REFRAME GOVERNANCE BOOK
FCIS · REFRAME REFACTORING · PUBLIC PROJECTION
GOVERNANCE CHAPTER · 01

Current index · The maintained retrieval map for choosing the chapters that bind a task.

Reading Index

Chapter summary: This index offers role-based reading paths, chapter descriptions, and a vocabulary map so humans and agents can retrieve only the material relevant to the task at hand. It covers the founding Grounding-first transition (00–11) and the working-surface, reasoning, knowledge, retrieval, uncertainty-representation, and capability-governance doctrine that grew from it (12–37). See the root README for the genesis and full arc.

The suite is intentionally divided into short, stable chapters. Agents should not load the whole directory into every prompt. Select the chapters whose authority is necessary for the current task, then retrieve live code and state for implementation detail. A UI claim is not settled by an accessibility-tree query alone — chapter 18 requires looking at the rendered view.

Reading paths

Product and architecture review

Read the abstract, development history, and target architecture. These chapters explain why the older index-centered design existed, why its lessons remain valuable, and why authority moves to Grounding and Storify now.

Grounding implementation

Read the target architecture, Grounding contract, and phases 1–3 of the refactoring program. Finish with the relevant tests in validation and acceptance.

Storify implementation

Read the current-state analysis, Grounding contract, and phases 2–4 of the refactoring program. The source-authority and no-index acceptance cases in validation and acceptance are mandatory.

Readiness, journey, or UI implementation

Read the target architecture, phase 4 of the refactoring program, and compatibility and future evolution. These changes are incomplete until generated capabilities and reasoning artifacts agree with the UI.

Index deletion

Read the entire refactoring program, especially its deletion gate, followed by the agent operating guide and validation and acceptance. Do not begin from a filename search and delete outward; prove replacement consumption first.

The Score, and composing a cut

Read the Score (the one working surface; the timeline and Cut as lenses; the Cut composes a take; every projection reads it — "has one cut"), then the beat and its arrangements (the beat anatomy and the take it fires) and animating truth (how the read is felt). Anything the writer sees or operates is also governed by the stage presents the act. The Cut is not a return of the retired patch-graph canvas — it is a lens and a second lane of the one surface.

Visual, UI, or design work

Read the stage presents the act first — it is the enforceable floor (the act is the star; the glasses test for type and hit targets; progressive disclosure; one act in focus; relationships drawn, not implied; verify by looking in light and dark). Then animating truth, the Score, and the specific surface's chapter. A machine-readable accessibility tree is the necessary but never sufficient half of accessibility; passing it is not passing legibility.

Copilot implementation

Read the target architecture, Grounding contract, the Copilot implementation extension, the situated Copilot, and Copilot capability governance, then follow chapter 10's mandatory discovery procedure before editing. Work that places the Copilot on a surface, or changes what she says when she arrives, is governed by chapter 15 and must satisfy its acceptance as well. The Copilot must reuse existing application operations and the same authority chain; it is not a second workflow engine. The behavioural, relaunch, no-index, and capability-parity acceptance cases in validation and acceptance apply.

Model lanes, cost, and task-based model selection

Read on-device first, and the writer's key — Reframe selects the best eligible model for the task from live capability, budget, credential, and health facts; paid is the default when available, bounded local execution is an internal economic optimization, and an explicit local-only instruction overrides it. It is governed together with the situated Copilot (the opener names the true elected lane and cost before spending).

Training the on-device model to the writer's work

Read training perspectives — a trained LoRA adapter is a perspective (a lens learned from the writer's material), authored by intent, adopted only on evidence (shadow comparison + eval gate), legible, and reversible; it is the on-device path to quality, the sibling axis to on-device first, and the writer's key (which governs the lane and cloud escalation).

Preferences, settings, and configuration

Read no preferences, only reasoning — Reframe has no panel where the writer configures how the app decides; the app reasons decisions in context and the writer instructs it in dialogue. The only stored settings are facts the app cannot reason into existence (credentials, storage location, account state), on a lean Accounts & Storage surface. It generalizes ch.20 (the lane) and ch.21 (training) into the rule both instance.

