect ONE stated autonomous goal whose unit plan and conditions are uncompiled; a request bundling several stated outcomes bound only by the host's standing procedural contract is composite and relays here rather than activating
  → read_obligations(goal) → O_G       -- construct the invocation-local obligation set and SUBTRACT the host's standing procedural contract: a requirement that host attaches to every change regardless of the goal is not a goal obligation but an ambient invariant every emitted unit inherits, so it is neither packed nor derived; G itself remains read-only
  → filter(velocity) → oos             -- an obligation guardable only by pre-action interception is declared out of scope with the delegated substrate recorded on the declaration; computed once over O_G before packing begins, so it never enters a unit
  → draft(goal, residual) → D          -- THE WHOLE-DRAFT OPERATOR: iterate the next five steps over a workset copied from residual until every obligation in that workset sits in a completed cut, then stop. It owns nothing — no obligation leaves residual here — and it settles nothing; what it produces is the shape the reader has to see before any one cut can be judged. Iterating rather than cutting once is what lets each cut carry its own seam verdict, so a whole draft is not uniformly heuristic just because it was drafted at once
  → scan(seams)                        -- read the REMAINING obligations (O_G minus the out-of-scope ones) for cuttable seams: dependency, deliverable, verification, ownership. Ordered after the filter, as FLOW and PHASE TRANSITIONS run it: a pre-action-only obligation is delegated out before any cut is shaped around it
  → pack(seams, horizon) → (Anchor, DraftUnit when Anchor ≠ ∅)   -- THE IRREDUCIBLE CORE, part one (completed into a ProposedUnit by complete_unit once fit and seam exist): an empty Anchor IS this step's no-cut verdict and carries no draft, so the three judgments below have no operand on that return and drafting hands what is left to autonomous_pack instead; a goal whose obligations were every one delegated out never reaches drafting at all, the empty-residual arm having relayed first. apportion the obligations into coarse units such that each unit fits one execution horizon and every obligation lands in some unit; also reads each unit's capability requirements and feasibility notes from the goal's stated needs — functional descriptions only, never a concrete executor/model/runtime/tool token (Substrate Boundary)
  → fit(unit, horizon) → SpanFit       -- per-cut horizon-fit predicate, run wherever a cut exists to judge, whether Pack found it at a seam or autonomous_pack placed it; Indeterminate is surfaced, never silently read as Fits
  → qualify(cut) → Seam                -- Grounded when a seam is cited: a dependency, deliverable, verification or ownership seam, or another the goal evidences — the four are the scanning taxonomy, not the admissible set; Heuristic when the goal carries no such evidence — declared, not asserted as a natural joint
  → complete_unit(draft, fit, seam) → ProposedUnit   -- writes the fit and seam judgments onto the cut, AFTER both exist; the sole constructor of ProposedUnit, seam-grounded cuts and autonomous_pack's alike, so no cut enters a draft without both judgments on it
  → surface_draft(D)                   -- the whole draft goes out before the first cut is settled: every cut with its obligations, fit verdict and seam disposition, so the reader judges a shape rather than a fragment, AND the standing affordance to send any cut back, named on the surface where the cut is shown. Relay — it presents no fork, and the forks that follow are each read against what this made visible
  → [the draft holding no Heuristic cut, a cut whose fit = Fits and over whose obligations no alternative cut stands up to the same evidence: relay(AcceptUnit) (extension) | else: present(anchor, proposed_unit, SpanFit, Seam, the draft's still-unsettled cuts) (constitution)]  -- the draft gate condition over the whole, then the option-set relay test per cut, read live at this point; the alternative it weighs never entered the draft, which carries one cut per obligation
  → integrate(unit_judgment, U, residual) → (U', residual')   -- monotone in coverage: an obligation leaves residual only when it enters some unit; integrate_unit(ProposedUnit) → Unit is the only constructor Unit has, and assigns the accepted unit its fresh UnitRef in that same step
  → derive(unit) → (Set(κ), Set(ρ), Set(σ))    -- THE IRREDUCIBLE CORE, part two: per obligation of the unit, a verifiable predicate (completion or invariant), a residual, or a reservation; every obligation of the unit lands in at least one of the three sets, and Derive writes it to exactly one — that single placement is how this step reads the obligation, not a property obligation_derived proves, which asks only for membership; a misplacement shows at the confirmation gate like any other read here. The third is for an obligation no check could settle because a judgment settles it — read at THIS step over candidates arriving like any other, so it is fallible and correctable at the confirmation gate; it is not an out-of-scope delegation, which hands an obligation to a substrate that must intercept before an action runs
  → derive_plan(goal, U) → P           -- conditions whose subject is the whole goal, not any one unit; NOT distributed across units to fit the leaf type
  → confirm(unit_plan)                 -- user judges the apportionment together with its conditions
  → emit(goal_entries)                 -- one entry per unit; resolve_unit's single certificate — DeterminateResolution when a compiled COMPLETION condition exists, else AcceptedUncoveredResolution with a non-empty accepted-completion witness, else ReservedJudgmentResolution with a non-empty reserved-completion witness; either witnessed form still carries any compiled invariant conjuncts
  → package(E)                         -- constructs the whole returned plan from E's own coproduct partition, envelope included — a read-back of what was emitted, never a second derivation beside it
  → park_carrier(plan) → C             -- parks the packaged plan in ONE durable carrier record
  → record_handoff(C) → N              -- emits the fixed-shape navigation block a later session dereferences to read that carrier back
  → ConditionBearingUnitPlan
requires: user_initiated(G)            -- user declares autonomous execution intent via /apportion
requires: single_goal(G)               -- domain restriction: ONE stated outcome. Shared procedure is not a shared goal — the host's standing procedural contract attaches to any work there, so it can carry no seam and a bundle bound only by it relays at Phase 0 without activating
deficit:  GoalPlanUncompiled           -- activation precondition (Layer 1)
preserves: G                           -- compile-time only; ReadObligations constructs O_G without mutating the goal; no execution-state mutation
invariant: Apportion over Order        -- Merismos cuts the units and conditions them; it does not sequence them
invariant: Whole Draft over Serial Cut -- no cut is settled before the draft it belongs to has been surfaced whole. What the reader judges is a shape with its siblings beside it, never a fragment whose neighbours are still unwritten — an acceptance given without the rest in view is one a later cut can force back open
invariant: Coverage over Convenience   -- every goal obligation belongs to some unit, is visibly delegated out of scope, or is accepted as uncovered on record — the same three arms coverage_complete reads; a plan that omits one converges locally and lies globally
invariant: Fit over Ambition           -- every unit fits one execution horizon, or carries an explicitly recorded override
invariant: Declared Seam over Asserted Joint  -- every cut DECLARES its seam quality: the evidence it cites, or heuristic where the goal carries none. What is invariant is the declaration, never which quality gets declared — a cut may honestly be heuristic, but it never claims a natural joint it cannot evidence

── TYPES ──
G              = AutonomousGoal { utterance: String, obligations: Set(Obligation), prior: ProtocolOutput?, session: Context }
