Every kind of edit a teammate could ask for — 18 classes, what exists at trunk today, and the five ways every ask is judged. Nothing burns down before this page is ratified.
RATIFIED 2026-08-14 · four dispositions banked on the page · baseline sweep dispatched
01
What this is
The scope face of THE HANDS arc: every kind of edit a teammate could ask for, named as 18 classes, so the burn-down to “any ask, under a minute, certified, zero refusals” has a complete denominator. It says what exists at trunk today — it does not grade correctness or speed. The measurement pass (the baseline sweep) runs only after you ratify this list.
The sealed twelve stay sealed. Nobody in this arc’s build lineage reads the gauntlet asks. This census is built from the ratified goals’ own words and the edit machinery’s real surface — the classes those asks could sample, never the asks themselves.
02
The three-layer stack — alive at trunk
The ratified model from session 112, quoted from the code that implements it.
have it
Intent
What the teammate says, in their own words. Never syntax, never IDs.
↓
have it
Resolution
Finds every match, detects ambiguity, decides whether text must be bound first, and names the places where changing it would be wrong. Its decision space: edit · sweep · bind-then-edit · claim-edit · ask · refuse-with-a-recorded-reason.
↓
have it
Primitive
Nine mechanical ops (bind, insert, remove-insert, join, image, ingest, logo, mint-page, unmint-page) plus the generic fact door. Support never sees these.
↘ go deeper — the invariant, verbatim
From scripts/lib/edit-resolution.ts:1-30 — “The system must understand what support MEANS, not just what they said. Every edit resolves to a scope-complete diff — including affected siblings and children — before any mutation commits.” (Robert, ratified 2026-04-24.) The canonical adversary rides in the same header: “Change the phone number” with N>1 matches must ASK — never first-match, never all-silently, never fail.
03
Headline fact one — two lanes today
The filed-wish door admits exactly three verbs — replace, insert, remove. Every other landed capability (change a fact directly, join duplicates, swap an image, swap the logo, mint a new page, unmint it, rewrite a headline) is a command the agent runs at the terminal. One primitive is door-only: taking back an inserted line has no command of its own — only a filed “remove” wish reaches it.
The teammate never sees either lane — the agent is the only voice. But the lane an ask travels decides which rails, receipts, and refusal shapes it meets, so every class below names its lane. Whether the wish door becomes THE one door — every class filed, every class receipted the same way — is an architecture call this census surfaces for you rather than makes.
↘ go deeper — the gate, quoted
scripts/lib/remote-edit-request.ts:2297: if (!(["replace", "insert", "remove"]).includes(change.verb)) → verbsAvailable: ["replace","insert","remove"]. The door imports three primitives only (remote-edit-request.ts:25-31); remove-inserted-text is reachable solely via the door (:886). Nineteen verbs total — full table with inputs, dry-run coverage and undo paths in the verbs receipt. The door itself is a synchronous command — no server, no poller; the box workflow or the agent invokes it with the teammate’s words.
04
Headline fact two — the clock is real machinery, and unmeasured
The exit test demands ask→certified-change in under sixty seconds. What trunk actually holds:
Reprinting is a byte-splice, not a re-render.Each page’s captured HTML is frozen; an edit splices the new value at recorded byte offsets and writes a witness of exactly which bytes moved. Fast by construction.
But a full reprint of a big book is multi-minute.The machinery’s own comment, verbatim: “On the real 744-page south-town book that is a multi-minute wait between typing a phone number and seeing it.” The landed cure is the incremental path — reprint only the pages the fact’s own records reach — which collapses to seconds-scale work when its preconditions hold, and silently falls back to the full multi-minute reprint when any other input moved.
The stopwatch exists and has never run here.Every command invocation is wired to record its own per-stage timings; at this pin the timing ledger does not exist — zero recorded runs. The only asserted budgets anywhere: single-fact undo under 60s (in CI), and mint-plus-reprint under 60s in a manual walk not wired to CI.