Turn routing, intent classification, the Copilot's understanding of a turn

Read one reasoning — a turn is understood by ONE reasoning over ONE complete taxonomy, and everything routes from that single decision; no speculative "fast" pre-classifier with a smaller vocabulary that fires first and misroutes, no cascade of reflect* passes racing to grab the turn. It is what makes ch.20's writer's-key recognition reachable and the sibling of ch.22 (no stored toggle for a decision; here, no fast pre-guess for the reasoning).

Intent uncertainty, clarification, escalation signal

Read the reasoning is an uncertainty map — the one reasoning (ch.23) produces an uncertainty map over what the writer could want (settled / ambiguity / thin / failure + why + what would resolve it), not a scalar confidence; the app routes from it (settled→dispatch, ambiguity→clarify, failure→fail visibly), it is the signal the writer's-key escalation (ch.20) reads, and it is inspectable/showable (UncertaintyScoreKit / FCIS-AX). This is also why the one reasoning can run lean.

UncertaintyScoreKit UX, arbitrary ledger lanes, and Reframe binding

Read a want is a gap in a ledger first — it makes the ledger collection open-ended and explains why a lane is only a ledger's drawing, never a fixed kind of doubt. Then read every gap keeps its address: the arbitrary-lane rack, shared-spine map, composite lane/note selection, stable selected-thread account, generic-kit/Reframe boundary, and the rule that chat records collaboration around the map rather than becoming its only state surface. Visual implementation is also governed by the stage presents the act, Apple's Human Interface Guidelines, and FCIS-AX.

Code review

Read current state and refactoring problem, the relevant target contract, and the phase exit criteria in the refactoring program. A review should reject dual authority, hidden index reads, numeric context shaping, or readiness claims that are not persisted.

.claude and .codex

Read the agent operating guide first, then follow the task-specific path above. The guide explains authority precedence, planning discipline, evidence expectations, and the rule that historical documentation is never operational state.

Release, publication, or “what can the App do?” review

Read the released surface is a named build, then validation and acceptance, Copilot capability governance, and the Copilot capability audit skill. The command catalog is an inventory; the release manifest is the only authority for what a named build ships.

Public publication and source-boundary review

Read public publication and private source policy, then the released surface is a named build and validation and acceptance. Use this path when changing what the Book, governance repository, or a public projection may expose.

Scenario execution, ownership, or acceptance integrity

Read validation and acceptance, the Reframe scenario development cycle, and scenario run ownership and non-interference. Use this path when a live scenario is being driven, resumed, interrupted, diagnosed, or promoted. The runner owns terminal classification; intermediate observations do not establish failure; and any unrecorded intervention invalidates the run.