O_G            = ReadObligations(G) = G.obligations \ { o | host_standing_contract(o) }   -- the subtraction is part of the read, not a later partition: what it removes never becomes residual, never enters a unit, and is never counted by coverage_complete
ProtocolOutput = prior protocol's converged output in current session
Obligation     = a stated or inferred requirement the goal must satisfy — the unit of coverage; each cites its evidence in G. A requirement the HOST attaches to every change it accepts regardless of the goal reaches this read as a candidate like any other, and host_standing_contract below is the judgment that keeps it out of O_G: it is an ambient invariant every unit inherits, not a goal obligation this goal generated. The exclusion is made AT the read — a judgment over candidates, as VelocityFilter's partition is — so the type does not guarantee it and a misjudgment is possible
host_standing_contract(o) ≡ o is goal-independent in the host the work is carried out in — the same requirement would be read from ANY goal there, because the host's own standing procedural contract attaches it to every change it accepts (its version/manifest discipline, its verification command, its branch/worktree/review path, its merge authority) — AND o is not itself the outcome G states. Such an o is neither a goal obligation nor an out-of-scope delegation: an OOSDeclaration names a substrate that must intercept BEFORE an action runs, whereas this binds every emitted unit alike and the host's own process already enforces it, so ReadObligations subtracts it and nothing downstream sees it. A requirement G states AS its outcome fails the second conjunct and stays a goal obligation
H              = ExecutionHorizon      -- the budget one autonomous run is expected to fit; read from context, cue cited
U              = Set(Unit)             -- the apportionment
Anchor         = Set(Obligation) -- Pack's per-cycle focus region: the (possibly proper) subset of `residual` Scan's seam evidence gives Pack something to prioritize a cut around this cycle
ProposedUnit   = { subject: String, obligations: Set(Obligation), fit: SpanFit, seam: Seam, capability_requirements: Set(CapabilityRequirement), feasibility_notes: Set(FeasibilityNote) }   -- inhabited only after complete_unit writes fit and seam; Pack alone yields a draft missing both
DraftUnit      = ProposedUnit without its fit and seam fields — what Pack yields before either judgment has run
complete_unit(d: DraftUnit, f: SpanFit, s: Seam) : ProposedUnit = d with fit := f, seam := s
D              = Set(ProposedUnit)     -- one Phase 1 cycle's whole draft: a PARTITION of the workset drafting ran over — its cuts pairwise obligation-disjoint, together covering that workset. This is what draft's own termination bound already rests on, since a workset that shrinks strictly as each obligation lands in a completed cut cannot also hand that obligation to a second cut; a draft carrying two claims on one obligation is therefore a defect in the draft, never a choice put to the reader. Where a region admits more than one workable apportionment, drafting draws ONE and records nothing about the other — whether that second reading deserves the reader is judged live at dispatch. Phase-local: built over a COPY of residual and discarded when the cycle settles, so no Λ field holds it
Unit           = { unit_ref: UnitRef, subject: String, obligations: Set(Obligation), fit: SpanFit, seam: Seam, capability_requirements: Set(CapabilityRequirement), feasibility_notes: Set(FeasibilityNote) }
SpanFit        ∈ {Fits, Overflows, Indeterminate}
Seam           = Grounded(Evidence) ⊎ Heuristic
Evidence       = { source: String, content: String }
CapabilityRequirement = a functional description of what carrying out the unit's work requires — descriptive only
FeasibilityNote = a free-text observation flagging a feasibility concern read from the goal — descriptive, not enforced; the empty set is valid when the unit carries no such concern
Derive         = Unit → (Set(κ), Set(ρ), Set(σ))
κ              = CompiledCondition { unit: Unit, obligation: Obligation, kind: PredicateKind, condition: VerifiablePredicate }
PredicateKind  ∈ {completion, invariant}
VerifiablePredicate = an executable check with a determinate pass/fail outcome
ρ              = Residual { obligation: Obligation, unit: Option(Unit), kind: PredicateKind, disposition: Option(ResidualDisposition) }
ResidualDisposition ∈ {AcceptUncovered} ∪ Emergent(ResidualDisposition)   -- written only by Phase 2 AcceptResiduals; a residual carries None until that step runs, which is what the AcceptUncovered filters distinguish
judgment_settled(x) ≡ what settles x is a judgment made against the context accumulated by the moment the question comes live and what the user has actually said by then, so no compile-time artifact can stand in for it: x is neither a predicate evaluable when an interval stops nor an obligation an interception could guard before an action runs. Fixing its answer now would close a live question where the user is not present, which is why leaving x open is the CORRECT disposition rather than a deferred shortfall. Judged AT the step that reaches x — Derive for an obligation of a unit, Qt for the whole-goal acceptance criterion — over candidates arriving there like any other, as VelocityFilter's partition is: the type does not guarantee it, a misjudgment is possible, and the confirmation gate is where one shows
σ              = JudgmentReservation { subject: ReservedSubject, unit: Option(Unit), kind: PredicateKind, ground: JudgmentGround, basis: Evidence }   -- the record that an item is held open to a judgment made outside compile time. A SIBLING of Residual and of OOSDeclaration, never a widening of either: a residual is an obligation the plan leaves unguarded and the user accepts as such, an OOSDeclaration hands an obligation to a substrate that must intercept before an action runs, and a reservation hands nothing anywhere — it names the ground that settles the item once the question comes live
ReservedSubject = ReservedObligation(Obligation) ⊎ ReservedAcceptance   -- ReservedAcceptance is the whole-goal acceptance criterion itself, which names no obligation; its reservation carries unit = None and kind = completion
JudgmentGround = a statement of what settles the reserved item at the moment it comes live — the context accumulated by then together with what the user has actually said by then — never a predicate this protocol could evaluate now
S              = Set(JudgmentReservation)        -- reservations, unit-scoped and whole-goal alike
reserved_completion_obligations(u, S) = { o | σ ∈ S, σ.subject = ReservedObligation(o), σ.unit = Some(u), σ.kind = completion }
acceptance_reserved(Λ) ≡ ∃ σ ∈ Λ.S : σ.subject = ReservedAcceptance   -- the whole-goal acceptance criterion is on record as constitutively open. DISTINCT from Λ.unbounded_approved, which records a waiver of a criterion the plan should have carried: one says the criterion is correctly left to resolve later, the other says a shortfall was accepted, and the convergence predicate keeps them apart
acceptance_reservation() = JudgmentReservation { subject: ReservedAcceptance, unit: None, kind: completion, ground: "the context accumulated by the moment the goal is judged accepted, together with what the user has actually said by then", basis: Evidence { source: "the ReserveJudgment answer at the whole-goal acceptance gate", content: "the criterion's right answer varies with that ground, so fixing it now would settle a live question where the user is not present" } }   -- the ground is fixed by the constructor, which is why the gate arm carries no direction: what settles this criterion is the same ground in every plan that reserves it
K              = Set(CompiledCondition)          -- unit-local conditions
P              = Set(PlanCondition)              -- cross-unit conditions
PlanCondition  = { scope: PlanScope, kind: PredicateKind, condition: VerifiablePredicate, dischargeable_when: PlanStateRequirement }
PlanScope      ∈ {FinalIntegration, GlobalNonRegression, WholeGoalAcceptance} ∪ Emergent(PlanScope)
UnitRef        = a stable identity carried by an emitted unit, assigned at integration and never reused