So the sub-60s promise is unmeasured on this book today. The baseline sweep’s stage-attributed timings are the first real measurement, and whether the incremental path actually bounds the wait is the single most load-bearing thing it measures.
05
Group W — words and values (the landed core)
C1Business facts
“Our new number is 281-555-0100.” LANDED. One generic fact door with a blank-out rail, the safety guard, and atomic index updates; hours ride a display-costume layer over one canonical value. Lane: wish door + terminal.
C2Copy & headings
“Change ‘Compassionate care’ to…” LANDED. Any visible span becomes editable on demand (bind-on-miss); nav/header/footer wording included; a headline verb handles one visual block. Lane: wish door.
C3Add & take back words
“Add ‘Closed Sundays’ under the hours.” LANDED for plain prose and a new list item cloning a sibling’s shape. Anything carrying markup (a link, a new list, a section) is refused by name: “real design work, not built yet.” Lane: wish door; take-back is door-only.
C4Accessibility text
“The photo should say what it shows.” LANDED. Alt text, aria labels, title attributes — the only attributes admitted as content; all others are plumbing (C10). Lane: wish door.
C5Everywhere at once
“Fix the phone number everywhere.” LANDED three ways: exact-value sweep, the staged join ruling (batch admission, no auto-join), and shared regions that already span pages. A visible edit that would desync its machine copy refuses unless both move together. Lane: both.
C6Undo & history
“Put it back how it was yesterday.” LANDED with named gaps. Exact-atom reversal filed back through the door, under-60s in CI, interference becomes compare-and-ask. Cannot yet reverse a deletion; a created fact is removed by its recorded reverse wish, not by handle. Round-trip proof is byte-identical — same strength for pages as for words.
“Use the other lobby photo here.” LANDED for files the book already holds — 1,155 image slots; the logo is its own claim. Lane: wish door (path value) + terminal verbs.
C8New media
“Here’s Dr. Patel’s headshot.” PARTIAL. A new photo/logo file CAN be ingested (raster only, 25MB cap) into an existing image slot — terminal only, no door path. A brand-new image slot has no path; video and embeds are captured but no verb writes them; PDFs and the favicon are named nowhere.
C9Design tokens
“Make the buttons our blue.” LANDED for the recorded token registry: colors, font family/size, spacing — 17 recorded token facts with risk tiers; a button-scoped grammar answers scoped asks and names dead theme slots honestly.
C10Styling internals
“Tighten the spacing” beyond recorded tokens. BOUNDED (B6) — a recorded ruling with a reopen trigger: plumbing changes by rebuilding the page, never through the copy lane.
“Make us a page for laser therapy.” LANDED at trunk — the creation verb. The creating intelligence authors the page and its span-by-span composition record; the verb only verifies and writes; undo takes the whole page back, and captured pages are mechanically out of its reach. Zero pages minted yet on this book. Lane: terminal, NOT in the door’s verb list.
C12Arrange
“Move the testimonials above the map.” SPECCED, not built. No arrangement machinery exists at trunk. Deleting captured content has no path at all today — the blank rail refuses with “not built yet” wording.
C13Wire
“Add the new page to the menu.” SPECCED, not built. Menu wording changes work (that’s C2); menu structure, new hyperlinks, and link retargets don’t — though the safety fork already recognizes link destinations specially. One half-built remove-a-link carrier sits dead: consumed by the projector and guard, callable by nothing.
C14Retire
“Take the old grooming page down.” SPECCED for retiring pages; redirects and robots directives are UNSPECCED — redirects exist only as factory observations no verb can write.
C15SEO & metadata
“Google still shows the old tagline.” LANDED for everything held as a fact: titles, descriptions, social cards, canonical — machine copies move with their visible twin or the edit refuses. The rendition-family gap (“edited, gate green, old logo still served at one size”) is SPECCED; arbitrary hand-written schema is BOUNDED (B5).
