kestrel.markets/CONTEXT.md

A typed, token-efficient language + runtime for agentic trading: agents author bounded plans, the runtime fires them at the tick. CLI + typed library + MCP server.

# Kestrel

The shared language for the Kestrel project: a typed, token-efficient language + runtime
for agentic trading. This file is a **glossary only** — no implementation details, no
specs, no decisions (those live in `docs/adr/`).

## Language

**Kestrel (the language)**:
One language with one lexical core. Four statement kinds (View, Wake, Plan, Grade) share
the trigger algebra, series references, price expressions, and lexical conventions. It reads like English, and is authored and read by humans and agents alike.
_Avoid_: "the DSLs" (plural), "the grammar" (ambiguous — say which surface).

**Surface**:
One of the four statement kinds of the language. **View** (what should I see?), **Wake**
(when should I look?), **Plan** (what may execute?), **Grade** (did it actually work?).

**Standing**:
The lifecycle of View, Wake, and Plan statements — authored, armed, versioned, and
superseded; they persist and act over time.
_Avoid_: persistent, active.

**Imperative**:
The lifecycle of a Grade statement — a job that runs, terminates, and returns a result.
It is never armed. (A recurring grade is a Wake that triggers a Grade — Grade itself
stays imperative.)
_Avoid_: batch, task.

**Kestrel Runtime**:
The deterministic artifact that runs Kestrel (OSS-ADR-0057): it parses and arms
documents, perceives (Frames), fires armed Plans at machine speed, models fills,
records (Bus), and grades — no wall clock, no unseeded randomness; same Bus +
same armed documents ⇒ byte-identical event stream, Frames, and Blotter. The
determinism boundary IS the artifact: fill models, simulation drivers, and
renderers live inside it (that is why certified results recompute); Agents live
outside it (the agent authors; the Runtime perceives and executes — it runs
even when every agent is asleep), and the platform's Execution module (its live
broker gate) is outside too. `docs/spec/RUNTIME.md` is its binding spec.
_Avoid_: engine (unqualified), execution engine (collides with the platform's
Execution module and names one subsystem of the determinism boundary),
interpreter; driver (a Runtime-internal loop, not product vocabulary).

**Kestrel document**:
A unit of authored Kestrel text: either a `.kestrel` file (pure execution) or a
```` ```kestrel ```` fenced block inside a Markdown file (docs, reasoning traces,
agent output). Both parse identically.

**Module**:
Every Kestrel document is a module (ESM-like): its named statements are importable by
other documents. A document may be a full Pod, a single Book, a library of Plans, or
any mix — composition over monoliths.

**Armory**:
A module of vetted, reusable Plan templates, imported into pods/books. Entries carry
provenance and a replay record; trust is graduated by provenance.

**View**:
The standing definition of what should be seen — which panes, at what token budget.
(Bloomberg's own word for a saved Launchpad layout — deliberately market-native.)
_Avoid_: screen spec, percept spec, layout.

**Frame**:
A View materialized at one moment: the typed bundle of values, each carrying its source.
The Terminal is live video; a Frame is one instant of it, fully specified. Replay is a
sequence of Frames. A full Frame is a **keyframe** (the OPEN screen); a **delta frame**
carries only what changed since the author's last Frame (the WAKE screen).
_Avoid_: percept, snapshot, page.

**Field**:
The atom of a Frame: every rendered value is a **Field** — its `value` plus the provenance
it was derived under (an **Attribution**, a **SourceWatermark**, and, for a model value, a
`confidence`). The Frame invents nothing, so a value that is genuinely unavailable is `null`
— an explicit UNKNOWN, rendered `—` — never a guessed or defaulted number. A `MODEL` Field
is honest only if it carries its receipt (a source and a model version) and its confidence;
a construct-time honesty guard refuses a `MODEL` Field that omits them, and refuses an
`OBS`/`CALC` Field that smuggles a model receipt in.
_Avoid_: naked number, cell.

**Attribution**:
The provenance class a **Field** carries — *how* its value was derived. The landed set is
three: `OBS` (an observed market datum — a quote, a trade), `CALC` (a deterministic transform
of OBS — VWAP, range, %chg — carrying no receipt), and `MODEL` (a model output — a fair, a
predictor or regime claim). The honesty split — **nothing above CALC goes unattributed** — is
enforced at construction: a `MODEL` Field MUST carry its receipt (a **SourceWatermark** bearing
a model version) and a `confidence`; `OBS`/`CALC` carry neither, and a Field that mis-attributes
is refused (fail-closed). UNKNOWN is not a class here — an unavailable value is the null Field,
rendered `—`. (The Frame charter reserves a wider ladder — DETECTOR, POLICY — not yet in the
landed class set.)

