# Low Passage Decisions The record of what changed and why, one dated line each. It used to close [[Low Passage]] and now lives beside it, because a log of reasoning is read differently from a design. **Append-only.** An overtaken decision gets a new dated entry naming what it replaced. An old entry is never edited, because the reason a thing changed is as useful as the thing. ## Decisions - **2026-11-07** — Erlang/OTP 28, cross-platform code. Windows is the development host; Linux and VPS nodes are expected targets; no WSL. - **2026-11-08** — The development host in fact runs OTP 29; the 2026-11-07 entries were written against 28. The code targets whichever major is installed, and every node is pinned to the same major before distribution is trusted. - **2026-11-07** — Colons for internal addresses; slashes in HTTP routes; `@` reserved for node names. - **2026-11-07** — Content in Markdown files; coordination in the log; mailboxes are doorbells only. - **2026-11-07** — The bridge is a separate application, not part of Bionic. - **2026-11-07** — Local models only for v0; the subscription path stays open through the mind behaviour. - **2026-11-07** — Stateless minds preferred, so migration ships a message list rather than a vendor thread. - **2026-11-07** — Enrollment splits three ways: nodes join the Erlang cluster, minds join the mind pool, consorts federate over A2A/HTTP. Android is a mind host or a consort, not an Erlang node. - **2026-11-08** — The unit is a **station**. OpenRig's "seat" is retired from our vocabulary; "effector" is the action half of a station. - **2026-11-08** — The metaphor is naval: fleet, task force, ship, department, station. The project remains **Rig**; a running instance is a ship. - **2026-11-08** — Rank is scope, not identity. Commissions are Admiral, Commodore, Captain, Commander, Lieutenant; most stations hold none, and a human may hold any of them. - **2026-11-08** — Model minds are provisioned and retired by a quartermaster within fleet policy. Human minds are enrolled and released. Culling drains before unload, and a bound station must have a fallback. - **2026-11-08** — Stations may request working parties; authority cannot exceed the granter's commission. A binding is a lease: if no mind is available, the station is ready-unbound and the job blocks with a reason. - **2026-11-08** — Human minds are enrolled and released, not provisioned. A future *summons* flow may request attention explicitly; it is deferred. - **2026-11-08** — The minimum viable fleet is a flagship: Commodore, bosun, quartermaster, flag log, one command mind, one work mind, one host. The first ship follows the task; `starter` is a default, not a requirement. - **2026-11-08** — Setup names the flagship and the initial crew. The role and address are stable; the crew name belongs to the occupant. - **2026-11-08** — Decommissioning retains the ship's log, rough log, standing orders, and proofs; the crew is released, and the name may be reused. - **2026-11-08** — Department IDs are local and authored. OpenRig's pod names (`dev`, `orch`) are examples, not requirements; the ID is an address segment, the label is free-form. - **2026-11-08** — Stations follow work, not the org chart. Every station must justify itself with a sensor, effector, judgment, or command role; the design is recorded as an order of battle before muster. - **2026-11-08** — Ships get functional, Culture-inspired names; classes stay generic (`starter`, `workshop`). The ship ID is the address-safe slug; the name is the label. - **2026-11-08** — Task forces are named for their purpose on the same principle, and the name outlives its commodore. Staff work is a post and not a rank: a chief of staff or a flag captain holds whatever commission the work needs, so the ladder never grows a rung for staff. - **2026-11-08** — Station IDs are roles; labels are for humans and may be functional or merely memorable; crew names belong to the occupant. The function lives in the ID because the ID is what routes, and putting the joke in the address is a mistake. - **2026-11-08** — Station roles are authored at muster, not selected from a registry. The named roles are recurring examples; what the system enforces is address uniqueness, not a vocabulary of permitted roles. - **2026-11-08** — Reusable definitions accumulate in a fleet library at every level — station roles, department patterns, ship classes — and are promoted like standing orders. Reuse inherits capability and not merely a name, so a library station's effectors are checked against what the design says may touch that resource, and a topology assembled from familiar parts re-derives its proof obligations rather than inheriting them. - **2026-11-08** — Composition **inside a ship** has three levels and does not nest: equipment inside a station, stations inside a department, departments inside a ship. A group of groups is a ship, not a department, which is also what the address grammar enforces. Formations above a ship group upward instead, per the later entry on climbing. - **2026-11-08** — Android provisioning uses