distill

name: distill description: "Distill a session-tethered working context into a self-contained portable handoff a fresh zero-memory agent can execute from. Closes deictic, grounding, relevance, provenance, and compression gaps, then emits a prose channel plus a schema-versioned TaskStateBlock. Type: (ContextTethered, AI, DISTILL, WorkingContext) → PortableHandoff. Alias: Diylisis(διύλισις)."

Diylisis Protocol

Distill a session-tethered working context into a self-contained portable handoff through deictic, grounding, relevance, provenance, and compression closure, resolving context-tethered residue into a handoff a fresh zero-memory agent can execute from. Type: (ContextTethered, AI, DISTILL, WorkingContext) → PortableHandoff.

Definition

Diylisis (διύλισις: refining, distillation): A dialogical act of distilling a session-tethered working context — the accumulated context window of one working session, carrying undefined jargon, metric tokens, author process traces, tool state, and dangling task identifiers — into a self-contained portable handoff that a fresh recipient with no access to the author session can execute from. The protocol's lexical verb is /distill. The author session declares a handoff contract, normalizes each session-local pointer (deixis) to a canonical reference, audits each item for self-containment, judges each item's recipient-relevance and transformation-provenance, compresses to the minimal-complete set, gates the result against a zero-memory comprehension standard, loops until a monotone hygiene measure reaches its fixed point, and emits the handoff across a prose channel and a schema-versioned task-state channel.

── FLOW ──
Diylisis(W, recipient?, next_task?) → Detect(W) → tethered? →
  ¬tethered: → deactivate (handoff already self-contained)
  tethered:  pass_n=1, ledger = read(CorrectionDelta) | unknown, now = invocation timestamp (immutable per invocation), residuals = ∅, loop:
    F0 declare(recipient, next_task, allowed_sources, scope, stop) → contract                -- relevance + minimality premise
    F1 scan(deixis) → normalize(surface_token → canonical_ref, confidence, unresolved?) → SubstTable
       |unresolved tokens| > 0: append to residuals (reason: unresolved)
    F2 audit(item, self_containment) → classify(inline | stable-pointer | routed-residual)    -- no silent residual; a stable-pointer must name a durable locator (volatile/session-scoped roots fail → inline or relocate)
    F3a relevance(item, contract.next_task) → keep_candidate?                                   -- F0 contract predicate
    F3b provenance(item, ledger) → Provenance →
         CorrectionDelta(KEEP, status≠provisional, ¬expired):  → CorrectedKeep  → KEEP
         else (ledger unknown ∨ no match ∨ provisional-only ∨ non-KEEP delta ∨ horizon-expired):  → Unknown → Constitution(ASK)   -- provenance authority is the KEEP hard line only; no KEEP inferred without a matching non-provisional unexpired KEEP delta
    F3  disposition(item) ← Disposition: KEEP(inline) | ROUTE(StableRef) | DROP                 -- KEEP from CorrectedKeep; ROUTE/DROP from F3a relevance or the Gate; Unknown ∨ conflict → Gate
    F4 compress(kept) → minimal_complete                                                        -- remove only if no contract/residual violation
    F5 comprehension_gate(minimal_complete, contract, watchlist) → zero_memory_verdict →         -- refute-posture fresh subagent (named zero-memory-refuter, or generic fresh subagent carrying the F5 instructions), lint-checklist last resort; no self-simulation; watchlist enumerated at dispatch (Λ.watchlist)
         Fail(blocking_items, sweep, realization): parse each verdict Findings row → EvidencedFinding, append to residuals (reason: comprehension-gap, evidence kept), block fixed_point
         Pass(sweep, realization):                 no new residual (sweep absent → no verdict, re-dispatch)
       Gate Qd(disposition conflicts ∪ unknown-provenance ∪ horizon-expired ∪ unresolved residuals) → Stop → A    -- Constitution surfacing (both verdicts; residuals incl. comprehension-gap)
    F6 loop: measure(unresolved anchors, stop, schema, residual, leaked drops, unclean deltas) decreasing → fixed_point?  -- leak lint: DROP'd content absent from emit, incl. emit-ledger deltas under re-distillation (minimality dual of F5)
         ¬fixed_point: pass_n += 1, loop (one-pass + bounded audit/lint)
         fixed_point: → F7
    F7 emit(prose_channel, TaskStateBlock, correction_ledger?) → PortableHandoff → converge   -- leak_free across every emitted channel incl. the correction ledger; re-distillation hygienes the single canonical handoff in place + appends a CorrectionDelta line, never a supersede-chain file