PlanStateRequirement = { predicate: VerifiablePredicate, basis: NonEmptySet(Evidence) }   -- cites the evidence the requirement rests on and is never empty, so a consumer placing this condition has a basis to judge it against; whether that evidence still tracks what it asserts is the receiving side's support-integrity judgment, not something this protocol certifies at compile time
topology_free(req) ≡ req contains no UnitRef, Move, MoveRegion, or order-position reference
LeafConjunct   = { condition: VerifiablePredicate, kind: PredicateKind }
NonEmptySet(T) = { S: Set(T) | S ≠ ∅ }
conjuncts(u)   = { { condition: κ.condition, kind: κ.kind } | κ ∈ K, κ.unit = u }
accepted_completion_residuals(u, R) = { ρ.obligation | ρ ∈ R, ρ.unit = Some(u), ρ.kind = completion, ρ.disposition = AcceptUncovered }
UnitResolution = DeterminateResolution { predicate: VerifiablePredicate, conjuncts: Set(LeafConjunct) } ⊎ AcceptedUncoveredResolution { accepted_completion_residuals: NonEmptySet(Obligation), conjuncts: Set(LeafConjunct) } ⊎ ReservedJudgmentResolution { reserved_completion_obligations: NonEmptySet(Obligation), conjuncts: Set(LeafConjunct) } -- THE CROSS-SEAM TERMINATION CERTIFICATE
resolve_unit(u, K, R, S) : UnitResolution = DeterminateResolution { predicate: ⋀ { κ.condition | κ ∈ K, κ.unit = u }, conjuncts: conjuncts(u) } when ∃ κ ∈ K : κ.unit = u ∧ κ.kind = completion
                                        ; AcceptedUncoveredResolution { accepted_completion_residuals: accepted_completion_residuals(u, R), conjuncts: conjuncts(u) } when ∄ κ ∈ K : κ.unit = u ∧ κ.kind = completion ∧ accepted_completion_residuals(u, R) ≠ ∅
                                        ; ReservedJudgmentResolution { reserved_completion_obligations: reserved_completion_obligations(u, S), conjuncts: conjuncts(u) } when ∄ κ ∈ K : κ.unit = u ∧ κ.kind = completion ∧ accepted_completion_residuals(u, R) = ∅ ∧ reserved_completion_obligations(u, S) ≠ ∅   -- the arms are tried in this order and are total over the units CONVERGENCE admits: a unit's completion is a compiled predicate, an accepted-uncovered residual, or a reservation, and the completion clause below requires at least one of the three. A unit carrying both an accepted completion residual and a reserved completion obligation takes the accepted arm, its reservation staying visible in the emitted reservation set keyed by σ.unit. The third certificate does not say the unit runs guarded — the interval is unguarded on that obligation exactly as in the accepted arm, and no step of this protocol makes anyone judge it. What it names is the ground that settles the unit's done, and what distinguishes it from the accepted arm is that nobody has accepted the gap
E              = Set(GoalEntry)        -- emission
GoalEntry      = UnitEntry { unit_ref: UnitRef, subject: String, obligations: Set(Obligation), resolution: UnitResolution, capability_requirements: Set(CapabilityRequirement), feasibility_notes: Set(FeasibilityNote) } ⊎ PlanEntry { scope: PlanScope, kind: PredicateKind, condition: VerifiablePredicate, dischargeable_when: PlanStateRequirement } ⊎ PlanEnvelopeEntry { accepted_residuals: Set(AcceptedResidualEntry), reserved: Set(JudgmentReservation), oos: Set(OOSDeclaration), unbounded_approved: Bool }
oos            = Set(OOSDeclaration)   -- obligations guardable only by pre-action interception
OOSDeclaration = { obligation: Obligation, substrate: String, basis: Evidence }   -- unchanged by the reservation slot: this declares an obligation whose violation must be caught BEFORE an action runs and names the substrate that must catch it. A reserved item names no substrate and asks nothing to intercept, so it is never written here and this set never widens to hold one
ReadObligations = G → O_G
VelocityFilter = O_G → oos
InvariantStatus = { coverage_complete: Bool, span_fit: Bool, termination_covered: Bool, obligations_derived: Bool, oos_substrate_named: Bool, reservation_ground_named: Bool, plan_conditions_topology_free: Bool }
hard_invariants_hold(Λ) ≡ Λ.invariant_status.coverage_complete ∧ Λ.invariant_status.span_fit ∧ Λ.invariant_status.termination_covered ∧ Λ.invariant_status.obligations_derived ∧ Λ.invariant_status.oos_substrate_named ∧ Λ.invariant_status.reservation_ground_named ∧ Λ.invariant_status.plan_conditions_topology_free
coverage_complete(U, O_G) ≡ ∀ o ∈ O_G : (∃ u ∈ U : o ∈ u.obligations) ∨ (∃ d ∈ oos : d.obligation = o ∧ d.substrate ≠ "") ∨ o ∈ Λ.accepted   -- a reserved obligation stays in the unit it was packed into, so it is covered by the FIRST disjunct and this predicate needs no reservation arm
span_fit(U)    ≡ ∀ u ∈ U : u.fit = Fits ∨ u.unit_ref ∈ Λ.fit_overrides
reservation_ground_named(S) ≡ ∀ σ ∈ S : σ.ground ≠ ""   -- the reservation's counterpart to oos_substrate_named: a reservation whose ground is unstated records nothing a later judgment could act on
obligation_derived(u, K, R, S) ≡ ∀ o ∈ u.obligations : (∃ κ ∈ K : κ.unit = u ∧ κ.obligation = o) ∨ (∃ ρ ∈ R : ρ.unit = Some(u) ∧ ρ.obligation = o) ∨ (∃ σ ∈ S : σ.unit = Some(u) ∧ σ.subject = ReservedObligation(o))
derived_already(u, K, R, S) ≡ (∃ κ ∈ K : κ.unit = u) ∨ (∃ ρ ∈ R : ρ.unit = Some(u)) ∨ (∃ σ ∈ S : σ.unit = Some(u))
acceptance_present(P) ≡ ∃ p ∈ P : p.scope = WholeGoalAcceptance ∧ p.kind = completion   -- BOTH fields: a whole-goal INVARIANT is a boundary the run preserves, not a statement of when the goal is accepted, so it neither suppresses Qt nor stands in for the waiver at emission
Aᵤ             = UnitJudgment ∈ {AcceptUnit, Recut(cut, direction), Sufficient} when SpanFit = Fits; {OverrideFit, Recut(cut, direction)} otherwise, joined by Sufficient while some still-unsettled cut of the draft has fit = Fits   -- Recut carries its TARGET as well as its direction: the gate presents one contested cut but ships the draft's other still-unsettled cuts with it, so the reader may send back any of those and not only the one in front of them. The target ranges over the surfaced draft's still-unsettled cuts; a cut this cycle already integrated is reached by Reopen at the confirmation gate instead, which is the one path that returns an owned obligation to residual   -- the accept/override pair is INDEXED by the fit verdict rather than deleted at presentation: the defined set for a firing IS what that firing presents, so `Fit-indexed answer set`'s intact-presentation invariant holds and an unfitting unit has no unguarded accept. Sufficient is indexed on that same principle one axis over: what it accepts is the draft's still-unsettled FITTING cuts, so on the unfitting arm it stands only while such a cut remains. With none left it would integrate the empty set and re-present the very cut already in front of the reader — an option with no future rather than a choice — and the ways forward there are the override and the recut, both of which move. On the fitting arm the presented cut is itself such a cut, so the condition holds by construction and never bites
V              = Judgment ∈ {Confirm, Adjust(direction), Reopen(unit)}
Vₜ             = TerminationJudgment ∈ {DefineNow(direction), RouteBound, ReserveJudgment, ApproveUnbounded}   -- ReserveJudgment and ApproveUnbounded are the two ways the plan proceeds without a defined criterion, and they assert opposite things: the first that the criterion is constitutively open and correctly stays so, the second that one the plan should have carried is waived. They write different Λ state, and each retracts the other's record, so the mutual exclusion at convergence holds by construction rather than being merely asserted
plan_condition(d) = PlanCondition { scope: WholeGoalAcceptance, kind: completion, condition: [the predicate direction d states], dischargeable_when: PlanStateRequirement { predicate: λ candidate_plan. False, basis: {Evidence { source: "the DefineNow answer at the whole-goal acceptance gate", content: d }} } }   -- the placeholder predicate is False until BindPlanRequirements normalizes it against |U|; the basis is the user's own definition, which is what makes it inhabit NonEmptySet from construction rather than after a repair
