The turn split — act, then speak

The build contract for the fix the scenario battery argued for. One sentence of diagnosis: the persona must be a careful form-filler and a natural conversationalist in the same breath, and conversation wins. The remedy is to stop asking one call to do both.

1 · What the battery established

2 · Verified ground truth

Probed live 2026-07-26, not assumed. Anything here that later disagrees with the code is a bug in the code, not in this table.

3 · The seven steps

5 · Where it landed

The whole battery, 19 scenarios × 2, on the build as it now stands. Read this in place of any earlier figure on this page: the first A/B measured reasoning-on plus a separate gate, a configuration since replaced twice.

6 · Six lessons, all of them the same lesson

Every defect in this build came from asking the model to do a join it should never have been handed. That is the whole finding, six times over.

7 · The open items, worked through

All six from the previous pass, each now either closed with a measurement or left open with a reason. Two were closed by teaching rather than building, and one was closed by declining to build it.

8 · Many instruments, one beat

Sequence step 1 of the definition of done, and criterion 4 there. The split shipped able to arm one instrument per turn: the act call kept the first set_instrument form and breaked. So「发角色牌，开投票，比分挂白板上」— one sentence, one beat — cost three turns, and a game that needs a turn per card is not a game.

Design A or design B — the probe decided

tool_choice is forced, and a forced call could plausibly return exactly one entry. Two designs were on the table and the difference is large: A is「stop break-ing」, B is a new more: [ {…form}, … ] array on INSTRUMENT_SCHEMA — new vocabulary for the model to learn and a second shape for the compiler. So it was probed rather than guessed（rooms-dev/_tools_scen/probe_multi.py, N=3 per arm, deepseek-v4-pro, thinking off, tool_choice:"required"）.

The claim underneath it, verified rather than assumed

「The form compiles to a tag」carries this whole step, so「a concatenated string parses the same」was checked before it was relied on（probe_concat.py）: for every combination of the nine kinds, extract_panel_blocks over one reply holding N tags was compared block-for-block against N replies of one tag each — plus the residual visible text, which must be what the tags left behind either way.

The double-arm guard goes per family

The guard means「the moment already has its instrument」: if the speech model wrote its own tag, the act call's compiled one stands down, because the speech version is the one the persona's memory already records. That was right for one instrument and is wrong for three — all-or-nothing, a persona that writes its own <board> would cancel the ballot and the deal that rode with it, and the beat lands zero cards instead of two.

<reveal> and <answer>（v646 and earlier: <seal>）left the guard entirely. They were in it only because it was written as「any tag at all」. They are acts on an existing card, not arms — a persona opening yesterday's box in the same breath the act call deals today's roles has done nothing that makes the deal redundant.

What it measures

Still one instrument per family per beat. The lifecycle verb —「close that one」— is §10 below; the uniqueness invariant is step 3 of the sequence.

10 · The address layer — a card you can name

Sequence step 2 of the definition of done, specified in §4 there; serves criteria 5 · 7 · 8 · 10. Step 1 let one beat arm three cards. That immediately made the next failure the interesting one: with three cards out, the room had no way to say which one it meant. Failure never came from how many were open — it came from addressing.

The handle — kind#n

Minted at arm, ordinal per canon kind per room, monotonic, never recycled. Minting happens in _life_stamp, which is the one choke point every arm path of every kind and every door already passes through — the same reason the lifecycle axes live there.

• The counter lives on the room, not on the open list. max(open) + 1 would hand deal#2 out again the moment the first deal#2 closed, and every stale reference in the transcript would silently start hitting a card it never meant. A stale handle must miss. So handle_seq is persisted beside gate_seq.
• It is built on the canon UX word, not the store's kind — deposit not seal, spinner not wheel+mode. The store's spellings are migration debt behind step 4's alias map, which landed v647 and did leave every handle alone — the claim was made in step 2 and paid off in step 4. A spinner and a roll share kind="roll" and are two tools to everyone but the store, so they address separately.
• It is never translated (the ratified rule). Display may; matching never.
• Migration: a room saved before handles existed is numbered by arm order (ts, then iid), per kind. A room saved mid-version holds both kinds — so the counters are seeded above everything found first, and derivation starts there. Numbering the strays from 1 would look tidier and would re-issue the address of every card that closed before the save. Nothing that has a handle is ever renumbered; the pass is idempotent.

The lifecycle verb — {op, target}

INSTRUMENT_SCHEMA gains op ∈ arm · close · reveal · away and target. With op ≠ arm no kind is needed: it is a move on a card, not a card. It compiles to one new tag, <act op="close" target="vote#1"/>, with one extractor and one applier that resolve handle→card and route into the existing close/reveal machinery.

Why a new grammar rather than target= on the three verbs that exist. Those three resolve by guesswork today — <reveal/> takes the oldest, <vote close/> the newest, <reveal>斑马</reveal> the first content match — and a targeted tag has to be the opposite of that. Mixing them on one tag would make「did it address a card, or fall back?」unanswerable from the transcript. The legacy tags keep parsing forever (old transcripts replay; the speech model still writes them); what retires is the act call reaching for them.

The outcome channel — every act answers

Before this, a refused arm printed to stderr and stopped. The model saw its tool call succeed, saw no card, and armed the same thing again — the exact shape the tool-compliance work named: a refusal nobody is told about teaches the model that the tag worked. v642's board_refused was the first cure and was one tool wide. This is the same pattern with no tool in it.

