The one door has one execution path: a bind runs, clicks or routes; a violation is re-asked, a disagreement floors, and no chat surface hands back a line to retype

The ask. Decide (the maintainer, after the operator's first day as the default door): everything after the operator's decision goes through one execution table — bind kind × surface → run / click / route / re-ask / refuse — owned by one module, with record 0067's seam as the only re-ask and the route as the only floor. This is a survey-driven collapse, not another patch: the day's fourteen defects were fourteen branches of the same missing rule, each fixed (or in flight) at its own render site, and a fifteenth site is a matter of time. Written for an engineer who knows the dispatcher's stages, record 0057 and plan 002. Success criteria:

1. One module owns the outcome of every bind the operator or the route stage produces; no caller — the dispatcher, the operator executor, the route stage, admission, the verifier — renders a line for a person to type or decides a bind's fate on its own.
2. A registry command below the effective confirm class runs through the class ladder; at or above it, on a chat surface, it is offered as one click through record 0044's store — the same mint whichever caller asks, never a To run this: beside a button.
3. A preset bind runs the person's own request through the route stage; a typed registry line runs as the person typed it, never re-spelled; a steer folds under the owner rule, read before any directive.
4. Every shape or content violation is the seam's re-ask; every disagreement between the door's own models — the verifier's, or a transport failure standing in for one — floors to the route, which runs the request; neither is ever a sentence handed to the person.
5. Each of the day's fourteen defects is a replay fixture that holds, so the day's failures become the regression suite.

TL;DR

On the operator's first day as the default door, production filed fourteen defects and every one is the same defect: after the model decides, five different modules each decide for themselves what to do with a bind, and four of them can end the conversation by printing a line for the person to retype. Preset binds were never executed; the verifier refused correct binds with misread reasons and handed the line back instead of falling to the route; a typed runs stop was re-bound into a spelling no chat grammar parses while a runaway run burned; a directive reply in a live pipeline's seed thread started a rival run; a refusal's text reached the person cut at its first parenthesis; and the hand-back lines themselves — bare ship, ship --repo …, runs_stop --run … — could not run as pasted. The bet: one execution table, bind kind × surface → run / click / route / re-ask / refuse, owned by one module every caller asks and none re-implements; the seam (record 0067) is the only re-ask, the route is the only floor, and on a chat surface no path renders text to retype — the click is the confirmation, the route is the recovery. It costs one module, the migration of eight render sites and three decide sites onto it, and fourteen fixtures. Doing nothing means the next defect lands at whichever site the last patch missed, and each fix ships as its own branch of a rule nobody wrote down.

Today at b19caf8a

The door as 1.255.0 ships it, then the fourteen defects one day of production found — all on this door. Every claim verified at head.

The door's own render and decide sites. The enumeration the collapse reduces:

Site	What it does on its own	Proof at b19caf8a
The route stage's write answer	a routed write without a click affordance or a store is answered To run this: <receipt>; a store unreachable at mint appends a note to the same hand-back; a secret-shaped line answers type the line yourself	src/core/dispatch/route.ts lines 1583 to 1610 (answerCommand), UNSHOWABLE_LINE
The cut note	a hand-back over the receipt cap carries a second line admitting the line "will not run as pasted" — a rendered line that documents its own unrunnability	route.ts line 137 (HAND_BACK_CUT_NOTE)
The operator executor, three hand-backs	a bind neither the registry nor the preset table parses is handed back; a write-class registry bind under the confirm class is handed back with its receipt — never the click the route stage's own path mints for the same command; every bind after a preset bind is handed back	src/core/dispatch/operator.ts lines 943, 953, 966 (executeOperatorDecision)
The verifier's disagreement	a disagreement — a misjudged bind, a transport failure, a timeout, no model — hands the bound line back to type and the bind runs nothing	operator.ts (verifyOperatorBind, the !verdict.agrees branch); src/core/dispatch/reply.ts line 407 (renderVerifierHandBack)
The dispatcher's typed short-circuit	a message the chat grammar parses, or one opening with an agent: directive, turns the operator off for the event — stage A decides the bind	src/core/dispatcher.ts lines 608 to 611 (typedDecision)
Admission's directive read	the follow-up rule reads directives.agent as typed intent, so a directive reply skips the owner rule	dispatcher.ts line 814; src/core/dispatch/admission.ts lines 500 and 601 (decideFollowUp)
The paste machinery	a subsystem exists to recognize a hand-back's paste and record it — machinery whose only job is observing the person retype what the door printed	src/core/dispatch/fastPath.ts (pastedRoute); routing-and-config item 21's outcome: pasted rows

The fourteen defects. One day under on, each a fixture the plan adds (D1 to D14):

