# The two-tier Strategist + Watcher agent architecture — judgment at its right speed and price

**Status:** **Accepted (2026-07-14) — the 7 open questions were ANSWERED AND APPROVED BY THE OWNER;
the ADR is unblocked for implementation. NO CODE HAS LANDED.** (Proposed 2026-07-13; co-shaped live
with the owner; reviewed and approved 2026-07-14 — the answers are recorded verbatim-in-substance
under [Resolved](#resolved-owner-approved-2026-07-14), which replaces the old "Open questions"
section.) The ADR remains DESIGN: it introduces no new determinism-core plumbing and lands no code —
what changed is that its open questions now have owner-approved answers that **bind** the
implementation rather than blocking it. It extends ADR-0012 (the Simulator seam — `open`/`decide`/`close`, the `AgentTurn`, the
determinism line at the returned turn; slow judgment + fast deterministic reaction), ADR-0013 (the
first-party BYOK harness, the config matrix, the controlled/optimized divisions), ADR-0029 (the
agent-requested emergent View authoring loop; the Brief/Mandate two-channel split it folds in),
ADR-0030 (the grammar is measured, not designed), ADR-0031 (the envelope-free pure-Kestrel turn),
and KM-ADR-0026 (kestrel.markets — "Language is interface: Brief, Journal, Thesis"; the Brief/Mandate
channels and the hard admission guard). It reconciles the Pod/Book org (CONTEXT.md) by making the
PM↔Trader desk literal across two model tiers. **Nothing here weakens a single determinism or
fail-closed non-negotiable; it composes existing seams into a two-tier cascade.**

> **AMENDED 2026-07-14 (evening business/growth grill) — THE CASCADE IS FIVE LAYERS, AND THERE ARE
> TWO CHEAP-MODEL ROLES, NOT ONE.** Everything above and below stands unchanged; the amendment is
> **additive** and lives in **§10–§14**. In one line: the ADR as accepted describes the cheap model
> *managing an armed Plan*; the amendment adds a **second, distinct cheap-model role upstream of the
> strategist** — a **watcher-gate** that decides, per candidate, whether the strategist's expensive
> attention should be spent at all. The full cascade is **Scan → GATE → Strategist → MANAGER →
> Human**. **Naming, from here on: this ADR's "watcher" is the WATCHER-MANAGER** (§5's tactical
> authority is unchanged and is *its* authority); the new role is the **WATCHER-GATE**. Where the
> accepted text says "watcher", read "watcher-manager". Nothing in §1–§9 is retracted, and nothing
> here weakens a determinism or fail-closed non-negotiable: the gate sits *below* the authoring line
> entirely — **it spends attention, it never authors an action** (§10.4).

## Context

The platform already has two of the three tiers a trading desk needs, and it has named them
precisely. Underneath everything sits the **deterministic runtime** (ADR-0011/0012): armed Plans fire
at machine speed (`fire-then-inform`), and every authored action passes the **admission Gate** (SELL
floored at intrinsic, budget clamp, never naked, the honesty guard — ADR-0012 §4, KM-ADR-0026's
mandate-is-the-only-admission-input rule). Above the determinism line sits a **single Agent** (the
ADR-0012 seam), invoked at Wake cadence, that authors Kestrel — the slow, expensive judgment.

The owner's insight (2026-07-13) is that **there is a missing middle tier**, and it maps exactly onto
the desk the org model already describes. The single Agent today is asked to be two people at once:

- the **PM / strategist** who sets the day's thesis, allocates the risk envelope, and re-frames on a
  regime break — a judgment made *rarely* and worth a frontier model's price; and
- the **trader** who sits in the loop and *manages* the armed book at wake cadence — reload, exit,
  trim, size-within-budget — a judgment made *thousands of times* and ruinously expensive to buy from
  a frontier model on every wake.