**SourceWatermark**:
The provenance stamp a **Field** carries — where and *when* its value was derived. Its *when*
is `asOfSeq`: the engine's monotonic sequence at derivation, an **ordinal, never a wall
clock** — the determinism and replay-stability key, so the same Bus replays to byte-identical
Fields and no date ever rides a Field. For a `MODEL` Field the stamp also carries the model
source and its **model version** — the receipt an honest MODEL claim rests on (required); an
`OBS`/`CALC` Field carries the sequence alone, no model receipt.

**Rendering**:
One serialization of a Frame. A Rendering never invents or changes a value — it chooses
only glyphs, layout, and token spend. It has two parameters: a **format**
(`ascii | unicode | md | json | html`) and the **tokenizer** its token costs are
measured under (which glyphs are cheap is an empirical, per-model fact). The agent's
ASCII screen and the human's HTML chart are two Renderings of one Frame.
_Avoid_: flavor, skin, theme.

**Caller**:
Who invoked the CLI — an **agent** (an automated harness, detected by environment) or a
**human** (an interactive operator; the party that sits above the root pod). The Caller
selects the default **Rendering**: an agent gets machine `text`/`json` (token-cheap,
non-interactive); a human on an interactive terminal gets the interactive Terminal
session — the human Rendering (CLI `ascii`, Web `html`) of a **PM**'s **acting** Frame. Orthogonal to
**Mode** (sim/paper/live) and to authentication.
_Avoid_: "user" (ambiguous — the human above the root vs. the agent).

**Streaming Rendering (cache-monotone)**:
A Rendering consumed continuously by a long-running agent must be **append-only**:
new time buckets arrive as new lines (vertical tape — one row per candle, newest
last), so the agent's KV cache stays valid and perception costs O(new bars), not
O(screen). 2D layouts (price × time grids) redraw on every update and are therefore
**keyframe-only** (one-shot orientation) or human-facing (`html`). The same discipline
extends to the **kernel** (ADR-0019): in a cache-monotone stream — the `conversation` /
`conversation-cached` policies, where the reader provably holds the prior full kernel in
cached context — a WAKE frame's SAFETY/CONTROL kernel is **delta-encoded**, carrying only
the fields that MOVED since the prior frame; the byte-stable skeleton (the lead banner, the
8 section labels, every unchanged field value) is NOT re-emitted — it rides the cached
prefix. A **keyframe** (the OPEN briefing, and every `stateless-redraw` frame, where the
reader holds no prior context) carries the COMPLETE kernel: self-complete frames stay
self-complete. A fail-closed composed-completeness guard verifies `cached-skeleton + delta`
reconstructs the full kernel byte-identically; a delta that would compose to an incomplete
kernel throws.

**Relative candle (anchored)**:
The **first candidate** streaming tape row (a graded hypothesis, never blessed by
taste — renderings compete in tournaments on identical Frames): direction glyph +
body in bps vs prior close + wick extents,
open implied (gap prints only when nonzero). Absolute levels live in the periodic
**anchor** (the keyframe re-stamps the level) and the levels registry — never
re-spent per row. Rationale: absolute prices every row fragment under BPE and repeat
high-order digits; small signed integers tokenize cleanly and stay legible arithmetic
(compressing past bps into opaque symbols is below the legibility floor).

**Tape**:
The market stream itself — prints, quotes, the recorded session. Reserved: never used
for renderings or screens ("reading the tape" keeps its real meaning).

**Pane**:
One named block within a View (a skyline, a chain card, a levels table, a detector
strip). A chart is one kind of pane, not the general term. A View selects panes; it
never computes — all values arrive in the Frame.