#	Defect	Proof
D1	a plain-words fix ask bound to a ship line without the person's words — the task text gone from every bind	issue 1993
D2	ship bound with flags the registry does not have (--repo, --issue, --branch, --base, --title, --body)	issue 1993
D3	the hand-back line a bare ship — a line that cannot run as pasted ("Nothing to ship")	issue 1993
D4	the seed directive rewritten and doubled (ship agent:ship in …) instead of passing through	issue 1993
D5	a preset bind never executed: the right preset bound with the right argument, and no run followed — reads dead as well as writes	issue 1993
D6	the verifier refusing correct preset binds with misread reasons ("binding is a run, not a fix command") — judging whether the author typed the preset instead of whether the preset fits	issue 1993
D7	a reply into a live unit's round bound as prose the registry cannot parse, handed back, the follow-up lost — no fold, no trace in the handoff	issue 1993
D8	the typed line runs stop <id> --mode hard re-bound into the MCP spelling runs_stop --run … --mode hard, which the chat grammar does not parse — the stop never ran while a runaway run burned	issue 1993
D9	an agent: directive reply in a live pipeline's seed thread started a rival coding run beside the pipeline instead of folding or being refused	issue 2010
D10	a typo'd directive word (adgent: for agent:) drew a refusal instead of the bind the words meant	issue 2025
D11	the refusal's text reached the person — and the record — cut at its first parenthesis: This request has a typo (	issue 2025
D12	the verifier calling the verbatim line a duplication: the bound preset line put the directive in front of a request already opening with a directive-shaped token, and the mangled line was handed back to type	issue 2025
D13	the operator's own To run this: text beside record 0044's confirmation click — two code paths for one concept, the route stage minting the click the operator's path never asks for (the fix in flight)	operator.ts line 966 beside route.ts answerCommand; issue 1993
D14	the verifier's failure mode a hand-back rather than a floor: a transport failure or a judgement miss ends the ask with a line to retype instead of letting the route run the request (the fix in flight)	renderVerifierHandBack; issue 1993

Fixes D1, D5, D6 and D8's interim carve-outs shipped by 1.255.0 as patches at their own sites — the preset-bind execution, the verifier's preset vocabulary, the operator's word-drop guard (record 0067 as amended), the typed-line and directive short-circuits — which is exactly the accretion this record collapses: each patch is one more site deciding on its own.

The shape

One module, src/core/dispatch/execution.ts (the plan names the files), owning the table every caller asks. (The maintainer's decision in the amendment of 2026-09-20 below collapses the deciders behind this table into one loop; the amendment's table supersedes this one.)

Bind kind	On a chat surface (Slack, the web chat)	On a typed surface (CLI, HTTP, MCP)
a registry bind below the effective confirm class	run through the class ladder, the receipt naming the line, the class verdict and the reason	run, the same
a registry bind at or above the confirm class	click: record 0044's row, minted by the one offer path, the full bound line on the button; a store unreachable or an unshowable line is a refuse naming why — never a line to retype	refuse naming the typed form — typing is that surface's native act, so naming the line there is the refusal's way forward, not a hand-back
a preset bind	route: the preset runs the person's own request through the route stage, the verifier's agreement on the receipt	route, the same
a steer bind	run as admission's fold under the owner rule — the thread's owner read before any directive	the same
a typed registry line (the person's own grammar parses it)	run as typed through the ladder — never re-spelled, never re-bound	run as typed
a shape or content violation (an unparseable line, dropped words, a mixed decision)	re-ask at the seam (record 0067), then the seam's declared floor: the route	the same
a verifier disagreement, failure or timeout	route: the readers' route runs the request, the disagreement on the record	the same
a model-authored refusal (policy or request)	refuse through record 0054's renderer — the text carried whole under the reason cap, never cut at a quote or a bracket; a request refusal is one question with the best guess	the same

The properties the table enforces, which no site can enforce alone:

• One owner. Every caller — the route stage's answer, the operator executor, the confirm click, admission's fold, the verifier's return — asks the table and executes its cell; none renders its own line, so a new bind kind or surface is a new cell with a table test, not a new branch in five modules.
• The seam is the only re-ask. A bind the table cannot execute for a reason the model can repair (the parse, the dropped words, the mixed shape) is record 0067's violation, re-asked with the violation named; the table adds no second retry loop.
• The route is the only floor. When judgement fails — the seam's retries exhausted, the verifier disagreeing or failing — the request itself runs through the route stage, which is what the door did before the operator existed and what it fell back to on every patched path this week. A floored request never re-enters the operator (the floor is terminal for the event), so no loop.
• No chat hand-back. To run this: leaves every chat render; the cut note retires with it (a line never rendered to retype needs no unrunnability warning); the paste machinery retires when its input does. The click is the confirmation; the person's next message is the correction.
• The owner rule is read before the bind. A reply into a thread a live run or a pipeline owns is that owner's follow-up first — folded, or refused naming the thread to reply in — and only then a bind; a directive is honoured inside that rule, never around it (D9's fix as a table property, not an admission patch).