USB/ADB; runtime uses Wi-Fi. USB is not the production transport. - **2026-11-08** — **Ship is the only word for the instance**; "hull" is retired. The distinction it carried — an instance rather than a working party — lives in the definition of *ship*, so the ship test reads "ship or working party" and nothing has to be said twice. - **2026-11-08** — A ship is earned by memory, queue, or trust boundary, not by task size. Mind-host enrollment hits all three, so it gets a tender (`warranty-void`); a task with none of the three is a working party. - **2026-11-08** — A crew asks for what it does not have, in any direction, rather than inferring intent. Ambiguity blocks with reason `awaiting_clarification`, a target, and a deadline; a decision that is cheap to reverse may proceed on a recorded assumption. - **2026-11-08** — A ship has two ends: it goes into reserve, or it is decommissioned. Reserve keeps the name, addresses, topology, and standing orders and is reversible; it requires jobs closed, minds unbound, and standing watches transferred first. Decommissioning is terminal and takes the ship apart into the fleet. - **2026-11-08** — Ship classes are discovered, not selected. Named classes are starting points; a new kind of problem is expected to produce a new class rather than be forced into an old one. - **2026-11-08** — A task force is commanded from a ship inside it, not from a separate node of its own. The command ship carries the commodore, the flag log, and the task force's staff stations; the commodore resolves what is local to the task force, and only capacity, policy, and irreversible fleet actions go up. - **2026-11-08** — Capacity buys concurrency, not capability. One mind may serve many stations in turn, so a wide force can run on a narrow pool at the cost of time rather than at the cost of the work. - **2026-11-08** — A binding may be episodic: a station can run unbound and acquire a mind only when it has something to think about. An alarm must not depend on cognition being available — a rule that fires sends raw when no mind can be had — because cognition makes an alert better and must never make it possible. - **2026-11-08** — Orders change mid-mission. Only the issuing commission or one above it may amend or recall, while a stand-down belongs to the commission that owns the scope it names; work in flight is re-examined rather than re-interpreted; a sortie the amendment invalidates closes with reason `superseded`; proofs keep their truth and lose their relevance; intent is versioned and cohorts do not mix across versions. - **2026-11-08** — Composition climbs without limit: fleets group task forces, a grand fleet groups fleets, and each level is a new kind of unit with its own command ship and log rather than the same unit nested. A level is added when fan-out outgrows one commander's attention, because each rung costs escalation latency, and the ladder comes down the same way: by reassigning ships upward or mothballing a formation intact — a formation prefix is a route rather than part of a ship's address, so either route changes nothing about the ships. Only the top seat is fixed to a human; the admiral ranks below it may be held by either. - **2026-11-08** — A ship idle past a policy threshold goes into reserve rather than being decommissioned. The threshold is a setting owned by the ship's commission, measured from the watch bill and the log and set above the cost of reactivation; repeated reactivation and mothballing is the signal it is too low. Reserve applies at every level: a formation is mothballed with its ships beneath it and keeps its order of battle, and a campaign is mothballed with its work tree and intent intact. There is no separate compression step: resources are freed by mothballing, and ships are moved by reassignment. - **2026-11-08** — A station's questions are bounded by its orders. A fact outside the mission's scope is refused with a reason and recorded, and a genuine need for it is a request to amend the orders from the commission that issued them — not a wider question asked of the owner. - **2026-11-08** — A clarification whose answer does not yet exist is answered by work: the request climbs as a question and comes back as a mission's result, served by as many ships as the work needs. Asking for a fact and asking for capacity are the same request until somebody establishes that the fact is already known. - **2026-11-08** — The work tree contracts. A task that is one mission's worth of work is a **mission with sorties**, and it earns a campaign only when a second mission arrives to sit beside the first. Three levels are a default, not a requirement. - **2026-11-08** — Repetition is not a new level, which sharpens the entry above: a second device, machine or repository of the same kind is another **instance** of one mission, not a second mission, and a campaign is earned by a different piece of intent. When the repetitions outgrow one ship, they add ships of the same class to the task force and the work tree stays as it was. - **2026-11-08** — Campaigns are concurrent contexts rather than phases: