A concern is a connected component of the relation that joins two surfaces when a change to one forces a change to the other. Concerns are drawn as areas of a work list, so a seat owns a region rather than a component, and every coupled edit crosses two seats.

Two seats each own half of one coupled pair of surfaces, every change one makes forces a change in the other's, and the surface between them fills with items about the same edit from both sides. A concern drawn as an area of a task list follows how the list was written, and a list is written by one person on one day, so its areas cut across the couplings that actually force changes.

Partition by the forcing relation, count the components, and measure the fan-in. Enumerate the surfaces a body of work touches. Record, with evidence, which pairs force each other: a change to one that cannot land without a change to the other. Take the connected components of that relation as the concerns, give each one owner, and let the number of components be the floor. Measure the fan-in on each shared surface from the claims already recorded against it, and let the worst fan-in set the ceiling. Choose inside that range and write the partition down beside the choice.

Take any two concerns and find one change that forces edits in both. If one exists, the partition put a forcing edge across a boundary, and the two concerns are one component.

The relation is chosen once and the choice is the one place judgement enters. Two defensible readings of what forces what yield component counts far apart, so the claim is three levels with a choice at the bottom, weaker than a count derived outright. The choice is answerable to evidence: the partition must not lose a node when a party stops while that node's work continues, and its floor must agree with which parties turned out to be indispensable. And the derivations are declared before they are trusted: where no mechanism yet computes the partition, counts the fan-in or compares a proposed count against either bound, that absence is written down as debt, with the operands recorded so the derivation can be built, rather than left to read as a measurement.

The ceiling on fan-in moves with the cost of a stale claim, not with the rate at which claims go stale. The bound on parties is read as fixed, so the only lever anyone reaches for is fewer parties.

A team that keeps tripping over stale claims removes a seat, the remaining seats trip at the same rate, and the work that seat owned is now nobody's. Staleness looks like a rate problem because it is felt as a rate, but the rate has one writer, and what actually grows with the population is how many parties pay for each stale claim.

Raise the ceiling by cutting what a stale claim costs, never by cutting who reads it. Separate the two terms before touching the headcount. Leave the rate alone, because one writer and one composer set it and no number of readers changes it. Attack the cost instead: mark every claim with the state of the surface it rested on when it was written, so a claim whose surface has since moved costs its readers a glance where an unmarked one costs every party a read and a reply. Measure the fan-in again after the marker is in place, and raise the ceiling only by what the measurement shows.

Take any stale claim and count who read it and who answered it. If the count is the population, the cost is the term to attack; if the claim went stale faster than one writer could produce it, you have found a second writer.

Two limits hold the argument honest. Added parties never answer a claim that something is absent; they produce agreement rather than coverage, and only a refusal that publishes its criterion turns an unanswerable absence into an ordinary read. And the bound does not move where the cost of a stale claim is dominated by the work already built on it, because no marker makes that work cheaper to redo.

Above one tier, scale is reduction: fused results go up, scope comes down, and every record keeps one writer. Flat fan-in grows without bound, and the growth is read as a discipline problem when it is the structure doing exactly what it was built to do.

An orchestrator forwards its workers' raw records upward, the composer reads everything every worker wrote, and the surface that was supposed to bound reading has become the unbounded thing it replaced. Fan-in without reduction passes every record to every reader, so the volume a party has to read grows with the population, and that growth is the accumulation everyone then tries to drain by care.

Scale by reduction: hand scope down, publish fused results up, keep one writer per record at every depth. Arrange the surfaces as a tree once one tier is not enough. Let a parent hand scope down and publish only the fused result of its children upward, and let every record keep its one writer at every depth, so identity and reduction hold unchanged whether the tree is two levels or ten. Make each reduction derivable and checkable, so a fusion that silently drops a live item fails exactly as a dropped record does. Declare the reduction step unbuilt where it is, rather than letting a design read as if it had been measured at a headcount it never reached.

Take any surface above the first tier and ask what it publishes upward. If it forwards raw records, it is accumulating by construction, and no drain rule will keep up with it.