Chapter catalogue

Chapter Purpose
Abstract Compact statement of the decision and completion condition.
Development history The architectural eras, retained lessons, and superseded assumptions.
Current state and problem What the runtime does now and where index authority still leaks through.
Target architecture Stage ownership, data flow, authority boundaries, and final invariants.
Grounding contract The persisted profile, identity rules, prompt relationship, and invalidation semantics.
Refactoring program Ordered implementation phases, affected seams, deletion gate, and exit criteria.
Agent operating guide Instructions for .claude, .codex, and human collaborators.
Validation and acceptance Required unit, integration, store, UI, live-provider, and negative evidence.
Compatibility and evolution Legacy-store policy, archival behavior, rollback, and rules for future extensions.
One Store Authority Across Repositories The shared Fountain-Store Swift authority for explicit selection, identity, readiness, leases, receipts, recovery, and Reframe's product-specific intents.
The Book Library Is Reframe's Sole Reading Provider Defines the separately hosted curated reading boundary: provenance, publication switches, generated OpenAPI, Reframe import, FountainStore boundary, migration, and the prohibition on generic web reading.
The Writer Enters by Intention Defines the new Reframe landing and Copilot-first Book Library discovery: writers ask by meaning, Copilot semantically searches grounded publication metadata, provider IDs stay internal, on-device help comes first, and AX plus rendered visual review are both release gates.
Open-Turn Mediation Protocol Defines the reusable mediation boundary for first contact, interruption, nonsense, correction, ambiguity, and spontaneous change of mind before any existing capability or lane executor acts; Copilot mediates on the right, drives the left projection, and keeps direct web reading out of Reframe.
The Fountain-Coach Git Library and Reframe Project Flow Defines the Fountain-Coach-owned Git project service, Swift Git boundary, Copilot project views, Library candidate/release flow, explicit authored export, custody, accounting, and migration.
The Fountain Editor Is the Project Surface Defines Reframe as the left-pane Fountain editor projection with Copilot as the right-pane mediator, managed Git as versioned transport, and the Book Library as publication authority.
The Fountain Project Round Trip Closes the governed Library → Reframe → Compose → Fountain Project → Git → Library lifecycle with explicit identities, provenance, transformation, no automatic feedback loop, and a projection-left/Copilot-right surface.
The Reframe Maintenance Control Plane Defines the authenticated maintenance API, Preferences/SecretStore boundary, Reframe and skill clients, authorization, receipts, rollback, migration, and the separation from the public Book Library source API.
FountainMaintenanceKit — Portable Swift Maintenance Contract Defines the reusable FCIS-governed Swift package boundary, native Git target, SecretStore protocols, host adapters, platform profiles, migration, and acceptance gates for the maintenance control plane.
FountainProjectKit — Durable Fountain Project Custody Defines the reusable Swift custody boundary around FountainEditorKit: immediate creation persistence, edit flush, interruption and relaunch recovery, AX save truth, and the separation of working drafts from Git and Book Library publication.
The Copilot as Writing Coach Merges the writer-facing Copilot role with the default Grounding stance and internal Dramaturg realization discipline: Grounding governs attention, the Coach mediates and teaches, and realization remains grounded, accountable, and writer-controlled.
FountainImagePublicationKit — Reframe Image Cloud and Publication Boundary Replaces the retired Apple Photos/iCloud handoff with Reframe's hosted Image Cloud: paste/selection intake, cross-platform Swift client/server contracts, rights-aware AI provenance, EU disclosure, preflight, delivery receipts, and migration-safe hosting.
FountainComposerKit — Remote Attachment Custody and the Composer Boundary Makes the Copilot composer the single typed ingress for text, images, and files; admits attachments to remote cloud custody before pipeline use; keeps only references and evidence locally; and defines the reusable cross-platform Swift boundary.
The Reframe E2E Scenario Is the Publication Unit Makes a versioned, prerequisite-complete E2E scenario the first artifact for every Book command: AX-driven interaction, state-based waits, paid-lane consent, FountainStore and window-ID evidence, one-run provenance, honest statuses, and a sanitized Book coverage projection.
The Book of Reframe Is a Dual Projection Keeps the Book public for humans while giving Reframe a reviewed, role-gated maintainer projection from the same commit and digest; neither projection replaces runtime authority or independent evidence.
External MIDI2 Control of Reframe Defines Reframe as a negotiated MIDI2 peer: external operation ingress, internal mediation and lane policy, FountainStore lifecycle authority, MIDI2 event projection, AX/window-ID witness, and the scenario-first gates for claiming full live drivability.
Reframe-to-Reframe Software-Peer Acceptance Defines the two-process software-peer conformance topology, separate process and Store authority, independent witnessing, scenario-first gates, and the boundary between software-peer acceptance and unproven hardware interoperability.
MIDI2 Peer Projections and Capacity Admission Defines the projections surface as the semantic peer boundary, generic and clonable MIDI2 endpoints, Reframe as the default software-peer fixture, capacity-governed admission, and AX/Store/MIDI2 evidence requirements.
The Reframe Scenario Development Cycle Makes the versioned scenario the reusable development unit across commands, capabilities, system boundaries, projections, and failure/recovery paths; keeps executable YAML beside the implementation, the Book as projection, and a separate scenario repository out of scope unless a new conformance authority is governed.
Private Image Prompt History Narrows prompt retention only for the private image.prompt.history capability: exact authored prompts may be recovered from protected FountainStore history, never from receipts, telemetry, logs, manuscript, or public Book projections.
Copilot implementation extension Extends the refactor to the conversational Copilot: perception, retrieval, action parity, discovery procedure, and acceptance.