One trace: a typed stop while a runaway run burns

The hard case is D8 and D9 together: the door's misreads created a runaway run, and the door then blocked the only chat path to stopping it.

1. A directive reply lands in a live pipeline's seed thread. Today: stage A reads directives.agent as typed intent, admission never asks the owner rule, and a rival coding run starts beside the pipeline (D9). After: the table's steer/owner row runs first — the thread's owner is the pipeline, so the reply folds into the unit's live child or is refused naming the unit thread; the directive is honoured inside that answer. No rival run exists.
2. Suppose it did (the world before the collapse): the person types runs stop <id> --mode hard. Today: the operator re-binds the typed line into runs_stop --run <id> --mode hard, the MCP spelling, and hands it back; the chat grammar does not parse the handed-back line, so typing it loops (D8). After: the typed-line row — the person's own grammar parsed it, so it runs as typed through the ladder. runs stop on one's own run is below the confirm floor for its requester: it runs; on another's run it is destructive: the click renders with the full line, one press stops the run.
3. Had the operator produced the bind instead (the person wrote "stop the runaway run" in prose), the same two rows answer it: a parsed runs stop bind runs or clicks by class; an unparseable paraphrase is the seam's re-ask, and after the retries the route floor runs the request — where the route stage's own reading of "stop the runaway run" gets its chance — never a To run this: that ends the ask.

The property: at no step does the person retype anything, and the worst model day degrades to the route, which is the door the product shipped with.

The difficulty map

1. Sequencing without a red day (most care): the module lands first as a pure refactor — every site asks the table, every cell holding today's behavior byte for byte — and each behavioral change is one cell flipped in its own unit with its fixtures, so production is green between units and routing.operator: off stays the rollback lever throughout.
2. The click on the operator's path: record 0044's store holds one pending row per thread; the operator can produce several write binds in one decision, so the table must serialize them onto the one-row invariant (the first write clicks, the rest are refused naming the pending row) without double-minting.
3. The route floor's re-entry: a floored request runs the route stage after the operator already decided — the event must not re-enter the operator, the decision's attempts must ride the run that then runs, and the two src/cli.ask.test.ts process tests must pass through the floor unchanged.
4. Retiring the paste machinery: outcome: pasted rows, the web composer's hand-back prefill and the replay's paste counters all read the hand-back's existence; each retires with a spec row change in the same unit, or the ledger grows silent holes.

Plan 002's remaining units

The collapse changes what three of the one-door plan's remaining units mean; plan 002 takes one dated note pointing here, and its unit table is not renumbered.

• U12 (the directive words leave): absorbed. The dispatcher's directive short-circuit (typedDecision) and stage A's directive read are two of the decide sites the table collapses; the deletion lands as the collapse's directive unit, gated by the directive replay row plus the day's two directive fixtures (D4, D10). U12 is not run as its own unit.
• U13 (the typed command line leaves stage A): amended. The day's evidence (D8) settled the open half of the plan's second key technical decision: a line the person's own grammar parses is the person's typed decision and runs as typed — permanently a deterministic row of the table, not an interim carve-out the operator later absorbs. What leaves is stage A as a separate render path: the parse moves behind the table's owner, and the operator is forbidden from re-spelling a parseable line by the table test rather than by prompt hope. U13 narrows to that move, gated by the command row as before.
• U16 (the confirm default moves): narrowed, half unnecessary. U16 existed to relax the write hand-back; under the table there is no hand-back to relax — a write on a chat surface is already one click. What remains is one cell: whether the write row's chat outcome is run or click, moved by the same gates U16 already names (the write and planted rows held twice on the final prompt, the requester fix deployed). U16 becomes that cell change.

U14, U15, U18 and U19 are untouched: the repository scan, the attach token and the lint rule delete readers ahead of the table; the seam (U19, shipped) is the re-ask column the table points at.