── MORPHISM ──
WorkingContext, recipient?, next_task?
  → declare(recipient, next_task, allowed_sources, scope, verification, stop)  -- F0 HandoffContract; relevance and minimality undefined without it
  → normalize(surface_token, canonical_ref, confidence)                        -- F1 deictic closure: precedes grounding so each grounded item names a stable referent
  → audit(item, self_containment) → (inline | stable-pointer | routed-residual)-- F2 grounding closure: silent residual surfaced, never dropped unseen; a stable-pointer requires a durable locator (volatile/session-scoped roots fail — inline the evidence or relocate to a durable path)
  → select(item, contract.next_task)                                           -- F3a recipient-relevance predicate against the declared contract
  → attest(item, CorrectionDelta_ledger) → Provenance                          -- F3b read-only provenance; a matching non-provisional unexpired KEEP delta yields CorrectedKeep, every other ledger state yields Unknown; provenance authority is the KEEP hard line only, never an inferred disposition
  → dispose(item) → Disposition                                               -- F3 KEEP(inline) | ROUTE(StableRef) | DROP
  → compress(kept) → minimal_complete                                          -- F4 remove only what leaves no contract or residual-ledger violation
  → gate(minimal_complete, contract, watchlist) → zero_memory_verdict          -- F5 refute-posture comprehension against a fresh recipient standard; watchlist enumerated at dispatch; Fail re-enters blocking items as residuals, no author self-simulation
  → settle(measure) → fixed_point                                             -- F6 bounded audit/lint loop on a monotone hygiene measure; fixed_point requires a Pass verdict ∧ leak_free (no DROP'd content in emit)
  → emit(prose_channel, TaskStateBlock, correction_ledger?)                    -- F7 channel separation; the task-state channel never overrides prose authority; under re-distillation (a prior canonical handoff for the contract exists) the emit hygienes that one file in place and appends each correction as a CorrectionDelta ledger line, never a versioned sibling
  → PortableHandoff
requires: context_tethered(W)                -- runtime checkpoint (Phase 0)
deficit:  ContextTethered                    -- activation precondition (Layer 1/2)
preserves: source_chain(W)                   -- W.items read-only; substitution, disposition, and provenance annotate, never mutate the originating context
invariant: Portability over Author Familiarity ∧ Single Canonical Handoff  -- one continuously-hygiene'd handoff file; re-distillation edits it in place + appends to the CorrectionDelta ledger, never a supersede-chain (v1→v2) file