Grounding as a given Refines the Grounding authoring model: a canonical manifesto shipped as the default given, auto-confirmed on import, edited centrally as prose, never model-dissected.
Animating truth Perceived performance: never sign a wait with a spinner. Render the frame and cheap/cached truth instantly; foreshadow the unknown as honest, animated structure whose motion maps to real work. Nothing that is not the manuscript may delay the manuscript; absence may not overwrite a truth already held; a click lands in its destination.
App-flow record The complete prose account of how the app must flow end to end — the single continuous narrative these numbered chapters refine.
Storage and performance Locks the storage layering — document layer = plain-text bundle + single manifest; musical layer = MIDI 2.0 — and the performance doctrine: reads are fast architecturally (cache-first, one manifest, no serial fan-out), not by encoding.
The beat and its arrangements One beat, three arrangements: a single widget anatomy whose only differing part is its measure; the take — one firing that renders the document and musical layers as siblings. Its patch-graph canvas (rules 7–9) is superseded by chapter 17; the beat anatomy and take are retained.
The situated Copilot One Copilot, differently placed: she perceives the arrangement hosting her and what is wired into the conversation there, opens in words that fit the place, offers nothing whose object the surface does not show, and states an empty situation rather than filling it.
The timeline is the machine room Making beats IS the machinery and the timeline is where it is seen: one machinery, one surface. No machine room, factory gate, engine view, run report, or heartbeat line; diagnostics may drive behaviour but never become a surface; unreachable surface is deleted, not kept.
The Score The performance space of the work, and the ONE working surface: the timeline and Cut become lenses of it (the patch-graph canvas is retired); a lane is a participant, not a track; the beat/arc is the structural spine every participant is grounded to; protocol state (MIDI 2.0) is composition. Defines the minimum honest Score — grounded spine + one Text participant from the source — with the distributed multi-participant stage named as horizon, not increment.
The Stage Presents the Act Legibility over density: a surface presents the ACT the writer is performing, not a console. Enforceable floor — the act is the largest/central element; the glasses test (min type + hit-target sizes); progressive disclosure of per-object machinery (no permanent hieroglyph rows); one act in focus at a time; relationships are DRAWN, not implied by a glyph; and every visual change is verified by LOOKING at the rendered view (light + dark), never by the accessibility tree alone (the machine-readable half is necessary, never sufficient).
Apple Human Interface Guidelines The HIG is Reframe's baseline visual/interaction standard — the floor beneath chapters 12/14/17/18, not an alternative. Adopts the specifics our chapters implied: system text styles (macOS Body = 13pt), contrast ratios (4.5:1 text / 3:1 controls / aim 7:1, verified in light, dark, AND Increase Contrast), 44pt hit targets where touch/accessibility reach, semantic system colours (never colour-alone, never hard-coded), the 8pt grid, system materials, purposeful motion that honours Reduce Motion, SF Symbols, VoiceOver. Reconciles each against our chapters, notes where Reframe is deliberately stricter (the no-spinner rule), and records the gaps to close (Reduce Motion, contrast audit, migrate hard-coded sizes/colours).
On-Device First, and the Writer's Key The on-device model is the FIRST lane — the default that must work on its own (a manuscript read, discussed, composed with no cloud at all). Cloud is a widening of perspective and the writer's money, so the writer holds the key: no cloud call without an explicit grant the writer gives/revokes in dialogue (default local-only). When on-device leaves real uncertainty, the Copilot may OFFER to escalate — a decision reasoned on-device over the UncertaintyScoreKit map, never a hard-coded benefitsFromCloud/preference-order table. Apple's on-device→Private Cloud Compute escalation, with the key in the writer's hand. Every surface names the ELECTED lane before spending; fail visibly, never silently spend or fabricate. Also governs CUSTODY of the key (§Where the key lives): the Keychain via SecretStore is the only place a credential is read from — no environment variable, no config file, no other app's auth file — and a plaintext key found on the machine is reported, never silently consumed.
Training Perspectives A trained LoRA adapter is a perspective — a lens the on-device model wears, learned from the writer's own material, to read/write THEIR work better. The sibling axis to ch.20: not which lane, but how the on-device lane gets better, and the on-device path to quality (the alternative to cloud escalation). Authored by intent ("learn my voice from these scenes"; the app reasons the training plan, expert knobs behind disclosure), adopted only on evidence (readable shadow comparison + passed eval gate; a perspective that doesn't beat the base is rejected), legible (provenance: what it learned, from what, how it compared), and reversible (worn per role, base never mutated). Cloud training is gated by the writer's key (ch.20); fail visibly, never silently fall back to base as success.
No Preferences, Only Reasoning Reframe has no preferences — no panel where the writer configures how the app decides. A stored toggle for provider / reasoning-visibility / command-autonomy / guide-policy / model-tuning is a decision frozen into config, the anti-pattern ch.20/21 reject. The app reasons decisions in context; the writer instructs in dialogue (understood by meaning, scoped or standing, revisable, remembered as an instruction with provenance). The only stored settings are facts the app cannot reason into existence — credentials, storage location, account state — on a lean Accounts & Storage surface (a credential is a fact, not permission to spend — that is the writer's key, ch.20). No retired toggle becomes an unreachable hidden default; expert machinery is demoted behind disclosure, not deleted. Generalizes ch.20 (lane) + ch.21 (training) into the rule both instance.
