# Twenty-Three-Part Cursors Research Program > **Status:** program plan. Each part names an invariant, a smallest executable experiment, visible evidence, and a condition that would weaken or falsify the idea. The point is not to make twenty-three subsystems. The point is to make one machine survive twenty-three different kinds of scrutiny. The research program uses one repeated structure: ```text INVARIANT What must remain true across implementations? FEATURE What useful capability follows if the invariant can be upheld? SMALLEST EXPERIMENT What is the cheapest executable test with real failure cases? COCKPIT EVIDENCE What should an operator be able to inspect? DANGER / FALSIFIER What result would tell us to narrow, replace, or delete the idea? ``` The parts are ordered by dependency, not spectacle. The later spatial and institutional ideas depend on the earlier causal, authority, storage, and receipt boundaries. A holographic cockpit cannot rescue a protocol that confuses delivery with execution, however handsomely it glows. --- # 1. Inspectable causal continuations ## Invariant A continuation survives a body only when its program point, serializable state, causal parents, state roots, capability references, and output/effect obligations are independently verifiable. ## Feature Pause work in one browser/native body and resume it elsewhere without serializing a JavaScript promise, Lua heap, C stack, process image, SQLite connection, or Cap’n Web stub. ## Smallest experiment 1. Start a continuation on Cedar. 2. Checkpoint explicit state. 3. Kill the executor process or Worker. 4. Resolve the checkpoint on Mirror. 5. Verify authority and body compatibility. 6. Resume exactly one successor. 7. Reject a stale duplicate result from Cedar. ## Cockpit evidence - parent cursor IDs; - continuation profile and program root; - checkpoint root and availability; - old and new body leases; - capability presentation; - successor cursor; - duplicate rejection. ## Danger / falsifier If portable state requires hidden runtime objects or implementation-specific heap snapshots, the abstraction is not a portable continuation yet. --- # 2. Causal debugging rather than chronological logs ## Invariant Wall-clock order is evidence, not causal proof. Cursors, messages, assertions, grants, state resolution, effects, and receipts retain typed causal relationships. ## Feature Ask why an outcome happened and follow the evidence across bodies, carriers, and storage boundaries. ## Smallest experiment For one resumed cursor, record: ```text message -> interest match -> authority gate -> state resolution -> body lease -> execution -> effect intent -> receipt -> successor ``` Then shuffle timestamps while preserving causal edges and verify the explanation remains unchanged. ## Cockpit evidence A causal-cone lens with edge classes: - required cause; - observed predecessor; - possible concurrency; - authority dependency; - material dependency; - carrier observation; - unresolved gap. ## Danger / falsifier If the explanation depends on correlation or timestamp proximity rather than explicit evidence, it is distributed tracing with better typography, not causal debugging. --- # 3. Why-not and bounded absence ## Invariant Missing evidence is false only when the relevant relation is complete for the selected horizon. Otherwise it is unknown. ## Feature Ask why a continuation did not resume, a message did not arrive, a grant was denied, or a carrier was not selected. ## Smallest experiment Ask why a watch-party continuation is still waiting: - before a matching assertion exists; - after an assertion exists outside the selected curve; - after its lease expires; - after a capability becomes invalid; - while remote state availability is unknown. ## Cockpit evidence Why-not classifications: ```text failed prerequisite missing in closed relation expired evidence excluded by curve/policy known object unavailable open-world unknown search budget exhausted ``` ## Danger / falsifier If the UI reports `false` without naming the horizon and completeness assumptions, remove the feature until it can speak accurately. --- # 4. Stable machinery and semantic zoom ## Invariant Position expresses stable locality or administrative territory. Component shape expresses semantic responsibility. Zoom reveals more of the same object. ## Feature Operators develop spatial memory while moving from world, to subsystem, to circuit, to wire, to canonical record. ## Smallest experiment Render one mailbox path at five zoom levels and verify: - the selected mailbox remains the same subject; - component locations remain stable; - each deeper level reveals real fields or evidence; - Return to Self and Return to Guide preserve context. ## Cockpit evidence - subject ID and lens stay visible; - selected causal