A field guide to deliberate rewrites

Plan to compost at least three.

We built a market protocol twice before reaching for formal methods. That was not a detour. It was how the object became visible.

The first build mined possibility. The second extracted constraints. The third is turning those constraints into machine-reasonable semantics—and will probably deserve to be composted too.

Thesis

A prototype is not a smaller product. It is an instrument for discovering what the product is.

The usual advice is to plan to throw one away. But throwing away code discards only the implementation; it says nothing about what must survive. Compost is a better metaphor. The structure breaks down. The nutrients—requirements, invariants, counterexamples, measurements, vocabulary—return in a form the next system can actually use.

What could exist?

Mine the model’s latent design space. Give every ambition a body. Learn the language of the problem by building too much of it.

What must be true?

Reason against the whole, now-visible shape. Separate essential constraints from the accidental machinery that first revealed them.

What can a machine check?

Make the semantics executable, the interfaces structural, and the assurance boundary precise—without sanctifying the third prototype.

01 Mine

Dragon’s Clutch / the latent-space build

First, make the ghosts physical.

At the beginning, the design existed as ambition, analogy, and pressure in a series of prompts. The only way to argue with it was to give it mass.

The first Dragon’s Clutch tried to hold the whole thought at once: categorical claims, structured payoffs, direct trading, batch clearing, dealer liquidity, real oracle resolution, funding, recovery, replay, retirement, operators, and a user interface. A swarm pulled possibility out of language and made it compile.

This kind of first build is not architecture in the mature sense. It is excavation. The design is still haunted by “illusory ghosts”: requirements that sound necessary only because no complete system exists yet to contradict them. So we materialized the ghosts—roughly fifty protocol accounts, a cumulative 51-action namespace, many lifecycle families—and watched what they did.

The excess was productive. It revealed hard things that had been easy to blur in prose: collateral and liveness funding are different substances; resolution failure needs a real outcome; a state partition must be canonical before it can mint liabilities; a clearing candidate can be valid without being globally optimal; retirement and replay need an owner.

It also revealed accidental things: semantic separation had become separate rent-bearing accounts; the internal workflow graph had become the public protocol; old and successor authorities coexisted; mocks persisted after their questions were answered; project lanes became an archipelago.

Sometimes we just need to build a bad first version, before you can understand what I’m trying to say in my prompts.
Project conversation · 24 August 2026

Mined constraint

Collateral is physical

A liability is meaningful only when its backing, custody, and conservation rule are explicit.

Mined constraint

Meaning needs one owner

Duplicated account projections cannot become parallel authorities for the same persisted fact.

Mined warning

Validation can become theater

Rerunning evidence is not progress when known lifecycle gaps remain unimplemented.

Mined warning

Parallelism can become topology

Agent isolation is useful only until its seams start shaping the protocol itself.

02 Shape

dClutch / the constraint build

Rebuild from what refused to bend.

The second implementation did not begin from the old module tree. It began from the facts the old tree had made impossible to ignore.

The fresh repository was a change in conduct as much as code. Dragon’s Clutch became compost, not a compatibility target. The new universal core became small. Trading, clearing, liquidity, transferable claims, and resolution became optional capabilities. Direct signed trading became the ordinary path; sophisticated batch clearing became a venue rather than the ontology of every market.

Provider data stopped being a mock authority. Product became the single owner of its finite result domain, including the failure outcome. Funding became typed: collateral, rent, liveness, fees, reserves, and bounties could no longer borrow each other’s names or balances. A small terminal root could retain replay authority instead of an elaborate closing ritual recovering every lamport.

This is why a second build can be more intelligent than a refactor. We could now reason against the entire visible shape, compare it to other protocols, and distinguish an essential market invariant from the scar tissue of the first route that happened to implement it.

But the second build also became a new instrument. Rust const generics specialized widths, actions, codecs, and account frames into machine code. The semantics were cleaner; the artifact was not. A complete old-style monolith grew past ten megabytes when every supposedly implemented capability was finally made reachable.

Our protocol seems shaped kinda weird right now. I wonder if we did folly.
Project conversation · 24 August 2026

Architecture diagnostic / integrated Rust monolith Not a release

10.93 MBAfter making Structured actually reachable through the public entrypoint.

Binary size was not an optimization footnote. It was the ontology leaving a footprint.

The dominant cause was repeated N=2…16 monomorphization across General, Dealer, Structured, Bearer, and Position machinery—not debug information and not one unusually bad function.