**Kernel**:
The non-configurable part of every Frame, bound to the **Episode**, not the View. An
**acting** Episode (a Book/Pod attached) carries the acting kernel — positions, resting
orders, budget, wake reason, engine log (role-appropriate: book-state for a Trader,
pod-state for a PM). A **spectator** Frame (no actionable Episode — publication,
research, historical charts) carries the provenance kernel only: watermarks, asof, data
health. You cannot opt out of the acting kernel by configuring the View — only by
genuinely having nothing at stake. The **kernel-leads invariant** is reinterpreted for
cache-monotone streams (ADR-0019), never weakened: _every frame makes the COMPLETE current
kernel available to the reader — as a full block in a keyframe, or as `cached-skeleton +
delta` in a cache-monotone stream — and a fail-closed composed-completeness guard verifies
the composition reconstructs the full kernel byte-identically._ **Absent-not-hidden**
survives the delta: a field that MOVED to UNKNOWN is present-and-marked in the delta;
a field merely unchanged is absent from the moved-set (held in cache) — omitted-because-
unchanged is never confused with omitted-because-unknown.

**Spectator / Acting**:
The two Frame contexts. Spectator = nothing at stake (websites, historical views,
research). Acting = inside an Episode that can act. Same View language for both; the
Episode decides the kernel.

**Wake**:
A standing subscription over the trigger algebra that spends **attention** (tokens,
wakes), never risk. A Wake is not a Plan.

**Plan**:
A standing, bounded-risk contingent program: trigger → actions → bracket → invalidation
→ TTL. Fired by the runtime at machine speed; the author is informed in parallel
(fire-then-inform).

**Expiry selector**:
The one way Kestrel names an option expiry, in exactly three forms: **relative** (`0dte`,
`1dte`), a **date** (`2026-07-17`), or a **tag** (`weekly`). The same selector language is
read at both the instrument level (`USING exec SPY 0dte`) and the leg level (`exp`) — one
expiry language, never two. A selector that no trading calendar can place is a parse escape,
not a guess.
_Avoid_: expiration, maturity, DTE (as a noun).

**`exp` (the leg expiry marker)**:
Marks an individual leg's own **Expiry selector**, so two tenors may coexist on one ticket
(`buy 1 atm C exp 2026-07-17`). A leg with **no** `exp` **inherits** the ambient
`USING exec` tenor — inheritance is the default, and a missing expiry is *never* a silent
`0dte`. A bare `exp` with no selector is a parse escape (STAND_DOWN), never a silent
inherit. The marker keyword is required rather than positional because a leg is followed by
`,` or `@`, so a bare positional tag would silently swallow the next token (OSS-ADR-0050).
_Avoid_: expiry-as-a-suffix, per-leg maturity, tenor override (it is inheritance, not override).

**Grade**:
The honest **result** of a run — realized EV, P&L, fills, counterfactuals, and the
fidelity/certification stamps — _and_ the surface an author writes to request and score one
("did it actually work?"). **Every run, however produced, carries a Grade.** It grades
judgment, never parameters.
_Avoid_: using "backtest" as a synonym (backtest is one _way to produce_ a run, not the
result).

**Simulate**:
A run produced by a **live agent in the loop**: an AI manages the book in `sim` mode over the
strategy's own horizon (minutes to weeks) in **compressed wall-clock**, defining its own
Wakes, revising Plans, and acting on live oversight (holdings, P&L, fills, new data) — exactly
as it would live. Parameterized by agent **config** (model, tokenizer, temperature, thinking
level), so the same recorded market data run under different configs is directly comparable.
The loop is non-deterministic (the judgment is the variable); the run it records projects
deterministically to a Blotter.
_Avoid_: backtest (Simulate has an agent in the loop; a backtest does not).

**Backtest**:
A run produced by replaying a **fixed** authored Plan (or set) autonomously over recorded
market data — no agent in the loop — under a named fill model. Deterministic and reproducible;
the static counterpart to Simulate, and the mode `GRADE plan X …` executes.
_Avoid_: any parameter search / curve-fit — a Kestrel backtest replays committed judgment, it
never sweeps parameters.

**Cell**:
The runnable unit of the benchmark matrix — one point in timescale × instrument ×
ticker × scenario, carrying its tape, license note, symbols, date span, sha256, and
tier. A Cell is addressable by name and runnable by anyone, agent or human. The tape
itself is never exposed: a Cell runs behind the API and returns Frames, a Blotter, and
a Grade — projections, never the raw tape.
_Avoid_: scenario (that is the Cell's axis-D family, not the unit), episode, task.