several may be open at once, each with its own task force and its own intent. A ship belongs to one task force at a time, and the address grammar enforces it with a single formation segment. - **2026-11-08** — **XO means the executive officer**, a post at any level rather than a commission, and the fleet's instance of it is the Captain of the Fleet. The metric-reading, proposal-writing station is the **analyst**. The Commander commission is department scope alone and carries no XO. - **2026-11-08** — The admiral's executive is a **post** — the Captain of the Fleet — and is not the same office as commanding a task force. Each task force gets its own commodore, local to it; at bootstrap one station wears both hats only because there is one task force. - **2026-11-08** — A standing watch moves to a **station that can perform it**, not merely to a ship still in service: a watch is a job on a station, and a station is its equipment, so a ship with no equivalent station cannot inherit the claim. This refines the earlier entry today, which said watches were "transferred" without saying to what. - **2026-11-08** — Renaming is a command act within a scope, recorded as an event that keeps the old name. Labels are renameable; addresses are not, because changing an address is a migration rather than a change of name. - **2026-11-08** — A human is added as advice, never swapped into command: a human mind with a console, bound like any other mind at capacity one. When the advice is needed across ships, the console gets its own ship, and the smallest ship in the fleet is one station with one person aboard. - **2026-11-08** — A tool is equipment. A mind may author one, and what it produces is a candidate proven by an independent station; fitting it is a topology change checked against what the design says may touch that resource; and it runs with its station's authority and never more. - **2026-11-08** — Effectors are never shared. A resource that several stations must act on gets one owning station and the others ask it; sensors multiply freely. Two stations declaring the same effector is a topology error rather than a race to be managed. - **2026-11-08** — Work inside a ship runs in parallel by default; nothing schedules a ship's turn. Parallelism is bounded by mind capacity, by effector ownership — which turns contention into a queue in one station's inbox — and by ordering that must be an edge rather than an expectation. A stop is therefore scoped to an address rather than to the whole ship. - **2026-11-08** — The ship's log records transitions, not ticks. High-frequency samples live in a rotating record, which is a standard tool for any station that samples often rather than a one-off decision. - **2026-11-08** — Android's JDK 17 is pinned per project in `gradle.properties`, not in `JAVA_HOME` or the global Gradle properties; other builds keep the modern JDK. - **2026-11-09** — **Every ship is in a task force**, the flagship included, because a commodore is the lowest commission that may muster one. The fleet owns task forces and nothing else, and "squadron" is retired: a standing task force needs no separate word. - **2026-11-09** — The **XO is tied to human occupancy**, not to a rank: it is the officer who turns a human's intent into work, so every human in a command post has one and a post held by a mind has none. At grand-fleet scale the top post's XO is an admiral, because that is the commission the work needs. - **2026-11-09** — A **Lieutenant is held where a station answers for what it decides** — it writes, acts on something shared, or leads other stations — and not by every station. That retires the older claim that a Lieutenant came with station scope itself. - **2026-11-09** — A **ship class carries each station's mind requirement**; the binding, which actual mind fills it, is made at muster. A class has to outlive the minds of the day. - **2026-11-09** — **Equipment is proven by running it, and anybody's run counts**, the author's included. Independence adds evidence about inputs the author did not choose; it is not a permission step, and a tool that has never run is a claim rather than equipment. - **2026-11-09** — A ship can run with **no mind at all** when every station in it is a rule; recon is the class that does it, and a picket lives that way between events. - **2026-11-09** — "Summons" became **hailing**: a message to a person over the channel they actually read, rather than a turn. Deferred, and researched. - **2026-11-09** — The **worked examples moved to the end** of the specification, after *Open questions* and before the decision log, because every other section supplies the words they rely on. - **2026-11-09** — **Ingestion** is the family name for putting the fleet on a device, and it has two modes: **scooping out its brain** hollows the device into a dedicated node, and **giving it an implant** leaves it doing its other work with the fleet living alongside. Hollowing gives the cleanest numbers; an implant is how hardware that cannot be spared still contributes. They are not equal in trust — an implanted device shares a boundary with its owner's accounts, which is fine for a consort or a station client and wrong for a mind host holding a token. - **2026-11-09** — The project is renamed **Low Passage**. *Rig* sat one letter from OpenRig and read as a variant of it, and the Traveller term names the bargain the design actually makes: the cheap berth, where a few passengers are expected not to wake up, with the log and the missing-row accounting as the part that keeps a loss visible. The folder, the documents, the `lowpassage` command, the CA and the Android package follow the new name; the old one stays as an alias and in the entries above. - **2026-11-11** — **Layers above the job.