Collapsing both into one frontier Agent at one cadence forces a bad economics: either you wake the
frontier brain often (pay a fortune for cheap in-loop reactions) or you wake it rarely (and the book
goes unmanaged between the expensive re-frames, or is left to pure deterministic Plans that cannot
exercise judgment). This is the same shape as the ADR-0029 "force a Plan you do not believe vs. stand
down" bad choice, one level up: **the desk needs a fast judge in the loop, and today there isn't
one.**

The three tiers, by clock and price:

| Tier | Clock | Cost/decision | What it is today |
|---|---|---|---|
| **Deterministic runtime** | microseconds | ~free | the pre-armed trigger firing + the admission Gate (ADR-0011/0012) — **exists** |
| **Watcher (small/fast model)** | seconds (wake cadence) | pennies | **the missing middle tier** — judgment-in-the-loop |
| **Strategist (frontier model)** | a few times/day | dollars | today's single Agent, but doing too much — **exists** |

The watcher is too *slow* to be a hard deterministic trigger (it reasons; a Plan trigger is a boolean
over the series algebra) and too *fast and cheap* to be a frontier call (it fires on every wake). It
is precisely the **judgment-in-the-loop layer that did not exist**. The design principle is old and
we claim it as lineage, not novelty (research-program §"Real-time reactive executives"): **System-2
sets the frame, System-1 trades it** — but made literal across two *model* tiers, with the
deterministic runtime as the fail-closed floor beneath both.

The tension is the platform's usual one, in a new place. Adding a cheap, possibly-fine-tuned,
possibly-weak model *inside the hot loop* sounds like it should relax the safety story. It must not.
The whole point of the design is that a weak or even adversarial watcher is **structurally incapable
of exceeding its mandate**, because it authors *above* the determinism line exactly like every other
Agent, and every action it emits passes the *same* admission Gate. The watcher buys judgment; it never
buys authority. Every decision below is placed to keep that true.

## Decision

### 1. The tier cascade — three tiers, each at its own clock and price

> *Amended 2026-07-14: the cascade is **five layers** — a **Scan** below and a **watcher-gate**
> between the Scan and the strategist, plus the human above. §1 stands as written for the three
> tiers it names; **§10 supersedes its count, not its content.***

The trading agent is a **cascade of three tiers**, not one model. Each tier owns the decisions that
belong at its latency/cost point, and each tier's output is *admitted, not trusted* by the tier
below.

- **Deterministic runtime (microseconds, ~free).** Unchanged from ADR-0011/0012. It fires armed Plans
  at machine speed (`fire-then-inform`), and — the load-bearing part — it is the **admission Gate**
  that every authored action from *either* model tier must pass. It exercises no judgment; it enforces
  bounds. This is the fail-closed floor.

- **Watcher — a small/fast model (seconds, pennies).** The **new middle tier**. It is an ADR-0012
  `Agent` (the same `open`/`decide`/`close` seam) running at **wake cadence**, in the loop. It watches
  a token-lean **View** (its percept) and reacts *within* the strategist's armed **Plan** and
  **Mandate**: manage, reload, exit, adjust, size-within-budget (§5). It authors Kestrel (ADR-0031)
  above the determinism line, exactly like today's Agent. When it reaches the edge of its mandate or
  the edge of its own certainty, it does not guess — it **escalates via a Wake** to the strategist
  (§4). It handles the *thousands* of in-loop reactions.

- **Strategist — a Fable-class frontier model (a few times/day, dollars).** Today's single Agent,
  narrowed to what only a frontier brain should do: at the OPEN it authors the day's **Plan** (standing
  authority), **Brief** (directional thesis), **Mandate** (the hard envelope), and **View** (what the
  watcher watches). It re-frames on a **regime break / SHOCK** or on a watcher escalation, issuing a
  new Plan/Brief/Mandate. It handles the *few* expensive judgments that set the frame for everything
  below.

The cascade is strictly **admit-downward**: the strategist's Plan/Mandate is *admitted* by the runtime
(a Plan is a bounded-risk contingent program, never arbitrary authority); the watcher's actions are
*admitted* by the runtime against that Mandate. Neither model tier is trusted; both are bounded. This
is the org model made literal: the strategist **is** the allocating Pod/PM, the watcher **is** the
Trader operating a Book under an assigned Coverage, and the runtime is the risk envelope the org tree
already carries (CONTEXT.md "Pod", "Trader", "Book", "Coverage").