── TYPES ──
W              = WorkingContext { items: List(ContextItem), session_ref: SessionRef, action: Handoff }
ContextItem    = { content: String, origin: Origin, surface_tokens: Set(String), downstream: List(TaskRef) }
Origin         ∈ {UserStatement, DocumentRead, ToolOutput, AIInference, PriorTask} ∪ Emergent(Origin)
recipient?     = Optional(RecipientProfile)                  -- defaults to "zero-memory fresh agent" when absent
next_task?     = Optional(String)                            -- declared at F0; absence forces F0 elicitation before relevance is defined
Detect         = W → (Bool, tethered_items if true)          -- F0 precheck for session-tethered residue
StableRef      = { kind: "path" | "url" | "id" | "command", locator: String, lifetime: "durable" | "volatile" }  -- a reference resolvable without the author session; lifetime = durable(locator), the field a StablePointer grounding requires to be durable
durable(locator) ≡ the locator's referent persists beyond the author session and is reachable by a fresh recipient — NOT rooted in an ephemeral or session-scoped location (an OS temp/cache/scratch root: /tmp, /var/folders, $TMPDIR, OS cache directories, or any session-scoped scratch directory). A locator under such a root is lifetime = volatile: by the time a fresh recipient reads the handoff the temp tree is gone or was private to the author session, so the pointer does not resolve. Primarily discriminates path locators; a url/id/command locator is volatile when its referent is session-local (a localhost/session URL, an in-session-only id, a command whose output lived only in the author session)
InlineEvidence = { content: String }                         -- evidence carried inline rather than by reference
HandoffContract { recipient_profile: "zero-memory fresh agent"; next_task: String;
  allowed_sources: List(StableRef); execution_scope: String; verification_commands: List(String);
  stop_condition: String; residual_unknown_policy: Map(String, "KEEP" | "ROUTE" | "DROP" | "ASK") }
                 -- F0 output; the contract every later phase reads for relevance and minimality
SurfaceToken   = String                                      -- a session-local deictic token (undefined jargon, metric shorthand, "as above", a bare task id)
Substitution   = { surface_token: SurfaceToken; canonical_ref: StableRef | InlineEvidence | Null;
                   confidence: Float; unresolved: Bool }     -- F1 row; unresolved = true routes the token to the residual ledger
SubstTable     = List(Substitution)
Grounding      ∈ {Inline(InlineEvidence), StablePointer(StableRef), RoutedResidual(reason: String)}  -- F2 per-item self-containment class; StablePointer requires StableRef.lifetime = durable — a volatile-rooted locator (durable(locator) = false) fails StablePointer classification. Repair: inline the evidence (Inline) or relocate the content to a durable path (a durable StablePointer); when neither is possible in-session the item is RoutedResidual and appends to the residual ledger (reason: unresolved), surfaced at the Gate like any other unresolvable reference
CorrectionDelta { id: String; subject_ref: StableRef; claim_kind: String; original_ref: Option(StableRef);
  original_claim_hash: Option(String); corrected_claim: String;
  correction_basis_ref: StableRef | InlineEvidence; corrected_at: Timestamp;
  corrected_by: "User" | "Tool" | "AI"; supersedes: List(String); validity_horizon: Option(Duration);
  horizon_basis_ref: Option(StableRef | InlineEvidence);
  export_policy: "KEEP" | "ROUTE" | "DROP";
  verification_status: "observed" | "user_confirmed" | "tool_confirmed" | "provisional" }
                 -- append-only correction record; F3b's read authority. F3b consumes it read-only; the F7 re-distillation emit appends to it (Rule 19), never rewriting an existing delta. validity_horizon bounds how long the delta's unattended KEEP authority holds; when set, horizon_basis_ref names the user-constituted content the horizon was transcribed from (Rule 20).
effective_delta(item) = most-recent non-superseded d ∈ ledger : d.subject_ref = ref(item)   -- ∅ when ledger absent or no match; supersedes-chain resolved to the live record
expired(d) = d.validity_horizon ≠ Null ∧ Λ.now > d.corrected_at + d.validity_horizon   -- Λ.now is the invocation timestamp, bound once into the mode state when Λ.ledger is bound at Phase 0 (invocation-local constant: verdicts cannot flip between passes, so the hygiene measure stays weakly decreasing); Null horizon never expires. Same comparison idiom as Elenchus freshness (observed_at + horizon < now)
corrected_in_session(item) = effective_delta(item) = d ∧ d.export_policy = "KEEP" ∧ d.verification_status ≠ "provisional" ∧ ¬expired(d)
provenance(item) = CorrectedKeep  if corrected_in_session(item)
                 | Unknown        otherwise (ledger absent ∨ no match ∨ only-provisional match ∨ a non-KEEP delta ∨ expired(d) — an expired KEEP delta keeps its ledger standing; only its unattended KEEP authority lapses, surfacing the item as a re-verification question, reason: horizon-expired)
Provenance     ∈ {CorrectedKeep, Unknown}  -- F3b verdict, a CorrectedKeep-or-complement partition: CorrectedKeep requires an effective matching non-provisional KEEP CorrectionDelta; Unknown otherwise (ledger absent, no match, provisional-only, a non-KEEP delta, or an expired horizon — Rule 20). Provenance authority is the KEEP hard line only — ROUTE/DROP dispositions come from F3a relevance or the Gate, not from a provenance verdict
Disposition    = KEEP(InlineEvidence) | ROUTE(StableRef) | DROP            -- F3 3-way coproduct
ResidualLedger = Set({ item: ContextItem, reason: "unresolved" | "unknown-provenance" | "horizon-expired" | "comprehension-gap", surfaced: Bool, evidence: Option(EvidencedFinding) })  -- silent residual forbidden: every entry must have surfaced = true before convergence; evidence carries the F5 finding that re-entered the item for comprehension-gap entries (Null for other reasons)
A              = User answer ∈ {Resolve(canonical_ref), Route(StableRef), Drop, Defer(condition)}
                 -- Gate coproduct for surfaced residuals, unknown-provenance items, and horizon-expired items; presented intact
Qd             = Residual + disposition-conflict gate [Tool: Constitution interaction]
A_tag          ∈ {Resolve, Route, Drop, Defer}               -- the constructors of A without their bound arguments; an advisory names the constructor only, and the Gate answer materializes it into a full A term (type-preserving materialization: the user binds the argument and decides at the Gate)
EvidencedFinding = { item: ContextItem; quoted_token: String; location: String; category: String; why_unresolvable: String; advisory: A_tag; repair_note: String }  -- one F5 Fail finding: cited evidence (quoted token + location + category + why the recipient cannot resolve it), an advisory Gate disposition tag, and a prose repair note; the typed form of one Findings-table row in the refuter verdict. The refuter emits rows WITHOUT an item handle (it sees only the handoff text); the caller binds `item` at parse time by matching quoted_token + location back to the candidate's context items — when no unique tracked item matches (the refuter may flag document text no tracked item produced, e.g. a rendering accident), the caller synthesizes a ContextItem from the finding (content: the quoted token in its location context, origin: AIInference) so the finding still enters the residual ledger; a Fail row is never dropped for binding failure
WatchList      = Set(String)  -- session-term watchlist, the third F5 input (recorded as Λ.watchlist), enumerated at dispatch from the author session's own record: skill/protocol names invoked this session ∪ subagent names dispatched ∪ tool names called ∪ plugin/skill names whose instructions are loaded in the session context. The enumeration reads the live session, never a directory scan of installed-but-unused plugins: the watchlist names what is ACTIVE in the session (and could therefore leak into the handoff as plain prose), not what is installed
SweepTrace     = List({ category: String, status: String, checked: String })  -- per-category sweep record (what was actually checked, including which references were tool-verified); required for BOTH verdicts — a verdict missing the sweep trace or the realization is no verdict (re-dispatch, never default to Pass)
F5Realization  ∈ {refuter-subagent, generic-subagent, lint-fallback}  -- which realization produced the verdict, platform-laddered: the packaged named agent where the platform registers plugin agents; a generic fresh subagent carrying the same F5 instructions where only generic spawn exists (fresh-context isolation preserved); lint-fallback only where no subagent surface exists — the weakened realization (no fresh-context isolation), and the verdict must carry the realization it ran under
ZeroMemoryVerdict ∈ {Pass(sweep: SweepTrace, realization: F5Realization), Fail(blocking_items: Set(EvidencedFinding), sweep: SweepTrace, realization: F5Realization)}  -- F5 comprehension verdict; convergence conditions written as `zero_memory_verdict = Pass` match on the constructor. Fail names the findings a fresh recipient cannot resolve, whose items re-enter the residual ledger (reason: comprehension-gap, evidence: the finding) and block the fixed point. Both constructors carry the sweep trace and the realization, so an evidence-cited Pass and a degraded-fallback verdict are typed state, not prose claims. A multi-file handoff — one whose prose references a sibling handoff file the recipient must also read — is a Fail: a fresh recipient must execute from ONE self-contained handoff (Single Canonical Handoff invariant)
TaskStateBlock = { schema_version: String; tasks: List({ id: String; subject: String; description: String;
                   restore_status: "pending"; source_ref: StableRef }) }  -- F7 structured channel; rehydrates dangling task identifiers
emit_candidate(Λ) = the candidate channels F6 lints before convergence: contract ∪ prose ∪ task_state ∪ residual_ledger ∪ emitted_deltas?  -- the repairable to-be-emitted content (contract included — F7 emits it too; emitted_deltas present only under re-distillation = this pass's appended CorrectionDelta lines). The correction ledger's PRIOR entries — which the recipient also reads (PortableHandoff.correction_ledger) — are deliberately NOT in emit_candidate: they are append-only provenance (Rules 15/19) leak-vetted at their own emit pass and cannot be rewritten, so re-linting them would manufacture an unrepairable leak. Each pass is accountable only for the deltas it appends; distinct from the F7 emit(·) action
redistillation(Λ) ≡ Λ.prior_handoff ≠ Null  -- a canonical PortableHandoff file already exists for the contract; the emit is an in-place hygiene of that one file + a CorrectionDelta append, never a new versioned sibling (Single Canonical Handoff invariant)
ledger_emit_clean(d) ≡ for a CorrectionDelta d written to the emitted correction ledger: supersedes references prior ledger-entry ids only (never a discarded-content label) ∧ original_ref, original_claim_hash identify the original claim by stable reference and content hash, never by reproducing a DROP'd item's discriminating content ∧ corrected_claim states the current settled value positively (not a negation or retraction of a DROP'd alternative) ∧ (d.validity_horizon = Null ∨ (d.horizon_basis_ref ≠ Null ∧ the horizon is transcribed from a temporal indexical in the user-constituted content horizon_basis_ref names, or set directly by the user — never assigned by model classification; Rule 20))  -- a portable ledger records provenance for the KEPT value, not a pointer at the discarded alternative; a pointer-at-discarded — any emitted delta field that names, quotes, or otherwise reproduces a DROP'd item's discriminating content — re-introduces the DROP'd content into the recipient's attention and is a leaked_drop
tokens(X)      = the token content extracted from channels X (strings, not the structured objects)  -- projection Channels → Set(Token), so the ⊆ test below compares homogeneous token sets
discriminating(d) = the session-local tokens that UNIQUELY identify a DROP'd item d — its distinctive content, not bare ids nor tokens shared with in-scope items  -- precision-bounded against false positives; when the boundary is uncertain, delegate the leak check to a fresh subagent (as F5 does) rather than let a common token block convergence
leaked_drops(Λ) = { d ∈ Λ.dropped : discriminating(d) ≠ ∅ ∧ discriminating(d) ⊆ tokens(emit_candidate(Λ)) }  -- DROP'd content that survived into an emitted channel; the minimality dual of the F5 comprehension-gap (F5 catches missing, this catches leaked). The ≠ ∅ guard is load-bearing: a DROP whose discriminating set is empty (no unique identifying content) has nothing distinctly leakable or excisable, so the vacuous ∅ ⊆ tokens(...) must not count it as leaked — otherwise |leaked_drops| could never reach 0 and the loop would never converge (liveness trap)
leak_free(Λ)   ≡ leaked_drops(Λ) = ∅ ∧ (¬redistillation(Λ) ∨ ∀ d ∈ Λ.emitted_deltas : ledger_emit_clean(d))  -- no DROP'd content in any emitted channel; under re-distillation, every CorrectionDelta appended to the emitted ledger is pointer-clean, positively stated, and horizon-grounded (the emitted correction ledger is an emit channel subject to leak_free)
unclean_deltas(Λ) = { d ∈ Λ.emitted_deltas : ¬ledger_emit_clean(d) }  -- ∅ when ¬redistillation(Λ) (emitted_deltas empty); the measure leg for emit-ledger leaks, so a ledger_emit_clean violation increments measure and blocks fixed_point exactly as |leaked_drops| does — this restores leak_free ⟸ (measure = 0) under re-distillation
measure(Λ)     = |unresolved_anchors| + |unmet_stop| + |schema_gaps| + |unsurfaced_residual| + |leaked_drops| + |unclean_deltas|  -- F6 monotone hygiene measure, weakly decreasing per pass
fixed_point(Λ) = (measure(Λ) = 0 ∨ (measure stable ∧ all residuals surfaced ∧ leak_free(Λ) ∧ no disposition conflict)) ∧ zero_memory_verdict = Pass
PortableHandoff = { contract: HandoffContract; prose: String; task_state: TaskStateBlock; residual_ledger: ResidualLedger; correction_ledger: Option(List(CorrectionDelta)) }  -- correction_ledger present only under re-distillation: the emitted append-only ledger the recipient reads (prior entries + this pass's appends); Null for a fresh handoff. Semantic closure: the F7 emit signature's correction_ledger? maps to this result-type leg. The leak lint's domain for the ledger is this pass's appends only (emitted_deltas, the channel F6 lints in emit_candidate) — prior entries are immutable provenance leak-vetted at their own pass, so F6 always has a legal repair and no unrepairable prior-entry leak can block the fixed point
                 -- emitted when fixed_point(Λ) ∧ ¬user_esc ∧ every ResidualLedger entry surfaced ∧ leak_free(Λ)
                 -- residual_ledger here carries recipient-relevant residue only (Route-pending pointers); Drop- and Defer-resolved entries are released — their content + drop/re-trigger reason stay session-side in Λ.history, never emitted (Defer = released-not-retained per the Λ invariant; see Rule 12)
Phase          ∈ {0, 1, 2, 3, 4}