BindPlanRequirements(P, U) = { p with dischargeable_when := plan_terminal(|U|) when p.scope = WholeGoalAcceptance; p unchanged otherwise | p ∈ P }   -- scope alone, deliberately unlike acceptance_present: a whole-goal invariant is still discharged at plan-terminal — it just does not answer the acceptance question
plan_terminal(n) = PlanStateRequirement { predicate: λ candidate_plan. |candidate_plan.units| = n ∧ ∀ r ∈ { e.resolution | e ∈ candidate_plan.units } : (r = DeterminateResolution { predicate: d, ... } ⟹ d holds) ∧ (r = AcceptedUncoveredResolution { accepted_completion_residuals: A, conjuncts: C } ⟹ A ≠ ∅ ∧ A ⊆ { a.obligation | a ∈ candidate_plan.accepted_residuals, a.kind = completion } ∧ ∀ c ∈ C : c.condition holds) ∧ (r = ReservedJudgmentResolution { reserved_completion_obligations: J, conjuncts: C } ⟹ J ≠ ∅ ∧ J ⊆ { o | s ∈ candidate_plan.reserved, s.subject = ReservedObligation(o), s.kind = completion } ∧ ∀ c ∈ C : c.condition holds), basis: {Evidence { source: "the current plan's UnitResolution, accepted-residual and reservation projections", content: "expected aggregate resolution count = " + String(n) + "; all executable resolution conditions; aggregate accepted-completion record; aggregate reserved-completion record" }} }
Rerouted       = routed_to_bound   -- produced by route_bound's relay emission, never by a bare deactivate: a declared route that no step emits would drop the continuation the user just chose
Emit           = (U, K, R, S, P, oos, unbounded_approved) → E [Tool: record]   -- R feeds resolve_unit's accepted arm and S its reserved arm; S, oos and unbounded_approved feed the envelope
Phase          ∈ {0, 1, 2, 3}
Qu             = Per-cycle apportionment interaction with (Anchor, proposed_unit: ProposedUnit, SpanFit, Seam, the cut set U as it stands at this firing, the still-unsettled cuts of the draft this cycle surfaced) [Tool: Constitution interaction]   -- the unsettled cuts travel because Sufficient settles THAT displayed draft; without them the answer would have nothing to accept but a re-derivation the user never saw, which is what would erase the seam dispositions drafting had already judged
Qt             = Whole-goal acceptance interaction, conditional on ¬acceptance_present(P) [Tool: Constitution interaction]
Qc             = Unit-plan confirmation interaction with (U, K, R, S, P, InvariantStatus, oos) [Tool: Constitution interaction]
ConditionBearingUnitPlan = { units: Set(UnitEntry), plan_conditions: Set(PlanEntry), accepted_residuals: Set(AcceptedResidualEntry), reserved: Set(JudgmentReservation), oos: Set(OOSDeclaration), unbounded_approved: Bool }
AcceptedResidualEntry = { obligation: Obligation, unit_ref: Option(UnitRef), kind: PredicateKind }
plan           = the ConditionBearingUnitPlan value returned by this invocation
HandoffLocator = { record: the durable identity of the carrier record C, session: the id of the session that parked it }
C              = PlanCarrier: the ONE durable record park_carrier writes the packaged plan into (record_handoff then emits N over it) — a single dereferenceable entry, distinct from E's per-unit entries, which exist for the downstream completion-predicate enforcer and carry no aggregate identity of their own
locator(C)     = HandoffLocator { record: C's record identity as the carrier-creating call returned it; session: the id of the session running record_handoff }   -- substrate-neutral by construction: the identity is whatever the carrier-creating call returned, so this type never names what performs that call
N              = NavigationBlock { purpose_frame: String, canonical_locator: HandoffLocator, dereference_instruction: DereferenceInstruction, snapshot_anchor: Option(String), grounding_instruction: GroundingInstruction }
DereferenceInstruction = an instruction to read the carrier record at the canonical locator's record identity, within the session that locator names — one read yields the whole plan
GroundingInstruction = the fixed instruction to run /inquire where available, or the recipient's equivalent grounding pass, and stop when a source is unreachable or a needed premise lacks support-integrity — and, when the parked plan carries reservations, to surface each as an open question together with the ground that settles it, worded so it invites an answer rather than suggesting one, since an answer suggested here would be a compile-time default standing in for the live one. A reservation is NOT a fourth stop condition: whether one blocks is read against the work actually at hand, and that read belongs to the recipient, never to this block
handoff_recorded(N, C) ≡ park_carrier wrote the packaged plan into C ∧ record_handoff presented N in the handoff output ∧ N.purpose_frame ≠ "" ∧ N.canonical_locator = locator(C) ∧ N.canonical_locator.session ≠ ""   -- the emission IS the text
── PHASE TRANSITIONS ──
Phase 0: G → Probe(G) [Tool] → goal_plan_uncompiled?                   -- activation checkpoint (observe): dereferences a prior navigation block when one is in scope, else internal analysis
           ¬autonomous_intent(G) → relay → deactivate                  -- no autonomous interval in scope (extension)
           ¬single_goal(G) → relay → deactivate                        -- composite goal: G bundles several stated outcomes whose only common bond is the host's standing procedural contract, and that contract attaches to any work there, so it evidences no shared outcome and can carry no seam. The relay names each constituent outcome and that bond; one apportionment per goal. Tested BEFORE the locator and condition_bearing arms, whose verdicts have no single subject over a bundle, and BEFORE init_loop_state, so no Λ loop field is seeded (extension)
           locator in scope ∧ (¬dereferenceable ∨ support-integrity failure) → relay → deactivate   -- handoff unreadable, for the locator that can be in scope here: the goal's navigation block. Covers a carrier that would not resolve, and a load-bearing premise the grounding pass could not support; the uncompiled arm is NOT taken (extension)
           condition_bearing(G)  → relay → deactivate                  -- units and conditions already present (extension)
           uncompiled            → ReadObligations(G) → O_G → VelocityFilter(O_G) → oos → init_loop_state (U=∅, residual=O_G \ {d.obligation | d∈oos}, K=∅, R=∅, S=∅, P=∅, plan_conditions_derived=⊥, plan_conditions_stale=⊥, fit_overrides=∅, invariant_status=⊥, accepted=∅, unbounded_approved=⊥) → Phase 1   -- ONE-TIME init, fired only on this edge; Phase 2's Reopen re-enters Phase 1 without re-running it. ReadObligations SUBTRACTS the host's standing procedural contract at this same step, so residual is seeded from what THIS goal generated; G remains unchanged
Phase 1: (G, residual) → residual?   -- the empty-residual arms are read off residual DIRECTLY, before anything is drafted: a draft coming back with no cut cannot distinguish "nothing was there to cut" from "nothing could be cut", and only the first of those relays. The second arm is the ordinary completion edge every converging run leaves Phase 1 through. apportionment loop (sense); residual/oos enter this phase either freshly seeded or as Reopen left them — never re-seeded on entry
           residual = ∅ ∧ U = ∅ ∧ oos = ∅ → relay(goal's scope too thin to read any obligation) (extension) → deactivate
           residual = ∅ ∧ (U ≠ ∅ ∨ oos ≠ ∅) → Phase 2
           residual ≠ ∅ → draft(G, residual) [Tool] → D → surface_draft(D) (extension)   -- draft iterates Scan/Pack/fit/qualify/complete_unit over a workset COPIED from residual until every obligation in that workset sits in a completed cut, autonomous_pack absorbing at heuristic seams only what the seam evidence could not reach; complete_unit still writes each cut's fit and seam, so a cut drafted in bulk carries the same two judgments an anchored one did and a whole draft is not uniformly heuristic. The copy is what keeps drafting owner-neutral: no obligation leaves residual here, integrate remaining the sole owner-changing step, so the coverage partition is untouched by anything drafting does. surface_draft then puts the WHOLE draft in front of the reader before a single cut is settled