horizon stays fixed unless deliberately changed; - no animated pulse exists without a runtime event; - planned/configured/observed/simulated states differ visually. ## Danger / falsifier If semantic zoom teleports to unrelated pages or force layouts move components between visits, the interface destroys the memory it claims to build. --- # 5. Petri/event-structure machinery ## Invariant Queues, enabling conditions, conflicts, concurrency, joins, and consumable resources have explicit semantics rather than generic arrows. ## Feature Render cursor machinery as a compositional circuit whose states can be checked, replayed, and modelled. ## Smallest experiment Model the effect lifecycle: ```text intent -> committed outbox -> leased execution -> uncertain/failed/observed -> admitted receipt -> continuation wake ``` Inject failure at every boundary. ## Cockpit evidence - places/queues and token counts; - enabled/disabled transitions; - conflict and inhibitor conditions; - transaction and receipt barriers; - observed trace versus declared machine. ## Danger / falsifier If the formal model cannot express uncertainty after an external effect may have happened, it is too tidy for the problem. --- # 6. Conversational dataspaces ## Invariant Assertions are attributed and leased; interests are structural; facets own conversational state; withdrawal or expiry is observable. A dataspace is not durable cursor history or one global tuple space. ## Feature Bodies coordinate through current knowledge rather than tightly coupled address-and-send choreography. ## Smallest experiment A watch-party room: - participants assert leased presence; - one facet subscribes to playback state; - a matching assertion wakes a continuation; - killing a facet withdraws its claims; - partitioned bodies retain separate honest projections. ## Cockpit evidence - publisher and lease; - matching interest/facet; - selected curve; - wake derivation; - assertion withdrawal/expiry; - distinction from durable cursors. ## Danger / falsifier If presence becomes a timeless fact or tuple possession becomes execution authority, the dataspace boundary has failed. --- # 7. Effects, uncertainty, and receipts ## Invariant Intent, authorization, submission, acceptance, completion, observation, and receipt are different states. “Exactly once” is never inferred from optimism. ## Feature Safe retries, duplicate suppression, compensation, and honest recovery after crashes or partitions. ## Smallest experiment Crash at four points: 1. before submission; 2. after submission, before acknowledgement; 3. after effect, before receipt persistence; 4. after receipt persistence, before client observation. ## Cockpit evidence A state machine that can display: ```text pending / executing / uncertain / failed / received ``` plus stable intent ID, lease, adapter, observation, receipt, retry, and compensation. ## Danger / falsifier If two processes can reuse one effect ID with different payloads, or an unleased executor can commit a receipt, stop before distributing anything consequential. --- # 8. Capability attenuation and caveats ## Invariant Derived authority can narrow but not widen the rights, resources, budget ceilings, context, audience, or validity of its parent. Structural validity and contextual authorization remain separate. ## Feature Macaroon/Biscuit-like readable caveats, third-party discharge, and capability-governed observation of curved dataspaces. ## Smallest experiment A grant permits reading one workbook and running one evaluator profile before expiry. Attenuate it to one sheet and one causal horizon, then require a separate safety discharge before publication. ## Cockpit evidence - issuer, subject, parent lineage; - rights removed; - caveats and discharge evidence; - audience/action/resource binding; - accepted trust roots; - denial reason. ## Danger / falsifier If possession of a pointer or live RPC stub becomes sufficient authority, or repeatable grants are described as consumed budgets without a redemption authority, the claims must be corrected. --- # 9. Curves as authority-relative views ## Invariant A curve selects a projection over one underlying collection of records and observations. It does not create a new universe or imply that hidden facts are false. ## Feature Local, family, project, recovery, and capability-restricted views of the same world. ## Smallest experiment Compare three curves over one mailbox and cursor history: - local Self; - invited room; - recovery-only view. Show one assertion visible in two curves, one grant visible in one, and one object unavailable everywhere. ## Cockpit evidence Side-by-side projection differences: ```text visible hidden by policy unavailable stale trusted under different roots live in only one curve ``` ## Danger / falsifier If opening