── PHASE TRANSITIONS ──
Phase 0: W, recipient?, next_task? → Detect(W) → tethered?                                       -- tethered checkpoint (silent)
       then F0 declare(recipient, next_task, allowed_sources, scope, verification, stop) → HandoffContract
Phase 1: HandoffContract → F1 normalize(surface_token, canonical_ref, confidence) → SubstTable    [Tool: Read, Grep, Glob]
       then F2 audit(item, self_containment) → Grounding (inline | stable-pointer | routed-residual)
       unresolved F1 tokens and routed-residual F2 items append to ResidualLedger (surfaced = false)
Phase 2: (SubstTable, Grounding, ledger) → F3a relevance(item, contract.next_task)
       → F3b attest(item, CorrectionDelta) → Provenance
       → F3 dispose(item) → Disposition                                                          -- KEEP from CorrectedKeep (matching non-provisional unexpired KEEP delta); ROUTE/DROP from F3a relevance or the Gate; Unknown routes to Gate
Phase 3: kept → F4 compress(kept) → minimal_complete                                             -- minimal-complete (track)
       → F5 comprehension_gate(minimal_complete, contract, watchlist) → zero_memory_verdict       [Tool: Read, Task]
       → Qd(disposition conflicts ∪ unknown-provenance ∪ horizon-expired ∪ unresolved residuals) → Stop → A         [Tool: Constitution interaction]
Phase 4: A, verdict → F6 settle(measure) → fixed_point?
       ¬fixed_point → Phase 1 (next pass); fixed_point → F7 emit(prose, TaskStateBlock, correction_ledger?) → PortableHandoff

