This is a static guide, not a live service status. Public remote writes and execution remain disabled. No JavaScript is needed to read this page.

Twenty-Three-Part Cursors Research Program

Status: program plan. Each part names an invariant, a smallest executable experiment, visible evidence, and a condition that would weaken or falsify the idea. The point is not to make twenty-three subsystems. The point is to make one machine survive twenty-three different kinds of scrutiny.

The research program uses one repeated structure:

INVARIANT
  What must remain true across implementations?

FEATURE
  What useful capability follows if the invariant can be upheld?

SMALLEST EXPERIMENT
  What is the cheapest executable test with real failure cases?

COCKPIT EVIDENCE
  What should an operator be able to inspect?

DANGER / FALSIFIER
  What result would tell us to narrow, replace, or delete the idea?

The parts are ordered by dependency, not spectacle. The later spatial and institutional ideas depend on the earlier causal, authority, storage, and receipt boundaries. A holographic cockpit cannot rescue a protocol that confuses delivery with execution, however handsomely it glows.

1. Inspectable causal continuations

Invariant

A continuation survives a body only when its program point, serializable state, causal parents, state roots, capability references, and output/effect obligations are independently verifiable.

Feature

Pause work in one browser/native body and resume it elsewhere without serializing a JavaScript promise, Lua heap, C stack, process image, SQLite connection, or Cap’n Web stub.

Smallest experiment

Start a continuation on Cedar.
Checkpoint explicit state.
Kill the executor process or Worker.
Resolve the checkpoint on Mirror.
Verify authority and body compatibility.
Resume exactly one successor.
Reject a stale duplicate result from Cedar.

Cockpit evidence

parent cursor IDs;
continuation profile and program root;
checkpoint root and availability;
old and new body leases;
capability presentation;
successor cursor;
duplicate rejection.

Danger / falsifier

If portable state requires hidden runtime objects or implementation-specific heap snapshots, the abstraction is not a portable continuation yet.

2. Causal debugging rather than chronological logs

Invariant

Wall-clock order is evidence, not causal proof. Cursors, messages, assertions, grants, state resolution, effects, and receipts retain typed causal relationships.

Feature

Ask why an outcome happened and follow the evidence across bodies, carriers, and storage boundaries.

Smallest experiment

For one resumed cursor, record:

message -> interest match -> authority gate -> state resolution
        -> body lease -> execution -> effect intent -> receipt -> successor

Then shuffle timestamps while preserving causal edges and verify the explanation remains unchanged.

Cockpit evidence

A causal-cone lens with edge classes:

required cause;
observed predecessor;
possible concurrency;
authority dependency;
material dependency;
carrier observation;
unresolved gap.

Danger / falsifier

If the explanation depends on correlation or timestamp proximity rather than explicit evidence, it is distributed tracing with better typography, not causal debugging.

3. Why-not and bounded absence

Invariant

Missing evidence is false only when the relevant relation is complete for the selected horizon. Otherwise it is unknown.

Feature

Ask why a continuation did not resume, a message did not arrive, a grant was denied, or a carrier was not selected.

Smallest experiment

Ask why a watch-party continuation is still waiting:

before a matching assertion exists;
after an assertion exists outside the selected curve;
after its lease expires;
after a capability becomes invalid;
while remote state availability is unknown.

Cockpit evidence

Why-not classifications:

failed prerequisite
missing in closed relation
expired evidence
excluded by curve/policy
known object unavailable
open-world unknown
search budget exhausted

Danger / falsifier

If the UI reports false without naming the horizon and completeness assumptions, remove the feature until it can speak accurately.

4. Stable machinery and semantic zoom

Invariant

Position expresses stable locality or administrative territory. Component shape expresses semantic responsibility. Zoom reveals more of the same object.

Feature

Operators develop spatial memory while moving from world, to subsystem, to circuit, to wire, to canonical record.

Smallest experiment

Render one mailbox path at five zoom levels and verify:

the selected mailbox remains the same subject;
component locations remain stable;
each deeper level reveals real fields or evidence;
Return to Self and Return to Guide preserve context.