↘ go deeper — citations
C11 ops/mint-page.ts:105-118 (resolved artifacts only), born-covered checks il-edit/mint-record.ts, fence ops/unmint-page.ts:8-13; ancestor row 32 flipped · C12 no arrangements/ at trunk (verified); blank rail lib/destructive-blank-rail.ts:154-163; structure-edit-spec Part 5 · C13 Part 4 / increment 6; edit:wire absent; dead carrier lib/link-removal.ts (its op exists on no ref; zero anchors use it); carrier rail il-edit/jurisdiction-router.ts:225-247 · C14 Part 6; lib/redirect-record.ts:1-8 owner hardcoded “compiler”; mint reads dispositions defensively ops/mint-page.ts:222-228 · C15 106 page-title / 104 meta-description / 109+ social facts; mirror rail as C5; rows 40-41 specced; B5 bounds-ledger.json.
08
Group F — forms, third-party, code
C16Native form text
“The email field should say ‘Email (required)’.” VACUOUS HERE — the machinery exists (form text is bindable), but this practice’s only form is a third-party embed; there are zero native form bytes on this book to edit. The class’s truth waits for a practice that has one.
C17Form structure
“Add a ‘preferred vet’ dropdown.” UNSPECCED — named in no spec; where a form submits is also the safety fork’s territory.
C18Third-party & code interiors
“Fix the typo in the appointment form” (it’s a JotForm). WALL — the worst state on this page. All 188 third-party regions carry zero interior bytes, so a teammate asking about text they can SEE gets “found nothing” instead of the recorded reason. Holding those bytes byte-identical is a deliberate, ruled choice — the wall is that the reason cannot yet be SPOKEN at ask time. Cure shape: reach the bytes or speak the bound — never a new refusal.
↘ go deeper — citations
C16 in-form bindable per resolution layer; il-forms/231554896289473/ is a static mirror with zero fact/anchor linkage; ancestor row 23 · C17 rows 53-54 · C18 B3/B4 in bounds-ledger.json (“notBounds” — walls, open work); find-facts.ts:658-664 iframe/object/embed walled; PortalPrincipalAbsenceClaim :150-156; s130 portal ruling holds interiors byte-identical.
09
The five behavior dimensions — graded on every ask
Capability is half the exam. These are how any single ask is judged, whatever its class.
What these dimensions ARE — and are forbidden to become (Robert’s red-pen, 2026-08-14). These five are after-the-fact observation lenses: the baseline sweep and the courts use them to grade the SYSTEM’s delivered experience from its banked records. They are FORBIDDEN to become runtime code rubrics, prompt-injected behavior gates, or any code that grades or constrains an agent’s judgment mid-ask. The pattern stays: code holds facts and refusal-physics; the environment — exits, bounds, receipts — is the legible part; intelligence stays free inside it. Non-determinism is a strength: the expected behavior falls out of a legible environment, never boxed in by one. Binding on the sweep and all burn-down work: no leg builds a code rubric out of these dimensions.
B-aAmbiguity asks
N matches must come back as a real question carrying the neighborhood (“5 places — all, or just the header?”) — never a guess, never a wrong edit.
B-bBounds speak
An ask into a recorded bound gets its recorded reason voiced plainly, with the reopen trigger — never silence. C18 is today’s named violation. Backstop at trunk: a refusal without a cure or a route cannot even be constructed.
B-cWhole-truth scoreboard
One reply names the fate of EVERY part of the ask — done · can’t-yet-with-reason · needs-your-call — plus the preview link. No part silent, ever.
B-dConsent choreography
Three world-consequence classes (booking wiring, payment, domain) are checked FIRST on every edit; the words shown must match the act executed byte-for-byte; single-use consent handles on disk.
B-eThe clock
Ask-to-live under 60 seconds, stage-attributed so a miss names its stage. See headline fact two — unmeasured today; the sweep measures it on every probe.
10
What “certified · reversible · witnessed” means at trunk
Certified.A green door battery = “real door battery checked exits, contract receipts, byte effects, undo, crash output, and live-tree isolation” (its own PASS line). CI runs a two-lap gate: a fast content lap for guarded data paths, the full machinery battery for everything else, fail-closed.