Records this design amends

Each amendment lands as a dated ## Amended note on the record in the same pull request as the unit that makes it true; the replacement sentences:

• Record 0039 ("a write is answered To run this: <chat form> and nothing is invoked; the paste is the confirmation, and it is stateless"): a routed write on a chat surface is offered as one click showing the full bound line, and where no click can render the door refuses by name; the paste is no longer a confirmation on any chat surface, and the front door still writes nothing from prose — the click is the person's act.
• Record 0044 (the hand-back as the fallback: a channel without offer, or a store unreachable at mint, "is answered To run this: <chat form> byte for byte"): without the click the write does not run and the refusal names why — the store could not be reached, or this surface shows no confirmation — and the person's next message re-asks the door; the graded ladder and the store are unchanged and become the one offer path every caller mints through.
• Record 0054 (every refusal rendered through the seam, the cause deciding the reply): a disagreement between the door's own models is not a refusal the person caused and is never rendered: it floors to the route, which runs the request; 0054's question with a best guess is reserved for what only the person can decide, and a refusal's text is carried whole under the reason cap, never cut at a quote or a bracket.
• Record 0057 ("a bind at or after the path's confirm class is handed back as the line to paste"; the verifier's disagreement "hands the line back to type"): a bind at or after the path's confirm class is offered as one click through record 0044's store on every chat surface, and a verifier disagreement or failure floors to the route; the operator outranks no guard, deterministic code still authorizes, fences and executes — and it also never interprets a failure into a sentence: no path after the operator's decision renders a line to retype.

Why not X

Why not keep fixing each site? The day produced fourteen defects and five fixes, each correct and each local; the survey shows eight render sites and three decide sites still standing after them. A rule enforced in eleven places is not a rule; the fifteenth defect lands at whichever site the sixteenth patch misses. The table makes the next defect a missing cell — a compile error or a failing table test — not a production incident.

Why not let the operator render the outcome too? Record 0057's split is the reason the door works at all: judgement in the model, determinism at the boundaries. Rendering is execution; an execution the model words is an interpretation of its own decision, which is the two-interpreters problem again from the other side.

Why not floor to a question instead of the route? A question spends the person's attention on the system's failure, which is record 0067's "never a refusal shown to the person" inverted. The route is a floor that acts: it runs the request with the reading the product shipped with, and the person corrects a wrong run — visible, steerable, stoppable — rather than answering for a parse.

Why not delete the hand-back on typed surfaces too? A terminal's native act is typing; naming the exact line there is the refusal's way forward, not a broken button. The guarantee is scoped to chat, where a rendered line to retype is a button that does not press itself.

Boundaries

Not changed: the class ladder and blastRadius over parsed input, the authorization table, the seam's parsers and retry bound (record 0067), the intake gate (record 0058), admission's owner store and the durable inbox, the confirm store's invariants (one row per thread, consume-once, requester-bound). Not owned here: the confirm default's level (the narrowed U16's gates), plan 002's memory, briefs and image units, and the plane's queue (record 0064) — the table decides a bind's outcome, never its admission to capacity. Compatibility: a deployment sees fewer dead ends and no new surface; routing.operator: off remains the rollback lever, and under it the route stage asks the same table.

What would change our mind

• The click is friction the text was not. If the confirmation rows' consumption rate says people abandon clicks where they used to paste (measured on the store's consume-vs-expire counts after one week), the write row's chat cell is re-argued by amendment — the table stays, the cell moves — and the pre-argued alternative is an undo window (run, then a bounded revert) for the writes that are provably reversible, never for a stop or a deploy.
• The route floor loops or surprises. If floored requests re-enter the operator through any path, or the route's reading of a floored request starts writes the person then reverts, the floor narrows to read-only presets by amendment and the rest becomes a named refusal.

Rollout

One plan, docs/plans/2026-09-20-001-feat-one-execution-path-plan.md, in the same pull request as this record: the fourteen fixtures first, the table as a pure refactor second, then one cell per unit in the order that keeps production green — the click, the verifier floor, the bind repairs, the owner rule, the typed line, and the hand-back's retirement last, when nothing renders it. Every criterion is bound to a test id and each defect's fixture names the unit that turns it green.

Sources

The field comparison in the amendment below (each system's primary documentation, linked there); records 0039, 0044, 0054, 0057 and 0067; docs/plans/2026-09-18-002-feat-the-operator-is-the-one-door-plan.md; issues 1993, 2010 and 2025 and the fixes they drew; docs/reference/specs/routing-and-config.md items 21, 25 and 29; the survey above, verified at b19caf8a.

Amended 2026-09-20 — pressure-tested against the field; the maintainer decides for the one loop, and the record is accepted with the table changed

Before acceptance, the table was held against the best-known systems that separate a person's intent from execution — the evidence that led to the decision at the end of this note. For each: what runs without asking, what is confirmed, what is refused, and how a lost instruction is recovered — then the four questions the table must survive, and the decisive comparison the first night under this record forced.