Cockpit evidence

subject ID and lens stay visible;
selected causal horizon stays fixed unless deliberately changed;
no animated pulse exists without a runtime event;
planned/configured/observed/simulated states differ visually.

Danger / falsifier

If semantic zoom teleports to unrelated pages or force layouts move components between visits, the interface destroys the memory it claims to build.

5. Petri/event-structure machinery

Invariant

Queues, enabling conditions, conflicts, concurrency, joins, and consumable resources have explicit semantics rather than generic arrows.

Feature

Render cursor machinery as a compositional circuit whose states can be checked, replayed, and modelled.

Smallest experiment

Model the effect lifecycle:

intent -> committed outbox -> leased execution -> uncertain/failed/observed
       -> admitted receipt -> continuation wake

Inject failure at every boundary.

Cockpit evidence

places/queues and token counts;
enabled/disabled transitions;
conflict and inhibitor conditions;
transaction and receipt barriers;
observed trace versus declared machine.

Danger / falsifier

If the formal model cannot express uncertainty after an external effect may have happened, it is too tidy for the problem.

6. Conversational dataspaces

Invariant

Assertions are attributed and leased; interests are structural; facets own conversational state; withdrawal or expiry is observable. A dataspace is not durable cursor history or one global tuple space.

Feature

Bodies coordinate through current knowledge rather than tightly coupled address-and-send choreography.

Smallest experiment

A watch-party room:

participants assert leased presence;
one facet subscribes to playback state;
a matching assertion wakes a continuation;
killing a facet withdraws its claims;
partitioned bodies retain separate honest projections.

Cockpit evidence

publisher and lease;
matching interest/facet;
selected curve;
wake derivation;
assertion withdrawal/expiry;
distinction from durable cursors.

Danger / falsifier

If presence becomes a timeless fact or tuple possession becomes execution authority, the dataspace boundary has failed.

7. Effects, uncertainty, and receipts

Invariant

Intent, authorization, submission, acceptance, completion, observation, and receipt are different states. “Exactly once” is never inferred from optimism.

Feature

Safe retries, duplicate suppression, compensation, and honest recovery after crashes or partitions.

Smallest experiment

Crash at four points:

before submission;
after submission, before acknowledgement;
after effect, before receipt persistence;
after receipt persistence, before client observation.

Cockpit evidence

A state machine that can display:

pending / executing / uncertain / failed / received

plus stable intent ID, lease, adapter, observation, receipt, retry, and compensation.

Danger / falsifier

If two processes can reuse one effect ID with different payloads, or an unleased executor can commit a receipt, stop before distributing anything consequential.

8. Capability attenuation and caveats

Invariant

Derived authority can narrow but not widen the rights, resources, budget ceilings, context, audience, or validity of its parent. Structural validity and contextual authorization remain separate.

Feature

Macaroon/Biscuit-like readable caveats, third-party discharge, and capability-governed observation of curved dataspaces.

Smallest experiment

A grant permits reading one workbook and running one evaluator profile before expiry. Attenuate it to one sheet and one causal horizon, then require a separate safety discharge before publication.

Cockpit evidence

issuer, subject, parent lineage;
rights removed;
caveats and discharge evidence;
audience/action/resource binding;
accepted trust roots;
denial reason.

Danger / falsifier

If possession of a pointer or live RPC stub becomes sufficient authority, or repeatable grants are described as consumed budgets without a redemption authority, the claims must be corrected.

9. Curves as authority-relative views

Invariant

A curve selects a projection over one underlying collection of records and observations. It does not create a new universe or imply that hidden facts are false.

Feature

Local, family, project, recovery, and capability-restricted views of the same world.

Smallest experiment

Compare three curves over one mailbox and cursor history:

local Self;
invited room;
recovery-only view.

Show one assertion visible in two curves, one grant visible in one, and one object unavailable everywhere.

Cockpit evidence

Side-by-side projection differences:

visible
hidden by policy
unavailable
stale
trusted under different roots
live in only one curve

Danger / falsifier

If opening two curves silently merges them or leaks material across an authority boundary, do not call them views. They are broken access control.