The second system found the next true constraint: put what varies in data; keep only universal invariants in code.

03 Prove

The formal turn / a semantic specializer

Make meaning executable.

The third build starts over again—this time with better instruments and fewer excuses.

The promising architecture is not “write the same protocol in Lean,” and it is not “have Lean print a great deal of Rust.” Either could reproduce the same forest more ceremonially. The semantic source should instead emit compact canonical data: typed schemas, transition bytecode, certificates, builders, hostile vectors, and proof obligations.

A small fixed-memory interpreter can execute the variable part. Small physical adapters can own the irreducibly Solana-shaped parts: signatures, account memory, token custody, provider calls, and CPI postconditions. Translation validation can compare the generated semantics to the safe-Rust interpreter and then pin the exact SBF artifact path.

This is “ABI via data structures” with consequences. The account frame stops being forty handwritten positional beliefs. A market transition stops being one more action number. Product widths stop multiplying the binary. The same semantic object can drive the onchain checker, operator, interface, documentation, tests, and machine proofs.

And the third attempt is still a prototype. Formal technology does not make an immature language good, a narrow theorem broad, or an adapter trustworthy. It lets us name the claim, its digest, its assumptions, and the boundary where ordinary engineering resumes. That is higher assurance—not absolution.

Semantic side

Meaning as data

Lean-owned economic transitions, canonical bytecode, typed schemas, boundedness and conservation certificates.

Physical side

Small machines

One reusable safe-Rust interpreter plus narrow claims, custody, resolution, and runtime adapters.

Assurance boundary, stated honestly

The current work is a proof-producing successor architecture, not a claim that dClutch is formally verified. Individual theorems cover named semantic transitions and generated artifacts. Rust decoding, the interpreter, compiler path, SBF runtime, Solana, CPI programs, and operational deployment remain separately measured or explicitly trusted until each connection is established.

Plan to throw one away.
Plan to compost at least three.

“Three” is not a magic number or a release plan. It is permission to stop defending an implementation merely because it taught us something expensive.

The compost ledger

Compost is selective continuity. Keep the knowledge that survived contact with reality. Let the machinery that merely carried it lose its privileged place.

Public shape Bury: cumulative action numbers Save: the user-visible operations and lifecycle promises they were trying to express.

Authority Bury: parallel DTO truths Save: one semantic owner, plus authenticated projections that are allowed to be wrong.

Infrastructure Bury: mock sources as destinations Save: reproducible fixtures, real provider boundaries, and the refusal cases they exposed.

Implementation Bury: width × action code forests Save: exact integer kernels, effect vocabulary, measurements, and adversarial vectors.

Process Bury: the agent archipelago Save: bounded parallel inquiry converging through one semantic source and one canonical workstream.

History Retain: every contradiction The commit graph and conversations are part of the research record, not debris to be squashed away.

A repeatable development loop

Build until the medium argues back.

01Prompt

02Swarm

03Execute

04Contradict

05Name constraints

06Compost

07Rebuild

Breadth is for discovery.

Swarm widely enough to force interactions into the open. Then converge at semantic interfaces before the temporary work graph becomes product architecture.

Evidence must change a decision.

A build, benchmark, test, or proof earns its place by closing uncertainty. Repetition without an implementation decision is validation theater.

No generation is sacred.

A formal prototype can be wrong in more disciplined ways. Its artifacts should make the fourth build easier—not make the third impossible to question.

What the builds actually bought us.

The numbers are not victory banners. They are traces of learning. Each measurement is paired with the limitation that keeps it honest.

Named actions

The first architecture made its internal workflow graph public.

Useful semantic inventory

10.93 MB

Integrated monolith

The second architecture made product width and capability breadth into repeated machine code.

Negative evidence, not a release

107,752 B

Three-program slice

Controller, claims executor, and custody adapter executed one real signed Direct fill.

Architecture proof, not parity

1 source

Semantic narrow waist

Typed schemas and transition programs begin replacing repeated ABI beliefs.

Still crossing trust boundaries

The project is not the current tree

Keep the learning. Release the form.

A protocol becomes legible by surviving implementations that are allowed to die. The ambition is continuous. The code is seasonal.

On 25 August, the dClutch history was grafted back beneath Dragon’s Clutch as a subtree. The compost and its successor now share a literal history without pretending they share one architecture. That feels about right.