### 2. The inter-tier interface IS Kestrel's existing surfaces (the load-bearing point)

**This is not new plumbing. The protocol between the PM and the trader already exists — it is the four
Kestrel surfaces plus the two KM-ADR-0026 channels.** The strategist authors the surfaces; the watcher
operates within them and escalates through one of them. Nothing in the wire contract is invented for
this ADR; the surfaces are *reused with an inter-tier reading*.

| Surface | Authored by | Inter-tier role |
|---|---|---|
| **Plan** (ADR-0001; standing, bounded-risk contingent program) | strategist | **Standing authority.** The armed book the watcher manages. The watcher operates *inside* armed Plans (reload/exit/adjust within them, §5); it may not arm new *unbounded* authority. The Plan is `fire-then-inform` at machine speed regardless of either model tier. |
| **View** (ADR-0001/0009; standing definition of what to see, token-budgeted) | strategist | **Exactly what the watcher watches.** The strategist authors a **token-lean** View precisely because the watcher watches it *continuously* at wake cadence — cheap perception is what makes in-loop watching economical. The frozen View is also the watcher's training curriculum (§8). The watcher may itself request views (`SHOW VIEW`, ADR-0029/0031) within its budget. |
| **Mandate** (KM-ADR-0026; hard, machine-checkable, narrowing-only) | strategist | **The hard boundary.** The envelope the watcher acts within — and the **only** input to the admission algebra (§3). The strategist sets it; the runtime enforces it; the watcher can never widen it. |
| **Brief** (KM-ADR-0026; soft, directional English, `brief_hash`) | strategist | **Directional guidance — the PM→trader channel.** The thesis/philosophy/persona the watcher reasons *from* when deciding manage-vs-escalate. Hard guard (KM-ADR-0026, non-negotiable): the Brief **never** enters admission — it directs the watcher's perception and authoring, it never authorizes anything. |
| **Wake** (ADR-0001; standing subscription over the trigger algebra) | strategist authors the watcher's cadence; watcher authors escalations | **Two readings.** (a) The strategist's Wake sets *when the watcher looks* (its in-loop cadence, floored by the staleness backstop). (b) A watcher-emitted Wake is repurposed as **"wake the strategist"** — the escalation channel (§4). "When should I look?" becomes, at the inter-tier boundary, "when should the watcher wake the PM?" |
| **Grade** (ADR-0001/0006) | the runtime, over the whole cascade | Scores the *whole cascade*, with performance attributed across tiers (§6). |
| **Journal / Thesis** (KM-ADR-0026) | both tiers | The watcher's per-wake journal + the strategist's pre-registered Thesis are the record the strategist reads on a re-brief (§4) and the attribution instrument reads on grade (§6). |

The single most important consequence of §2: **building the cascade requires no new inter-tier
protocol.** The strategist and watcher already speak Kestrel to each other, because Kestrel is the
language the platform already made "authored outside, measured inside" (KM-ADR-0026). The two tiers
are two `Agent`s over the *same* Session, reading and writing the *same* surfaces.

### 3. THE SAFETY KEYSTONE — the Mandate is enforced by the runtime's admission Gate, never by trusting the watcher

This is the foreground decision, and it is what makes a cheap, learned, possibly-adversarial model
safe in the hot loop.

**Every action the watcher authors passes the SAME fail-closed admission Gate as any agent** — the
identical Gate ADR-0012 §4 routes `placeOrder`/`cancelOrder` and a fired Plan through: SELL floored at
intrinsic, budget clamp, **never naked**, the bounded-risk envelope, and the ADR-0011 honesty guard.
The watcher is an ADR-0012 `Agent` above the determinism line; its `AgentTurn` is the *only* thing that
crosses the line; and it crosses **into the same Gate**, not around it. Concretely:

- The **Mandate is the sole admission input** (KM-ADR-0026's hard rule, unchanged). The watcher's
  Brief — its directional guidance — is structurally barred from the admission algebra. A watcher that
  *believes* it should exceed the envelope cannot: the Gate reads the Mandate, not the watcher's
  conviction.
- A watcher action that would exceed the Mandate (over-size, naked, past the envelope) is **refused at
  admission, fail-closed**, exactly as an over-reaching frontier-Agent action is today. The refusal is
  the ADR-0012 proportionate response: refuse-that-action-and-log, or STAND_DOWN on an unparseable
  whole turn — never a book-wide crash, never a silent clamp into a fantasy corner.
- Therefore a **weak, misbehaving, or adversarial watcher CANNOT exceed its mandate.** It has judgment
  only *within* the runtime-enforced bound. The worst a bad watcher can do is trade *badly inside its
  envelope* (which the Grade will punish) — it can never trade *outside* it (which the Gate makes
  structurally impossible). This is the precise property that lets us put a cheap learned model in the
  hot loop without importing its weakness into the risk surface.