10. Cursor Cells as a compact proof

Invariant

Formulas are versioned deterministic ASTs. JavaScript remains complete. Accelerators pass the same vectors. Inputs, formula, evaluator profile, result, and receipt roots remain explicit.

Feature

Spreadsheet-shaped local-first computation that can move across bodies, reconcile edits, and explain recalculation.

Smallest experiment

A ten-cell sheet containing:

scalar arithmetic;
conditional;
range aggregate;
vector/matrix value;
intentional cycle;
one offline edit;
JS/Nelua parity;
signed result receipt.

Cockpit evidence

dependency cone;
invalidation and cache hits;
evaluator selected/fallback;
step/memory budgets;
SQLite transaction/outbox;
result and receipt roots.

Danger / falsifier

If formulas can reach host objects, ambient clock, locale, network, DOM, or arbitrary JavaScript, it is not the bounded Cells language.

11. Reconcile identity, then recover bytes

Invariant

Set reconciliation discovers which immutable identities differ. Fountain/RaptorQ recovery reconstructs bytes for already-identified objects. Hashes/signatures authenticate the result.

Feature

Efficient intermittent exchange without forcing complete logs or rare-piece dependence.

Smallest experiment

reconcile a small difference with minisketch;
extend capacity over the same frozen snapshot;
fall back to exact IDs;
recover one large missing payload from several RaptorQ sources;
inject corrupt symbols and reject the reconstructed hash.

Cockpit evidence

Three separate instruments:

knowledge rank
recovery rank
causal completeness

Danger / falsifier

If fountain rank is shown as trust, or minisketch is used on unsolicited unbounded sets, the UI and protocol are lying in different dialects.

12. Cap’n Web at the live edge

Invariant

Promise pipelining may reduce live round trips. Durable cursors, grants, checkpoints, outbox state, and receipts survive session loss.

Feature

One browser batch for dependent local/remote operations over HTTP, WebSocket, MessagePort, or WebRTC.

Smallest experiment

Compare:

resolve -> mailbox head -> append -> receipt

as sequential REST and a Cap’n Web pipeline under several simulated RTTs, while forcing a session break after durable commit.

Cockpit evidence

live calls and pipeline dependency graph;
measured turns, bytes, and latency;
durable commit boundary;
broken ephemeral stubs;
successful recovery from SQLite/cursor state.

Danger / falsifier

If a stub is serialized as durable identity or disconnect loses accepted continuation state, the integration is backwards.

13. Cursor Apps need four trust stories

Invariant

Artifact identity, release authorization, build provenance, transparency, and runtime authority are distinct.

Feature

Install and execute signed browser/Worker/Wasm/native apps with narrow explicit capabilities and inspectable supply-chain evidence.

Smallest experiment

Create five deliberately different failures:

correct artifact, unauthorized release signer;
authorized signer, rollback;
valid release, missing provenance;
valid app, denied runtime capability;
valid capability, incompatible body.

Cockpit evidence

Separate panels for content root, release metadata, build steps/materials, transparency inclusion, body imports, capabilities, and execution receipt.

Danger / falsifier

One green padlock or one signature must never summarize the entire chain.

14. WASI/component bodies

Invariant

A component handle or WIT resource is body-local. Cursors records and grants define durable identity and authority outside the runtime session.

Feature

Run the same semantic continuation in browser Wasm, native components, mobile, or other hosts through narrow asynchronous interfaces.

Smallest experiment

Implement one pure evaluator and one outbox adapter through a versioned component interface. Kill and recreate the component between calls.

Cockpit evidence

component profile/version;
imports and granted handles;
async task boundaries;
durable state before/after component loss;
engine fallback.

Danger / falsifier

If WASI availability becomes a prerequisite for browser correctness or a component resource becomes portable authority, the body boundary has leaked.

15. Identity as several facts

Invariant

Key control, key continuity, admission, relationship, authority, and presence are separate claims with separate evidence.

Feature

Local-first Self continuity, optional cloud hydration, signed introductions, key rotation, and honest recovery.

