The Settle

Design Plan — The Settle, Up-Versioned

Loop MMT™ · Mature Maple · a design record, served redacted

> A note on this page — read first. This is a *real* design plan, published *redacted on purpose.* It records how we re-derived one of the methodology's own regulators: an autonomous nightly maintenance system with a human blessing-gate. Roughly half of the working document is buildable blueprint — the exact operations, the tool composition, the safety algebra, the memory chart. We hold that half. Where the private record carried the working mechanism you will see a ⟨held⟩ marker in its place. What stays is the whole shape of the thinking: the frame, the design decisions, the safety architecture, and every ruling actually reached. We would rather show a genuine design with the moat kept than a polished page pretending nothing was withheld — the honesty about *what* we held is part of the point. Nothing here is fabricated; held regions are elided, never faked.

---

What this is, and what it replaces

The first version of the Settle was a regulator built for a plant that no longer exists. Its world assumed manual bookkeeping, hand-kept registries, and administrative debt that compounded until the next session had to do archaeology. Its cure was an operator-invoked, read-only, four-phase reconciliation.

None of that world is the current system. The system today is byte-truth-canonical and derived-registry: it re-derives every projection every time a session closes, sitting on a whole family of reality-audit tools. ⟨the specific in-system tool family is held⟩

So this is a re-derivation, not a patch. By Ashby's Law of Requisite Variety, a regulator must carry at least the variety of the plant it regulates. The plant's variety grew; the thin first version cannot absorb it. The only legitimate move is to compose the reality-audit capability the system already owns — not to build a new engine, which would add variety we would then have to regulate in turn (a net loss).

The framing that holds it together: a build sprint *scatters* points; the settled state is the *attractor.* The up-versioned Settle's job is not to tidy paperwork. It is to confirm the scatter converged onto the attractor and is no longer drifting, spend the periodic clean-up the continuous close-work can't reach, and leave the system in signal-not-noise for the next mind that boots into it.

---

The layered conception (four layers, two built)

The Settle is an umbrella of four layers:

- A continuous layer — already exists. Re-derives every projection at every session close.

- Nightly Sleep — the new build. A 2am daemon that clears and consolidates, attests convergence, and queues a bless-list.

- A deep / one-time catch-up — not a separate engine; a mode of Sleep run wide and deep.

- A seasonal deep-tune — already exists.

The central cut: there are only two things to build — a nightly orchestrator and one chart (a map of the system's memory, described below). Everything else already exists, or is a *mode* of something that exists. If this plan ever grew a third build-object, it would have been gilded. ⟨the exact object composition is held⟩

Naming the dead honestly is part of the method: the old operator-invoked reconciliation is dead (the continuous close-work ate it); "the catch-up as a fourth engine" is dead (folded into a mode of Sleep); the old manual-drift threat model is dead (its world is gone).

---

The two tracks: clear, and keep

Sleep runs two tracks, and they are not symmetric — they carry different safety proofs. The structural metaphor is glymphatic sleep, and it is load-bearing, not decoration: the sleeping brain does not reconcile ledgers — it clears metabolic waste and consolidates memory.

- Clear the bad — reversible clean-up. Reclaim dead branches and stale locks; cut derived artifacts that are provably regenerable; heal stale working state. The one subtle case is *aging a surface that only grows*: deleting an old note is a lossy judgment, not a reversible clean-up, so an unattended aging pass may only archive (move to a recoverable store), never delete. A true prune waits for a blessing.

- Keep the good — append-only consolidation. Harvest the session's lessons and durable findings into their stores.

Why the asymmetry matters (the safety spine). Clearing must be a *reversible* operation — everything it removes is either provably dead or provably regenerable. Keeping must be an *order-independent, append-only* operation — two nights' work must combine the same way regardless of order, so a re-run never double-writes or reorders. Those two properties are exactly what make one track safe to run unattended and force the other to stage its judgments for a human. The boundary is not a policy slider — it falls out of the operations' own structure. ⟨the categorical algebra that proves each property is held⟩

---

Nightly Sleep: the build

Shape: a *thin orchestrator* — a scheduled job that calls a handful of capabilities we already own and queues a bless-list. If it cannot be described that plainly, it is overbuilt. It owns no new engine; it *composes* units that already exist. ⟨the owned-tool composition and its paths are held⟩

Nightly sequence: clear (run the reversible clean-up against a staging area) → keep (run the harvesters append-only against staging, rolling a coverage roll-call over the memory map) → attest convergence → emit the morning bless-list.

Operations floor (non-negotiable): the daemon is idempotent and resumable. A half-run, a box-down night, or two nights stacked must *re-converge*, never corrupt. The reversibility of the clearing track and the order-independence of the keeping track make that provable rather than hoped-for.