Model intent against deterministic execution — Claude Code and Anthropic's agent guidance. Claude Code splits exactly where record 0057 does: the model proposes tool calls and a deterministic permission engine decides — rules "are enforced by Claude Code, not by the model", evaluated deny → ask → allow, read-only actions running unprompted, writes prompting (permissions). Two details corroborate the table's cells. The approval prompt shows the command in full, and where a prompt cannot show everything a standing rule would allow, the standing options are withheld and only a one-time approval is offered — the analogue of the table's refuse when the click cannot carry the full line. And a denial can carry a comment that is sent to the model "as the reason for the denial, and Claude continues working" — the violation named to the model, which repairs; never a line handed to the person. Anthropic's guidance draws the same line at design level: workflows are "orchestrated through predefined code paths" while agents direct their own process, with programmatic gates between steps and a separate model screening another's output (building effective agents) — the verifier as a parallel judge, never a renderer.

An ambiguous or malformed instruction — Devin, Cursor's agent, Copilot's coding agent. Devin runs its best reading and puts the burden on the author: vague instructions "can lead Devin to implement solutions that don't align with your actual needs" and it "can get stuck without a clear path or when faced with too many interpretations" (instructing Devin) — recovery is the person steering a visible session, not retyping. Cursor's agent has a clarifying-question tool, but "while waiting for your response, the agent continues reading files, making edits, or running commands", and checkpoints give a local undo (agent overview). Copilot's coding agent never hands text back at all: every outcome lands as a branch and a pull request a person reviews (about the cloud agent), and its issue automations grade each action's confidence against a repository threshold — at or above it the action runs with a recorded rationale, below it the action is held as a one-click suggestion — with the docs' own caveat that "approvals are a workflow convenience, not a security control": permissions, not prompts, bound what the automation may do (rationale, confidence, and approvals). Nobody in this field answers ambiguity by printing a line for the person to retype, and everyone records why it acted.

A mistyped command — Unix shells and git. The terminal is the one surface where the hand-back is native: command not found plus a suggestion — zsh's CORRECT option prompts before running a correction, bash exposes command_not_found_handle for the distributions' "did you mean" — leaves the fix to the typist (zsh options, bash manual). git grades the same decision as configuration: help.autocorrect defaults to showing the suggested command, and can prompt for confirmation, run it immediately, or run it "after specified deciseconds" (help.autoCorrect). Two readings for the table. First, the field's most conservative tool ships a mode that runs the likely command with no confirmation at all, so the floor-to-route for non-destructive binds is not an outlier. Second, the delayed auto-run is sound only because the terminal has a native in-flight cancel — Ctrl-C during the delay; chat has none, which is why the table's chat answer to a destructive bind is the click rather than a countdown, and why its typed-surface refusals keep naming the line: exactly the scope the shells prove.

A partial match — Slack's slash commands and Linear's command palette. Slack routes /command and passes everything after it as one opaque text parameter; a malformed argument is the app's problem, the platform's recommended answer is an ephemeral error with usage guidance — a hand-back — and a name collision between apps silently runs whichever was "installed most recently" (implementing slash commands): the two failure shapes the table removes, the retype loop and the arbitrary likely-intent. Linear's command menu narrows as you type and scopes on single-letter prefixes, but a partial match never executes — the person's Enter on a highlighted, fully rendered row is the act (search and the command menu). That is the click cell: resolution may be fuzzy, execution is an explicit selection of a fully shown candidate.

Desired state against execution — Kubernetes and Temporal. kubectl apply keeps the person's declared intent on the object itself (the last-applied-configuration annotation) and computes every change from declared against live, so a retry re-applies the same intent and never re-asks the person (declarative management). Temporal makes the instruction durable in the event history and replays code against it: commands that match history proceed, a mismatch is a non-determinism error — a refusal, never a guess (workflow definition). The table's counterparts hold: the floor is terminal for the event so no loop re-asks, the person's own words are the durable input the route runs, and a lost instruction cannot exist because the request, the decision and the attempts ride the run's record.

The judgement on the four questions.