One Reasoning A turn is understood by one reasoning over one complete taxonomy of what the writer can want, and everything routes from that single decision. No speculative "fast" pre-classifier with a smaller vocabulary (FastRouteTargetG) that fires first and grabs the turn; no cascade of standalone reflect* passes racing to be first. Multiple reasoners with divergent vocabularies disagree, and first-to-grab wins — which is how "stay on device" (turning the writer's key) became a segmentation, and content questions / "fix it" became reads. Retire the fast pre-pass and the competing reflections into one decision; the key-turn (cloudGrant) is a case in the one taxonomy, so it becomes reachable by construction. Cheap preconditions (deterministic guards) are fine; a second model reasoning over intent is not. If the one reasoning is too slow, make IT lean — never front it with a lossy guesser. Sibling of ch.22 (no stored toggle for a decision; here, no fast pre-guess for the reasoning).
The Reasoning Is an Uncertainty Map The product of the one reasoning (ch.23) is an uncertainty map over what the writer could want — per-intent state (settled / ambiguity / thin / failure) + reason + resolvedBy — not an opaque verdict or scalar confidence. Route from it: settled→dispatch, ambiguity→clarify (ask, don't guess), thin→proceed/offer, failure→fail visibly (a window overflow is a loud failure, never a segmentation). Ambiguity (a real two-way split) and failure (a breakdown) are different in kind. This is why the reasoning can run lean — it needs only the taxonomy + message + minimal state, never the execution manifest (that loads in the dispatched producer). The map is the signal ch.20's writer's-key escalation reads (thin/failure whose resolution is a stronger model → offer to widen), and it is inspectable/showable via UncertaintyScoreKit + FCIS-AX so the writer decides on real evidence. Fuses ch.23 (one reasoning) + ch.20 (the key) + UncertaintyScoreKit into one law: the reasoning's product is an inspectable map of doubt, and the app acts from it.
The CoPilot Is the Surface Every capability that was a panel, editor, or toggle lives in the CoPilot as dialogue: the CoPilot teaches the writer the capability (they don't arrive knowing "grounding," a "reader lens," a "trained perspective"), states its current value in plain language, is instructed to change it by meaning (scoped/standing, revisable), and shows the effect on the work. The constructive half of ch.22: retiring a panel is not enough — the capability must re-appear in conversation, taught and held there, or it's a lost capability. Persistence is invisible plumbing — the writer never hears "saved," "stored," "Preferences," or "confirm." Instances: the key (ch.20), perspectives/LoRA (ch.21), preferences (ch.22), and grounding/lenses (new — retire the baseline/grounding editor; the writer changes the lens by asking and the beats re-form). Onboarding is mandatory and in-context; expert machinery is demoted behind maintainer disclosure, never taught to the writer.
Internals Tune Themselves The default disposition of any internal is reasoned — Reframe decides it dynamically, in context, at the moment it matters (output caps, routing, storify window, retries, budgets, reading shape) and can explain it; there is no setting. The writer meets a control only when their judgment is genuinely needed (a stance, a spend, a voice, a training intent), and then the CoPilot surfaces it contextually, teaches it, and asks — never a standing toggle. Turns ch.22 (no preferences) + ch.25 (CoPilot is the surface) into a disposition procedure (fact → reasoned → dialogic → maintainer → plumbing) and applies it to an audit of all 73 persisted settings. End state: Preferences collapses to a lean Accounts & Storage + Integrations surface plus a maintainer-only Developer disclosure — no routing panel, no tuning, no LoRA knob wall on the writer's path. Facts stay; reasoned values self-tune + stay explainable; genuine decisions go dialogic; maintainer machinery hides behind disclosure; runtime/learned state is never dressed as config.
Parse Before You Ask Structure is parsed, meaning is read, and local non-generative tools measure what they can establish without invention; a higher reasoning is never asked what a lower tier can answer.
A Beat Is the Question It Raises A beat is the span over which one story question remains open; atoms are local reading units and never promoted into named beats.
Beat Movement and the Uncertainty Overlay Reconciles beat identity with UncertaintyScoreKit: grounded dramatic movement is primary; question movement is an optional, evidenced overlay that can be raised, carried, transformed, answered, deferred, or still open.
NaturalLanguage Measures, Storify Interprets Measurement supplies candidates, coordinates and contradictions; only the reading interprets meaning or assigns uncertainty state.
The Living Gazetteer The evidenced, revisable account of what the source has established to exist; it remembers the world without routing, judging, or silently filling its holes.
Compiled Knowledge Hard, durable reasoning is compiled into evidenced project memory so the local lane improves for this work without pretending the model itself learned the world.
Referenced Knowledge Knowledge outside the manuscript is retrieved rather than recalled, cited with the source's own words, and promoted only by the writer.
A Want Is a Gap in a Ledger Uncertainty is collected from arbitrary registered ledgers; every gap carries a typed want naming who can close it, and a missing ledger reports failure rather than disappearing.
A Question That Leaves the Work An outward question carries its work, measured doubt and bounded source passages; generated prose is discarded while fetched documents remain auditable.
Deep Search A cited page begins the source reading; justified local reasoning follows source-internal links, records every reason, and states exactly why the search stopped.
Every Gap Keeps Its Address The UI consequence of arbitrary ledgers: every gap keeps a composite lane/note address across an arbitrary-lane rack, shared-spine map, manuscript, typed want, evidence and decision. The kit remains generic; Reframe supplies domain context; complexity is represented at synchronized scales rather than flattened into fixed lanes or expanding chat cards.
Copilot Capability Governance Current status and implementation perspective for joining the MIDI backplane IDL, application capabilities, Copilot verbs, runtime actors, contextual availability, and persisted evidence into one checked action contract.
Copilot Capability Audit Skill Defines the repository-tracked audit skill and closure ledger that distinguish executable, live-accepted, unavailable, and drifted capabilities while planning the next widening batch.
A Model Cannot Be Told What It Cannot Do Draws the line by KIND, not confidence: what the writer MEANS is a judgement the model makes; what Reframe CAN DO is a fact the app states from the registry. Where a fact exists, the app speaks it.