**This ties directly to the obligation-preserving-standing-authority thesis.** A Plan is standing
authority with *preserved obligations* (bracket, invalidation, TTL) that the runtime enforces
independent of who is managing it. The watcher inherits authority to *manage* that standing Plan, but
the obligations ride with the Plan and are enforced by the runtime, not by the watcher's good behavior.
The watcher can reload or trim *within* the Plan's obligations; it cannot dissolve them. Delegating
management down a tier never delegates the obligation — the obligation is preserved by the runtime,
which is exactly the standing-authority guarantee ADR-0012 already makes, now spanning two model tiers.

The keystone in one sentence: **the watcher buys judgment; the runtime keeps authority.**

### 4. Escalation model — when the watcher wakes the strategist

The watcher does not silently absorb everything. When it reaches the edge of what it should decide, it
**escalates via a Wake** — the "call the PM" move. The escalation triggers (a config-tunable policy;
the **hybrid** shape is owner-approved — Resolved 1):

1. **Mandate-edge.** The watcher's best judgment would require an action *outside* its tactical
   authority (§5) or outside the Mandate — e.g. it wants to add risk beyond the armed envelope, arm a
   new thesis, or re-allocate. It does not attempt-and-get-refused; it escalates, because the *right*
   actor for a mandate change is the strategist.
2. **Uncertainty threshold.** The watcher's own certainty drops below a threshold (a legible signal —
   see §8's grammar-forced-comment reasoning, which makes the watcher's confidence a first-class,
   trainable output). Low certainty = "I am out of my depth; call the PM." This is the model-tier
   analog of ADR-0029's "do not force a Plan you do not believe."
3. **Regime shift / SHOCK.** A structural regime break (the percept crosses a regime boundary the
   Brief flags, or a SHOCK keyframe fires). Re-framing on a regime break is definitionally the
   strategist's job.
4. **A Brief-flagged event class.** The Brief may enumerate event classes ("on an FOMC print", "if the
   0DTE gamma flips") that must always escalate regardless of watcher certainty — the strategist
   pre-declares what it wants to be woken for.

**The Wake surface is the escalation channel.** A watcher-authored Wake carries the escalation reason
(mandate-edge / low-certainty / regime / brief-flag) — the standing-subscription surface, read at the
inter-tier boundary as "wake the PM." It spends *attention*, not risk (ADR-0001's Wake invariant),
which is exactly right: escalating costs a frontier call, never an unbounded action.

**The re-brief handoff.** On escalation, the strategist is invoked with the watcher's **journal +
current book/Mandate state** (the ADR-0012 acting Frame plus the watcher's per-wake journal since the
last brief — the KM-ADR-0026 Journal is the narrative the PM reads before re-arming). The strategist
issues a **new Plan / Brief / (optionally) Mandate**, which supersede the standing set (ADR-0012
`supersede`); the watcher resumes managing under the new frame. The handoff is a normal supersede — no
new machinery — with the watcher's journal as the strategist's input context. Between escalations the
watcher runs autonomously in the loop; the strategist sleeps.

### 5. The watcher's tactical authority — scoped

The watcher's authority is **tactical management within armed Plans and the Mandate**, and nothing
more. Precisely, what Kestrel it MAY author:

- **Manage** an armed Plan: adjust its bracket (tighten a stop, trail a TP), advance an invalidation,
  extend/shorten a TTL — *within* the Plan's obligations and the Mandate.
- **Reload / exit / adjust** a position the armed Plan already authorizes: re-enter after a stop
  (within the Plan's re-arm terms), exit early, scale.
- **Size-within-budget**: choose size for an action the Plan authorizes, clamped by the budget the
  Mandate sets — the Gate enforces the clamp regardless (§3).
- **Reschedule its own next Wake** (its in-loop cadence), and **request a View** (`SHOW VIEW`,
  ADR-0029/0031) within its attention budget.
- **Stand down / pass** a wake (ADR-0031 `STAND-DOWN` / empty turn) — the honest "nothing to do here."