** The **Galaxy** is everything one installation can reach — its nodes, its Complement, its mind pool and its consort list — and because it is an installation rather than an organization it **holds no standing orders**: the ladder of orders stops at the highest command scope that exists. **Node** is an Erlang word and belongs to that layer alone, so no ship, department or station is ever described as one. **Complement** names the ships and everything inside them, as against the minds and consorts that attach from outside. This overtakes the 2026-11-09 wording in which hollowing "hollows the device into a dedicated node": a hollowed device belongs to the Galaxy, and whether what it runs is a node is a separate question with its own answer. - **2026-11-11** — The table headed **Node kinds** became **what a ship is made of**. Its rows — manned station, department, unmanned station — are ship components filed under an Erlang word, and that one heading is what let "Android is not a node" be read as "Android cannot be a station." - **2026-11-11** — Naming splits four ways. An **address** is the whole path and names a post; a **segment** is one part of it and is all that "ID" ever meant; a **role** is what a station or crew position does and is one segment; a **label** is what a person reads and is never part of an address. So a rename never moves an address, and a label resolves to one rather than replacing it. - **2026-11-11** — **Crew positions carry no label; minds do.** A crew is the station's own process and a human is a mind rather than a crew member, so what changes when a billet changes hands is the **mind label** — and one mind may hold several crew positions at once. "Crew name" retires as a term. - **2026-11-11** — **Ingestion is into the Galaxy, not into a fleet.** A device joins the installation — hollowed or implanted — and the fleet is an organization that dispatches ships onto it afterwards. So what a hollowed device belongs to, and what an enrollment disables, is measured against the Galaxy: it holds nothing but the Galaxy's secrets, and a consort living there is not the fleet's at all. - **2026-11-11** — **Addresses are read by walking them.** A reference is resolved left to right, each segment looked up in the scope the segments before it established, so `tf1:alpha:review:qa` resolves the same way whoever sent it; a reference that omits the ship begins at the sender's own. A bare name matching more than one thing is **refused with the candidates named** rather than guessed, because a guess is a message that fails silently and surfaces hours later. Segments are slugs without colons, since the grammar has no escaping, and muster and registration both reject one. - **2026-11-11** — **Uniqueness is checked where the scope is, and labels have their own reach.** A ship or a task force is checked at muster, in the fleet, because its name is its address prefix; a department or a station at registration, in the ship. A label resolves to an address and never replaces one, so a label can be taken up again after its owner is decommissioned while the log stays readable. Instances hold labels unique across the Galaxy, which is why *the Enterprise* needs no qualifier; departments and stations within their ship; minds across the Galaxy, because a mind is consulted from more than one ship and outlives them. Roles and crew positions hold none. - **2026-11-11** — **Addresses are qualified by their fleet, so the uniqueness check stays where the scope is.** A ship's segment only has to be unique inside its fleet, because the fleet's own segment sits above it: `fleet1:tf1:alpha` and `fleet2:tf1:alpha` are different addresses and neither is ambiguous. Nothing moves up to the Galaxy, and the whole path is what the router resolves, while the shorter forms begin wherever the reader is standing. A reassignment therefore changes a ship's addresses in their formation prefix, which makes it a migration rather than a rename. This corrects the entry above on uniqueness, which called a ship's segment its address prefix; the prefix is the formation above the ship, not the ship itself. - **2026-11-11** — **Standing orders are held at every scope with a crew to give them to.