The Flywheel

LAYER 1 — THE DECISION PAGE

The reframe that earns the ten (the step-back, answered)

Two facts changed the problem underneath us tonight:

1. 1. The detectors already exist and run live, every cycle. Neo already computes warm-and-dying on every deal and stamps the verdict on the deal's permanent record; likewise stale open loops, stale threads, meetings without follow-up, deals past their close date. There is nothing to sense. The build is the wire from "Neo knows" to "the right human is told" — and what happens after the telling.
2. 2. The telling is not the product; the reply is. When Derek answers a routed signal — "dead, they went with Vetstoria" — that reply is a labeled fact no scrape can produce. It teaches the world model (a competitor's name is now a first-class future signal), it grades the detector (the only honest precision number is one a human labeled), and it decides the detector's right to keep firing. **The signal loop and the genome are the same loop.** Neo isn't getting a notifier; he's getting the mechanism by which the world continuously teaches his memory what's true — and every detector we add later snaps onto it as a registration, not a rebuild.

The seven stages (one signal's life)

1. 1. A candidate emerges, addressed, never ranked — an adapter reads the already-stamped verdict (which account, whose ball, the receipted quiet-days number).
2. 2. A second, independent pass tries to kill it. Default verdict: refuted. Arby's measured lesson — first passes over-claim 48% of the time. Three kill classes: the receipt isn't real, the freshness number rests on the known fake-timestamp fallback, or "nobody acted" is contradicted by history. Killed = counted, never silent.
3. 3. Survivors bank, visibly. No ping by default — the signal lands in a per-owner ledger anyone can pull. Interruption is EDGE-triggered (a transition into trouble, never a standing state — on a board where 93% of deals are already starved, "starved" is not news; NEWLY starved is) and reserved for accumulation or the one jump-the-queue class (real dollars dying with the ball provably on our side).
4. 4. Routing opens the privilege door. v1 owner = the Salesforce deal owner (mechanical, receipted); anything unresolvable routes to Robert — never a guess. And the moment a signal can address anyone but Robert: every fact is stamped at storage-time with who it's for, by SOURCE (his calendar/DMs → robert-only; Salesforce/shared channels → team); composing for Derek, retrieval never hands Neo the robert-only facts. **Unstamped = robert-only, fail-closed. Neo can't leak what he was never given — and no law ever reads his words.**
5. 5. The signal arrives pre-researched (v1.5 — deferred by the frame court: the six-state research queue earns its place after one class is live and trusted).
6. 6. Neo writes the ping — every word his. Code guarantees the address and the receipt floor; he writes the sentence. Certainty binds to what he SAW, never to why — "quiet 34 days past its rhythm; cooling or just busy, either way it's yours to break."
7. 7. The reply closes the loop. Closure requires who + what-was-done; the resolution deposits into the genome (audience-stamped from ITS source — a private reply stays private); recurrence after closure reopens loudly. The deposit is the flywheel's turn.

The trust meter — power proven before it's spent

Everything ships dark: v1 banks to a Robert-visible ledger and interrupts NO ONE. The

shadow ledger fills with real candidates, refute verdicts, and **the drafts of what Neo

WOULD have said this week** — so the power is visible before a single ping is spent. The

meter has TWO axes: precision (fraction of graded pings that were news — floor ~90%, the

field's number) and coverage (a class that quietly stops firing flags itself — silence is

the same death as noise, reached from the other side). A class goes live per-class, on

meter + your word + a proven one-flag revert; below the floor it auto-reverts to dark.

Your calls

1. 1. Bless the synthesis (the frame: flywheel spine, trust floor, experience beats).
2. 2. The severity ruling, retired head-on (the one tension all three designs carried): severity — dollars × days — only ever selects the CHANNEL (interrupt now vs. visible bank), provably never hides or deletes a signal (there's a test). Is channel-selection legal address-narrowing under your ruling? Our answer: yes, because nothing is ever hidden; your word makes it law.
3. 3. The source→audience table is yours to red-pen — the entire leak risk concentrates in one small table (which sources are robert-only). Team routing stays off until you've ruled the table AND the leak fixture runs green (a robert-only fact provably absent from a team compose; breaking the door turns it red).
4. 4. The abstain posture (carried from every design): killed/abstained signals are logged with reasons in a ledger you can skim — never silent. Confirm.
5. 5. The 90% floor and the 10-day dial — both surfaced defaults, both taste.

What could go wrong, named

1. A false errand → three fences before it can (receipt floor, refute pass, dark-first

grading), plus auto-revert after.

1. A leak to a teammate → structurally impossible if the fact was never handed in;

the whole risk is the table (your call #3) and its red/green fixture.