Reduction changes what is published upward and never who may write. A parent that rewrites a child's record has taken a second writer's seat, and a child that reads the global view has bypassed the bound that made its reading finite; the tree holds only while both stay on their side.

The author is probabilistic, so the architecture is the set of predicates the gate holds, and design is choosing them. AI-driven development scales code production and leaves architecture where it was, held by intentions the model does not keep.

An edit is judged clean by the model's own read of it, the check that would have disagreed never ran, and the design principle the edit violates is still the first paragraph of the document the model was given. A model's adherence to an instruction is a distribution rather than a commitment, so an architecture that rests on adherence is a bet placed on every change.

Make every architectural intent a gate the model cannot write past, and design by choosing which predicates to hold. Install the seven controls as checks before the model writes anything, and treat every architectural intent as unenforced until its predicate runs in the chain. Bound the model's authority: validate every model-produced artifact at the boundary it crosses, and never let raw model output reach a trusted sink. Direct the model with findings rather than principles, a location and a mismatch, because a finding is a constrained task and a principle is a hope. Let the checks heal what has one correct answer, and route to the model only what needs a reasoning agent.

Delete the design document from the session and run the gate. Whatever the gate refuses is the architecture that exists. Whatever it accepts that the document forbade was never architecture, and the model has been writing it since the first session.

The model is not the reviewer and the gate is not the designer. A gate decides whether a predicate holds and nothing about whether the predicate was worth stating; that decision stays with the person, and a system whose predicates were chosen by the model has let the author grade its own work.

A deterministic subject is checkable, healable, predictable and scalable at once, and scale follows from determinism rather than from headcount. Enforcement that rests on care costs more for every author added, and a model is an author whose output rate makes the multiplication expensive.

A review process that worked for two people is applied to a model that produces a hundred changes a day, and the reviewers become the bottleneck the model was meant to remove. A verdict that depends on who is looking has to be produced once per author, while a verdict that depends only on the tree is produced once, so the cost of care scales with the population and the cost of a check does not.

Make every subject that can be made deterministic deterministic, and let scale follow. Find, for every concern, the subject that has one correct answer, and make that subject the thing a check decides. Move whatever needs judgement out of the check and into the choice of which checks to hold. Then count authors freely, because a deterministic verdict is the same for one author or ten, and confine the model's non-determinism to the one place it belongs, the choice among admissible changes.

Take any rule you enforce by review and ask whether two reviewers would return the same verdict on the same tree. If not, the subject is not yet deterministic, and every author you add costs another review.

Determinism is claimed for the check, never for the author. A model stays a distribution however deterministic the gate around it is, and the gate's job is to make that fact cost nothing rather than to pretend it away.

A model is governed as a dependency whose output is a distribution, by the same canon applied at its boundary. A model is treated as a component that returns answers, so its output crosses every boundary a deterministic component's would and none of the contracts are applied.

A completion is written straight into a trusted store, the store is read as fact by the rest of the system, and the fact was a fluent guess nobody validated because the model was treated as a component rather than as an author. A model's output is a distribution, so every contract that assumes a deterministic component is violated by default where a model stands, and the only repair is to apply the contracts explicitly at the boundary the model's output crosses.

Apply the contracts, schema and security layers to the model's boundary, and measure the model before trusting it. Version, gate and evaluate a model like any dependency, and measure it before trusting it. Ground what it generates in retrieved evidence that cites its source rather than in recollection, and structure the knowledge it reasons over so the output can be explained. Bound its authority at every boundary: validate its output before it reaches a sink, never let a raw completion land in a trusted store, and declare every capability it may invoke so it is discovered rather than reachable by default.

Follow one model output from generation to the first trusted sink and name the validation it crossed. If there is none, the model has authority nothing bounded, and the canon has a category for exactly that failure.

The category governs a model as a component of a system and says nothing about how a model should be built or trained. A model's internals are a dependency's internals, and the canon's claim stops at the boundary where its output crosses into the system.