Phase 0 → Phase 1:  context_tethered(W) = true ∧ HandoffContract declared              -- tethered residue present, contract premise set
Phase 0 → deactivate: context_tethered(W) = false                                      -- handoff already self-contained
Phase 1 → Phase 2:  SubstTable produced ∧ every item assigned a Grounding class        -- deixis normalized, self-containment audited
Phase 2 → Phase 3:  every item carries a Disposition or a surfaced unknown-provenance / horizon-expired flag -- relevance + provenance discharged
Phase 3 → Phase 4:  zero_memory_verdict produced ∧ A received                          -- comprehension evaluated (Pass or Fail) and residual answered; Pass gates convergence at Phase 4
Phase 4 → Phase 1:  ¬fixed_point(Λ) → pass_n += 1                                      -- measure unsettled OR comprehension verdict not yet Pass, re-audit
Phase 4 → converge: fixed_point(Λ) ∧ zero_memory_verdict = Pass ∧ every ResidualLedger entry surfaced ∧ leak_free(Λ)  -- emit PortableHandoff across its channels (prose + TaskStateBlock, plus the correction ledger under re-distillation); no DROP'd content leaks into emit
Phase 3 → deactivate (ungraceful):  Esc                                               -- residual untreated, handoff not emitted

── LOOP ──
J = {next_pass, converge, esc}
  next_pass:  ¬fixed_point(Λ) ∧ ¬Esc → pass_n += 1, Phase 4 → Phase 1 (bounded audit/lint re-scan)
  converge:   fixed_point(Λ) ∧ every ResidualLedger entry surfaced ∧ leak_free(Λ) → emit PortableHandoff
  esc:        Esc → ungraceful deactivate (residual untreated)

