Merismos Protocol

Apportion an autonomous goal into coarse execution units and derive each unit's completion conditions before the run begins: cut the goal at its evidenced seams so each unit fits one execution horizon and no obligation is orphaned, derive per-unit completion and invariant predicates plus the cross-unit plan conditions, and emit one goal entry per unit. Type: (GoalPlanUncompiled, User, APPORTION, AutonomousGoal × ExecutionHorizon) → ConditionBearingUnitPlan.

Definition

Merismos (μερισμός: a dividing into parts, an apportionment): A dialogical act of apportioning one stated autonomous goal — deciding which units the goal is carried out in and what each unit's done means — when the goal is stated but its plan is uncompiled. The protocol's lexical verb is /apportion. It reads the goal's obligations — the host's own standing procedural contract subtracted, since that attaches to every change the host accepts whatever the goal is — cuts them into coarse units at seams it can cite, judges each unit against one execution horizon, derives a completion predicate and any invariant predicates per unit, separates the conditions whose subject is the whole goal rather than any one unit, and emits one goal entry per unit whose conditions are conjoined into a single leaf predicate — or, for a unit whose completion condition remains residual, an explicit accepted-uncovered certificate that still carries any compiled invariant conjuncts. An item no check could settle because what settles it is a judgment made against the context accumulated by then and what the user has actually said by then is reserved rather than compiled — recorded with the ground that settles it, at the unit level and for the whole-goal acceptance criterion alike, and kept apart from the waiver that records an acceptance criterion the plan simply lacks. Activation takes one goal: a request bundling several stated outcomes whose only common bond is that standing contract relays at the checkpoint instead, one apportionment per goal. Every goal obligation belongs to some unit or is visibly accounted for, and every unit fits one horizon or carries a recorded override; the MORPHISM block names these and the protocol's other invariants. Merismos apportions and conditions; it does not order — sequence, independence, reconciliation, termination topology and routing are outside its own scope, so the emitted plan is a pre-conduct artifact. The protocol holds no state during execution.

── FLOW ──
Merismos(G) → Probe(G) → goal_plan_uncompiled? →
  ¬autonomous_intent(G):  → relay(no autonomous interval in scope) (extension) → deactivate
  ¬single_goal(G):        → relay(composite goal — name each stated outcome it bundles and the shared-procedure bond that made them read as one; one apportionment per goal) (extension) → deactivate   -- fires BEFORE init_loop_state, so no Λ loop field is ever seeded and no unit is cut across outcomes that share only the host's standing contract
  locator in scope — the goal's navigation block — ∧ (¬dereferenceable ∨ support-integrity failure): → relay(handoff unreadable — locator unreachable, missing its session half, or a load-bearing premise the grounding pass could not support) (extension) → deactivate
  condition_bearing(G):   → relay(units and conditions already present) (extension) → deactivate
  uncompiled: ReadObligations(G) → O_G → VelocityFilter(O_G) → oos → init_loop_state: U=∅, residual=O_G \ {d.obligation | d∈oos}, K=∅, R=∅, S=∅, P=∅,
                              plan_conditions_derived=⊥, plan_conditions_stale=⊥, invariant_status=⊥, unbounded_approved=⊥, loop:   -- init_loop_state runs EXACTLY ONCE, on this Phase 0 → Phase 1 edge; Phase 2's Reopen re-enters "loop:" directly without re-executing it
    Phase 1 residual? →   -- the empty-residual arms are read off residual DIRECTLY, before anything is drafted: a draft that comes back with no cut cannot tell "nothing was there to cut" from "nothing could be cut", and only the first of those relays. The second arm is the ordinary completion edge every converging run leaves Phase 1 through
      residual = ∅ ∧ U = ∅ ∧ oos = ∅:  → relay(goal's scope too thin to read any obligation) (extension) → deactivate
      residual = ∅ ∧ (U ≠ ∅ ∨ oos ≠ ∅):  → Phase 2
      residual ≠ ∅:  draft(G, residual) → D → surface_draft(D) (extension) →   -- draft iterates Scan/Pack/fit/qualify/complete_unit over a workset copied from residual until every obligation in that workset sits in some completed cut, autonomous_pack absorbing at heuristic seams only what the seam evidence could not reach; it moves nothing out of residual, integrate remaining the sole owner-changing step. The WHOLE draft reaches the user before any cut is settled: what the user recognizes is the shape, and settling one cut at a time out of a visible whole is what keeps a misalignment found late from re-opening cuts already accepted blind