What the watcher may NOT author (these require the strategist — the watcher **escalates** instead,
§4):

- **Arm new unbounded authority** — a genuinely new thesis, a new instrument, a Plan outside the
  standing set's scope. (The boundary case is settled — Resolved 2: arming a *new bounded Plan within
  the existing Coverage and Mandate* **is** watcher-authorable; a new Coverage / thesis / allocation is
  strategist-only.)
- **Exceed the envelope / widen the Mandate** — structurally refused at admission anyway (§3), but the
  *right* response is to escalate, not to attempt-and-get-refused.
- **Re-allocate risk across Books** (a Pod/PM allocation act — the strategist's, per the org model).

The scope is deliberately the Trader's world in the org model: "a Trader's world is its Book" —
positions and orders inside an assigned Coverage and budget, never allocation, never a new mandate.

### 6. Determinism holds, and the Grade attributes across tiers

**The watcher is just an ADR-0012 `Agent` at a faster cadence.** Both tiers author *above* the
determinism line; the runtime executes and grades *below* it. The ADR-0012 determinism contract is
untouched:

- Both tiers return `AgentTurn`s; each turn's actions serialize to Bus events through the same
  canonicalizer; the graded Bus is a pure function of Bus bytes (ADR-0011).
- **`recordedAgent` replay holds for the whole cascade.** `CapturedTurns` keys on wake ordinal
  (ADR-0012 §4b); a two-tier run captures *both* tiers' turns at their ordinals (strategist turns at
  OPEN / re-brief ordinals, watcher turns at in-loop wake ordinals). Replaying the captured cascade
  re-emits a byte-identical graded Bus. `SimRunId = sha256(graded Bus)` is unchanged. A recorded
  cascade re-runs with **no model calls at either tier** — the deterministic re-run substrate spans
  both tiers for free, because both are already above-the-line `Agent`s.
- Escalation Wakes are Bus/CONTROL events (attention, not risk); the strategist's re-brief supersede is
  a normal supersede — both replay byte-identically.

> *Amended 2026-07-14: the ladder gains a **fifth** level — **`gate_alpha`** — and `watcher_alpha` is
> renamed **`manager_alpha`** (same counterfactual, unambiguous name now that there are two cheap-model
> roles). The frozen-counterfactual method below is unchanged; see **§12**.*

**Grade attribution across tiers — a three-way `management_alpha` decomposition.** The Grade scores
the whole cascade (realized/bankable EV over the graded Bus, ADR-0006/0014). But the *point* of the
architecture is to know **which tier earned the P&L** — was it the strategist's plan/brief quality, or
the watcher's in-loop execution quality? We propose extending the EVALUATION Part-2 counterfactual
(`management_alpha = EV(supervised) − EV(frozen armory)`) into a **three-level ladder**, each level a
frozen counterfactual over the *same* recorded tape and fill model:

    strategist_alpha  = EV(frozen strategist Plan/Brief, replayed pure-algo)      − EV(buy-and-hold / benchmark)
    watcher_alpha     = EV(cascade: watcher manages the strategist's armed Plan)  − EV(frozen strategist Plan, no watcher)
    cascade_total     = strategist_alpha + watcher_alpha  (= EV(cascade) − benchmark)

Read the three:
- **strategist_alpha carries it** → the frame (plan/brief) is the product; the watcher is executing a
  good plan competently (and a cheaper/simpler watcher may suffice — feeds §8's size sweep).
- **watcher_alpha carries it** → in-loop management is the product; the value is the watcher trading the
  frame the strategist set. This is the two-tier thesis *confirmed* — the missing middle tier earns its
  keep.
- **Neither** → an honest null on this cascade; iterate the Brief, the View (the watcher's percept), or
  the escalation policy (each independently gradable, per EVALUATION).