A Citation Is a Promise Someone Can Check Outgoing citations: checked (retrieved and the quotation found) or visibly said to be unchecked — there is no third position, and a writer's "verified" flag is not one. Also governs the UNBUILT Copilot reading surface (§Showing the source): a rendered source is evidence the writer can check herself, never a browser, and never a way to set checked.
One Retrieval, Two Directions Unifies incoming references (ch.32) and outgoing citations (ch.40) as one retrieval with two obligations: admissible before Reframe believes it, checkable before a reader is asked to.
What Is Already Recorded Is Read, Never Re-Derived Doctrine that was available and unread is the most expensive failure on this record. What is written — in a chapter, in the store, under ch.08's evidence authorities — is read, not re-derived.
The Released Surface Is a Named Build Separates runtime command inventory, governed capabilities, live acceptance, and the named-build release allow-list.
Copilot Reading Surface and Typography Defines the two-pane Reframe surface: a Copilot-controlled source/reading/editor projection on the left and the conversational Copilot authority on the right.
Dynamic Grounding Defines Grounding as a source-authoritative flow: default non-integrational reading, score-derived proposal, explicit /ground acceptance, new lineage, and persisted evidence. A lens is a hypothesis about the READER's blind spot — what the reading was attending to — not a description of the work or a summary of its open questions; the writer's own lens is authoritative and verbatim, and a hole in the reading is not a lens problem.
Situated, Mixed-Initiative Interaction Defines Reframe as an open interaction space in which human turns may be corrective, interrupted, out of sequence, or unrelated, while only grounded live state and one mediated meaning may authorize mutation.
A Service Is a Fact, Not a Symptom Registers every internal and external service Reframe calls, requires each call to carry its service, lane, cost and outcome as facts typed at the call site, and requires failures to be reported to the writer where she works — never re-inferred downstream from symptoms, and never answered by adapting her text.
One Definition, Two Projections An operation is defined ONCE — in the reasoning manifest, which composes the IDL's mechanics (QoS, capability masks, budgets, correlation, chunking) with its MEANING (userMeaning, whenToUse, neverUseWhen, readOnly, mutatesState) under a declared precedence. The IDL is the first input, not the definition — and projected twice: onto a backplane topic and onto an OpenAPI-described HTTP route, both generated, never authored. The web does not speak MIDI 2.0 BY DEFAULT (midi2.js teaches it), so the HTTP surface is owed to the consumer who will not adopt it — a reason to project, never to define twice. A service binds by MIDI-CI Property Exchange, the market's own answer to "declare what you can do". Reframe is future-proofed by MIDI 2.0's negotiation semantics held as a projection; bound to UMP as THE transport the pillar becomes a cage.
Text Is Stored So It Can Be Pointed At A store that can only return the whole work is not a data store for text. Measured: Ulysses is ONE record of 1,519,413 characters and 32,694 lines, so "open Circe" cannot be expressed as a fetch — only as fetch everything and look at part of it, which is why choosing a chapter opens the work at its beginning and why screenplay/lines.get overshoots its declared 65,536-byte budget by 23× on every read. FountainStore is not the limitation: its declared API already serves prefix/range scans with paging. So local text is ADDRESSED by ordered units whose identifiers sort in reading order — and a unit is a RANGE, never a payload: the authoritative source stays the bundle folder (ch.13) and the unit index is derived and rebuildable over it, holding offsets and never copies (ch.29); every fetch NAMES the span it wants and fetching more than commanded is the defect even when the display is right; selection is a STORE operation, not a client-side slice; the payload budget is binding, so an oversized answer pages instead of overshooting; structure is ASKED for rather than scanned for; and the operation is declared once in the IDL and projected by generation (ch.49), so no hand-rolled reader can quietly fetch more than it was told to select. Where no typographic boundary exists, the store records that fact rather than inventing a grid, and any mechanical cut is a recorded repair debt.
One Decision Decides the Lane "Which lane serves this?" is answered once for the role and task from live facts. The result carries the elected model and its budget; ordered configured/permitted/credentialed/constructible/healthy gates may only narrow it, and refusals are typed rather than silent fallback. Paid availability is the default election for writer-facing work, while an explicit local-only instruction remains authoritative. Presence never elects a lane, naming never reads a secret, failures teach only what they evidence, and every surface prints the same recorded decision.
The Pencil Belongs to the Writer A reader underlining marks FORWARD, IN IGNORANCE — salience not conclusion, mute (no caption, often unreconstructable later, and that is normal), cheap to be wrong about, layered across readings. The mark Reframe now emits is the exact inverse: made backward from a window the model has finished, asserting "these words raised this question", captioned, and expensive to be wrong about because a machine's mark reads as a finding. So it is NOT an underline — it is a CITATION (ch.40), and drawing it as a pencil stroke would be the app claiming to have attended to a page it has only finished reading. An underline was already three things here — evidence of a claim (producer removed with the semantic index), read-through progress (transient), and the new anchor — with the CoPilot's own help text spending a paragraph warning writers not to confuse them. The citation marks the beat's HEAD, never its body: measured on Circe 2026-08-08, threads run 20608→20815 while their anchors are 15–86 lines, and one thread opens 95 lines into its own passage. So the pencil is unclaimed, and it belongs to the WRITER: her mark says "this matters to me, I do not yet know why" — an instruction with an address (ch.46) that the app may notice and ask about in dialogue but never interpret, rank, or feed to a prompt as evidence. The two marks never share a visual language; absence stays absent; progress leaves nothing behind.