two curves silently merges them or leaks material across an authority boundary, do not call them views. They are broken access control. --- # 10. Cursor Cells as a compact proof ## Invariant Formulas are versioned deterministic ASTs. JavaScript remains complete. Accelerators pass the same vectors. Inputs, formula, evaluator profile, result, and receipt roots remain explicit. ## Feature Spreadsheet-shaped local-first computation that can move across bodies, reconcile edits, and explain recalculation. ## Smallest experiment A ten-cell sheet containing: - scalar arithmetic; - conditional; - range aggregate; - vector/matrix value; - intentional cycle; - one offline edit; - JS/Nelua parity; - signed result receipt. ## Cockpit evidence - dependency cone; - invalidation and cache hits; - evaluator selected/fallback; - step/memory budgets; - SQLite transaction/outbox; - result and receipt roots. ## Danger / falsifier If formulas can reach host objects, ambient clock, locale, network, DOM, or arbitrary JavaScript, it is not the bounded Cells language. --- # 11. Reconcile identity, then recover bytes ## Invariant Set reconciliation discovers which immutable identities differ. Fountain/RaptorQ recovery reconstructs bytes for already-identified objects. Hashes/signatures authenticate the result. ## Feature Efficient intermittent exchange without forcing complete logs or rare-piece dependence. ## Smallest experiment - reconcile a small difference with minisketch; - extend capacity over the same frozen snapshot; - fall back to exact IDs; - recover one large missing payload from several RaptorQ sources; - inject corrupt symbols and reject the reconstructed hash. ## Cockpit evidence Three separate instruments: ```text knowledge rank recovery rank causal completeness ``` ## Danger / falsifier If fountain rank is shown as trust, or minisketch is used on unsolicited unbounded sets, the UI and protocol are lying in different dialects. --- # 12. Cap’n Web at the live edge ## Invariant Promise pipelining may reduce live round trips. Durable cursors, grants, checkpoints, outbox state, and receipts survive session loss. ## Feature One browser batch for dependent local/remote operations over HTTP, WebSocket, MessagePort, or WebRTC. ## Smallest experiment Compare: ```text resolve -> mailbox head -> append -> receipt ``` as sequential REST and a Cap’n Web pipeline under several simulated RTTs, while forcing a session break after durable commit. ## Cockpit evidence - live calls and pipeline dependency graph; - measured turns, bytes, and latency; - durable commit boundary; - broken ephemeral stubs; - successful recovery from SQLite/cursor state. ## Danger / falsifier If a stub is serialized as durable identity or disconnect loses accepted continuation state, the integration is backwards. --- # 13. Cursor Apps need four trust stories ## Invariant Artifact identity, release authorization, build provenance, transparency, and runtime authority are distinct. ## Feature Install and execute signed browser/Worker/Wasm/native apps with narrow explicit capabilities and inspectable supply-chain evidence. ## Smallest experiment Create five deliberately different failures: - correct artifact, unauthorized release signer; - authorized signer, rollback; - valid release, missing provenance; - valid app, denied runtime capability; - valid capability, incompatible body. ## Cockpit evidence Separate panels for content root, release metadata, build steps/materials, transparency inclusion, body imports, capabilities, and execution receipt. ## Danger / falsifier One green padlock or one signature must never summarize the entire chain. --- # 14. WASI/component bodies ## Invariant A component handle or WIT resource is body-local. Cursors records and grants define durable identity and authority outside the runtime session. ## Feature Run the same semantic continuation in browser Wasm, native components, mobile, or other hosts through narrow asynchronous interfaces. ## Smallest experiment Implement one pure evaluator and one outbox adapter through a versioned component interface. Kill and recreate the component between calls. ## Cockpit evidence - component profile/version; - imports and granted handles; - async task boundaries; - durable state before/after component loss; - engine fallback. ## Danger / falsifier If WASI availability becomes a prerequisite for browser correctness or a component resource becomes portable authority, the body boundary has leaked. --- # 15. Identity as several facts ## Invariant Key control, key continuity, admission, relationship, authority, and presence are separate claims with separate evidence. ## Feature Local-first Self continuity, optional cloud hydration, signed introductions, key rotation, and honest recovery. ## Smallest experiment - prove control