        D holds no Heuristic cut ∧ ∀c ∈ D whose fit = Fits ∧ no alternative cut of c's obligations stands up to the same evidence: → relay(AcceptUnit) (extension) → integrate_unit(c) → c' → U := U ∪ {c'}, residual := residual \ c'.obligations   -- `Whole-draft relay test` read twice, in this order: the leading conjunct over the WHOLE draft — the relay path opens only where the goal's evidence reached every cut, one heuristic cut sending the draft to the gate entire — then the familiar per-cut reading inside it. What it weighs is NEVER a member of D: D is one partition, so no two of its cuts claim the same obligation and none of them stands against another. What the test asks is whether c's region could have been cut a second way the goal's evidence would back as well — a live reading made HERE, at dispatch, over that evidence and the accumulated context, which drafting neither draws nor records
        D has no unsettled cut left ∧ residual = ∅:  → Phase 2
        else:  → Qu(the first unsettled cut, U, D's still-unsettled cuts) → Stop → Aᵤ →
          Aᵤ = AcceptUnit     → integrate_unit(the cut this firing presented) → loop   -- in Aᵤ's defined set iff SpanFit = Fits
          Aᵤ = Recut(c, d)    → re-derive c's Anchor frame under d → loop   -- c ranges over the surfaced draft's still-unsettled cuts, not only the one this firing presented: same residual, different cut, and the next cycle drafts under d
          Aᵤ = OverrideFit    → integrate_unit(the cut this firing presented) → loop  -- in Aᵤ's defined set iff SpanFit ≠ Fits
          Aᵤ = Sufficient     → ∀c ∈ D still unsettled with fit = Fits: integrate_unit(c) → c' → U := U ∪ {c'}, residual := residual \ c'.obligations → [∃c still unsettled with fit ≠ Fits: → Qu over the first such cut, reason surfaced as relay first → Stop → Aᵤ → the same Aᵤ dispatch | none: residual = ∅ → surface (extension) → Phase 2]   -- blanket relay over the fitting cuts OF THE DISPLAYED DRAFT: Sufficient is the user's constitutive act over that whole, so what it accepts is what was shown — each cut's seam disposition included — rather than a remainder re-packed at heuristic seams the user never saw
    Phase 2 ∀u∈U, ¬derived_already(u,K,R,S): Derive(u) → (Set(κ), Set(ρ), Set(σ)) → K:=K∪κs, R:=R∪ρs, S:=S∪σs ∥ [¬Λ.plan_conditions_derived: DerivePlan(G, U) → P; Λ.plan_conditions_derived := ⊤] →
      oos ≠ ∅ → OOS(oos) (extension)                                            -- obligations needing pre-action interception: out of scope, substrate named
      S ≠ ∅ → Reserved(S) (extension)                                           -- items held open to a judgment made outside compile time: the ground that settles each is named, and nothing is delegated to any substrate
      ¬acceptance_present(P) → Qt(K, P) → Stop → Vₜ →
        Vₜ = DefineNow(d)     → P := P ∪ {plan_condition(d)}; [Λ.unbounded_approved: Λ.unbounded_approved := ⊥]; S := S \ {σ∈S : σ.subject = ReservedAcceptance}
        Vₜ = RouteBound       → relay(the whole-goal acceptance criterion's definition is routed to /bound) (extension) → deactivate   -- Rerouted: the route is EMITTED, not merely exited on
        Vₜ = ReserveJudgment  → S := S ∪ {acceptance_reservation()}; [Λ.unbounded_approved: Λ.unbounded_approved := ⊥]   -- the criterion is constitutively open, not missing: it stays open to runtime resolution. This arm never SETS the waiver flag, and it CLEARS one an earlier firing on this same invocation left standing — the waiver and the reservation are mutually exclusive, so the arm answered last is the one that stands
        Vₜ = ApproveUnbounded → Λ.unbounded_approved := ⊤; S := S \ {σ∈S : σ.subject = ReservedAcceptance}   -- the symmetric retraction: drops a ReservedAcceptance member an earlier firing left standing, for the same exclusivity
      BindPlanRequirements(P, U) → P := Pᵦ → check(U, K, R, S, Pᵦ, oos) → Λ.invariant_status := InvariantStatus   -- coverage_complete ∧ termination_covered ∧ obligations_derived ∧ oos_substrate_named ∧ reservation_ground_named ∧ plan_conditions_topology_free
      Λ.plan_conditions_stale → StaleNotice(P) (extension)                       -- pre-gate text before Qc: Adjust to update, or Confirm to keep as recorded
      Qc(U, K, R, S, P, InvariantStatus, oos) → Stop → V →
        V = Adjust(d)  → rederive(K, R, S, P, d) → (K, R, S, P) := (K', R', S', P') → Λ.plan_conditions_stale := ⊥ → [¬acceptance_present(P') → Qt(K', P') → Stop → Vₜ → P' and S' updated as at Phase 2 entry] → [acceptance_present(P') ∧ Λ.unbounded_approved: Λ.unbounded_approved := ⊥] → [acceptance_present(P') ∧ acceptance_reserved(Λ): S' := S' \ {σ : σ.subject = ReservedAcceptance}] → BindPlanRequirements(P', U) → P' := Pᵦ' → check(U, K', R', S', Pᵦ', oos) → Λ.invariant_status := InvariantStatus → Qc(...)   -- over the SAME U: K' ∪ R' ∪ S' spans every obligation of every unit; no removal — a withdrawn condition becomes a residual, and a residual the direction re-reads as judgment-settled becomes a reservation. rederive rewrites the unit-scoped members of S only; the ReservedAcceptance member is Qt's own record and carries through