** The ladder runs fleet, task force, ship, station, with a Grand Fleet above the fleet while one is needed, and the Galaxy is not on it at all: it is an installation, and it has nobody to give orders to. The task force rung is what lets two campaigns of one fleet behave differently without standing up two fleets, which the earlier "a fleet or ship" wording could not express. - **2026-11-11** — **A ship carries the ladder rather than reaching for it.** Each layer is one file with one writer; a ship holds a copy of every layer above it, replaced whole and never merged, with the source and the fetch date in the frontmatter. It does that because a ship is expected to keep working with the link down, and a stale copy with an old date on it is honest where a stale assumption is not. The authoritative copy sits with the scope that owns the rule: the fleet's with its record, the task force's on its command ship, the ship's in its own. - **2026-11-11** — **What may sit inside what is fixed by kind, and the kinds stay open.** A ship holds departments, missions and its own machinery; a department holds stations and equipment; a station holds parts — a crew, a tool runner, a sampler — and a part holds nothing that is a ship, department or station. That last row is what bounds the nesting, so invention underneath is safe. **A department is a supervision subtree and not a `pg` group**, because a group has no owner to start, stop or restart its members; a group is an index for fan-out and nothing more. And **too many children is a question rather than a limit**, asked at every level rather than answered once for all of them. - **2026-11-11** — **A section on where this departs from OpenRig.** *Why not adopt* already says why the tool was not taken; what was missing was the design, decision by decision — the unit, the container, the hierarchy, who may be a mind, where wisdom lives, which record is canonical, where work state lives, addressing, distribution, and judging the topology. The analyst is recorded there as an **addition** rather than a departure, and the one with the least outside evidence behind it, since nothing we read of it describes a loop that proposes a reorganization, predicts its effect, and scores the prediction. - **2026-11-11** — **The record survives the node, not just the process.** The log is written locally and its tail shipped to whatever persistent store every node can see, so a node death costs a bounded window rather than the record itself. Nothing else goes on that store that needs exclusion, because a synced folder gives durability and not POSIX, and the single-writer rule has to come from the muster rather than from a lock. What the window is should be a number chosen rather than assumed. - **2026-11-11** — **No automatic failover. Recovery is a declared loss and a resume.** OTP restarts inside a VM and nothing restarts a release elsewhere; the registry is per ship, so two flagships would go unnoticed; and takeover across nodes assumes the consensus the design refuses. So a human declares the loss, a node resumes the flagship's existing identity rather than initialising a new one, the record supplies what to rejoin, the fabric reconnects itself, and the Complement reports in from each ship's own log. - **2026-11-11** — **Nothing but the log is authority, so Mnesia may only be a cache.** A Mnesia table is a projection with replicas: on a split the divergent copy is thrown away and rebuilt, never consulted as authority. It earns a place only for small fleet-scoped tables read on every turn — the mind pool, the node roster, the consort list — and is the wrong store for the log, the watch bill or the routing path. Mnemosyne, the name that comes to mind, is Mnesia's query language and is superseded; QLC queries lists, ETS, DETS and Mnesia and stores nothing of its own. - **2026-11-11** — **A ship that stopped without anyone deciding it is *out of action*.** Not *lost*, which is final in the maritime register and which this project already spends on the passenger who does not wake; not *missing*, which means an uncertainty we do not have and which the completeness check already uses; not *crashed*, which names the node rather than the ship. The statuses are running, in reserve, out of action and decommissioned, and leaving out of action is a ruling rather than a timeout. - **2026-11-11** — **Restart is automatic inside a node and commanded across them.** OTP restarts children without anyone asking, and the mind pool and consorts retry on their own. Across nodes nothing re-musters itself, because one ship on two nodes is invisible to address registration — but a commodore may resume an out-of-action ship promptly as a matter of standing orders, so the automatic behaviour can be had without a new mechanism. Only the flagship needs a human, and only because it sits at the top of the ladder with no live scope above it to hold such an order; a grand fleet would remove even that requirement. - **2026-11-11** — **The bridge is the human interface and holds no authority.** "The monitor: topology, watch bill, health" was narrower than M5, which already asks for message-to-any-address. A principal has a console and no station, and a principal has no effectors, so an order typed into the bridge becomes intent that a station executes rather than an action the console takes. What the bridge authenticates is a person; what acts is the commission they hold. So it can sit at the Galaxy level and rank nothing. - **2026-11-11** — **Communications owns the channels, and they are peers.