1. Is the floor-to-route right for non-destructive binds? Yes. It is the shape of Copilot's above-threshold auto-apply and milder than git's immediate: what runs on the floor is not a model's correction but the deterministic route the product shipped with, reading the person's own words, visible and stoppable. The field's other answer — ask the person (Cursor's tool, zsh's prompt) — spends the person's attention on the system's failure, which this record already rejects; even Cursor keeps working while it asks.
2. Is one click the right confirmation for a destructive write? Yes. Claude Code's one-keypress prompt showing the full command, Copilot's one-click suggestion carrying its rationale, and Linear's Enter on a rendered row are the same act; the table's refuse-on-unshowable-line matches Claude Code withholding a standing option its prompt cannot fully display. An undo window (Cursor's checkpoints; git offers none) was weighed and rejected as the chat default: the door's writes — a stop, a deploy, a shared channel's config — are not reliably reversible, and chat has no dependable in-flight cancel; "What would change our mind" now names the undo window as the pre-argued alternative should the click's consumption data call it friction.
3. Is the seam's re-ask the right treatment of a malformed bind? Yes, and it is the field's better half: the shells hand the fix to a typist and Cursor asks the person, but Claude Code's deny-with-comment — the violation named to the model, which continues working — is exactly the seam, spending model retries rather than the person's attention, with a floor that acts when the retries run out.
4. Does the field do anything the table misses? A "did you mean" that runs after a delay — rejected: chat lacks the terminal's cancel affordance that makes git's deciseconds sound, and the click is chat's equivalent of the delay's escape hatch, while the route floor already runs the likely intent where nothing destructive rides on it. An undo window — rejected as the default, recorded as the re-argument path above. A rationale on every automatic act — already a table property: the run cells carry the receipt naming the line, the class verdict and the reason, and a floored event carries the disagreement on the record. What the field does do better is the decisive comparison below: it has one decider where this record still has four.

The decisive comparison — Claude Code's own shape against the door's chain of deciders. Claude Code is a single agent loop: one model, typed tool calls as the only way to act, read tools it may call before deciding, a question that keeps the turn open until the person answers, deterministic permission gating on each tool call — and no second model checking the first (permissions; agents "are typically just LLMs using tools based on environmental feedback in a loop", gaining "ground truth from the environment at each step", with tools poka-yoked so the mistake cannot be expressed — building effective agents). The door this record tables has four deciders in a chain: the operator's one-shot decide, a verifier model that can disagree with it, the readers' route as the floor, and the general preset as the fallback that answers in prose. The first night under this record, production filed three more defects (issues 2043, 2045, 2046) and every one landed at a hand-off between two of the four: two plain-words docs asks were refused as "privileged administrative updates" by a model-authored refusal no policy row backs, inventing an administrator that does not exist (2043); a bare review reply in a thread whose parent names the pull request drew "Review what?" plus a proposal that would fail if clicked (2045); and one ask crossed all four — the operator asked a question the coding child could have answered itself, the person's free-text answer could not be joined to the question, the route floor called the complete thread "unclear request", and general answered a write ask with "post a new top-level message" — the retype hand-back this record retires, produced by the fourth decider (2046). Each decider did its narrow job; the defects live between them, because every hand-off re-reads the situation without the previous decider's reasoning and without ground truth. The field's verdict is uniform: no system surveyed above puts a second model in judgement over the first's intent, and every failure class the chain produced is unrepresentable in the single loop — a malformed bind cannot be typed into a validated tool schema, a false refusal cannot be authored where only the policy table refuses, and an unjoinable answer cannot exist where the question is parked state the answer re-enters.

The decision (the maintainer, 2026-09-20): the chain collapses into one loop, and the table changes. The operator becomes an agent loop with typed tools — bind_preset (the preset and the person's request as typed arguments), run_command (a registry command with typed arguments), ask (one question, parked as the thread's pending question in durable state), or nothing — with read tools (the thread's owner and pending question, the repository's facts, the registry's own help) so it decides with ground truth. The table's rows become the loop's turn outcomes:

Turn outcome	On a chat surface (Slack, the web chat)	On a typed surface (CLI, HTTP, MCP)
run_command below the effective confirm class	run through the class ladder, the receipt naming the line, the class verdict and the reason	run, the same
run_command at or above the confirm class	click: record 0044's row, minted by the one offer path, the full bound line on the button; a store unreachable or an unshowable line is a refuse naming why — never a line to retype	refuse naming the typed form
bind_preset	route: the preset runs the person's own request through the route stage	route, the same
ask	question: one question, parked as the thread's pending question; the person's next message in that thread — mention or not — is joined to the original request with the question and its answer, and re-enters the loop as facts	the same
a turn ending with no tool call	route: the readers' route runs the request — the only floor, terminal for the event, and the router reads the thread's parent as the request	the same
a typed registry line (the person's own grammar parses it)	run as typed through the ladder — the line never enters the loop, never re-spelled	run as typed
a steer into an owned thread	run as admission's fold under the owner rule — read before the loop sees the message	the same
a refusal	refuse only from the policy table, rendered through record 0054 naming the policy row it stands on; the model authors no refusal — a model's "cannot" is an ask or nothing	the same

What the collapse deletes from the original table: the malformed-bind row — a shape violation is unrepresentable in a typed tool schema, so record 0067's re-ask narrows to the harness's own repair of a tool call that fails to validate, invisible to the person and to every caller; and the verifier row — the verifier retires, because a second model judging the first's intent is the two-interpreters problem this record already names, its every disagreement was already discarded to the floor, and deterministic gating per tool call (the ladder, the authorization table, the owner rule) is what the field uses in its place. The floor narrows to one cause: a turn that ends without a tool call. And general is never reached by a write ask — a write exists only as run_command through the ladder or a preset's route, so the fourth decider's prose can no longer end a write ask.