of a local key; - rotate it through a signed successor event; - accept a separate admission grant; - establish one local relationship label; - expire presence without deleting identity; - restore encrypted material without manufacturing authority. ## Cockpit evidence A table showing which proof supports each claim and which claims remain absent. ## Danger / falsifier GitHub login, transport reachability, mailbox possession, or a web challenge must not become “human identity” by rhetorical compression. --- # 16. Native host and driver cells ## Invariant Durable records name semantic operations, sealed regions, budgets, idempotency, and receipts. File descriptors, queue addresses, device paths, interrupts, and DMA mappings remain body-local. ## Feature Restartable isolated host cells for storage, networking, radios, and later hardware without encoding Linux into the protocol. ## Smallest experiment A virtual device queue behind an isolated process: - submit one bounded operation; - kill the cell after submission; - report uncertainty; - restart under the same narrow capability; - admit or query a receipt; - reject capability widening. ## Cockpit evidence - semantic operation packet; - local adapter mapping; - queue/completion state; - cell lifecycle; - uncertain effect boundary; - receipt. ## Danger / falsifier If durable continuations contain local handles or require privileged host mounts, the native boundary is not portable or least-authority. --- # 17. Formal methods produce ordinary evidence ## Invariant Specifications, executable fixtures, and observed traces share named transition and invariant vocabulary while retaining different evidence classes. ## Feature Open a TLA+, Alloy, Petri-net, or explicit-state counterexample in the same causal cockpit used for live execution. ## Smallest experiment Model duplicate delivery around a crash and receipt loss. Import the smallest counterexample as a `formal` causal horizon and compare it with a deterministic executable scenario. ## Cockpit evidence - invariant violated; - formal steps; - mapped cursor/message/grant/effect objects; - divergence from executable behavior; - observed versus formal label. ## Danger / falsifier A green model check does not prove implementation conformance. A real trace does not prove the model exhaustive. --- # 18. Signed commitments and institutional machinery ## Invariant Offers, acceptance, commitments, delivery, inspection, receipts, disputes, resolutions, balances, and reputation projections are separate signed events and views. ## Feature Research mutual-credit, Ricardian-contract-like commitments, project incorporation, and cooperative work without hiding institutional choices inside a token balance. ## Smallest experiment Use fictional test units for a two-party service commitment with explicit delivery, inspection, dispute, and resolution paths. ## Cockpit evidence - terms and signers; - accepted authority/jurisdiction profile; - events and receipts; - disputed branches; - local balance/reputation projection; - unresolved legal status. ## Danger / falsifier Do not represent legal enforceability, human identity, market value, tax treatment, or fairness as consequences of a signature graph. External expert work remains external. --- # 19. Spatial/XR causal traversal ## Invariant XR is another projection of canonical subjects and evidence. Self remains a stable origin; object identity does not depend on 3D coordinates. ## Feature Walk a causal cone, compare curves spatially, and manipulate counterfactual plans while preserving orientation. ## Smallest experiment Render only one local causal neighborhood in WebXR: - Self at origin; - upstream causes behind/left; - concurrent alternatives lateral; - downstream effects forward; - distant regions through compressed portals. Measure search time and spatial recall against 2D. ## Cockpit evidence The same selected subject, horizon, edge classes, and evidence details as the 2D view. ## Danger / falsifier If XR adds spectacle but worsens diagnosis, spatial memory, accessibility, or evidence comprehension, keep it out of the operational path. --- # 20. Flagship experiments This part is the integration gate for the previous nineteen. ## Experiment A: process-kill migration Tests continuation, causal history, body replacement, state resolution, capability checks, and duplicate rejection. ## Experiment B: uncertain external effect Tests transaction/outbox boundaries, leases, idempotency, uncertainty, receipts, retry, and compensation. ## Experiment C: Cursor Cells Tests deterministic language, incremental dependency logic, JS/Nelua parity, SQLite, exchange, and receipts. ## Experiment D: carrier invariance Moves one semantic envelope through local, WebRTC, Cloudflare mailbox, HTTP/webseed, swarm, and imported-file