** Email, Discord, Keet and the bridge are one kind of thing: an effector out and a sensor in, all owned by one station, with the bridge merely the richest. That is what stops the station special-casing its own UI, and it puts Communications in the minimum command crew — without it no person can reach the fleet at all. The interface defaults to routing an order through the chain; a direct address is a deliberate act. - **2026-11-11** — **Cowboy for serving, htmx for the first page, LiveView named as the alternative.** OTP has `httpc`, `ftp` and `tftp` and no SMTP or IMAP, so the client side needs nothing new and an email channel needs `gen_smtp` plus an IMAP library or a provider API. Elixir 1.20.5 is already installed against OTP 29, so LiveView costs a language rather than a runtime; htmx is chosen first because it is reversible, and because the channels outlive whatever the page is written in. - **2026-11-11** — **Keet has no bot SDK, and the stack under it does.** The public answer as of 2026-11 is that Keet traffic cannot be driven from outside: a sidecar built on Hyperswarm could not decode Keet's internal protobuf and compact encoding, and a Keet Bot SDK is described as quietly in development. Hypercore, Hyperswarm and the rest are mature and documented, so the peer-to-peer channel, if we want one, is our own Pear/Bare peer rather than a Keet bot. - **2026-11-11** — **Four things left the ladder for the installation.** The store, the definition library, the CA and the mind pool inventory all belong to the Galaxy, because each has to exist before any fleet does — the same argument in all four cases. Cost enters a command's scope at the binding, which is where a mind becomes a crewman. The node roster was withdrawn: membership is OTP's, and the only per-node state is its own identity declaration. - **2026-11-11** — **`galaxy init` is the first of three acts.** The installation is created before anything else, because a node cannot enrol without a certificate from the CA and a flagship cannot fit equipment the store does not hold. The order is `galaxy init`, `node join`, `flagship init` — each idempotent, none implying another. Re-running `galaxy init` against an existing installation does nothing rather than replacing it, which is also how a restored disk resumes. A single node needs no second machine to be recoverable: it needs its own files and a copy of them somewhere that outlives the disk, which is a backup question rather than a topology one. - **2026-11-11** — **The first token is minted by the forge; every later one by a command.** `galaxy init` issues the token that admits the first node, because at that point there is nobody to ask. Joining is admission to the installation, and the installation has no authority — no standing orders, no commission — so the decision to admit belongs to whichever scope sits at the top of the ladder. A node replacing a lost core is not an admission: it joins as a new node and the ship is resumed onto it, which is a different act. - **2026-11-11** — **A Galaxy carries a label.** The installation's name and nothing more: it appears in the record and on the bridge and grants nothing. Consistent with a Galaxy that holds no standing orders, and the reason `galaxy init` asks for one. - **2026-11-11** — **The bridge runs on a node that declares it may host it.** On a one-node galaxy that is the only node there is, which is why the bridge starts as part of `node join` rather than in an act of its own. Being an OTP application, relocating it is start-elsewhere and stop-here: no record to replay, no address to change, none of the machinery a ship needs. What moves is the declaration, and because the record holds it, the interface stays reachable across the move. - **2026-11-11** — **A channel belongs to the station that needs it, not to the fleet.** The flagship's Communications owns the route to the Admiral because that is the one the flag deck needs; a channel to anybody else is a different resource with a different owner, fitted by whichever station has the need. The ownership rule is unchanged — one owner per resource, everybody else asks — it simply turns out to apply per person, because what is scarce is the way to reach one person rather than the number of channels a fleet may have. - **2026-11-11** — **The quartermaster's equipment is a mind host adapter, not an LM Studio adapter.** LM Studio is what this machine runs, which is a fact about the machine rather than a preference in the design. Almost every host worth using speaks the OpenAI API, so one adapter covers most of them with a base URL and a model alias; what differs is whether the host exposes load and unload over an API and whether it can require a token. So: LM Studio, QVAC, `llama.cpp`, Ollama and vLLM are implementations behind one fitting. - **2026-11-11** — **The scarce thing is the channel, not the person.