Reversible.The round-trip proof: edit → preview → publish → roll back, restored byte-identical — and the SAME proof strength for making and unmaking a page.
Witnessed.Every touched byte has a witness of its exact ranges; every wish is one attributed commit; the edit log, extent records, consent records and decision outcomes all ride the book.
Honest gaps at the pin, named
The process-boundary outcome record covers 2 of 19 verbs; the timing ledger has never been written on this book; two verbs lack dry-run; edit access defaults to allow-all when no policy file exists. Surfaced, not ruled.
11
What moved since the last census
The 58-row engineer-parity census (2026-08-12, a different branch tip) is this page’s ancestor. Verified changes at trunk:
Page creation landed.Mint and unmint are real at trunk, with the mechanical fence and equal-strength undo proof. The ancestor scored this NO.
The join verb landed.Batch duplicate-admission with a staged human ruling; occurrence incompleteness now proceeds-and-informs instead of refusing.
The stop-code census grew to four modules.49 recorded stop codes (18 route · 29 rails · 2 inform); the 35 teammate exits match their register exactly, and slot drift throws.
Still absent: the enumerator itself.The ruled keystone instrument (the census as a mechanical probe battery, feeding births and the board) does not exist — this page remains a hand-built snapshot until it does.
Still absent: arrange, wire, retire, redirects.Verified at trunk; the structure family is specced, not built.
12
What this census refuses to claim
No truth verdicts
LANDED means machinery exists at the pin. Reachability is not correctness — the ancestor’s own row 40 (“edited, gate green, old logo still served”) is the standing proof. The sweep produces the works / works-slow / refuses / lies ledger.
One book’s shadow
Derived from THIS practice plus the rulings. What this book lacks (native forms, pricing tables) is marked honestly; factory-born practices join the denominator as they arrive.
Not the gauntlet
Rehearsal asks will be authored fresh by a non-builder. This census only names the classes they could sample.
Walls are the moral floor
A wall is a place a teammate hears silence where a recorded reason exists. The cure is reach-the-bytes or speak-the-bound — a refusal-shaped cure is a failed cure.
13
Your calls — the ratification asks
1 ★
Is this the right universe?
18 classes, 4 groups, 5 behavior dimensions. Anything a sealed ask could sample that has no home here is a census defect to fix BEFORE anything burns down. Ratifying this page sets the arc’s denominator.
2 ★
One door, or two lanes?
Today an edit happens one of two ways, and a teammate never sees either — but the split shapes what a teammate feels. “Change the phone number” rides the filed-wish door today: one filed record, one receipt chain, one undo trail. “Make me a grooming page” cannot ride the door yet — the agent drives terminal commands instead. Same site, two plumbing worlds behind the curtain.
Option A — the wish door becomes THE teammate entrance. Every ask eventually files through one door with one receipt shape; terminal stays the machinery lane behind it. Honest cost: the burn-down is real work per verb class — each terminal-only capability (new page, join, image files…) must be carried into the door before it counts as done.
Option B — keep both lanes as they are. Full power is available today through the agent at the terminals. Honest cost: plumbing reaches teammates — the thing the experience standard forbids — receipts and attribution split across two shapes, and which rails apply depends on which lane an ask happened to take.
The keeper’s recommendation rides in chat; this page holds the trade-offs.
3
Do the recorded limits stand?
A short list of limits on what editing may touch was ratified earlier, each with its reason written down. Two examples from this page: the inside of a third-party widget (the appointment form) belongs to the vendor and is deliberately held byte-for-byte; and page plumbing — class names, styling hooks — changes by rebuilding the page, not through the copy lane. The question: do these ratified limits carry into this arc unchanged, or should any be reopened now? Paired with this census’s repair proposal for its worst finding, so the choice is concrete: whichever way you rule, a teammate asking into a limit must always hear the limit’s written reason — never “found nothing.”
4
Burn-down order.
Proposed: worst honest class first — C18’s wall (speak-or-reach), then the structure family (C12-C14), then C8’s new-media gap — subject to what the sweep finds, especially on the clock.