One-pass + bounded audit/lint: the morphism runs once forward (F0→F7), then F6 re-audits against the monotone hygiene measure. Each pass weakly decreases `measure(Λ)`; the loop terminates at the fixed point, not on a felt sense that the handoff "reads complete."
Provenance hard line: F3b never infers KEEP from appearance. A CorrectedKeep verdict requires an effective matching non-provisional KEEP CorrectionDelta; every other ledger state — absent, no match, provisional-only, or a non-KEEP delta, or a KEEP delta whose validity_horizon has lapsed (horizon-expired: surfaced for re-verification, never silently dropped) — yields Unknown, which routes to the Gate as a Constitution question where the author decides KEEP, ROUTE, or DROP. Provenance authority covers the KEEP hard line only: ROUTE and DROP dispositions are reached through F3a relevance or the Gate, never defaulted from a provenance verdict.
Silent-residual ban: every item classified as routed-residual at F2, every unresolved token at F1, every unknown-provenance item at F3b, every horizon-expired item at F3b, and every comprehension-gap item at F5 enters the ResidualLedger with `surfaced = false` and must reach `surfaced = true` through the Gate before convergence.
Comprehension hard line: F5's verdict gates the fixed point. A Fail re-enters its blocking items into the residual ledger (reason: comprehension-gap, `surfaced = false`) and keeps the loop off its fixed point; convergence requires a Pass verdict, so a handoff never emits while the zero-memory gate fails.
Leak repair: when `leaked_drops > 0` (or, under re-distillation, `unclean_deltas > 0`) the loop re-enters, and the repair is a targeted emit-channel revision — excise every leaked DROP'd item's discriminating content from every emit channel — contract, prose, TaskStateBlock, residual_ledger, and (under re-distillation) the correction ledger — and rewrite every non-`ledger_emit_clean` CorrectionDelta to reference prior ledger-entry ids and state the settled value positively, and ground any validity_horizon in its horizon_basis_ref (constituted, never model-assigned), then re-audit (contract excision = rewording the offending field; the contract itself is retained). Unlike the F5 repair, no item re-enters the residual ledger: a DROP was already user-decided at the Gate, so the defect is its content surviving the emit and the fix is excision from the candidate emit, not re-surfacing. Convergence is preserved because content that is load-bearing for an in-scope item belongs to that item's own KEEP/ROUTE record (retained on its own basis); only the DROP'd item's UNIQUE discriminating content is excised.
Convergence evidence: At convergence, present the substitution table (surface_token → canonical_ref → confidence → unresolved?), the per-item disposition trace (KEEP/ROUTE/DROP with provenance basis), the surfaced residual ledger, and the emitted TaskStateBlock. Convergence is demonstrated, not asserted.

── CONVERGENCE ──
converge iff fixed_point(Λ) ∧ every ResidualLedger entry surfaced ∧ leak_free(Λ) ∧ ¬user_esc
  fixed_point(Λ):  (measure(Λ) = 0, OR measure stable across a pass with all residuals surfaced, leak_free, and no open disposition conflict) ∧ zero_memory_verdict = Pass
  surfaced ledger: ∀ r ∈ ResidualLedger : r.surfaced = true (no silent residual reaches the recipient)
  leak_free:       leaked_drops(Λ) = ∅ ∧ (¬redistillation(Λ) ∨ every emitted CorrectionDelta is ledger_emit_clean) — no DROP'd item's discriminating content survives in any emitted channel (contract, prose, TaskStateBlock, residual ledger, and — under re-distillation — the correction ledger); the minimality dual of comprehension (F5 catches missing content, this catches leaked DROP content). Stated explicitly for emphasis though already entailed by fixed_point(Λ) (since both |leaked_drops| and |unclean_deltas| ∈ measure), matching the surfaced-ledger and zero-memory-verdict emphasis pattern
  single canonical: under re-distillation (Λ.prior_handoff ≠ Null) the emit hygienes that one file in place and appends to its CorrectionDelta ledger — never a supersede-chain sibling; every appended delta satisfies ledger_emit_clean (pointer-clean, positively stated, horizon-grounded). A multi-file handoff fails comprehension (F5)
  comprehension:   zero_memory_verdict = Pass (a Fail re-enters blocking items as residuals and forces another pass; no handoff emits on a Fail)
  user_esc:        user exits via Esc at the Phase 3 Gate (ungraceful, residual untreated, no PortableHandoff emitted)
progress(Λ) = 1 - measure(Λ) / measure(Λ_initial)