| A Selection Snaps to Meaning | Reframe asks the writer to point at text — to mark, cut, cite, reframe it — and was asking her to do it CHARACTER BY CHARACTER with a mouse. That is an operability failure belonging to the app, not to her: a reader indicates a phrase, a line, a speech, a sentence, never a character offset, and requiring the offset excludes anyone whose hands or eyes are not perfect today. So a selection is SNAPPED to the smallest unit of MEANING containing what she indicated — whole words always, the sentence or speech when she barely selected anything — and the snap only ever GROWS outward to a boundary the text itself declares: never shrinks, never moves off what she touched. The boundary is PARSED, never asked of a model (ch.27), and MEASURED, never concluded (ch.29) — a tokenizer says where a sentence ends, not what it means. And where the text declares no boundary the snap STOPS AND SAYS SO: measured on this app's own shipped corpus, Ulysses' Penelope runs 27,287 characters with a single full stop, so "snap to the sentence" there would select the whole episode. The unit is chosen by what the text IS at that point — speech, stage direction, verse line, sentence — which makes it contextual rather than mechanical; it is shown before it is committed; a deliberate precise selection is honoured exactly; and no surface ever tells the writer her selection was wrong. |

| The Writer Does Not Manage the Projection | Reframe contains its own ledgers, providers, consent, batches, and rendering detail so the writer can navigate /readings, /ground, /world, and an offered /reference act as manuscript questions — without managing internal machinery — while every durable uncertainty note remains reachable through a bounded, honest, AX-verifiable projection. |