             D holds no Heuristic cut ∧ each c ∈ D with fit = Fits ∧ no alternative cut of c's obligations standing up to the same evidence → relay(AcceptUnit) (extension) → integrate(c, U, residual)   -- the leading conjunct is the draft gate condition, read over the whole draft: one heuristic cut sends the draft to the gate entire. The rest is the option-set relay test, applied HERE and read live: D is a partition, so what this weighs is a cut drafting did NOT draw, never a second member of D standing against the first
             D has no unsettled cut left ∧ residual = ∅ → Phase 2
             else → Qu → Stop → Aᵤ (constitution) [Tool]   -- Qu carries the first unsettled cut standing as its own Anchor, that cut's SpanFit and Seam, U, and the draft's still-unsettled cuts
               Aᵤ = AcceptUnit   → integrate(the cut this firing presented, U, residual) → Phase 1        -- in Aᵤ's defined set iff SpanFit = Fits
               Aᵤ = Recut(c, d)  → re-derive c's Anchor frame under d → Phase 1   -- c is any still-unsettled cut of the surfaced draft, not only the presented one: same residual, different cut, and the next cycle drafts under d
               Aᵤ = OverrideFit  → integrate(the cut this firing presented, U, residual) → u' → Λ.fit_overrides := Λ.fit_overrides ∪ {u'.unit_ref} → Phase 1   -- in Aᵤ's defined set iff SpanFit ≠ Fits
               Aᵤ = Sufficient   → ∀c ∈ D still unsettled with fit = Fits: integrate(c) → c' → U := U ∪ {c'}, residual := residual \ c'.obligations → [no cut still unsettled has fit ≠ Fits ∧ residual = ∅: surface (extension) → Phase 2 | else Qu over the first still-unsettled cut with fit ≠ Fits, that cut standing as its own Anchor and carrying its own SpanFit and Seam → Stop → Aᵤ → the same Aᵤ dispatch] → Phase 1   -- blanket relay over the fitting cuts OF THE DISPLAYED DRAFT: Sufficient is the user's constitutive act over that whole, so what it accepts is what was shown, each seam disposition intact, rather than a remainder re-packed at heuristic seams the user never saw
Phase 2: U → ∀u∈U, ¬derived_already(u,K,R,S): Derive(u) → (Set(κ), Set(ρ), Set(σ)) → K:=K∪κs, R:=R∪ρs, S:=S∪σs ∥ [¬Λ.plan_conditions_derived: DerivePlan(G, U) → P; Λ.plan_conditions_derived := ⊤]   -- condition derivation (sense), scoped to units and plan conditions not yet derived this apportionment
           oos ≠ ∅ → OOS(oos) (extension)                              -- out-of-scope declaration, substrate recorded on each OOSDeclaration
           S ≠ ∅ → Reserved(S) (extension)                             -- reservation notice, ground recorded on each JudgmentReservation; no substrate is named because none is asked to intercept
           ¬acceptance_present(P) → Qt(K, P) → Stop → Vₜ (constitution) [Tool]   -- fires at pass entry, and again after any Adjust that clears acceptance
             Vₜ = DefineNow(d)     → P := P ∪ {plan_condition(d)}; [Λ.unbounded_approved: Λ.unbounded_approved := ⊥]; S := S \ {σ∈S : σ.subject = ReservedAcceptance}
             Vₜ = RouteBound       → route_bound (extension) [Tool] → deactivate (Rerouted)
             Vₜ = ReserveJudgment  → S := S ∪ {acceptance_reservation()}; [Λ.unbounded_approved: Λ.unbounded_approved := ⊥]   -- records the criterion as constitutively open; this arm never SETS the waiver flag, so no waiver is claimed, and it CLEARS one still standing from an earlier Qt firing on this same invocation
             Vₜ = ApproveUnbounded → Λ.unbounded_approved := ⊤; S := S \ {σ∈S : σ.subject = ReservedAcceptance}   -- the symmetric retraction: drops a ReservedAcceptance member still standing from an earlier Qt firing, so the arm answered last is the one that stands
           BindPlanRequirements(P, U) → P := Pᵦ → check(U, K, R, S, Pᵦ, oos) → Λ.invariant_status := InvariantStatus (track)   -- the ONLY writer of Λ.invariant_status, which Confirm's hard_invariants_hold guard reads; normalize every WholeGoalAcceptance requirement against the current |U| BEFORE topology_free is checked; coverage_complete ∧ span_fit ∧ termination_covered ∧ obligations_derived ∧ oos_substrate_named ∧ reservation_ground_named ∧ plan_conditions_topology_free (track)
           Λ.plan_conditions_stale → StaleNotice(P) (extension)        -- pre-Qc surfacing: review, Adjust, or Confirm as recorded
           Qc(U, K, R, S, P, InvariantStatus, oos) → Stop → V (constitution) [Tool]
             V = Adjust(d) → rederive over the SAME U → (K, R, S, P) := (K', R', S', P') → Λ.plan_conditions_stale := ⊥ → [¬acceptance_present(P') → Qt] → [acceptance_present(P') ∧ Λ.unbounded_approved: Λ.unbounded_approved := ⊥] → [acceptance_present(P') ∧ acceptance_reserved(Λ): S' := S' \ {σ : σ.subject = ReservedAcceptance}] → BindPlanRequirements(P', U) → P' := Pᵦ' → check(U, K', R', S', Pᵦ', oos) → Λ.invariant_status := InvariantStatus → re-present Qc   -- obligation_derived(u, K', R', S') holds for every u ∈ U; rederive rewrites the unit-scoped members of S only, the ReservedAcceptance member being Qt's own record; check is RE-RUN against the normalized adjusted state before Qc re-presents
             V = Reopen(u) → residual := residual ∪ u.obligations; U := U \ {u}; K := K \ {κ∈K:κ.unit=u}; R := R \ {ρ∈R:ρ.unit=Some(u)}; S := S \ {σ∈S:σ.unit=Some(u)}; Λ.fit_overrides := Λ.fit_overrides \ {u.unit_ref}; Λ.plan_conditions_stale := ⊤ → Phase 1   -- the reopened unit's derived conditions, reservations and fit-override record leave with it; the unit-free ReservedAcceptance member stays; P itself is not re-derived (`Back-edge state preservation`)
             V = Confirm ∧ ¬hard_invariants_hold(Λ) → re-present Qc naming the violated invariant
             V = Confirm ∧ hard_invariants_hold(Λ) → AcceptResiduals(R) → Λ.accepted := Λ.accepted ∪ {ρ.obligation | ρ ∈ R}; ∀ρ∈R: ρ.disposition := AcceptUncovered (track) → Phase 3   -- AcceptResiduals produces the accepted-completion witnesses resolve_unit reads during Emit; S is untouched, a reservation being a sibling of the residual rather than one awaiting acceptance
Phase 3: (U, K, R, S, P, oos, unbounded_approved) → Emit → E [Tool: record] → package(E) → plan → park_carrier(plan) → C [Tool: record] (track) → record_handoff(C) → N (extension) → converge(apportionment trace) (extension) → ConditionBearingUnitPlan

Phase 0 → Phase 1: goal_plan_uncompiled(G)                             -- this edge alone performs the one-time VelocityFilter/residual init
Phase 0 → deactivate: ¬autonomous_intent(G) ∨ ¬single_goal(G) ∨ condition_bearing(G) ∨ (locator in scope ∧ (¬dereferenceable ∨ support-integrity failure))   -- relay the scan result; no activation. "Locator in scope" is the goal's navigation block, the only locator this phase can hold. ¬single_goal is the composite-goal termination path: it relays the constituent outcomes and deactivates, exactly as the other three non-activation arms do
Phase 1 → deactivate: residual = ∅ ∧ U = ∅ ∧ oos = ∅                   -- nothing could be read from the goal's scope; relays rather than emitting an empty plan
Phase 1 → Phase 1: next draft over the current residual                -- bounded by coverage (residual strictly shrinks on AcceptUnit/OverrideFit, and on every cut the relay arm integrates) and by user agency (Recut/Sufficient). Each cycle discards the previous draft and re-drafts what is left, so nothing carries a stale cut forward and no Λ field has to hold one
Phase 1 → Phase 2: residual = ∅ ∧ (U ≠ ∅ ∨ oos ≠ ∅)                    -- every obligation apportioned or visibly delegated
Phase 2 → Phase 1: V = Reopen(u)                                       -- that unit's obligations return to residual; bounded by user agency exactly as Adjust is
Phase 2 → Phase 2: V = Adjust(d)                                       -- rederive over the same apportionment; U unchanged
Phase 2 → Phase 2: V = Confirm ∧ ¬hard_invariants_hold(Λ)              -- Qc re-presents with the violated invariant named; no state advances
Phase 2 → deactivate: Vₜ = RouteBound                                  -- Rerouted; route_bound emits the route first; /bound → /apportion re-entry recompiles fresh
Phase 2 → Phase 3: V = Confirm ∧ hard_invariants_hold(Λ)               -- residuals accepted on record; every clause of apportioned(G) that Qc can violate holds AT THE TRANSITION
Phase 3 → converge: emitted(E) ∧ handoff_recorded(N, C)                -- ConditionBearingUnitPlan + apportionment trace + navigation block

── LOOP ──
Two bounded loops, one per irreducible part.