Smallest experiment

prove control of a local key;
rotate it through a signed successor event;
accept a separate admission grant;
establish one local relationship label;
expire presence without deleting identity;
restore encrypted material without manufacturing authority.

Cockpit evidence

A table showing which proof supports each claim and which claims remain absent.

Danger / falsifier

GitHub login, transport reachability, mailbox possession, or a web challenge must not become “human identity” by rhetorical compression.

16. Native host and driver cells

Invariant

Durable records name semantic operations, sealed regions, budgets, idempotency, and receipts. File descriptors, queue addresses, device paths, interrupts, and DMA mappings remain body-local.

Feature

Restartable isolated host cells for storage, networking, radios, and later hardware without encoding Linux into the protocol.

Smallest experiment

A virtual device queue behind an isolated process:

submit one bounded operation;
kill the cell after submission;
report uncertainty;
restart under the same narrow capability;
admit or query a receipt;
reject capability widening.

Cockpit evidence

semantic operation packet;
local adapter mapping;
queue/completion state;
cell lifecycle;
uncertain effect boundary;
receipt.

Danger / falsifier

If durable continuations contain local handles or require privileged host mounts, the native boundary is not portable or least-authority.

17. Formal methods produce ordinary evidence

Invariant

Specifications, executable fixtures, and observed traces share named transition and invariant vocabulary while retaining different evidence classes.

Feature

Open a TLA+, Alloy, Petri-net, or explicit-state counterexample in the same causal cockpit used for live execution.

Smallest experiment

Model duplicate delivery around a crash and receipt loss. Import the smallest counterexample as a formal causal horizon and compare it with a deterministic executable scenario.

Cockpit evidence

invariant violated;
formal steps;
mapped cursor/message/grant/effect objects;
divergence from executable behavior;
observed versus formal label.

Danger / falsifier

A green model check does not prove implementation conformance. A real trace does not prove the model exhaustive.

18. Signed commitments and institutional machinery

Invariant

Offers, acceptance, commitments, delivery, inspection, receipts, disputes, resolutions, balances, and reputation projections are separate signed events and views.

Feature

Research mutual-credit, Ricardian-contract-like commitments, project incorporation, and cooperative work without hiding institutional choices inside a token balance.

Smallest experiment

Use fictional test units for a two-party service commitment with explicit delivery, inspection, dispute, and resolution paths.

Cockpit evidence

terms and signers;
accepted authority/jurisdiction profile;
events and receipts;
disputed branches;
local balance/reputation projection;
unresolved legal status.

Danger / falsifier

Do not represent legal enforceability, human identity, market value, tax treatment, or fairness as consequences of a signature graph. External expert work remains external.

19. Spatial/XR causal traversal

Invariant

XR is another projection of canonical subjects and evidence. Self remains a stable origin; object identity does not depend on 3D coordinates.

Feature

Walk a causal cone, compare curves spatially, and manipulate counterfactual plans while preserving orientation.

Smallest experiment

Render only one local causal neighborhood in WebXR:

Self at origin;
upstream causes behind/left;
concurrent alternatives lateral;
downstream effects forward;
distant regions through compressed portals.

Measure search time and spatial recall against 2D.

Cockpit evidence

The same selected subject, horizon, edge classes, and evidence details as the 2D view.

Danger / falsifier

If XR adds spectacle but worsens diagnosis, spatial memory, accessibility, or evidence comprehension, keep it out of the operational path.

20. Flagship experiments

This part is the integration gate for the previous nineteen.

Experiment A: process-kill migration

Tests continuation, causal history, body replacement, state resolution, capability checks, and duplicate rejection.

Experiment B: uncertain external effect

Tests transaction/outbox boundaries, leases, idempotency, uncertainty, receipts, retry, and compensation.

Experiment C: Cursor Cells

Tests deterministic language, incremental dependency logic, JS/Nelua parity, SQLite, exchange, and receipts.

Experiment D: carrier invariance

Moves one semantic envelope through local, WebRTC, Cloudflare mailbox, HTTP/webseed, swarm, and imported-file carriers.

