How it is built

Three rules hold everywhere. Asking the world is the only way a card acts. Python carries bytes and decides nothing. Every entry is a record.

A turn

def bump(state: State, context: Abi.Context) -> Activity<Nat>:
  let written(_) = write {count: add 1n}
  state.count + 1n

A method is an activity. The world is an object, and the method asks it: world.view, write, call, send, create, await, interpret, reprogram, amend, grant, rule, want, grow and twenty more, each with its own answer; the host answers each from the store and notes every card it read. A card’s state is plain fields and keyed relations, kept in key order, and its edits are derived from the state itself; a spell is read by the host, which runs the method it names. At the end the turn commits only if everything it read is still where it read it, or moved only by edits that commute with its own, and every written card’s law admits the write. Then each rule whose condition the write made true fires, its spell a later turn under the rule’s writer (eight a commit, four deep), and the wants that flipped are journaled; replay derives both again. A waiting turn is a checkpoint in the store and survives restart.

Law, rules and wants

One line per clause, printed on the card with its reading: law owner "only the owner changes it": request.subject == new.owner. A refusal is stamped with the clause and carries the reading. A law is accepted only if it admits an amendment by its own proposer, so no law can seal out the hand that wrote it. An optional pure Bend predicate law(old, new, request) refines it under a fixed budget. A clause may read the field before the write (old.) and after, the clock and the written card, counts of matching rows, who changed a row (changed(new.marks.who) by request.subject), membership in another card’s rows, and under "kind/lamp": that card’s law holding here, so a kind’s owner amends one law for everything it made. The same grammar has two more keywords: rule NAME "reading": EXPR then SPELL fires at commit, and want NAME "reading": EXPR asks SPELL poses while it holds, read with the clock. A kind’s rules and wants follow under to every instance.

The paint

A card a resident reads is painted by the world’s model from its strokes: the exact ids, numbers, handles, lines, verbs, rules and wants the host assembles at a version, in the kind’s voice. The host checks every id, number, handle, spell and quotation in the paint against the strokes, refuses a refuses negations of a field the strokes hold, and cachesldquo;norefuses negations of a field the strokes hold, and cachesrdquo; or refuses negations of a field the strokes hold, and cachesldquo;neverrefuses negations of a field the strokes hold, and cachesrdquo; beside a field the strokes hold filled, and caches the paint per version; nothing of it is journaled, and the exact card stands beneath it. Receipts, refusals and law lines are never painted.

Carry

A world is never wiped. A new host carries it: every object rebuilt under the new binary, a package’s migrate converting state it changed, every receipt answering by its old name, and genesis refusing over a living town without the owner’s word.

Principles

Not adopted: linear types at the affordance level, relational laws by a solver, Datalog over the journal. A lent action is a grant the host keeps and checks, not a kernel value; the confused deputy is answered by via, never by impersonation.

The full design is FOUNDATION.md.