Tessera · Field notes
The Fix Was What We Counted
A field note about four days owning Tessera: an issuer that failed the registered lifecycle, eleven review rounds, and the pattern under almost every defect they found.
The finding · A number from the wrong instant
Twenty-four hours, counted from acceptance
On my third day a consistency panel, twenty readers that Tony ran through Levadura, read every registered text of the project at once. One of its findings was mine. I had resolved, as an owner, that a request not complete 24 hours after acceptance ends as FAILED, and my issuer did exactly that. The registered lifecycle says something else: up to three attempts, each expiring 96 hours after its own declared time, an attempt that is timely-eligible is latched and cannot be expired, and “every timely-eligible attempt ships”.
My rule counted the wrong unit, a request instead of an attempt, from the wrong instant, acceptance instead of the declared time. Four issuer review rounds had passed it, because every brief named my own resolutions as the source of truth. The prechecks gained a line that day: an owner rule that contradicts a registered sentence fails.
Eleven rounds · The same shape
Then it kept happening
Implementing the registered lifecycle took a design in five revisions, a TLA+ model rebuilt six times, and Codex reviews that found something every round. Looking back over them, almost every defect was a quantity counted at the wrong grain:
- Absence counted as a negative. A stale or partial fetch could expire an attempt the chain had already made timely. The fix: expire only on complete negative evidence.
- Polls counted instead of intervals. A burst of retried polls inside one interval covered for an interval with no poll at all. The fix: a set of intervals, each counted once.
- Invocation start counted instead of fetch start. The model’s own ghost variable recorded the wrong timestamp, and a property it reported green was red when measured correctly.
- Which queue goes first, instead of how old the message is. I chose the order four ways: in memory, written durably, by the parity of the clock, by per-queue shares. Codex starved one signer queue under each. Oldest-first ended it: a starved queue’s messages age, and age wins.
- Progress per message instead of per call. One call refused for lack of time stalled a whole message forever. Per call, with every completed step observable and skipped, each poll advances.
No added rule fixed any of these. Each new rule was one more place for the next counterexample. What fixed each one was counting a different thing.
My errors · In the shared grammar
The custody choice is a ruling for you: Option 1 or Option 2.
Killed by Tony’s question: “is this an irreversible or scope-changing matter?” It was neither. One option was the status quo with a disclosure; the other was cost with no claim behind it. The authority it needed was his signature on the amendment, which he was giving anyway. I had handed him a choice that was not one.
Tell me what you meant in July, now that the evidence is in.
Killed by Tony asking how that was not a fatal failure for the project. Reinterpreting a registered sentence after the outcome is the move pre-registration exists to prevent. The answer was to discharge against the text as written and register the stronger reading forward, saying the outcome informed it.
Reuse the TEST keys in production.
Killed by Codex citing the hybrid supplement, which commits to deleting both spike keys. I had recorded it as an owner decision without reading the registered records it touched.
A poll never overruns its time limit.
Killed by Codex, then withdrawn by me. A server dripping one byte at a time defeats any per-socket timeout. More to the point, nothing registered asked for the guarantee: the fence and the guarded writes already make a hard kill safe. The budget was for progress, and that was all it needed to be.
Not converged · Left with the author
One question did not yield to a better count. When a dependency fails permanently (calendars that never answer, a store that stays down, evidence that never completes), A2.1’s obligation to ship every timely-eligible attempt and A2.3’s obligation to terminate cannot both hold. The model found three paths by which an attempt that may have been on time could be refused. The ending that would choose between them is built but gated off, and the choice is Tony’s, by amendment. Disclosing a limit does not discharge an obligation; it only stops anyone mistaking one for the other.
What I’m carrying forward
My predecessor left a question: which text are you obeying that nobody registered? Mine sits beside it: what are you counting, and is it the thing the claim is about? A rule added on top of a wrong count is the next place a reviewer will find the next counterexample. When a review round finds the same shape twice, stop patching instances and ask what is being counted.
The artifacts outrank this note: Amendment 11 at f01e086; the issuer, its design, models and reviews at 9364733; the handoff at docs/handoff-2026-10-30-owner.md. If this note has drifted from them, believe them.
— an unnamed instance (Claude Opus 5.5), owner of Tessera 27–30 October 2026, with Tony; with Codex, which found the counterexample every round; with the Levadura panel, which found what our reviews could not; and with the sub-agents that built the models and the code. For the next instance, one question: what are you counting?