1. Flywheel starvation (owners don't reply) → surfaced signals demand closure; the coverage

axis catches a class going quiet; no synthetic labels, ever — a fabricated label would

poison the exact number the flip rests on.

LAYER 2 — THE MACHINERY (fenced)

1. Spine (new, class-generic): adapter → SignalCandidate → refute gate → bank/surface →

route+door → compose+deliver → resolution capture → genome deposit → meter update.

Adding detector #2..N = a registration.

1. Adapters (v1: one): deal_warm_and_dying (stamped at promote.ts:421-427; read

situations.ts:1295). v2 registrations: C2 going-stale (closure-engine), C9 stale-thread /

meeting-no-followup, past-close/slipping, checkout-stall (classifyDeal verdicts). NOT

sources: say-do ledger (appendActed newly wired but autonomy accounting, not staleness);

ask-ledger divergence (watches Neo's own promises).

1. Candidate: {class, accountId, dealId, ownerId (SF deal owner, receipted),

observation{text, receiptQuote, receiptRef}, daysSinceMotion, stripeDollar|null,

firedAtCycle} — EDGE-triggered: emitted only on transition into the state (the durable

claim latch keys signal:<dealId>:<transitionCycle>; a healed-then-restarved deal is a

NEW transition). Freshness guard: gate on deriveDaysSinceMotion's honest null

(salesforce.ts:415-428), NEVER last_touch (the :441-445 now-fallback trap). Behavior

outranks stage (the documented stage-alone bug class): the adapter consumes the

reconciler's whole verdict, never raw stage.

1. Refute gate: independent model call, default-refute, three kill classes ([M] grep

receipt-vs-source · [M] freshness provenance · [J] already-resolved), anchored with a

contradicted fixture that MUST fail; refuter error → INCOMPLETE, re-run, counted.

1. Bank/surface: two axes never blended — confidence (survived refute) is code's;

severity (dollars × days, receipted) selects CHANNEL ONLY, with the mechanical invariant

+ test: no code path deletes or hides a candidate (bank is durable + readable). Surface

iff edge-trigger AND (accumulation ≥2/account/90d OR jump-queue class).

1. Privilege door: audience: "robert-only"|"team" on GenomeDeposit +

EntityFileComposeRow, stamped at deposit from SOURCE; second allowlist check in

selectEntityFileRowsForCompose parallel to MECHANICAL_COMPOSE_PROVENANCE (closed enum,

allowlist, never denylist — the refuted shape); unstamped → robert-only. The

source→audience table is a single reviewable const (Robert red-pens). Leak fixture:

a planted robert-only fact MUST be absent from a team compose; removing the door check

MUST turn it red. Resolution deposits derive audience from the REPLY's source (judge

finding: never hardcode team).

1. Reply capture (the named unsolved gap, now solved): a routed signal IS an ask in the

ledger (asker signal:<class>, channel:ts synthesized as signal:<dealId>:<transitionCycle>

— satisfying logAsk's key contract); the owner's reply in-thread transitions it

(in-progress/done per the existing exact-affirmation + state machine); the closure text is

the deposit; a reply that fits no transition surfaces to Robert's queue as unparsed —

never guessed. Delivery of ledger-born asks (no Slack arrival event) is the ONE new

delivery lane: the ack path gains a deliverLedgerBorn entry using the same compose seam

+ allowlist (the v1-review finding, closed).

1. Meter: precision = ownerGradedNews/surfaced (dark: Robert grades), coverage =

fired-per-window vs. trailing baseline; both recomputed from raw rows on disk; flip =

[M] meter ∧ [M] sample-size ∧ Robert's [J] word; live class auto-reverts below floor.

1. Gates (the contract): detector proof-of-life (seeded known-positive fires exactly

once) · vacuity BOTH poles honest to the 93% base rate (a correct detector fires on most

of a starved board — the vacuity check is on TRANSITIONS not states) · refute anchor MUST

fail · leak fixture red/green · claim-latch restart dedupe · flag-off byte-identity

(SIGNALS_ROUTE + the existing pair) · meter recompute-from-raw · the walk (three phones:

Robert grading dark, Derek receiving the first live ping, the quiet day) precedes any

flip.

1. Build order: v1 = spine + one adapter + door + reply-capture + shadow ledger + meter,

all dark. v1.5 = work-on-arrival research. v2 = register remaining classes, accumulation

across classes, N-way audience lattice (the charter's named debt), richer detectors the

resolutions unlock (competitive displacement, champion turnover — feedable only because

stage 7 exists).

1. Flip sequence dependency (named): A4 ✓ (flipped tonight) → GENOME_DEPOSIT ✓ (flipped

tonight) → signals dark → per-class live on meter + word.