**Practice tier / Holdback tier**:
The two Cell tiers, split by what a Grade can honestly *mean*. **Practice** = public,
well-known events, prior-knowledge OK — and therefore **non-ranking**: a model trained
past that date already knows how it resolved, so a practice run proves you can operate
the mechanics, never that you have edge. **Holdback** = the same Cell shape run as a
sealed **forward window after the model's training cutoff**, blinded, and therefore the
only tier that is **ranking-eligible**. The free/paid boundary falls here for an
epistemic reason, not a commercial one: a practice run *cannot* be a credible score;
only a blinded forward run can.
_Avoid_: calling a practice result a "score" or ranking one.

**Support flag**:
A fill model's per-assessment answer to *"is this cash REAL?"* — `calibrated` (the cell is
a structural price-priority fact, or is covered by realized live data) vs `extrapolated`
(priced off the offline ceiling with no live anchor — an uncalibrated hazard cell, or a
fantasy corner like a resting far-OTM offer / a dark internalization lift). Support is
carried on the record as a **four-cell partition** (calibrated/extrapolated × gain/loss),
written once and never collapsed; every sign policy is a named view read from it
(ADR-0014). It is the fill-model analogue of a predictor's data-quality gate.

**Raw / Bankable expected-$**:
The two named views over the support partition — two questions, one record. **Raw** is
what the run claims under its own fill model, support-labeled: the experiment view that
config grids and fill-model floor↔ceiling brackets compare. **Bankable** is what may be
banked, ranked, or sold: calibrated cells in full plus extrapolated *losses* —
extrapolated *gains are refused*, so a strategy can neither hill-climb into an
uncalibrated corner nor park its losses there. Leaderboards and anything attested read
bankable; sign policy is a property of the question, never of the run.
_Avoid_: applying "refuses to bank" to the raw view (raw labels, never censors).

## The desk (org model)

**Pod**:
The recursive organizational node: an allocating role (PM) + a risk envelope +
children, where each child is a Book or another Pod. Depth is unbounded — the org is
data (a standing Kestrel document, revisable intraday), not fixed structure. The system
is never fully autonomous — humans sit above the root; a pod is the largest thing that
runs on its own. Invariants at every edge: budgets nest, authority only narrows
downward.
_Avoid_: desk, team, fleet.

**PM (Portfolio Manager)**:
The role that runs a Pod node: allocates children's envelopes, arms/de-arms, assigns
Coverage, watches aggregates. A PM never authors tickets — PM actions are allocations
and envelope changes. A role, not a job title; one agent may be PM of a node and
Trader of a leaf. (Always "portfolio manager" — never product/project manager.)

**Trader**:
The role that runs a Book (a leaf) under an assigned Coverage. A Trader's world is its
instruments' tape, depth-first.

**Book**:
The leaf of the org tree — the only place positions and orders live. One Trader's
positions + P&L + risk envelope (budget, concurrency, arbitration). Everything above a
Book allocates and aggregates; it never holds positions.
_Note_: a naming collision to clean up — the runtime's `BookState`/`BookLedger` types are a
**per-instrument inventory ledger**, NOT a Book in this org sense; slated to rename to
`InventoryLedger` (kestrel-32tl).
_Avoid_: using "book" for the per-symbol position ledger.

**Coverage**:
The assignment of instruments to a Trader **plus the thesis for why**. Instruments
alone are not coverage.

**Risk**:
Reserved for the platform's bounded-risk enforcement layer (the L0 envelope): clamps or
vetoes, may never open risk, sits above every pod member including the PM.

## Instances, episodes, blotters

**Mode**:
What an order means when it fires: **sim** (recorded data, simulated fills), **paper**
(live data, simulated fills), **live** (the real broker gate, real money). Same engine,
same plans — only the gate differs.
_Avoid_: replay, backtest (as mode names — say sim).

**Instance**:
One instantiation of a Pod definition in a mode — the definition is the class (a
versioned module); instances are the things that run. An instance's execution divides
into **Episodes** (one per market session), each yielding a **Blotter**; its history is
that ordered sequence. **sim and paper instances are unbounded** (10k parallel sims of
1000 versions); **the live instance is a singleton per pod lineage**, platform-enforced
— two live instances of one pod means doubled orders. Promotion = authoring a book into
the live pod's next version, never flipping a flag.
_Avoid_: run (say Instance for the identity, Episode for the temporal span).