| Scenario Run Ownership and Non-Interference | An executable scenario has one owner and one bound run identity; Store/AX observations remain provisional while it runs; only declared terminal predicates classify it; and any unrecorded intervention invalidates acceptance. | | The Scenario Runtime Is Swift and MIDI2-Native | Makes the scenario executor, Store preparation, lifecycle waits, evidence binding, and terminal classification an owned Swift capability using the same typed MIDI2 operation boundary as production peers; Python is transitional only, while AX/CoreGraphics remain independent witnesses. | | Scenario-Driven Development Is Org Infrastructure | Names the organizational consequence of the scenario cycle: a portable, released Swift/MIDI2 seam with product-local authority, independent evidence, public/maintainer projections, historical context, and a future of negotiated software peers. | | The Default Semantic Manuscript Projection | Fixes the default Reframe workspace as a continuous Courier/Fountain manuscript with semantic Questions, Movements, and Read coverage navigation, Copilot on the right, MIDI2 peers below, and no A4 cards, horizontal timeline, or Slugline application chrome. The signature illustration is design evidence only. |

Vocabulary

Canonical source means the imported manuscript stored under the source document identity. It is evidence, not a work surface for generated analysis.

Grounding Profile means the writer-confirmed policy document that directly governs downstream interpretation. It is not a summary of the source.

Storify Source Auto means the chapter-aware structural reading that converts source atoms into kept/noise decisions, beats, uncertainty, synopsis, and arcs.

Cut Script means the mutable, authored draft product assembled from chosen Storify units and later composition.

Continuity means the audit over Cut Script or other explicitly selected units. It is not a substitute source reader.

Legacy semantic artifacts means index passages, reading states, semantic memory, published semantic objects, repair debt, and index performance memory created before this refactor. They may remain inspectable, but they have no authority in the final pipeline.