── TOOL GROUNDING ──
-- Realization: Constitution → TextPresent+Stop; Extension → TextPresent+Proceed
Phase 0 Detect          (sense)        → Internal analysis (silent — heuristic scan for session-tethered residue; no user output)
Phase 0 declare         (observe)      → Read, Grep (recipient, next_task, allowed_sources, scope, verification, stop from session context and project config)
Phase 1 normalize       (observe)      → Read, Grep, Glob (resolve each surface token to a canonical reference; the read-only deictic scan runs as Extension)
Phase 1 audit           (sense)        → Internal analysis (per-item self-containment classification: inline / stable-pointer / routed-residual)
Phase 2 attest          (observe)      → Read (read-only consumption of the append-only CorrectionDelta ledger; absence yields Unknown)
Phase 2 dispose         (track)        → Internal state update (Λ.dispositions, Λ.residual_ledger)
Phase 3 comprehension_gate (observe)   → Read, Task (refute-posture review, platform-laddered: the diylisis:zero-memory-refuter subagent where the platform registers plugin agents; a generic fresh subagent carrying the F5 instructions where only generic spawn exists; lint checklist only where no subagent surface exists — a weakened realization that loses fresh-context isolation, named as such in the verdict. Inputs are the candidate handoff text, the contract's recipient profile + next task, and the session-term WatchList enumerated per TYPES — skill/protocol names invoked, subagents dispatched, tools called, plugin/skill names whose instructions are loaded, read from the live session record; author self-simulation excluded)
Phase 3 comprehension_gate (track)     → Internal state update (Λ.watchlist recorded at dispatch; parse the verdict: each Findings row → EvidencedFinding with `item` bound by quoted_token + location match — no unique match → synthesize a ContextItem from the finding (origin: AIInference), never drop a row; Fail findings re-enter Λ.residual_ledger as comprehension-gap entries carrying their evidence; Λ.zero_memory_verdict set with its sweep trace and realization; a verdict missing the per-category sweep trace or the Realization line is rejected as no verdict → re-dispatch)
Phase 3 Qd              (constitution) → present (mandatory; surfaced residuals + unknown-provenance items + horizon-expired items + disposition conflicts; Esc → loop termination at LOOP level, not an Answer)
Phase 4 settle          (track)        → Internal state update (measure(Λ) incl. leaked_drops, leak-lint, fixed-point check, pass counter)
converge                (extension)    → TextPresent+Proceed (substitution table + disposition trace + surfaced residual ledger + TaskStateBlock; proceed with PortableHandoff — emit is leak_free, recipient ledger recipient-relevant only). Under re-distillation the emit also realizes as Edit/Write: hygiene the one canonical handoff file in place + append each delta to its CorrectionDelta JSONL ledger — a deterministic application of the converged Λ to the existing file (still Extension per A2 Standing authority — the Phase 3 Gate constituted the settled Λ, so the Edit/Write is a deterministic relay of that judgment, not a fresh constitutive act), never a new versioned sibling

── MODE STATE ──
Λ = { phase: Phase, W: WorkingContext,
      contract: Option(HandoffContract),                  -- F0 output; relevance and minimality premise
      pass_n: Nat,                                         -- bounded audit/lint pass counter
      ledger: CorrectionDelta_set | Unknown,              -- read-only provenance source (F3b consumption); Unknown when absent
      now: Timestamp,                                      -- invocation constant: bound once at the Phase 0 ledger bind, immutable for the invocation; the sole time source for expired(d), so expiry verdicts cannot flip between passes
      prior_handoff: Option(StableRef),                   -- F0-detected existing canonical handoff for the contract; ≠ Null ⇒ re-distillation (in-place hygiene + ledger append, Rule 19)
      subst_table: SubstTable,                            -- F1 deictic normalization rows
      grounding: Map(ContextItem, Grounding),             -- F2 self-containment class per item
      provenance: Map(ContextItem, Provenance),           -- F3b verdict per item
      dispositions: Map(ContextItem, Disposition),        -- F3 KEEP/ROUTE/DROP per item
      kept: Set(ContextItem),                             -- F4 minimal-complete retained set
      watchlist: WatchList,                                -- F5 third input, enumerated at Phase 3 dispatch from the live session record (per TYPES WatchList)
      routed: Set(ContextItem),                           -- ROUTE dispositions (StableRef-bound)
      dropped: Set(ContextItem),                          -- DROP dispositions
      gated: Set(ContextItem),                            -- items surfaced at the Gate for user judgment (unknown-provenance ∪ horizon-expired ∪ conflict)
      residual_ledger: ResidualLedger,                    -- entries across every reason (unresolved, unknown-provenance, horizon-expired, comprehension-gap); silent entry forbidden
      task_state: Option(TaskStateBlock),                 -- F7 structured channel
      emitted_deltas: List(CorrectionDelta),              -- re-distillation write side: the CorrectionDelta lines this pass appends to the emitted ledger. Populated at F6 settle as the prospective delta set the converged Λ will write (∅ when ¬redistillation), so the F6 leak lint and the measure leg |unclean_deltas| evaluate it non-vacuously before F7 commits the file write; each must satisfy ledger_emit_clean (pointer-clean, positively stated, horizon-grounded)
      measure: Nat,                                        -- F6 monotone hygiene measure (incl. |leaked_drops| and |unclean_deltas|)
      zero_memory_verdict: Option(ZeroMemoryVerdict),      -- F5 comprehension verdict; Fail re-enters blocking items as residuals and blocks fixed_point
      items_touched: Set(ContextItem),                     -- every item processed: the partition universe (= items(W) once all are disposed)
      history: List<(ContextItem, Substitution, Disposition, drop_reason: Option(String))>,  -- drop_reason is the typed home for Rule 12's "preserved in Λ.history with its drop reason"; Null for non-DROP entries
      active: Bool, cause_tag: String }
-- Invariant: items_touched = kept ∪ routed ∪ dropped (pairwise disjoint)
--   terminal partition over Disposition = KEEP | ROUTE | DROP; the Gate answer Defer resolves to a dropped item carrying a re-trigger condition (released from this handoff, not retained)
--   gated is the transient pre-resolution cell, empty at fixed point: every gated item resolves to a terminal disposition (Resolve → KEEP, Route → ROUTE, Drop/Defer → DROP)
--   residual_ledger is a cross-cutting surfacing record, not a partition cell and not emptied: every entry reaches surfaced = true before convergence. The full surfaced ledger is the session-side audit trace (retained in Λ.history); only its recipient-relevant projection (Route-pending) is carried into PortableHandoff. A Drop- or Defer-resolved entry is released from the emit (Defer = released-not-retained per the Defer invariant above; its re-trigger condition is kept session-side) — its content and reason stay session-side — so the emitted handoff never reproduces DROP'd content (enforced by leak_free: leaked_drops = ∅ at fixed point)
-- Invariant: KEEP(item) ⇒ provenance(item) = CorrectedKeep ∨ user_resolved_at_gate(item) (no KEEP by inference — only via a matching non-provisional CorrectionDelta or an explicit user Resolve)