** A channel is owned by exactly one station and may carry one person or several: a room three people watch is still one channel, and its station's job is to work out who spoke and dispatch by a declared policy to whoever is responsible for them — which is what a department already does, with no mind of its own. Adding somebody to the fleet therefore either adds a channel or adds an entry in an existing one. What "responsible for that individual" means is still open: the station that last hailed them, or an owner declared against their enrollment. This corrects the entry above, which concluded that ownership runs per person; it runs per channel, and a person is how a channel's traffic is sorted rather than what the channel is for. - **2026-11-11** — **A reply is routed by what it answers, and the declared owner is only the fallback.** A reply that names the request goes to the station that asked; one that names nothing goes to whoever is declared responsible for that person, and somebody with no declaration can still be answered to if the reply correlates. Both mechanisms are kept because they fail differently, and together they are what make an **open question** possible — a hail addressed to nobody in particular, answerable by whoever knows, whose owner is the station that asked rather than the person who answered. This closes the open question left by the entry above. - **2026-11-11** — **Skills are part of the bootstrap set.** A new fleet's first command answers a question the fleet's own vocabulary poses — "ingest" has two modes — and no amount of cognition supplies the missing definition, because the gap is in our words rather than in the world. So the deployment carries written procedures for the operations that recur: ingest, enroll, survey, muster. They sit beside the definition library and the store, and like both they must exist before any fleet does. This amends the label entry above: a Galaxy may be labelled at any time and need take no name at birth. - **2026-11-11** — **Enrolling a node costs one privileged act, and never standing root.** A user account is enough to install and run a node — a release in a home directory, an ordinary process, nothing in the system's own parts — and not enough to make it return after a reboot. Both routes to boot-start are one privileged command each: a system unit, or a user unit with `loginctl enable-linger` set. So the honest sum is the same either way, and the fleet never has to hold a root password at all. A privilege used once and recorded is a decision; one held forever is a liability waiting for a reason to be useful. - **2026-11-11** — **The fleet cannot escalate, so an elevated command is a hail.** A station has no more rights than the account it runs under and nothing in the design lets it acquire any, so a privileged act is asked for rather than performed, and what arrives is a grant. Standing root is refused; a **named grant with a recorded scope** is accepted, because a privilege that can be looked up is a decision and one nobody can see is a liability. Three routes to boot-start trade privilege against robustness — a system unit and a lingering user unit cost the same single command, and a user `@reboot` cron entry costs none and will not restart a dead VM. - **2026-11-11** — **An implanted device can host a mind; the token is just weaker there.** The earlier rule said *never*, which cannot survive an owner handing over their own machine. What is actually true is that a secret kept beside somebody else's work needs an owner of its own, a file nothing else can read, and an owner who accepts that root can read it regardless — so it is a decision about the secret rather than a prohibition, and where those conditions cannot be had the device is a consort or a station client instead. - **2026-11-11** — **A secret arrives in one message, and a privilege is a standing rule with a transient key.** There is no out-of-band route for the password: it comes in the same message as the account, over the same channel, because a second route multiplies the ways it can fail without protecting anything. That makes the bridge a channel that carries the fleet's secrets, and therefore one that has to be trusted rather than merely convenient. There is no one-shot `sudoers` rule either — a grant is standing by nature — so what makes it one-shot is the password: the fleet keeps it from the grant to the end of the install and then discards it, leaving a permission it can no longer exercise. - **2026-11-11** — **`inets` httpd is the server to standardize on; Cowboy stays a later check.** The bridge needs a server, and Cowboy does not answer on this OTP: it returns 400 to every request before routing, measured on 2.13.0 and 2.21.0 alike, while `inets` httpd answers 200 on the same machine and adds no dependency. So the first page is `inets` httpd with htmx. Cowboy is not rejected — it is the thing to check again if the ERTS 17 fault is understood or a later OTP fixes it. This replaces the serving half of the earlier entry that named Cowboy; htmx and the LiveView alternative stand.