# Questions that can earn real innovation

The project should deviate where a modern invariant becomes simpler, safer, or more expressive—not merely because Unix did something first.

## Cursor semantics

1. What is the smallest continuation description that can resume across different executors without serializing a whole machine?
2. Which state belongs in the cursor payload, which belongs in the object DAG, and which is merely a resolver hint?
3. Can a cursor be partially disclosed while still proving the parentage needed by a recipient?
4. How should speculative branches declare that only one may redeem a consumable effect?
5. Can a join prove aggregate work without exposing every private branch?
6. When is checkpoint compatibility structural, and when does it require a specific runtime build or CPU feature set?

## Authority

1. Which budgets are locally countable, which need an online redeemer, and which need distributed settlement?
2. Can “reforge” provide an understandable capability debugger: a visible proof of every removed right and narrowed scope?
3. What is the right offline revocation UX for a device returning after months or years?
4. Can threshold grants represent a group, horde, or quorum without turning every operation into consensus?
5. How do we prevent authority inference from cursor metadata even when contents remain encrypted?

## Storage and memory

1. Should a resumable state graph address typed cells, immutable regions, language objects, or all three through explicit views?
2. When can local mappings safely optimize a remote-reference abstraction without changing lifetime or failure semantics?
3. Can NVMe queue completions become first-class cursor receipts with less impedance than a filesystem syscall path?
4. How should mutable device state be represented without pretending it is an immutable object?
5. Can partial streams and fountain symbols be resolved as ordinary object views rather than a special bulk-transfer subsystem?

## Scheduling and horde behavior

1. What does a scheduler optimize when bodies vary in trust, energy, data locality, connectivity, and lifespan?
2. Can executors bid using leased assertions without revealing their complete topology or capacity?
3. How should a program express “any two independent failure domains,” “this friend group,” or “this body only while solar-rich”?
4. What useful behavior emerges from local interests and assertions without appointing a global orchestrator?
5. How do Selves and bodies acquire playful identities without confusing role-playing names with cryptographic authority?

## Compatibility

1. What is the smallest Linux driver-cell boundary that survives device reset and malicious descriptors?
2. Which POSIX workloads should remain contained Linux bodies instead of being ported or emulated?
3. Can one host ABI serve a Node prototype, WASM runtime, Linux process, VM, and native host without becoming a lowest-common-denominator syscall list?
4. Which Linux facilities are implementation techniques (`io_uring`, namespaces, VFIO) and must never leak into durable records?

## Programming world

1. What does Smalltalk-style “everything is inspectable” mean when some objects are remote, encrypted, expired, or authority-gated?
2. Can facets be paused and resumed with their assertions automatically withdrawn and later re-established safely?
3. Should a world be one root cursor, a set of named horizon cursors, or an attributed dataspace view?
4. What is the simplest textual and graphical notation for splitting, migrating, and joining execution?
5. Can debugging be ordinary graph navigation rather than an exceptional privileged mode?
6. Which Lua subset can become a reviewable complete parser and embedded VM profile without weakening explicit-state recovery?
7. Where is the measured break-even between one coarse executor and a Lua Worker pool across memory, OPFS, native SQLite, and mobile hosts?
8. Which relational projections justify a native SQLite virtual table instead of generated/materialized columns?

## Deliberate parallel tracks

- Issue #44 owns the SQLite-controlled Lua Cursor Machine.
- Issue #50 may independently implement the same portable packet fixtures in Rust; neither implementation waits for the other.
- Issue #42 complements the machine with live Cap'n Web/worker pipelining, but live RPC is not durable execution.
- SignedData/SignedForm issue #39 remains a separate record/form design track.
- TIP-inspired TLV islands remain experimental encoding research and do not become the Lua, SQLite, or Cloudflare sync protocol.

## Decision test

Before adding a radical mechanism, answer:

- Which current invariant becomes expressible?
- Which failure becomes visible or recoverable?
- What is the minimal executable demonstration?
- Can the mechanism be independently implemented from its record description?
- How does it behave offline, duplicated, delayed, reordered, expired, and under hostile input?
- Can a person see and revoke the authority it creates?
- What familiar mechanism is retained at the edge for compatibility?