carriers. ## Experiment E: app trust anatomy Tests artifact, release, provenance, transparency, capability, body compatibility, and execution. ## Experiment F: logic and why-not Tests horizons, Datalog derivation, provenance, open-world absence, counterfactuals, and cockpit explanation. ## Exit condition A new subsystem is not “integrated” until one flagship experiment exercises it through real failure and the cockpit explains the outcome accurately. --- # 21. Video sequence The maintained direct-link sequence lives in [Research Horizon](research-horizon-watchlist.md). Its role in the program is not passive viewing. Every video entry records: - the mechanism to watch; - the Cursors experiment it suggests; - the claim or boundary it might invalidate. The sequence begins with Colin Breck’s edge/cloud and infrastructure convergence argument, then moves through Syndicate, moldable development, Whyline, deep-zoom debugging, live programming, egglog/e-graphs, Unison, formal reasoning, CRDT limitations, and Cap’n Web. ## Exit condition A source enters the architecture only after it produces a concrete experiment or deletes a redundant abstraction. --- # 22. Core reading order ## Tier 1: current implementation decisions 1. Dedalus and CALM for temporal/distributed logic. 2. Syndicate for attributed conversational coordination. 3. Whyline, Causeway, ShiViz, Oddity, and Pivot Tracing for explanation. 4. Macaroons/Biscuit for attenuation and caveats. 5. SQLite virtual tables, authorizer, functions, recursive CTEs, and Session constraints. 6. egglog/e-graphs for plan-equivalence exploration. 7. DBSP/Differential Dataflow for incremental maintenance. 8. Bundle Protocol, minisketch, range reconciliation, and RaptorQ for intermittent exchange. ## Tier 2: body and language evolution 1. Emerald and Obliq for mobility and distributed scope. 2. Ken/MaceKen, Beldi, Waterken, and choreography systems for recovery. 3. Unison for content-addressed code. 4. Scheme/miniKanren for relational language-level Cursors. 5. WASI component async for body interfaces. ## Tier 3: interface and formal composition 1. Moldable Development and Self/Smalltalk inspection. 2. Semantic zoom and ecological interface design. 3. Petri nets, event structures, open systems, and process mining. 4. TLA+, Alloy, and model-based testing. 5. WebXR/spatial programming only after operational evidence exists. ## Exit condition Reading notes must name a changed invariant, experiment, or deletion. “Interesting” is not a project state. --- # 23. Things Cursors should deliberately not copy - Force-directed layouts that destroy spatial memory. - One global tuple space. - CRDTs as effect-execution semantics. - Bearer URLs or RPC stubs as durable authority. - Opaque heap/process snapshots as cursor truth. - Exactly-once language without a narrow receipt domain. - WASM as a magical sandbox or source of authority. - Arrow, JSON, CBOR, S-expressions, or any one encoding as the universal form for every job. - Transparency logs as authorization. - Fountain coding as authenticity. - One signature as a complete software supply chain. - One scalar “confidence” score averaging unrelated evidence. - An optimizer allowed to cross authority, causality, transaction, curve, or receipt barriers. - AI-generated explanations without inspectable derivations. - A cockpit that invents activity to appear alive. - XR or 3D merely because the machine looks lonely in two dimensions. - A second database, queue, AST, term model, or plan language when SQLite and Cursor Terms already own the job. ## Exit condition When a new proposal resembles one of these, the proposer must show the invariant the old warning no longer covers. Otherwise delete or narrow it. --- # Program-level release sequence ```text R0 Freeze Cursor Terms, rule IR, plan IR, horizons, budgets, vectors R1 SQLite-owned JavaScript Datalog reference + provenance R2 Nelua/C/Wasm bounded join/delta parity R3 why/why-not causal cockpit and live guide embeds R4 typed cryptofabric plans + egglog sidecar experiment R5 process-kill and uncertain-effect flagship demonstrations R6 Scheme language-level profile and bounded relational search R7 formal counterexample import and counterfactual horizons R8 measured spatial/XR experiment, only if still justified ``` Every release keeps JavaScript complete, SQLite operational state rebuildable, signed Cursors records portable, logic proposal-only, and effects behind explicit capability and receipt boundaries. ## Related guides - [Cursor Logic](cursor-logic.md) - [Causal Horizons and Why-Not](causal-horizons-and-why-not.md) - [Cryptofabric Plans and Egglog](cryptofabric-plans-and-egglog.md) - [Cursors Lego Architecture](cursors-lego-architecture.md) - [Research Horizon](research-horizon-watchlist.md) - [Roadmap](roadmap.md)