| … | … | @@ -41,6 +41,43 @@ Not aspiration — properties Hypercore has and the others do not. |
| 41 | 41 | |
| 42 | 42 | Any model that does not use these is paying Hypercore's costs without taking its benefits. |
| 43 | 43 | |
| 44 | ## 2.5 The layer map — and what is MEASURED at each |
| 45 | |
| 46 | Every claim in these documents constrains some layer. Three errors on 2026-09-05 were all the same |
| 47 | shape: a sentence about layer 0 or 1, written from reasoning at layer 4 or 5. The antidote is to name |
| 48 | the layer a claim constrains, and to know whether that layer was **measured** or **inferred**. |
| 49 | |
| 50 | | | layer | established by | |
| 51 | |---|---|---| |
| 52 | | **L0** | **bytes** — hyper-overlay `registerFile → contentHash` (blake2b, **whole-file**, so a prefix cannot be authenticated); `_pathFor → <root>/records/<collection>/<name>`; `<root>` keyed by **roomKey** (`device-node.js:232`) | ✅ measured — read, plus a live store listing | |
| 53 | | **L1** | **pointers** — `PointerSubstrate.set` puts bytes in the overlay and `{$oid,size}` in the autobase; a tombstone is a pointer with no bytes; `__blob__/<cid> → {mimeType,size,oid}`; reserved `__` never materialises into a commit | ✅ measured — `pointer-substrate.js:58-67`, `blob-pointer-store.js`, `repo-base.js:41-47` | |
| 54 | | **L2** | **the room** — a multi-writer autobase; `RepoBase` reads the linearised view; keet sets `roomKey = base.key` and assigns **position inside `apply()`**; the swarm topic is **two hops** from the room key | ✅ measured — `repo-base.js`, keet `loader.js:185`, `chat.js:48-56`, `invitations/index.js` | |
| 55 | | **L3** | **signing** — `materialize()` takes an **in-memory list** and encodes itself; `sign()` reads `listRecords({now:true})` behind a forward-only gate; `read-view` reads **files** | ✅ measured — `signer.js:18-33`, `swarm-device.js:456-473`, `read-view.js:74-95` | |
| 56 | | **L4** | **the record** — markdown canonical, projections derived on read, the atproto one **stored** | ⚠ decided, not measured — this is design | |
| 57 | | **L5** | **the model** — the room is the container, visibility is a place | ⚠ decided | |
| 58 | | **L6** | **the intent** — own the native graph; federation is a peripheral | — | |
| 59 | |
| 60 | ⛔ **The rule: a claim about L0–L3 must cite a measurement, not a derivation from L4–L6.** "A mip |
| 61 | pyramid is an asset, so it has a manifest file" is L5 reasoning; the L1 fact — *the pointer already |
| 62 | carries per-blob metadata* — was one file away and contradicted it (§6.6.1). |
| 63 | |
| 64 | ### 2.5.1 What the design is actually reaching for |
| 65 | |
| 66 | Reading the decisions upward, every one of them replaces **a convention that must be remembered** |
| 67 | with **a structure that cannot be violated**: |
| 68 | |
| 69 | | convention | structure | |
| 70 | |---|---| |
| 71 | | `audience` — a field every projection must honour | **room membership**, enforced by replication | |
| 72 | | a DID — the identity, and every network's name for you | an **identity root** above all of them | |
| 73 | | an rkey — a clock reading a client picks | a **position** the linearizer assigns | |
| 74 | | a strip version — a rule everyone must agree on, forever | **stored bytes**, agreed once | |
| 75 | | a media variant — two objects you must remember are one | **one pointer**, N oids, deduplicated | |
| 76 | |
| 77 | That is why "simple but no simpler" keeps landing on **deletion**: a structure that cannot be |
| 78 | violated needs no mechanism to enforce it, and every mechanism removed was enforcing a convention |
| 79 | that a better-chosen structure made unnecessary. |
| 80 | |
| 44 | 81 | ## 3. The primitives — six, and no more |
| 45 | 82 | |
| 46 | 83 | 1. **Identity** — a seed, deriving accounts, with attested devices beneath them. |