This is the org model's PM-vs-Trader attribution made literal: `strategist_alpha` is the PM's
allocation/thesis alpha, `watcher_alpha` is the Trader's execution alpha, and the frozen-Plan-no-watcher
counterfactual is exactly the "armory alone" arm of EVALUATION Part 2 with the watcher as the
supervision layer. (The escalation boundary is settled — Resolved 3: the ladder is confirmed and the
escalation boundary **decomposes** — the watcher is credited for **the call** (recognizing the moment),
the strategist for **the answer** (the re-brief's quality). A profitable escalation pays **both** — the
alternative teaches the watcher never to escalate.)

**The ladder is FOUR tiers, not three** (owner decision, 2026-07-14 — Resolved 3, extended). Above the
strategist sits the **human**, whose instruction lands on the Bus as a **typed event** (ADR-0035), so
the counterfactual is free: replay with that event **ablated** and the delta is an honest
**`human_alpha`** — which is also a **$-labeled supervision signal** for §8's training program. The
full ladder: **deterministic runtime → watcher → strategist → human.** Details, consequences, and the
two caveats: Resolved 3.

### 7. Benchmark-as-architecture — the subject is a system, not a model

> **NOTE — dependency resolved, owner 2026-07-15.** §7 (the family × size × **CFG** regime breakout
> map) and **§8.4** (CFG guarantees valid Kestrel at loop speed; "envelope-free (ADR-0031) is what
> makes the single Kestrel grammar constrainable") rested on **ADR-0031**, which was only *Proposed* —
> the **authority inversion** flagged in `docs/adr/NOTE-agent-architecture-reconciliation-0029-0031-0032.md`
> (#8): an *Accepted* ADR (this one) depending on a *Proposed* one. **ADR-0031 is now Accepted
> (2026-07-15)** — the pure-Kestrel turn is canonical, envelope-free is the single constrainable
> grammar CFG acts on, and the two open grammar keywords are blocking beads kestrel-qim.1 /
> kestrel-qim.2. §7's CFG-clean-map argument and §8.4's loop-speed-CFG dependency therefore stand on
> an Accepted foundation; nothing in §7/§8.4 changes. (Tracker: **kestrel-2sy**.)
>
> **Naming pointer:** per the 2026-07-14 amendment (§10, header), **bare "watcher" is DEPRECATED in
> new docs** — write **`watcher-GATE`** (the attention-allocation role, §10.3) or
> **`watcher-MANAGER`** (the in-loop management role, §5, this ADR's original "watcher"). §1–§9's
> unqualified "watcher" reads as **watcher-manager**. (Companion three-layer mapping for
> `STAND-DOWN`/`standDown`/`STAND_DOWN` lives in ADR-0031's ratification note.)

The single sharpest reframe: **the benchmark subject is no longer "a model" — it is an ARCHITECTURE.**
The comparison axis grows one level. The three architectures under test:

- **frontier-only** — today's single Agent at frontier price, at whatever cadence (the ADR-0013
  status quo);
- **small-only** — a single small/fast model doing both jobs (cheap, but under-judging the frame);
- **strategist + watcher cascade** — this ADR.

The **System Profile / ConfigId** (ADR-0013 §d, SYSTEM-PROFILE.md) already captures a run's identity as
content-hashed config; the architecture folds in as **config axes** — the tier topology (single vs
cascade), the strategist model, the **watcher model (and its size — §8)**, the escalation policy, and
the watcher's View/Brief. A cascade run is a distinct `ConfigId`, so it mints its own grid column and
never averages with a frontier-only column (the controlled/optimized discipline, ADR-0013 §d,
unchanged). The `face` axis and the m9i.7 tournament shape are undisturbed — a cascade is a *system
profile*, benchmarked exactly like any other.

**The measurable claim** the architecture exists to test: **does the cascade beat both frontier-only
and small-only on the cost/latency-vs-grade frontier?** The leaderboard already ranks
`bankable_ev`/`floor_pnl`/`fidelity_adjusted_ev` and — crucially — `ev_per_ktoken` (the attention
axis, ADR-0012 §5). The cascade's thesis is a **Pareto claim**: it should match frontier-only's grade
at a fraction of frontier-only's cost (because the frontier brain wakes a few times/day, not every
wake), and beat small-only's grade (because the frame is set by a frontier brain, not under-judged by
a small one). If the cascade is *not* on the frontier, that is an honest, publishable null — the
architecture is measured, not assumed (ADR-0009/0030 discipline, one level up).