The convergence line

A Settle that only tidies cannot tell you whether you are *settled.* Each morning Sleep reports whether the overnight re-derive reached a fixed point — projections byte-identical to the prior close, meaning the scatter converged — or whether projections are still moving, meaning the system is still drifting and something needs a look. It is a Lyapunov question made decidable with a property the system already rests on. No new machinery.

```

converged: fixed point reached — the system is settled

moving: N projections still re-deriving differently — flagged

```

---

The autonomy boundary

This is the heart of the design, and it is also the product story: *the system sleeps and cleans itself, and nothing changes without the builder's morning blessing.*

Four invariants, and the build must preserve all four:

1. The daemon never writes to canon. It writes only to a staging area, off the main line — which also keeps it out of the way of live work, never racing it. ⟨the exact staging mechanism is held⟩

2. It performs only the unattended-safe set — the reversible clean-up and the append-only keep. Anything requiring a judgment is *staged,* never applied. ⟨the exact type partition is held — the named differentiator⟩

3. The morning blessing is the only path to canon. The operator wakes to a bless-list; blessing is what serializes staged work onto the main line, by hand.

4. A legibility cap on the bless-list. Reversible, self-evident clean-up is summarized in aggregate ("reclaimed 4 dead branches, 2 stale locks") and never itemized for approval; only genuine judgments surface as line-items. A 200-item rubber stamp is a *worse* gate than no gate — it launders automation as consent.

One line holds the whole boundary: Sleep clears and consolidates; it never decides. Decisions wait for waking.

The autonomy is real precisely *because* the reversibility is structural — everything staged is inspectable, and nothing is destroyed. Transparent, tracked, auditable, reversible.

---

Memory made whole: the map keystone

A wide sweep of the system found roughly twenty distinct memory surfaces — and no unified map of them. You cannot *prove* consolidation covered "all of them" without an enumeration to quantify over. You cannot cover a space you have not charted. So the map is not a deliverable competing with the keeping track — it is that track's *type signature.* You cannot write the function until you have declared its domain.

The surfaces chart into one typed map across the kinds of memory a working system actually keeps: the version-controlled substrate, behavioral guardrails, the episodic session record, associative recall, forward-looking to-do stores, distilled lessons, archival snapshots, and the catalogs that index them all. ⟨the surface-by-surface enumeration and the coverage-contract mechanism are held — this is the keystone⟩

One discipline the map must honor: it is derived, not hand-kept. A hand-authored catalog is exactly the *second control surface to keep true* that this methodology keeps warning against — it drifts from the reality it charts. So the map is built as a derived projection with a self-checking re-fold, enumerating the surfaces from the byte-truth itself rather than from a prose list, and it self-trues on every close. A map you have to remember to update is not a keystone — it is the next thing to Settle.

---

The clearance gate: a first-class stage

Anything the system would ever render outward passes, as a *required stage,* a clearance gate. (This very page passed it.) The design decision that makes it first-class rather than a checkbox: the unit of evaluation is the composed whole, not the item. A rendering is cleared only if it does not weaken the site's secret-sauce metric *when composed into everything already published* — not merely on its own. The question the gate ultimately asks is: *can the method be rebuilt from what is shown?* If it can, it is not cleared.

The gate composes existing controls rather than inventing a new strictness dial, and it is precise about which of those controls are already built and which are still in design. ⟨the specific control composition and its tools are held⟩

How strict that reconstruction bar runs — how much leakage is too much — is a business judgment, not a technical one, and it is the operator's to set. This is the one commercial control in an otherwise durable-asset arc: the day the system renders anything publicly, this gate is what stands between "durable asset" and "gave the methodology away."

---

Host and credential posture

Sleep needs an always-on host — an ephemeral session cannot run a nightly job. The chosen host is also a forward-integration decision: it sits where it can later wire into the wider product ecosystem, not merely where a scheduled job is cheapest.

The credential principle is the load-bearing part, and it is what makes an always-on autonomous key tolerable at all: because the daemon writes only to staging, even a leaked key cannot land anything to canon. The autonomous key's blast radius is *staging,* never the main line. ⟨the specific host and the exact credential grant are held⟩

---

Cadence

Default 2am — the cheap, quiet hours — deferrable and re-settable. A scheduled job invokes the thin orchestrator; the run is idempotent and resumable, and the convergence line is its morning self-report.

---

The honest ceiling

The same ceiling the rest of the system carries: visibility, not immunity. Sleep makes drift clearable and consolidation provable-in-coverage; it *cannot force its own run, cannot force the blessing, and lands nothing itself.* The operator stays the sole write-gate and the witness. The staging design means the worst an unattended failure can do is leave *staged* work for a blessing that never comes — never a bad landing on canon.

---

*Loop MMT™ · The Settle, Up-Versioned · a design record, served redacted*

*You poured the foundation, and the close-work already vibrates the bubbles out every close.*

*Now the system sleeps: it clears the waste, consolidates the memory, and waits for the morning blessing.*

*© 2026 Shea Gunther · New Gloucester, Maine · CC BY-NC 4.0*