What this replaces in plan 2026-09-20-001. The plan is rewritten so its first unit is the loop itself, at the top of the queue ahead of every other unit: E2 becomes that unit — the operator loop with typed tools and the table above as its turn-outcome surface — and it absorbs the separate bind, refusal, verifier and owner-rule repairs (E4, E5 and E6), whose test scenarios become the loop's fixtures. The verifier retires with verifyOperatorBind and renderVerifierHandBack rather than flooring. The fixtures from the first night's four door failures — the two false refusals of plain-words docs asks (issue 2043, the record-status ask and the pressure-test ask), the PR thread's "Review what?" (issue 2045), and the unjoined answer that floored a write ask to general (issue 2046) — ride that unit's contract. E1, E3, E7 and E8 stand, re-scored against this table.

The maintainer decided for the one loop on this comparison (2026-09-20), and the record is accepted as amended: one owner, one loop, typed tool calls as the only way to act, deterministic gates on every act, refusals only from the policy table, the route as the one last-resort floor, no write ask ever reaching general — and nothing on a chat surface handed back as text to retype.

Amended 2026-09-20 — the write-intent cell: a write-class intent never executes as a read command

The first defect filed on the one loop (issue 2088) was a missing cell: a plain-words write ask ("change my default models to openai") was answered with a read (config show) — nothing in the table forbade a read command answering a write intent, and a write whose required argument was missing or named a provider the deployment does not have (no openai provider; OpenAI models ride openrouter) had no outcome of its own. The table gains one row, unresolvable_write → question on both surfaces, and the check is the executor's, not only a prompt sentence: every registry command tool the loop offers carries a required typed intent (read or write) beside its reason, a write intent bound to a read-class command never runs the read, and a write-class call the deployment cannot run as typed — a required argument missing, or a model ref naming a provider the config does not define — lands in the question cell, its proposal the write line built from the providers and presets that exist, so "yes" runs it through the click path and the person's next words refine it. A new read tool, provider_models, grounds the proposal in the refs this deployment can actually run — each provider block's own /models catalogue plus the configured models — so "openai" resolves to the openrouter OpenAI refs that exist, never a provider the config lacks. The fixture is the door row's N5, scored under unit W1; and every operator decision leaves a record whether or not a run results — an inline command answer's record lists for the thread with the door's tool call, arguments and reason.

Re-evaluation: the record's bet — one owner, one loop, typed tool calls as the only way to act, deterministic gates on every act — held; the defect was a missing cell, never a fifteenth render site, and the fix lands as one row of the table with its fixture and its record, exactly the shape the record prescribes. The floor stays the route and stays terminal; the question cell spends the person's attention only where the deployment itself cannot resolve the ask, which is the boundary the original "why not floor to a question" argument drew.

Amended 2026-09-20 — a plain-words model is the directive's equal: the bind carries the ref and the run uses it

A person who names a model in plain words — "with astra, fix issue 42", "use sol for this", "on gpt-6 review this PR" — must get a run on that model, exactly as model:openrouter/openai/gpt-6-astra would resolve, with no directive typed. The loop's bind_preset gains one optional typed argument, model: a <provider>/<model> ref the provider_models catalogue lists, resolved by the loop from the person's word through the same read tool the write-intent cell grounds its proposals in. The parse holds the ref's shape and its provider, the loop holds it against the catalogue (a ref the catalogue does not list is a violation re-asked — the model gets its retries to read provider_models and pass a listed ref, or ask — never a run on a guessed model), and the executor rides the ref on the route so the dispatcher applies it at directive precedence: the request layer of the resolution, where a typed model: directive would stand, a directive on the message still outranking it. The request rides verbatim — the model word is stripped from nothing. A word that matches several refs, or none this deployment can run, is one question naming the catalogue's candidates — never a guess and never a silent default — and a request naming no model binds with no model. The door row gains the plain-words model set M1 to M6 under the door set's MW1 tag, and the resolution's equality with the directive path is unit-proven at resolveRun.

Re-evaluation: the record's bet held again — one loop, typed tool calls as the only way to act, deterministic gates on every act. The plain-words model is one more typed argument on an existing tool, held by the same violation re-ask the loop already runs, riding the same route cell; no new decider, no new render site, and the "never a guess" line lands as the question cell the original table already carved. The floor stays the route and stays terminal: a floored event runs on the thread's resolved model, which is what the product shipped before this amendment — legible on the record, never a silent model swap.