        V = Reopen(u)  → residual := residual ∪ u.obligations; U := U \ {u}; K := K \ {κ∈K:κ.unit=u}; R := R \ {ρ∈R:ρ.unit=Some(u)}; S := S \ {σ∈S:σ.unit=Some(u)}; Λ.plan_conditions_stale := ⊤ → Phase 1   -- residual is NOT reseeded from O_G \ oos; every other unit's obligations carry forward untouched; the whole-goal ReservedAcceptance member is unit-free and stays; plan-level P is NOT re-derived (`Back-edge state preservation`)
        V = Confirm ∧ ¬hard_invariants_hold(Λ): → re-present Qc with the violated invariant named
        V = Confirm ∧ hard_invariants_hold(Λ):  → AcceptResiduals(R) → ∀ρ∈R: ρ.disposition := AcceptUncovered → Phase 3   -- P and S are read-only on this edge; AcceptResiduals supplies the non-empty accepted-completion witness resolve_unit reads at Phase 3, and touches no reservation — a reservation is not a residual awaiting acceptance
    Phase 3 Emit(U, K, R, S, P, oos, unbounded_approved) → E [record] → package(E) → plan → park_carrier(plan) → C [record] → record_handoff(C) → N → converge(apportionment trace) → ConditionBearingUnitPlan

── MORPHISM ──
AutonomousGoal × ExecutionHorizon
  → probe(goal)                        -- detect ONE stated autonomous goal whose unit plan and conditions are uncompiled; a request bundling several stated outcomes bound only by the host's standing procedural contract is composite and relays here rather than activating
  → read_obligations(goal) → O_G       -- construct the invocation-local obligation set and SUBTRACT the host's standing procedural contract: a requirement that host attaches to every change regardless of the goal is not a goal obligation but an ambient invariant every emitted unit inherits, so it is neither packed nor derived; G itself remains read-only
  → filter(velocity) → oos             -- an obligation guardable only by pre-action interception is declared out of scope with the delegated substrate recorded on the declaration; computed once over O_G before packing begins, so it never enters a unit
  → draft(goal, residual) → D          -- THE WHOLE-DRAFT OPERATOR: iterate the next five steps over a workset copied from residual until every obligation in that workset sits in a completed cut, then stop. It owns nothing — no obligation leaves residual here — and it settles nothing; what it produces is the shape the reader has to see before any one cut can be judged. Iterating rather than cutting once is what lets each cut carry its own seam verdict, so a whole draft is not uniformly heuristic just because it was drafted at once
  → scan(seams)                        -- read the REMAINING obligations (O_G minus the out-of-scope ones) for cuttable seams: dependency, deliverable, verification, ownership. Ordered after the filter, as FLOW and PHASE TRANSITIONS run it: a pre-action-only obligation is delegated out before any cut is shaped around it
  → pack(seams, horizon) → (Anchor, DraftUnit when Anchor ≠ ∅)   -- THE IRREDUCIBLE CORE, part one (completed into a ProposedUnit by complete_unit once fit and seam exist): an empty Anchor IS this step's no-cut verdict and carries no draft, so the three judgments below have no operand on that return and drafting hands what is left to autonomous_pack instead; a goal whose obligations were every one delegated out never reaches drafting at all, the empty-residual arm having relayed first. apportion the obligations into coarse units such that each unit fits one execution horizon and every obligation lands in some unit; also reads each unit's capability requirements and feasibility notes from the goal's stated needs — functional descriptions only, never a concrete executor/model/runtime/tool token (Substrate Boundary)
  → fit(unit, horizon) → SpanFit       -- per-cut horizon-fit predicate, run wherever a cut exists to judge, whether Pack found it at a seam or autonomous_pack placed it; Indeterminate is surfaced, never silently read as Fits
  → qualify(cut) → Seam                -- Grounded when a seam is cited: a dependency, deliverable, verification or ownership seam, or another the goal evidences — the four are the scanning taxonomy, not the admissible set; Heuristic when the goal carries no such evidence — declared, not asserted as a natural joint
  → complete_unit(draft, fit, seam) → ProposedUnit   -- writes the fit and seam judgments onto the cut, AFTER both exist; the sole constructor of ProposedUnit, seam-grounded cuts and autonomous_pack's alike, so no cut enters a draft without both judgments on it
  → surface_draft(D)                   -- the whole draft goes out before the first cut is settled: every cut with its obligations, fit verdict and seam disposition, so the reader judges a shape rather than a fragment, AND the standing affordance to send any cut back, named on the surface where the cut is shown. Relay — it presents no fork, and the forks that follow are each read against what this made visible