Apportionment loop (Phase 1): one whole-residual draft per cycle.
  Each cycle drafts the current residual to closure, surfaces that draft entire, then settles out of it — the
  relay path opening only over a draft whose every cut cites a seam the goal evidences and, once open,
  integrating every cut no second reading contests; the gate takes the rest one at a time, and takes the
  draft entire where any cut is heuristic.
  Two bounds, nested and independent. INSIDE a cycle, drafting terminates because it runs over a COPY of
  residual that strictly shrinks as each obligation lands in a completed cut, autonomous_pack absorbing whatever
  no seam evidence reaches, so the workset empties in finitely many steps and no cut is left without one.
  ACROSS cycles, residual strictly shrinks on every AcceptUnit, every OverrideFit, every cut the relay arm
  integrates, and every Sufficient — which stands only while the draft still holds an unsettled fitting cut, so
  it always has one to integrate — and the loop therefore cannot cycle on coverage. Recut alone leaves residual
  unchanged: it re-frames one still-unsettled cut of the surfaced draft under a user direction, whichever cut
  the answer names, and the next cycle drafts under that direction, so it is bounded by user agency rather
  than by coverage. A cycle entered via Reopen (the one back-edge from Phase 2) drafts residual exactly as
  Reopen left it: that unit's restored obligations, every other already-packed unit's obligations untouched. No draft crosses a cycle boundary — each cycle discards
  the last and re-drafts what remains, which is why no Λ field holds a draft and no transition has to hunt down
  cuts a settlement made stale.

Condition loop (Phase 2): Qt fires whenever the whole goal carries no acceptance criterion — at pass entry, and
  again after an Adjust that clears one. Its two no-criterion arms assert opposite things and are kept apart end
  to end: ReserveJudgment records the criterion as constitutively open, ApproveUnbounded records a waiver, and
  each RETRACTS the other's record when it is still standing — so at most one of the two ever holds, by
  construction rather than by assertion, and a user who answers one arm at a later firing has revised the earlier
  answer rather than added to it. An Adjust that instead INTRODUCES whole-goal acceptance retracts
  whichever of the two is still on record in that same transition — the waiver by clearing Λ.unbounded_approved,
  the reservation by dropping its ReservedAcceptance member — and does not re-fire Qt; the SAME retraction of
  both fires unconditionally on Qt's own DefineNow arm, on every firing.
  Qc's Adjust rederives over the SAME apportionment — K' ∪ R' ∪ S' still spans every obligation of every unit
  (obligation_derived, no removal; a withdrawn or weakened condition becomes a residual, and a residual the
  direction re-reads as settled by judgment becomes a reservation). BindPlanRequirements
  runs idempotently on every pass immediately before check, so every WholeGoalAcceptance condition carries
  plan_terminal(|U|) before the guard reads it; check is RE-RUN in full against that normalized state before Qc
  re-presents, so Confirm's hard_invariants_hold guard always consults an InvariantStatus computed against the
  current K/R/S/P/U. Confirm performs no later P mutation and does not waive a hard invariant: a coverage or fit
  violation re-presents Qc with the violation named rather than advancing to emission. Reopen is the one
  back-edge to Phase 1: it returns exactly that unit's obligations to residual, clears that unit's own K/R/S
  entries, and re-enters the apportionment loop. The back-edge is SCOPED: residual is never re-seeded from the
  goal's full obligation set, and Derive/DerivePlan run only over what is not yet derived, so a unit's
  Adjust-shaped conditions and any whole-goal conditions already on record survive the detour. Reopen also sets
  Λ.plan_conditions_stale, and the next Qc surfaces that as a notice — Adjust or Confirm as recorded — clearing
  once the user Adjusts. AcceptResiduals then accepts R and supplies the non-empty completion-residual witness
  any AcceptedUncoveredResolution needs at Emit. Confirm terminates.

Stateless: Merismos terminates at emission. No invocation-local state survives into the execution interval —
no session approvals, no per-action classification, no mid-execution checkpoint. The emitted navigation
block is the cross-session route to the carrier, not surviving Λ state.

Convergence evidence (relay, at emission): present the apportionment trace —
  (a) Plan readback — the goal restated as its units in plain single-sentence form;
  (b) Per-unit: (obligations covered, seam quality with its citation or heuristic declaration, horizon fit or
      the recorded override) → the unit resolution certificate — the conjoined predicate plus typed conjuncts
      when the unit has ≥1 compiled completion condition, an accepted-completion witness plus any invariant
      conjuncts when it has none, or a reserved-completion witness plus any invariant conjuncts when what its
      done means is held open to judgment — the unit's capability requirements and feasibility notes, and the
      disposition that settled it: relayed as a cut no second reading contested, accepted at the gate, accepted
      with a recorded override, or settled under a Sufficient over the displayed draft. This is REPORTED CONDUCT,
      not a field read back — the run presenting this trace is the one that just took those arms, and no Λ cell
      holds the answer. Making it one would buy nothing the ordering does not already give: Whole Draft over
      Serial Cut is a property of WHEN surfacing happens relative to integration, so no predicate over the final
      state can check it and a run that skipped the surfacing would write the same label as one that did not.
      What the disposition earns its place by is showing the reader which cuts they settled and which the draft
      settled for them;
  (c) Plan-level conditions with the plan-state requirement that makes each safe to discharge;
  (d) Each accepted-uncovered residual with its obligation, each reserved item with the ground that settles it,
      and each out-of-scope obligation with its substrate;
  (e) When unbounded_approved: the recorded whole-goal acceptance waiver with its gate site. When the whole-goal
      acceptance criterion is reserved instead: that reservation with its ground, stated as a criterion left
      open on purpose rather than as a gap — the two never appear together.
(d) and (e) are additionally emitted as a plan-envelope entry alongside the unit and plan-condition entries.
Convergence is demonstrated, not asserted.