Amended 2026-09-20 — the readers' router floor is retired; the door owns its final answer

Re-evaluation: the one-loop decision holds, and the last second decider was the floor itself: a turn that ended with no tool call handed the request to the closed readers' router, spending another model call on every non_decision the door-row replay already scored as a miss. That floor is retired. A no-call turn is a named violation and the same operator is asked once more; if that turn also ends without a tool call, deterministic code sends bind_preset through the door's existing typed parser with preset general and reason no_decision. The resulting run records that reason on its operator field. There is no router prompt, model, effort, intake hand-off or route event in this path, and the person's request still rides verbatim.

Amended 2026-09-21 — the door reads and binds the repository target

Re-evaluation: the one-loop decision still holds, but its repository facts must be visible at the door. A bind_preset outcome now carries optional repo: owner/name beside model and reason. The loop's thread_state read returns the newest finished run's agent, repository and pull request and the channel's default repository; those are facts the dispatcher already computed, not another model's inference. A bare review again can therefore route review on the thread pull request, and a repo-bound ask with no target in the thread inherits channels.<id>.repo. An explicit target in the current message outranks the inherited slot, and deterministic repository authorization and vetting still run after the bind.

The ask row gains a pre-render guard: its proposed line must parse as a registry invocation or a projected preset bind that has task words and any repository fact it needs. A proposal that would only ask the person to retype an incomplete command is a tool-call violation and is repaired inside the loop. A ship write with exactly one available repository uses record 0054's Yes/No row with a runnable agent:ship in owner/name: … proposal; no syntax example is rendered. Typed chat grammar remains decisive: mcp list invokes mcp.list even when the registry backend is unavailable.

Amended 2026-09-30 — chat has one interpreter

Re-evaluation: the final sentence above kept a second interpreter on chat. It let a directive, command grammar, repository token scan, or Ship task probe decide from the request's characters before or after the operator's typed bind. A PR URL could then be stripped from the task and a requested review could start as new coding work. This contradicts record 0057's one-interpreter contract, so the typed-chat row is retired. A line such as mcp list is still a valid request: the operator binds it to the registry's typed mcp.list tool, and the registry authorizes and executes that call. CLI, HTTP, and MCP machine inputs retain their explicit grammars.

On Slack and web chat, the operator alone decides intent from the complete authored turn and thread context. It returns typed action, target, and Ship entry fields; deterministic code checks schema, actor authority, thread ownership, repository and pull-request identity, and the exact current head before an effect. A target claimed as authored evidence must point to a verbatim span in an actor-stamped turn and resolve to the same canonical target; a model's unsupported target grants nothing. Channel adapters may decode transport markup, but neither they nor dispatch infer intent with a regex, keyword, stripped URL, or command parser. A failed operator turn reports its failure or asks; it never falls through to a chat parser.

The execution table still owns what a typed bind may do, and the policy table still owns authorization. The change removes competing interpretations, not the gates. Tests must cover the old typed forms as operator fixtures, exact target and owner conflicts, and an unavailable operator. A source-aware lint rule makes a new semantic regex over incoming chat text fail CI; only adapter encoding helpers are exempt. Record 0057's U12 to U15 migration and their proof rows govern the deletion.

Amended 2026-10-13 — the accepted typed action reaches execution

Re-evaluation: The one-interpreter decision stands. PR-specific prose shortcuts and repeated display-line interpretation violated it. The operator now interprets every PR request through its existing model loop, validates the typed choice, and carries the accepted preset or batch identity to the existing executor. Registry arguments remain private. Rendered text serves display and audit; it does not select a current action. Saved preset questions retain their accepted typed task and settings. A qualified legacy boundary remains for older records.

An explicit authorized leading preset token constrains action, not necessarily runtime preset. Single Review uses Review; an authorized typed Review batch uses Conductor without acquiring a Ship or Conductor grant. Owned turns retain their full accepted capability projection for folding into the original unit. Only an authored contiguous formal control prefix constrains exact values; quoted or later task data stays with model-classified evidence. Missing or different controls require the existing bounded correction or a question.

Current-message Review evidence can be complete without old history. The same loop loads authorized context only when a helper or context-dependent proposal needs it, and validates the same proposal again against that context. It does not run another interpreter or reset its deadline or repair allowances. Required custody, current audience, original ownership, exact target/head and feasible execution remain deterministic gates.

The production boundary is executeOperatorDecision followed by dispatcher and registry gates. The older decideExecution table remains a replay model, not a claim that production calls it. JSON shape, reference checks and semantic fit remain distinct. An optional semantic evaluator is appropriate only when existing held-out evaluation shows an improvement; neither typed JSON nor two model calls guarantee correct intent. No new evaluator call is introduced without that evidence.