**Episode**:
The deterministic execution unit: one continuous span of an Instance's execution over one
market session — the runtime object (`{ driver, clock, gate, bus, mode }`; still named
`Session` in code until kestrel-10he lands) owns it. An Episode owns exactly **one Bus**
and yields exactly **one Blotter**; it is bounded and replays byte-for-byte. Acting vs
spectator is a property of the Episode (see Kernel). Two ways the tape arrives — never a
difference of execution authority: a **backtest Episode** replays a bounded recorded
window, compute-paced, certifiable immediately; a **forward Episode** rides the advancing
tape, wall-clock-paced from *outside* the runtime, bounded only in retrospect, and
certifiable at close. Orthogonal to **Mode** (paper vs live is an authority difference on
the order gate, invisible at this layer).
_Note_: renamed from "Session" (OSS-ADR-0055). "Resting episode" (ADR-0016, the fill
channel's resting-order exposure span) keeps its qualified two-word name; a bare
**Episode** always means the execution unit.
_Avoid_: session (reserved — the word survives only as the market-hours span that bounds
an Episode, the **Terminal session**, and transport vocabulary owned by other protocols);
run (say Instance for the identity, Episode for the span).

**Kestrel Terminal**:
The product: the market workstation for agents. Every face — CLI, API, MCP, SDK, web — is
a **Rendering** of the one Terminal, none of them plumbing for another; a **Frame** is one
instant of its screens. This repo's stake: the language, the **Kestrel Runtime**, the
perception layer (View/Frame/Rendering), and the local single-face Terminal session; the
durable cross-face session and its vocabulary live on the managed service.
_Avoid_: "the CLI" or "the web app" as the product (each is one face of the Terminal).

**Terminal session**:
The place a **Caller** sits at: standing screen state — View subscriptions, watchlist
and book view, pending operations — that faces attach to and detach from (the tmux
model). A Terminal session *launches* Episodes and **references** them; it never contains
their records, and it survives any one face disconnecting. It holds what is *on the
screens* — never strategy, prompts, or the author's reasoning, and it may never inject
wall time or nondeterminism into an Episode. Locally it is ephemeral and single-face; the
managed service makes it durable and cross-face. This is the only thing "session" names
in product vocabulary.
_Avoid_: using "session" for the execution unit (that is an **Episode**).

**Bus**:
The Episode's single truth: an append-only, schema-versioned stream of typed events
with monotonic `seq` — the audit trail, the replay substrate, and the grading corpus
at once. Reasoning rides the bus too (JOURNAL events), so pre-hoc vs post-hoc is
provable by `seq`, never by convention. The **canonical serialization is JSONL** —
determinism hashes and byte-identity certification are computed over it; storage
varies behind the BusStore seam (a local file today; archive/db adapters must
reproduce the canonical bytes exactly).
_Avoid_: log, event store.

**Blotter**:
The complete, replayable record of one Episode, projected **deterministically from its
Bus** — every event, order, fill, wake, and the author's reasoning (JOURNAL events),
stamped with certification, fidelity, and fill-model versions. The bus is the truth;
the Blotter is its projection: regenerable, byte-stable, never a second writer. Grade
replays buses; humans and review tooling read Blotters. (The desk's own word for the
day's record of orders and fills — deliberately market-native.)
_Avoid_: report, run record, log.

**Ledger**:
The queryable, **regenerable** index across Blotters — runs, plans, lineages, grades —
the substrate the leaderboard and lineage queries read ("names are data"). Derived
from buses/Blotters; never a second truth: delete it and rebuild it, byte-for-byte
answers. (Today: the sqlite tracker at `src/ledger` — **Registry**
stays reserved for the series phonebook.)
_Avoid_: registry (that word is the series phonebook), database (an implementation).

**Fidelity**:
How *real* an Episode's fills are — the axis from **modeled** to **realized**. **sim** and
**paper** are both *modeled*: the same probabilistic FillModel yields a per-fill `pFill`,
scored as expected-$ over the survival product `Π(1 − pFillᵢ)` — they differ only by feed
(sim replays recorded tape; paper takes a live feed in). **live** is *realized*: the fills
are actual. Carried with the fill-model version + per-fill **fill-claims** (which modeled
fills rest on `calibrated` support vs `extrapolated`). Fidelity is what a result may
*claim* — orthogonal to Certification (a sim Blotter can be certified yet low-fidelity).
_Avoid_: accuracy, confidence (prediction words; Fidelity is fill realism).

**Certification**:
The verdict on whether a Blotter is a *faithful, reproducible* record of its Episode — a
set of pass/fail/na **legs**, chief of which is **determinism** (re-project the Bus →
byte-identical Blotter). Paper/live add legs (detectors bit-for-bit, fills ⊆ live,
lifecycle divergence explained). Verdict is **certified** only if every *applicable* leg
passes, else **provisional**; numbers always render with the verdict attached.