**The core scientific contribution — the watcher BREAKOUT MAP (owner, 2026-07-13).** The watcher sweep
is not one-dimensional (size, §8). It is a **3-axis map: MODEL FAMILY × SIZE × TRAINING-REGIME**
`{prompted / CFG-constrained / fine-tuned}`. The headline benchmark result is a **breakout map** over
that space: **WHERE does a viable in-loop watcher emerge — the smallest/cheapest `(family, size,
regime)` that HOLDS the grade at watcher cost/latency?** Family is a *distinct* axis, not a nuisance
parameter, for four reasons the ADR records:

1. **Capability-per-parameter differs across families** (Qwen vs Llama vs Mistral vs Gemma vs the cheap
   OpenAI/Claude tiers) — a 14B in one family may match a 32B in another.
2. **Percept/tokenizer fit differs by family — a real interaction, not noise.** The research-program
   Qwen tokenizer audit showed families digest the relative-candle/percept representation very
   differently; **a family whose tokenizer fits the percept can break out at a SMALLER size.** So
   `family × percept-fit` is a genuine interaction the map must resolve.
3. **CFG makes the map CLEAN.** By guaranteeing valid syntax at decode time (ADR-0031 §5), CFG removes
   the authoring-noise confound — e.g. dry-run-2's ~33% Gemini envelope-non-emission failures *hid its
   actual judgment*. Constrained to emit valid Kestrel, the map measures **pure judgment-per-parameter,
   not "can it emit valid Kestrel."** This is why CFG is an axis, not just an enhancement: it changes
   *what the benchmark is measuring*.
4. **Fine-tuning shifts the breakout threshold DOWN** — a fine-tuned 7B may break out where a prompted
   32B does. The regime axis is where the SFT/RL program (§8) buys its economics.

Framed as the paper's likely headline: the contribution is **not "which model trades best," but "where,
across families and sizes, does viable in-loop trading judgment EMERGE, and how cheap is the smallest
`(family, size, regime)` that holds the grade."** That map *is* the cascade's real economics.

**Benchmark economics — amortize the frontier plan; sweep the watcher cheaply.** The `strategist ×
watcher × cell` matrix is made affordable by a **record-once-replay-many discipline applied to the
frontier PLAN** (the same discipline the benchmark already uses for tapes). Per cell, the frontier
strategist's **Plan + Brief + curated context + reasoning traces + chosen View** is authored **ONCE**
and frozen as a **shared, content-hashed fixture** (`plan_fixture_sha`). Every watcher variant in the
breakout map runs against the **byte-identical frozen frontier plan+context.** Therefore:

    matrix cost  =  (frontier plan authoring × cells, once, expensive)
                 +  (watcher variants × cells, cheap, replayed against the frozen plan)

The expensive frontier call is **amortized across the whole watcher sweep, not multiplied by it.**
Bonus — it is a **cleaner comparison**: because every watcher variant faces an *identical* plan and
context, **the only variable is the watcher**, so the breakout map is a *controlled* judgment-per-
parameter measurement with strategy held fixed (the ADR-0013 controlled-division discipline, applied
to the watcher tier). The frozen frontier plan is a fixture keyed into the System Profile alongside the
tape sha and fill model; a re-authored plan mints a new fixture hash and a new column, never a silent
contamination.