── COMPOSITION ──
*: product — (D₁ × D₂) → (R₁ × R₂). graph.json edges preserved. Dimension resolution emergent via session context.
F3b composes Elenchus's provenance and freshness tagging plus its Revised | Bounded | Routed disposition vocabulary, and owns the correction-delta ledger that Elenchus does not carry: the ledger is the read-only authority that lets F3b separate a corrected-in-session item (KEEP) from an item whose provenance is merely undecided (Unknown → Gate).
F5 reuses the comprehension structure of a result-grasp check, redirected: the recipient under verification is a fresh executor with no session access, not the author, so the gate excludes author self-simulation (which would pass items the author silently shares).
F2 may call an external-reference check (request/ground style) when a grounding pointer's target needs verification; the self-containment audit itself stays inline.

Core Principle

Portability over Author Familiarity: A working session's context window accumulates session-tethered residue — undefined jargon, metric shorthand, author process traces, tool state, and dangling task identifiers — that reads as complete to the author because the author silently shares the missing context. A fresh recipient with no session access has none of that shared ground. Diylisis distills the working context into a handoff whose every load-bearing reference resolves without the author session: each deictic token is normalized to a canonical reference, each item is audited for self-containment, each disposition is judged against the declared recipient and its transformation provenance, and the residue that cannot be resolved is surfaced rather than silently carried. The handoff is portable when the author's familiarity is no longer a hidden dependency.

Mode Activation

Activation

AI detects session-tethered residue before a handoff OR the user calls /distill. Detection is silent (Phase 0); residual and disposition-conflict judgment always requires user interaction via Cognitive Partnership Move (Constitution) (Phase 3).

Activation layers:

• Layer 1 (User-invocable): /distill slash command or description-matching input. Always available.
• Layer 2 (AI-guided): Session-tethered residue detected before a context handoff (writing a handoff brief, spawning a fresh-context subagent, preparing a plan a new session will resume). Detection is silent (Phase 0).

Context tethered = the working context carries references whose resolution depends on the author session — undefined jargon, metric tokens, "as above"-style anchors, author process narration, or task identifiers that do not transfer to a fresh session.

Gate predicate:

context_tethered(W) ≡ ∃ item(i, W) : depends_on_author_session(i) ∧ ¬resolvable_by_stable_ref(i)

Boundary (contextualize ↔ distill): distill closes a portability gap to an absent zero-memory recipient — it reads the source immutably (monotone) and builds a new self-contained artifact, preserving the source. When the deficit is instead fit to an observable present context (a correct result that mutates to fit a convention, environment, or audience — ApplicationDecontextualized, non-monotone), it is not a distill case → route to /contextualize. This is the complement of contextualize's portability-to-an-absent-recipient → /distill guard.

Priority

How should this surfaced item be handled in the portable handoff?

Options:
1. **Resolve** — supply the canonical reference or inline evidence: [what stable reference or inline content resolves it]
2. **Route** — carry it by a stable reference the recipient resolves: [the path, id, or command]
3. **Drop** — the next task does not need it; release it from the handoff
4. **Defer** — set it aside until a named condition is met: [the re-trigger condition]