── CONVERGENCE ──
-- plan denotes the returned ConditionBearingUnitPlan (see TYPES); E is the record-emitted goal-entry set
apportioned(G) = emitted(E) ∧ handoff_recorded(N, C)
                 ∧ coverage_complete(U, O_G) ∧ span_fit(U)
                 ∧ (U ≠ ∅ ∨ oos ≠ ∅)                                                -- a goal with nothing read from it never claims apportionment occurred
                 ∧ (∀u∈U: (∃ κ ∈ K : κ.unit = u ∧ κ.kind = completion) ∨ (∃ ρ ∈ R : ρ.unit = Some(u) ∧ ρ.kind = completion) ∨ (∃ σ ∈ S : σ.unit = Some(u) ∧ σ.kind = completion))   -- the three arms are exactly resolve_unit's three, in its order, so every emitted unit has a defined certificate
                 ∧ (∀u∈U: obligation_derived(u, K, R, S))
                 ∧ (∀u∈U: |{e ∈ E : e is UnitEntry ∧ e.unit_ref = u.unit_ref}| = 1)   -- the join rule holds: one unit entry per unit, keyed on unit_ref — subject is not unique across units
                 ∧ (∀u∈U: ∀e∈E: (e is UnitEntry ∧ e.unit_ref = u.unit_ref) → (e.obligations = u.obligations ∧ e.resolution = resolve_unit(u, K, R, S) ∧ e.capability_requirements = u.capability_requirements ∧ e.feasibility_notes = u.feasibility_notes))   -- the join rule's durable certificate: resolve_unit jointly supplies the completion disposition, its accepted-completion or reserved-completion witness when needed, and every typed conjunct; the emitted obligations/capability/feasibility fields are exact reads from the owning unit
                 ∧ (∀p∈P: ∃! e ∈ E : e is PlanEntry ∧ e.scope = p.scope ∧ e.kind = p.kind ∧ e.condition = p.condition ∧ e.dischargeable_when = p.dischargeable_when)
                 ∧ (∀e∈E: e is UnitEntry → ∃! u∈U: e.unit_ref = u.unit_ref)          -- reverse correspondence: no unapproved UnitEntry can ride in E
                 ∧ (∀e∈E: e is PlanEntry → ∃ p∈P: e.scope = p.scope ∧ e.kind = p.kind ∧ e.condition = p.condition ∧ e.dischargeable_when = p.dischargeable_when)   -- reverse correspondence: no unapproved PlanEntry can ride in E
                 ∧ (∀p∈P: topology_free(p.dischargeable_when))
                 ∧ (∀p∈P: p.scope = WholeGoalAcceptance → p.dischargeable_when = plan_terminal(|U|))   -- produced by BindPlanRequirements before the final check; the captured aggregate count prevents a dropped-unit projection from satisfying the terminal universal vacuously
                 ∧ plan.units = {e ∈ E : e is UnitEntry}                             -- the RETURNED plan's units are exactly E's UnitEntry partition — produced by Phase 3 package from E
                 ∧ plan.plan_conditions = {e ∈ E : e is PlanEntry}                   -- the RETURNED plan's plan conditions are exactly E's PlanEntry partition — produced by Phase 3 package from E
                 ∧ (acceptance_present(P) ∨ Λ.unbounded_approved ∨ acceptance_reserved(Λ))   -- the acceptance question is closed one of three ways: a defined criterion, a recorded waiver, or a recorded reservation
                 ∧ ¬(acceptance_present(P) ∧ Λ.unbounded_approved)                  -- a real acceptance condition and an unbounded waiver never both hold at emission
                 ∧ ¬(acceptance_present(P) ∧ acceptance_reserved(Λ))                -- nor a real acceptance condition and a reservation: DefineNow drops the reservation on the same edge that adds the condition
                 ∧ ¬(Λ.unbounded_approved ∧ acceptance_reserved(Λ))                 -- THE WAIVER/RESERVATION DISCRIMINATOR: exactly one of the two can stand at emission, so the converged plan alone answers whether the criterion was WAIVED (plan.unbounded_approved) or CORRECTLY LEFT OPEN (a ReservedAcceptance member of plan.reserved) — the two are never both set and never stand in for each other. This holds by construction: each of the two arms retracts the other, and DefineNow and an acceptance-introducing Adjust retract both
                 ∧ (∀d∈oos: d.substrate ≠ "")
                 ∧ (∀σ∈S: σ.ground ≠ "")                                             -- reservation_ground_named: every reservation names what settles it, as every out-of-scope declaration names its substrate
                 ∧ (∃! e ∈ E : e is PlanEnvelopeEntry)                               -- exactly one envelope per emission
                 ∧ (∀e∈E: e is PlanEnvelopeEntry → e.accepted_residuals = { AcceptedResidualEntry(ρ.obligation, ρ.unit.map(u ↦ u.unit_ref), ρ.kind) | ρ ∈ R : ρ.disposition = AcceptUncovered } ∧ e.reserved = S ∧ e.oos = oos ∧ e.unbounded_approved = Λ.unbounded_approved)   -- exact correspondence in BOTH directions, keyed by unit_ref rather than by obligation+kind; the reservation set carries across whole, its subjects distinguishing the unit-scoped members from the whole-goal one
                 ∧ plan.accepted_residuals = (the PlanEnvelopeEntry of E).accepted_residuals
                 ∧ plan.reserved = (the PlanEnvelopeEntry of E).reserved
                 ∧ plan.oos = (the PlanEnvelopeEntry of E).oos
                 ∧ plan.unbounded_approved = (the PlanEnvelopeEntry of E).unbounded_approved   -- the returned value READS BACK the emitted envelope rather than being re-derived beside it; produced by Phase 3 package from E
-- Rerouted (Qt RouteBound) is a deliberate non-emission exit — it does not claim ConditionBearingUnitPlan (see TYPES): the emitted result is well-formed exactly when apportioned(G) holds.
-- Each Phase 0 relay (no autonomous intent, composite goal, unreadable handoff, already condition-bearing)
-- precedes activation: init_loop_state never runs, so no clause of this predicate is entered or owed.
-- The guarantee is compile-time and pre-conduct (see the Apportion over Order invariant).

── TOOL GROUNDING ──
-- Realization: Constitution → TextPresent+Stop; Extension → TextPresent+Proceed
Phase 0 Probe        (observe)      → record read, artifact read (autonomous intent + goal singleness + uncompiled-plan detection over the goal; cue cited. Singleness is read off what G states: several stated outcomes bound only by the host's standing procedural contract are a bundle, since that contract attaches to any work there — the verdict is about G, never about whether some individual obligation is derivable. When the scan finds a prior /apportion navigation block, this step DEREFERENCES it — reading the ONE carrier record at the locator's record identity within the session that locator names, then running the grounding instruction — and decides condition_bearing against the plan read back from that carrier, whose accepted_residuals and reserved fields are what close its accepted-uncovered and reserved units respectively. An unreachable source, a locator missing either half, or a load-bearing premise the grounding pass cannot support STOPS: this step surfaces the handoff as unreadable and deactivates, and the goal never falls through to the uncompiled path — GroundingInstruction's own clause requires the stop, and /conduct's ground_pointer does the same on the mirror path. With no navigation block in scope at all the step is internal analysis over the goal alone, and the uncompiled path is correct)
Phase 0 relay        (extension)    → TextPresent+Proceed (no autonomous interval in scope, a composite goal, or the plan already carries units and conditions: surface the scan result; deactivate without activating. On the composite arm the surfaced result names each stated outcome the request bundles and the shared-procedure bond that made them read as one, so the user re-invokes once per goal rather than receiving units cut across them)
Phase 0 ReadObligations (observe)   → record read, artifact read (construct O_G once as G.obligations, a local read, never a G mutation. The same step SUBTRACTS every requirement the host attaches to any change regardless of the goal — its standing procedural contract — because such a requirement is an ambient invariant every emitted unit inherits rather than something this goal generated; leaving it in would make every goal in that host read the same inflated set and bury the goal's own obligations among them. The subtraction is not a delegation: no OOSDeclaration is written, since nothing is being handed to a pre-action interceptor. When it leaves nothing behind, the run reaches Phase 1 with residual = ∅, U = ∅ and oos = ∅ and takes the existing too-thin relay rather than emitting an empty plan. Produces the set VelocityFilter, residual seeding, and coverage_complete consume)
Phase 0→1 VelocityFilter (sense)    → Internal analysis (obligations guardable only by pre-action interception; computed from O_G on the Phase 0 → Phase 1 edge alongside init_loop_state and only there, before residual is seeded, so an out-of-scope obligation never enters the packing loop and Phase 2's Reopen back-edge re-enters the packing loop without recomputing this partition; empty scope with no obligation and no delegation relays rather than proceeding)
Phase 1 Scan         (observe)      → artifact read, artifact search (optional seam evidence gathering over the goal's cited substrate; read-only)
Phase 1 Pack         (sense)        → Internal analysis (apportionment search: units fitting one horizon, coverage over obligations; produces a DRAFT when it finds a cut — an empty Anchor IS this step's no-cut verdict and yields no draft, which is why the exhaustion arms are decided before fit and qualify run — and fit and seam are written later by complete_unit, so what Pack yields does not yet inhabit ProposedUnit; reads each proposed unit's capability requirements and feasibility notes from the goal's stated needs — functional descriptions only, never a concrete executor/model/runtime/tool token (Substrate Boundary). The search may well turn up more than one workable cut of the same Anchor; what it does with that is DRAW ONE. The draft is a partition, so standing both in it would leave two cuts claiming one obligation — the defect draft's own termination bound forbids, not an option put on offer. It records nothing about the cut it did not draw: whether that second reading deserves the reader belongs to the relay step, made later against the surfaced whole, and a verdict fixed here would settle it before the reader had the draft in hand)
