See the fault.
Telemetry, stale-state checks, receipts, and participant reports expose a mismatch.
Architecture / continuity + recovery
Continuity belongs to the lane. Compute comes and goes.
The model contributes reasoning. The continuity lane carries owned history, chronology, policy, open loops, and evidence. When that lane degrades, bounded self-repair works to preserve the thread instead of pretending nothing failed.
Core architectural capability
Failure is not the end of the thread.
The operating system watches for degraded state, bounds unsafe paths, preserves continuity where possible, repairs the specific fault, and demands evidence before normal operation is claimed again.
Health sentinelsFail-closed holdsReceipted recoveryHuman-visible gates
Stop the spread.
Unsafe writes, physical action, or unsupported continuation pause at a named gate.
Keep the thread.
Live continuity, source records, and failure evidence remain intact while the damaged path is isolated.
Fix the bounded fault.
A scoped service or human operator repairs the failed component without silently rewriting history.
Earn the resume.
The path is retested, limits are recorded, and only then does normal operation resume.
What “self-healing” means here
Follow the recovery evidenceBounded detection, containment, preservation, repair, and verification. It does not mean unrestricted autonomy, guaranteed recovery, or permission to erase inconvenient history.
Interactive system map
Follow the thread.
Each layer has a different job. Combining them into one “memory” box makes failures hard to see and ownership easy to blur.
Human intent remains visible.
The human participant is not a ceremonial approver at the end of an opaque call. Intent, consent, correction, uncertainty, and physical-start authority stay separable and inspectable.
Input is not permissionA request can be interpreted without silently becoming authority.
Refusal remains availableHold, no, uncertain, and stop are represented states.
The lane owns continuity.
An isolated namespace carries attributable context, open loops, chronology, disclosure rules, and correction history. A model session participates in that lane; it does not become the entire identity.
Seam-aware resumeRestarts and model swaps are explicit events, not invisible resets.
Ownership survives retrievalRecords preserve whose memory or evidence they are.
Different stores do different work.
Graph relationships, fast vector recall, transactional custody, temporal history, and receipts are coordinated by role rather than collapsed into one overloaded database.
Similarity is not truthRecall proposes evidence; provenance and policy govern its use.
History is amendedCorrections supersede or tombstone; they do not silently rewrite.
Models are replaceable cognition.
Reasoning models, audio sensors, local models, and specialist tools can be routed by task. Their outputs are candidates until attributed, checked, and accepted into the appropriate state.
No automatic promotionGenerated text is not automatically fact, consent, or durable memory.
Capability routingUse the smallest sufficient model without moving continuity into it.
Continuity reaches the room and the fleet.
The cockpit, glance displays, voice endpoint, cameras, managed devices, fabrication tools, and compute nodes are replaceable surfaces connected to Home. They are not separate copies of the continuing system.
Interface independenceBrowser, terminal, voice, display, and multi-host routes share governed state.
Scoped physical gatesEvery command names its target; software completion remains distinct from verified physical success.
Failure becomes part of the record.
Receipts, hashes, pressure holds, rejected runs, stale-state markers, and recovery rehearsals make repair possible without rewriting the story into uninterrupted success.
Ugly parts preservedStalls, nulls, and failed validation remain evidence.
Fail closedUnknown custody or authority stops progression instead of inventing success.
Active build / multimodal household re-entry
Recognize the returning pattern, then corroborate it.
Cadence can compare a returning conversation with longitudinal interaction patterns: vocabulary, phrasing, turn-taking rhythm, correction habits, relationship history, active work, timing, and the expected participant. One bounded front-end camera observation can then add visual corroboration before the appropriate continuity lane resumes. The camera is not the whole recognizer.
Recognition is evidence, not authority.
A conversational-pattern match or camera frame alone is not identity proof. Low-confidence, conflicting, or unfamiliar signals remain unresolved and require confirmation; recognition does not itself unlock privileged commands or authorize physical action.
The relationship has a pattern.
Known household participants have different stylometric and discourse patterns, carry different history, pursue different work, and relate to Home in distinct ways. Those longitudinal differences help route the returning conversation without blending identities.
One look, not an open watch.
An intentional camera observation can corroborate the interaction pattern at re-entry. It does not require turning a private room into a continuously monitored public feed.
Mismatch becomes a hold.
If conversational, temporal, and visual evidence conflict, the system preserves the uncertainty and asks for confirmation instead of manufacturing a match.
The physical control plane
A human can see when the system is not okay.
The cockpit brings different timescales into one place: glance state, live telemetry, and actionable issues. The participant can notice, stop, and repair.
TOP
GlanceIdentity, host heartbeat, GPU, and store counts.
MID
TelemetryCPU, RAM, GPU, PSI, drives, network, weather, monitoring.
LOW
ActionActive work, attentions, issues, continuity, systems, workshop, repair.
Beyond a browser
The architecture has edges.
Repurposed miner displays carry glanceable state. A repurposed voice endpoint routes speech to Home. The workshop path coordinates CAD, validation, slicing, cameras, and printers while keeping physical authority explicit.
Distributed displaysEvidence gaps and health uncertainty at the point of work.
Voice laneA replaceable speech surface connected to durable Home continuity.
Fabrication edgeFamiliar human console over isolated, auditable machinery.
Architecture without hand-waving