Experiment E: app trust anatomy

Tests artifact, release, provenance, transparency, capability, body compatibility, and execution.

Experiment F: logic and why-not

Tests horizons, Datalog derivation, provenance, open-world absence, counterfactuals, and cockpit explanation.

Exit condition

A new subsystem is not “integrated” until one flagship experiment exercises it through real failure and the cockpit explains the outcome accurately.

21. Video sequence

The maintained direct-link sequence lives in Research Horizon. Its role in the program is not passive viewing. Every video entry records:

the mechanism to watch;
the Cursors experiment it suggests;
the claim or boundary it might invalidate.

The sequence begins with Colin Breck’s edge/cloud and infrastructure convergence argument, then moves through Syndicate, moldable development, Whyline, deep-zoom debugging, live programming, egglog/e-graphs, Unison, formal reasoning, CRDT limitations, and Cap’n Web.

Exit condition

A source enters the architecture only after it produces a concrete experiment or deletes a redundant abstraction.

22. Core reading order

Tier 1: current implementation decisions

Dedalus and CALM for temporal/distributed logic.
Syndicate for attributed conversational coordination.
Whyline, Causeway, ShiViz, Oddity, and Pivot Tracing for explanation.
Macaroons/Biscuit for attenuation and caveats.
SQLite virtual tables, authorizer, functions, recursive CTEs, and Session constraints.
egglog/e-graphs for plan-equivalence exploration.
DBSP/Differential Dataflow for incremental maintenance.
Bundle Protocol, minisketch, range reconciliation, and RaptorQ for intermittent exchange.

Tier 2: body and language evolution

Emerald and Obliq for mobility and distributed scope.
Ken/MaceKen, Beldi, Waterken, and choreography systems for recovery.
Unison for content-addressed code.
Scheme/miniKanren for relational language-level Cursors.
WASI component async for body interfaces.

Tier 3: interface and formal composition

Moldable Development and Self/Smalltalk inspection.
Semantic zoom and ecological interface design.
Petri nets, event structures, open systems, and process mining.
TLA+, Alloy, and model-based testing.
WebXR/spatial programming only after operational evidence exists.

Exit condition

Reading notes must name a changed invariant, experiment, or deletion. “Interesting” is not a project state.

23. Things Cursors should deliberately not copy

Force-directed layouts that destroy spatial memory.
One global tuple space.
CRDTs as effect-execution semantics.
Bearer URLs or RPC stubs as durable authority.
Opaque heap/process snapshots as cursor truth.
Exactly-once language without a narrow receipt domain.
WASM as a magical sandbox or source of authority.
Arrow, JSON, CBOR, S-expressions, or any one encoding as the universal form for every job.
Transparency logs as authorization.
Fountain coding as authenticity.
One signature as a complete software supply chain.
One scalar “confidence” score averaging unrelated evidence.
An optimizer allowed to cross authority, causality, transaction, curve, or receipt barriers.
AI-generated explanations without inspectable derivations.
A cockpit that invents activity to appear alive.
XR or 3D merely because the machine looks lonely in two dimensions.
A second database, queue, AST, term model, or plan language when SQLite and Cursor Terms already own the job.

Exit condition

When a new proposal resembles one of these, the proposer must show the invariant the old warning no longer covers. Otherwise delete or narrow it.

Program-level release sequence

R0  Freeze Cursor Terms, rule IR, plan IR, horizons, budgets, vectors
R1  SQLite-owned JavaScript Datalog reference + provenance
R2  Nelua/C/Wasm bounded join/delta parity
R3  why/why-not causal cockpit and live guide embeds
R4  typed cryptofabric plans + egglog sidecar experiment
R5  process-kill and uncertain-effect flagship demonstrations
R6  Scheme language-level profile and bounded relational search
R7  formal counterexample import and counterfactual horizons
R8  measured spatial/XR experiment, only if still justified

Every release keeps JavaScript complete, SQLite operational state rebuildable, signed Cursors records portable, logic proposal-only, and effects behind explicit capability and receipt boundaries.