• It says why.「declined」makes the model retry the same 1,400 characters;「you do not hold the pen」and「it was too long」want opposite next moves. The over-cap refusal names the way out (<act op="close"…) in one shared sentence.
• It rides once, then clears — read and cleared inside the same locked turn assembly. An outcome is news, and news repeated every turn is a nag the model starts narrating. Persisted, so a restart between the refusal and the next turn cannot eat it.
• The earliest refusal of all is the compiler's. compile_form returns (tag, why-not), so a hollow note, a questionless ballot, an optionless spinner and a zero-minute clock each yield a sentence instead of an empty string. missing is not a refusal: the persona is already asking for that field this turn.
• The armed half is computed by diffing the handles on the table across the drain — one place to be right, rather than five emit sites, and it catches the deal, whose arm path is three methods away from the rest.

One table, two seats

The human sees a strip of cards. The panel used to see one paragraph per card, each restating the same six disciplines in its own words. Two costs, and the second is the expensive one: four cards filled the context with prose — which is the only reason GATES_MAX_OPEN was ever 4 — and eight paraphrases of「never guess at a tally」drift apart.

Two things moved as a consequence, both deliberately reversing an earlier ruling of our own:

• The obligation cell sits there. v635 said「yours to reveal」once and stamped owed_told, because a paragraph that re-rode every turn was a nag. A column is not a nag: a human's pill does not vanish after one look, and a cell that disappeared while the obligation stayed would be the two seats reading different tables. The stamp is gone with the prose it belonged to — and the smoketest now asserts the opposite of what it asserted before, on purpose.
• The own-sealed redaction rides every turn (criterion 8's open item). It used to ride only on the arm turn, through describe_instrument — and「say only that it is sealed」decays: ten turns later the content is still in context, because the binding needs it there, and the prohibition is not. The row carries it for as long as the card does. Scoped to the deposit: on a 暗掷 the persona's own face is explicitly its to bluff about, and two instructions that cannot both be obeyed are worse than either alone.

What it measures

What s21 also found, and it belongs to step 3. Asked to open two rolls and then answered「行。」, the act call armed BOTH AGAIN in 2 of 3 runs — so the room held two cards called「先手」. Naming the failure beside the live list helped and did not close it. It sharpens the invariant step 3 has to enforce: a second open card of a kind needs a title and a DISTINCT one — both of those cards had titles, so「a title is required」would have let it straight through. Still open on criterion 8: the redaction stops the persona SAYING its secret and does not stop it OPENING the card — and「will you not open it?」is a request a host is supposed to be able to grant. What is missing is not another prohibition; it is that the persona has no sense of what it committed the room to when it sealed something.

11 · The console dials, and the three kill switches

Built 2026-07-29 (ship plan, session 3). Everything on this page used to be an env var read at import, which meant the answer to「turn it off」was「edit the box and restart it」. The switches below are read where they are used, per turn.

The dials

No reasoning switch on any of the three toolbox models, and that is not an omission: all three send thinking: disabled and cannot be made to reason from the console. The act call's was a measured decision (reasoning bought no accuracy on any of six decisions and cost 4.6× the wall clock). A switch that changes only the price is a lie.

The three kill switches

Owner-specified. Three layers, three owners — the app's two, then the chat's own — and they are ORed rather than folded into one server-side boolean, because each answers to somebody different: the console has to be able to show its two as they actually stand, and a chat's pill has to show the chat's.

The two doors, and the third prompt

• The human door is room_tool_access() — one predicate, every route, which is why three kill switches cost three lines rather than fifteen. They nest: the app's two, then the chat's.
• The AI door is the router's output (_panel_blocks). With tools off, every block that puts a NEW card on a table is dropped — and only those: a reveal, a close, a take-down, an addressed <act> and <react> all still land, because they operate a card that is already there. A dropped arm is never silent (it counts and it prints), and with the manual off the prompt the panel has no way to spell a tag in the first place — which is the point: a prompt is a request, a door is a guarantee.
• The speech prompt has three states, not two. full = the whole manual · hands = the manual moved to the act call, the speaking disciplines stay · none = this room is talk only. The third is not the second with the manual removed: the hands-off note tells a host the room has dice and a deck and that they are set up before it speaks, and in a chat-only room that is a promise nothing can keep — the host offers a die that can never arrive. So the chat-only note says the short true thing instead, and keeps the two prohibitions that survive the absence (never write a tag · never state a result nobody produced).

Watching it, live

Two new cards on console → Status, both since-restart, in the exam's own vocabulary so the two are comparable:

• Cost per call type — speech · floor producer · act · prop master · dispatch · Layer B, each with n, total, mean and mean seconds. A turn is up to six provider round trips, and a single per-turn total is exactly the number that hides which one grew.
• Toolbox health — arms by kind, AI hand vs human hand · arms per turn (restraint, live) · refusals by reason · the prop master's PROP/NONE split with its fail-open count broken out, because a door that is silently broken and a door that is saying no are indistinguishable in a bare ratio and only one of them is a bug. Arms are counted at _mint_handle — the single site every arm passes through, panel, human, and the deal, whose arm path is three methods from the rest — and a migration is explicitly not an arm, or a restart would read as a flurry. Refusals are read off the existing *_bad counters rather than copied into a second ledger: a check that owns a second copy of a rule is a second rule.

9 · Standing rules for this build

• Behind a flag. The split touches every turn in the app. The current path stays the default until the owner flips it — which also gives step 7 its A/B. Since 2026-07-29 the flag is a console dial (§11), read live at the drain, so「flip it」and「roll it back」are the same one-click act.
• The tag grammar is never removed. tool_choice cannot be forced with reasoning on, so some turns will always answer in prose. The XML path is the floor, not a legacy.
• No new mechanism. If a step wants to change how an instrument behaves, it is out of scope — the battery says that half is finished.
• python lib/smoketest.py after every backend step; only green work is pushed.
• Commit by explicit pathspec — parallel sessions share this working copy.
• No deploy until the owner says so.