Phase 1 fit          (sense)        → Internal analysis (per-unit horizon-fit verdict; Indeterminate surfaced, never read as Fits)
Phase 1 qualify      (sense)        → Internal analysis (seam quality: Grounded with its citation — the four named seam kinds are what this scan looks for, and any other seam the goal actually evidences qualifies the same way — or Heuristic declared when no evidence is there)
Phase 1 draft        (observe)      → artifact read, artifact search (the whole-draft pass: iterate Scan/Pack/fit/qualify/complete_unit over a workset COPIED from residual until every obligation in that workset sits in a completed cut, then stop. The substrate contact is Scan's alone and it is optional — a pass with no seam evidence to gather reads nothing — but what this entry names is the capability the pass MAY need, which is why the transition marks it as dispatching while the four steps it iterates beside Scan are internal. Each cut gets its own qualify verdict, so a Grounded seam stays Grounded and only what no seam evidence reaches falls to autonomous_pack — drafting at once is not drafting uniformly heuristic. This step OWNS NOTHING: the workset is a copy, no obligation leaves Λ.residual here, and integrate remains the sole owner-changing step, so the coverage partition sees nothing drafting does and gains no fourth cell. What it yields is a PARTITION of that workset — one cut per obligation, never two claims on one, which is the same fact its termination bound rests on. Where a region admits more than one workable apportionment it draws one way and records nothing about the other: it SETTLES nothing and stores no verdict, and whether a second reading deserves the user is judged downstream against the surfaced whole. Nothing it produces survives the cycle: the next cycle discards it and drafts the residual as it then stands)
Phase 1 surface_draft (extension)   → TextPresent+Proceed (put the WHOLE draft in front of the reader before any one cut is settled — every cut with its obligations, its fit verdict, and its seam disposition with citation or heuristic declaration. Relay: it opens no fork, and the forks that follow are each judged against what it made visible. This is the step Whole Draft over Serial Cut names — without it the reader accepts a fragment whose siblings are still unwritten, and a cut found wrong later forces back open what was already accepted blind. It carries one thing beyond the cuts: the STANDING AFFORDANCE to send any of them back, stated here rather than left for the reader to discover at a later gate. A partition's alternatives cannot be enumerated the way an axis's named values can, so what discharges the cut's openness is not a list of rival cuts but this affordance travelling beside it. Naming it here is what makes the correction cheap: at this point nothing is derived, while the same correction taken at Qc invalidates conditions already compiled and marks the plan-level ones stale. It is a free-response pathway, not a gate option — it yields no turn of its own, and where it lands depends on what has happened to the cut: a still-unsettled one is reached by Recut at this cycle's Qu, which carries the target as well as the direction, and one this cycle already integrated is reached by Reopen at the confirmation gate, the one path that returns an owned obligation to residual. Both are named on the surface, so the affordance promises what the transitions actually admit)
Phase 1 relay        (extension)    → TextPresent+Proceed (this path opens only where every cut in the surfaced draft cites a seam the goal evidences: a heuristic cut is the AI's own guess, and a guess is where anchoring bites — a drafted answer moving the reader from constituting the apportionment to approving one — so one of them sends the draft to the gate entire rather than only itself, a cut with an arbitrary boundary giving its neighbours arbitrary boundaries too. What makes relaying an evidenced draft safe is what this protocol can reach: nothing it relays touches a substrate, no obligation's ownership becomes durable until Phase 3 parks the plan, and Qc stands between the two — so a cut relayed here is still correctable at a gate the user holds, and a stop before that would spend attention on a confirmation the flow already provides. Within an open relay path, a cut that fits its horizon and that no second reading contests — no alternative apportionment of its obligations stands up to the same evidence — is accepted without a turn yield. This is the option-set relay test, read HERE and read LIVE rather than looked up from anything an earlier step computed: whether a region's other cut deserves the user's weighing varies with what the goal turned out to contain and with what the user has said, so fixing it before the draft existed would settle it where the reader is not yet present. The alternative is never IN D — D carries one cut per obligation — so this compares the drawn cut against a reading, never against a sibling standing beside it)
Phase 1 autonomous_pack (sense)     → Internal analysis (drafting's own fallback, and now only that: INSIDE a draft pass, once the seam scan has run out of evidence over what is left of the workset, pack that remainder at Heuristic seams — judging fit and running complete_unit on each, so what it adds to the draft are completed ProposedUnit values built by the same constructor the seam-grounded cuts use, never a second inhabitant; capability requirements and feasibility notes read exactly as Pack reads them. EVERY obligation it touches lands in some completed cut — obligations no heuristic seam places become one final cut anchored on themselves, its fit judged like any other — which is what lets draft terminate with its workset empty and no obligation left uncut. Each cut it makes carries its Heuristic declaration to surface_draft, so the reader sees which parts of the draft the goal's own evidence shaped and which parts it could not. It integrates nothing and settles nothing: what it makes enters the draft, and every cut in that draft is then dispatched by the same relay-or-gate reading as any other. The Sufficient trigger this step used to carry is GONE — Sufficient now settles the draft the reader was shown, and routing it back through here would re-pack at heuristic seams a remainder the reader had already seen cut at grounded ones)
Phase 1 Qu           (constitution) → present (the contested cut [ProposedUnit], itself standing as its Anchor + horizon-fit verdict + seam quality with its basis + current cut-set + the draft's still-unsettled cuts; the accept option is fit-complementary — AcceptUnit when the span fits, OverrideFit when it does not — and Sufficient rides the same indexing one axis over, standing only while the draft still holds an unsettled fitting cut for it to accept; Aᵤ carries both, and every firing hands its judgment to the one Aᵤ dispatch. The unsettled cuts travel with the gate for two reasons that are not the same one: Sufficient settles THAT displayed remainder, so without it the answer would have nothing determinate to accept; and the contested cut is only judgeable beside the neighbours it was cut against, which is Whole Draft over Serial Cut holding at the gate rather than only at surface_draft) [Tool]
Phase 1 complete_unit (track)       → Internal state update (write the SpanFit fit produced and the Seam qualify produced onto Pack's draft, yielding the ProposedUnit the gate presents and integrate consumes — the only step that inhabits ProposedUnit's fit and seam fields)
Phase 1 integrate    (track)        → Internal state update (consumes a ProposedUnit and produces a Unit — the only constructor Unit has: the accepted unit enters the apportionment and its obligations leave the residual; a fresh UnitRef is assigned in that same step, stable for the remainder of the apportionment; OverrideFit records THAT fresh UnitRef into Λ.fit_overrides after assignment, never before. Which arm called is NOT written into the unit. The trace reports it because the run that presents the trace is the run that took the arm, and a cell holding it would only mirror a distinction the transitions already draw — the arms are four, the members would be four, and nothing downstream would branch on the copy)
Phase 2 Derive       (sense)        → Internal analysis (per-unit completion and invariant predicates; an obligation with no verifiable predicate becomes a residual, EXCEPT where judgment_settled(o) holds — an obligation no check could settle because a judgment against the context accumulated by then and what the user has actually said by then settles it becomes a reservation instead, carrying the ground that settles it. The two are different findings: a residual says the plan leaves the obligation unguarded, a reservation says compiling it at all would fix a live answer where the user is not present. Neither is an out-of-scope delegation, which names a substrate that must intercept before an action runs, and this step writes no OOSDeclaration. The read is fallible and lands as pre-gate text at Qc, where an Adjust direction can move an item either way; scoped to units where ¬derived_already(u,K,R,S))
Phase 2 DerivePlan   (sense)        → Internal analysis (conditions whose subject is the whole goal; never distributed across units; fires once per apportionment, guarded by ¬Λ.plan_conditions_derived)
Phase 2 OOS          (extension)    → TextPresent+Proceed (out-of-scope declaration per obligation, with the delegated substrate named. Unchanged in scope by the reservation slot beside it: what is declared here is still exactly an obligation whose violation must be caught before an action runs, and a reserved item never routes through this step)