Certification is record honesty, never strategy quality — a certified Blotter can hold a
terrible strategy. What a proof certifies is an Episode.
_Avoid_: validation, audit (too generic); never conflate with Fidelity.

**Judge**:
The deterministic, OSS-exported grader — Blotters → GradeResult — that any self-hosted
Kestrel runs to score a set of Blotters, emitting *both* metric families (the risk-honest
family: bankable EV, realized floor, expected-$; and the activity family: realized P&L,
fills, orders, positions, traded notional) over one shared rounding grid. Judge is the
recompute substrate certification rests on: it consumes only the public **protocol
Blotter**, so any outsider can re-derive the numbers, and the managed service's signed
output is byte-identical to what Judge produces from the published record; a signed grade that fails Judge's byte-check is not a Certified grade.
Distinct from **Grade** (the surface an author writes to request and score a result) and
from **Certified grade** (the signed output Judge makes recomputable).
_Avoid_: judge as a verb for grading (say "grade"); scorer, evaluator; conflating with
the Grade surface.

**Certified evidence**:
The `totals` and `fill_claim` fields the protocol Blotter carries so that certified
numbers are *outsider-recomputable* — the risk-honest metrics and the fill-claim support
partition travel on the wire alongside the record, not only inside the private engine.
Carrying them is what lets Judge re-derive a Certified grade byte-for-byte from the
published Blotter. The fields are additive-optional; their **absence** on a pre-widening
Blotter reads as UNKNOWN and fails closed for the risk-honest metrics — never a silent
zero.
_Avoid_: treating absent evidence as zero (absent = UNKNOWN); "the totals" alone (the
fill-claim partition is part of the evidence).

**SettleMarkVerdict**:
The verdict-only projection of the engine's settle mark that crosses onto the public
Blotter — the *derived staleness verdict* (`stale`, `source`, `mark_uncertain`, `note`)
without the raw vendor settle spot or its observation timestamps. The engine keeps the
licensed mark private; only the honest "is this mark stale / uncertain?" verdict ships,
so a Blotter can carry settle-mark honesty without redistributing vendor data.
_Avoid_: putting the raw settle price or its ages on the wire (verdict only).

## Shared expression layer

**Series**:
Anything with a name whose value changes over time — the universal operand of the
language (trigger operands, panes, grade columns are all series references). Two kinds,
and only two: **market facts** (signal space — `spot`, `vwap`, `velocity` — ambient per
signal instrument, visible even to spectators) and **org facts** (path-scoped in the
org tree — `pnl`, `dram.pnl`, `fills.avg_px` — resolved lexically from where the
statement sits, existing only in acting Episodes).

**Registry**:
The one shared phonebook of series. Register once → visible to every surface (trigger,
pane, grade column) by construction. Registration is taste-free; replay decides what
earns usage. An unresolvable series reads UNKNOWN → the referencing statement de-arms
cleanly with a logged reason — never crashes, never silently false.

**Trigger algebra**:
The shared WHEN expression language — named series × predicates (comparison, cross,
break-and-hold, distance, velocity, state, window, fill events) × AND/OR/NOT +
held/within. Used by Wake, Plan, and Grade filters alike.

**Window**:
The timescale parameter every rate/magnitude series carries — `velocity(1m)`,
`move(1w)`, `range(1d)`. **There is no absolute shock**: magnitude is judged at a
window, against that window's own trailing baseline (`p99`, `3sigma` — the portable,
cross-instrument form; absolute thresholds stay legal). A wake's delivered View zooms
to the wake's window: detection scale = rendering scale.

**Wake delivery**:
A Wake names the View it delivers; the wake decides *when*, the View decides *what*.
Delivery is a delta frame by default, keyframe on request. Past its attention budget,
wakes coalesce and downgrade — never silently drop (the squelch is visible in the
kernel).

**WakeHandler**:
The adapter seam between an Episode driver and its author: at each wake the driver
hands the adapter the delivered Frame; the adapter returns the author's response
(new or superseding statements, or nothing). The adapter is the only place wall
time may exist in an Episode (an external author deliberating); the driver owns
tape-time accounting (Deliberation record, Latency-fold) uniformly across
adapters. A wake boundary is checkpointable: driver state is serializable while
an author response is pending.
