The agent
How the model decides what to do, how invalid decisions are made unreachable, and what happens when it is handed a goal.
When a method from 1960 beats the transformer
There are two ways to choose a tool here, and the interesting result is that the older one wins.
The first decodes the applet's name token by token under a grammar. The second reads a single hidden state and hands it to a closed-form ridge regression (Widrow-Hoff, 1960) solved by Cholesky decomposition in the kernel. Twelve thousand parameters, about 1.6 ms, no transformer forward pass at all, and better held-out accuracy than decoding the name.
That is worth sitting with. The task is choosing one of a few dozen labels from a sentence, which is a job a linear classifier over a good representation has always been able to do. The transformer's contribution is the representation; asking it to also spell the answer adds a decode loop and a chance to spell it wrong.
Making invalid output unreachable
Constrained decoding makes invalid output impossible to produce, where merely making it improbable leaves it reachable. The grammar is built from the live applet table, so a name that does not exist cannot be spelled.
The read-only mode is the clearest illustration of why that framing matters. It works by removing mutating applets from the reachable set before sampling, never by checking afterwards. A check after the fact is a check somebody can forget, and it fails open. Removing the tokens from the candidate set means the sampler could not have produced them however the probabilities fell.
The same reasoning was applied to run's argument, later than it should have been. The applet name was always decoded under the grammar, but its arguments were free text, which is right for a filename to be written and wrong for run, where the whole space of valid answers is enumerable. The model had to spell a learned skill's full path exactly, so a skill it could not spell was a skill it could not use however good the judges said it was: adoption that put a tool in the toolkit that nothing could pick up.
Agreement is the signal
Three cores vote on each decision: the linear probe, a hashed n-gram Bayes classifier, and a lexical matcher. What is acted on is not their majority but whether they agree.
When all three agree the answer is right 90.3% of the time. When they split it is right 50% of the time. That gap is the whole product. It is a confidence signal that costs three cheap classifiers and no extra forward passes, and it is what lets the system say "I am not sure" on the cases where it is in fact not sure.
One queue, one busy flag, one abort, one task
Handed a goal and a step budget, the agent picks an applet through the grammar, reads what the applet printed, and decides again, writing a transcript as it goes.
A job is either an episode or an application to write, and both run on the same task. That is not tidiness. A second task running a second kind of work would need a second entry in the engine's exclusion check, which is the stale-call-site failure that check's own documentation warns about, and here the failure is two forward passes interleaving in one KV cache, with no error message. Stopping cancels either kind without needing to know which.
The engine has exactly one holder. A record names the task that holds it, a per-call claim takes it for the length of a call, and an RAII claim covers work spanning many calls. That distinction is the load-bearing part: two mutable borrows of the engine at once is undefined behaviour, and the per-call claim prevents it with nobody having to remember a flag. Somebody else decoding between two of your calls is not undefined behaviour, but it corrupts the cache, the position and the last token, and produces confident nonsense.
It replaced a flag-and-identifier pair per task, which is exactly why a third holder had been invisible: the nightly training trial ran on the initiative task, set neither flag, and handed a second mutable borrow to anyone who asked during its twenty seconds. Adding a third pair would have made the next omission just as quiet.
The claim is reentrant within a task, deliberately. Nesting is still forbidden, but a claim that refused its own holder would turn any nesting that does exist into a silent failure. And a refusal now says which of the two reasons it failed. Every caller used to print "no model loaded" for both, which became actively misleading once authoring started returning to the prompt immediately, since the next question reported the model absent while it was loaded and working.
The resident mind speaks as a framed turn. It always generated into this same cache, but unframed, so a thought it had on its own spliced into the middle of its last sentence to the operator, and the next question read as a continuation of it. The frame closes the open turn and opens a labelled one, so neither party has to guess who said what.
Who is allowed to be the operator
Every program under the tools directory used to run with operator capabilities: raw memory, I/O ports, the network, the model, the framebuffer. An application had been jailed since the day the application loader was written; a tool was not, and the agent writes tools, and a skill shared by a stranger is a tool. It was open by omission, and nobody had argued for it.
Running a stored tool now follows the same path an application does: operator powers only for bytes the operator has explicitly named, and everything else fresh and sandboxed in its own subtree under a smaller budget. Identity is the hash of the file contents, so editing a trusted skill revokes its trust by construction, with no rule for anybody to enforce.
Granting that trust is shell-only and never an applet, for the same reason approving an application is: a model that could grant itself trust would have defeated the gate by using it. An ambiguous hash prefix is refused.
The three tools that ship need only pure and read-only builtins and go on working sandboxed. Nothing that ships needs operator powers, and now nothing has them until asked.