  → [the draft holding no Heuristic cut, a cut whose fit = Fits and over whose obligations no alternative cut stands up to the same evidence: relay(AcceptUnit) (extension) | else: present(proposed_unit, the draft's still-unsettled cuts) (constitution)]  -- the draft gate condition over the whole, then the option-set relay test per cut, read live at this point; the alternative it weighs never entered the draft, which carries one cut per obligation
  → integrate(unit_judgment, U, residual) → (U', residual')   -- monotone in coverage: an obligation leaves residual only when it enters some unit; integrate_unit(ProposedUnit) → Unit is the only constructor Unit has, and assigns the accepted unit its fresh UnitRef in that same step
  → derive(unit) → (Set(κ), Set(ρ), Set(σ))    -- THE IRREDUCIBLE CORE, part two: per obligation of the unit, a verifiable predicate (completion or invariant), a residual, or a reservation; every obligation of the unit lands in at least one of the three sets, and Derive writes it to exactly one — that single placement is how this step reads the obligation, not a property obligation_derived proves, which asks only for membership; a misplacement shows at the confirmation gate like any other read here. The third is for an obligation no check could settle because a judgment settles it — read at THIS step over candidates arriving like any other, so it is fallible and correctable at the confirmation gate; it is not an out-of-scope delegation, which hands an obligation to a substrate that must intercept before an action runs
  → derive_plan(goal, U) → P           -- conditions whose subject is the whole goal, not any one unit; NOT distributed across units to fit the leaf type
  → confirm(unit_plan)                 -- user judges the apportionment together with its conditions
  → emit(goal_entries)                 -- one entry per unit; resolve_unit's single certificate — DeterminateResolution when a compiled COMPLETION condition exists, else AcceptedUncoveredResolution with a non-empty accepted-completion witness, else ReservedJudgmentResolution with a non-empty reserved-completion witness; either witnessed form still carries any compiled invariant conjuncts
  → package(E)                         -- constructs the whole returned plan from E's own coproduct partition, envelope included — a read-back of what was emitted, never a second derivation beside it
  → park_carrier(plan) → C             -- parks the packaged plan in ONE durable carrier record
  → record_handoff(C) → N              -- emits the fixed-shape navigation block a later session dereferences to read that carrier back
  → ConditionBearingUnitPlan
requires: user_initiated(G)            -- user declares autonomous execution intent via /apportion
requires: single_goal(G)               -- domain restriction: ONE stated outcome. Shared procedure is not a shared goal — the host's standing procedural contract attaches to any work there, so it can carry no seam and a bundle bound only by it relays at Phase 0 without activating
deficit:  GoalPlanUncompiled           -- activation precondition (Layer 1)
preserves: G                           -- compile-time only; ReadObligations constructs O_G without mutating the goal; no execution-state mutation
invariant: Apportion over Order        -- Merismos cuts the units and conditions them; it does not sequence them
invariant: Whole Draft over Serial Cut -- no cut is settled before the draft it belongs to has been surfaced whole. What the reader judges is a shape with its siblings beside it, never a fragment whose neighbours are still unwritten — an acceptance given without the rest in view is one a later cut can force back open
invariant: Coverage over Convenience   -- every goal obligation belongs to some unit or is visibly delegated out of scope — the two arms coverage_complete reads; what a unit leaves unguarded is a residual accepted at Confirm; a plan that omits one converges locally and lies globally
invariant: Fit over Ambition           -- every unit fits one execution horizon, or entered U through the user's OverrideFit over its verdict. Holds by construction of the Fit-indexed answer set Aᵤ: the accept option is AcceptUnit exactly when the fit is Fits and OverrideFit otherwise, and the relay arm and Sufficient integrate fitting cuts only, so no path admits an unfitting cut without that act — nothing records it beside the unit, and no check re-reads it
invariant: Declared Seam over Asserted Joint  -- every cut DECLARES its seam quality: the evidence it cites, or heuristic where the goal carries none. What is invariant is the declaration, never which quality gets declared — a cut may honestly be heuristic, but it never claims a natural joint it cannot evidence