_Avoid_: wake callback, author hook.

**Staleness backstop**:
The one platform-default Wake in every acting Episode: if nothing woke you in N,
wake anyway. Author-tunable; not removable while holding positions. Spectators have
none.

**Scan**:
A Wake whose scope is a **universe** rather than a coverage — wide and slow (all
NYSE/NASDAQ at `move(1d) > p99`) where a coverage Wake is narrow and fast. The
discovery layer: a Scan fires → the PM evaluates → may author a new leaf (Book +
Coverage + thesis + budget) into the pod. Breadth × window-length is the attention
economics that keeps a wide universe affordable.
_Avoid_: screener (the retail noun; Scan is the Wake kind).

**Lineage**:
The identity a recurring name carries across authored instances: `fade-ladder` authored
fresh on 40 days is one strategy with 40 instances — the name is the leaderboard key.
**Names are data**: every free-text name (plan, wake, clause, tag) is a legible,
gradable aggregation key; clustering names with their graded outcomes discovers
emergent strategy families and sub-regimes nobody hand-defined. Name-families with
earned records graduate into the Armory.

**Regime tag**:
An open-vocabulary state series (`regime.intraday`) written by any authorized writer
at that scope — trader-agent (with logged reason), PM, or an app detector. The platform
defines **no taxonomy**: tags are opaque values; agents mint new ones freely
(emergence through authorship); Grade culls them (a gate that doesn't beat its ungated
counterfactual is refuted-as-posed).

**Post**:
A role in an agent organization, distinguished by its affordable deliberation
budget: PM and Strategist are slow, deliberate, frontier-class judgment;
Watcher is the fast reflex — low-latency perception → armed-plan control +
escalation (ADR-0032). A benchmark contestant fills posts; no single model fills them all well, because the posts' latency envelopes differ by orders of magnitude. You buy a **Seat** (the platform's sellable unit); you work a Post — the exchange floor's own split (renamed from "Seat", OSS-ADR-0057; PLAT-ADR-0057 pairs).
_Avoid_: seat (now platform-only vocabulary — the sellable unit), tier (that's
access, platform-side), role (overloaded; reserved platform-side for human
RBAC), chair, and using "post" for the thing a face attaches to (that is a
**Terminal session** — a Post deliberates; a session is sat at).

**Clock-honest wake**:
A wake whose deliberation consumes tape time (ADR-0040): while a post's agent
thinks, the market keeps moving, and the returning control lands as of its return time
(measured wall time + a configured latency buffer, recorded on the Bus so
replay/certification re-project byte-identically). Alpha internalizes latency —
there is no separate latency score. An Episode on data too coarse for this
(no 1s bars / event stream) is **latency-blind** and can never ground a latency
claim. Both edges are clocked: wake→control and the Watcher→Strategist
escalation round-trip.
_Avoid_: latency penalty, time-out (there is no lapse-to-null; late controls
execute late and the tape prices the delay)

**Deliberation record**:
The Bus event (`WAKE`/`deliberation`, bus_schema v6) that records one clocked
turn's cost: `measured_ms` (wall time of the post's whole turn, bounded
authoring loop and repair retries included) + `buffer_ms` (the configured
latency buffer), linked by `wake_seq` to the WAKE checkpoint it prices; its
`ts` IS the derived return time. Part of the byte-hashed Episode record —
replay/certification re-project from recorded costs, never re-time
(docs/design/clock-honest-wakes.md).
_Avoid_: latency event, timing record (it is a cost the tape charges, not a
side-metric)

**Latency-fold**:
The clock-honest squelch (ADR-0040): wakes whose ts falls inside a post's open
deliberation window cannot be delivered (its agent is thinking) and are folded —
visibly, via the coalesced counter — into ONE catch-up delivery at the post's
return time, which is a normal frozen-at-wake frame (kernel leads, ADR-0019)
with wake source `latency-fold`. Safety-class: never itself folded, never
silently dropped; a flat-book staleness probe is skipped, not folded.
_Avoid_: missed wake, dropped wake (nothing is dropped; the fold is visible
attention accounting)

**KestrelBench**:
The public trading-judgment benchmark run as governed seasons on the managed
service (governance and season vocabulary live platform-side). This repo's
stake: the harness is runnable here, results are deterministically
recomputable here, and no governed season runs latency-blind (ADR-0040).
_Avoid_: AgentTradingBench