### 8. The component program — the watcher is a fine-tuned small model, and its SIZE is a benchmark sweep

**Why the watcher can be SMALL — two levels of distillation (the core mechanism, owner 2026-07-13).**
This is the load-bearing argument for the whole cascade, and it is *why* the breakout threshold (§7) is
lower than intuition suggests. The frontier strategist hands the watcher not just *actions* but a
**carefully curated CONTEXT**: the Brief, the Thesis, the reasoning traces, the **chosen View** (what to
even look at — the frontier decided the watcher's percept), and the **forced-comment reasoning welded
into each Plan clause** (ADR-0013 (b) / ADR-0031 §2c). The watcher operates *inside that scaffold*: it
does **not originate strategy — it APPLIES frontier-curated judgment in the moment.** Given, welded into
the armed Plan, "*fade the poke — +399M gamma wall at 510 pins it, skew flat = unfunded breakout*," a
small model can act correctly **without deriving that reasoning itself.** Two distinct distillations
stack:

- **Training-time distillation** — SFT from frontier trajectories + RLVR from the grade (below). The
  frontier's judgment is baked into the watcher's *weights*.
- **Inference-time distillation** — the frontier's *actual reasoning is present in the watcher's
  context* every wake (the Brief, the Thesis, the inline comment-reasoning on each clause, the curated
  View). The watcher stands on the big model's reasoning *at run time*, not only at train time.

**The small model stands on the big model's reasoning at both levels.** The consequence: the breakout
threshold sits **lower** than a naive "how smart must an autonomous trader be" estimate, because
**faithfully applying a well-reasoned frame is a far smaller ask than frontier-grade reasoning.** The
**curated View + the inline comment-reasoning are the vehicle** that carries frontier judgment down to
the cheap tier — which is exactly why §2 has the strategist author a token-lean View *and* why §8's
forced-comment reasoning is load-bearing, not decoration. This mechanism is what the breakout map (§7)
measures the reach of.

The watcher is also where the platform's SFT/RL/CFG/forced-reasoning threads land as a concrete
component. The program, in dependency order:

1. **Cold-start: a PROMPTED small/fast model is the first watcher (the tracer bullet, below).** BEFORE
   any fine-tuning, the watcher is a *prompted* mid-size model (haiku, or a cheap open 30–70B). This
   makes the architecture **testable immediately** — the cascade is wireable and gradable with zero
   training. Fine-tuning is an *optimization of a working architecture*, never a prerequisite for it.
2. **SFT: distill the watcher from frontier trajectories.** Once the cascade runs, the strategist (and
   frontier watchers) produce in-loop management trajectories over the frozen View. These are the SFT
   curriculum: the watcher learns to author valid in-loop Kestrel reactions from a frontier model's
   in-loop judgments. **The frozen View is the curriculum** — this is why §2 has the strategist author
   a *token-lean* View the watcher watches continuously: it is simultaneously the cheap percept and the
   stable training input (ADR-0009/0029 "discover then freeze the View before small-model SFT/RL").
3. **RL from the grade (RLVR).** The Grade (§6, `watcher_alpha` especially) is the verifiable reward:
   RL the watcher on the realized in-loop management alpha over recorded tape. The reward is the
   platform's honest grade, not a proxy.
4. **CFG guarantees valid Kestrel at loop speed.** Grammar-constrained decoding (ADR-0031 §5) is
   *especially* valuable for the watcher: a small model in the hot loop cannot afford a repair-retry
   round trip on every wake, and CFG makes syntactically-invalid Kestrel unrepresentable at the
   sampling step. Envelope-free (ADR-0031) is what makes the single Kestrel grammar constrainable.
   Semantic validation stays post-parse (ADR-0031 §5.4), and the Gate is the ultimate backstop (§3).
5. **Grammar-forced-comment reasoning makes the watcher's fast judgments legible + trainable.** The
   watcher's `#` comment reasoning (ADR-0013 (b) / ADR-0031 §2c) is not decoration: it is the legible
   trace of a fast judgment, and — forced by the profile — it makes the watcher's *certainty* (§4
   trigger 2) and *rationale* first-class outputs that SFT/RL can train and the emergence telemetry
   (ADR-0030) can measure. A legible fast judgment is a trainable fast judgment.

**The watcher's model SIZE is a TUNABLE, and a first-class benchmark sweep (owner refinement,
2026-07-13).** Do **not** hard-code a size. The design principle is: **the watcher is the SMALLEST
model that HOLDS THE GRADE — not the smallest model possible.** The argument, which belongs in the
architecture:

- **Latency headroom.** The watcher sits at the **second-scale in-loop tier, NOT the microsecond
  deterministic tier.** At second-scale cadence, the *absolute* latency gap between a 3B and a 32B
  model is small (both are well under the wake budget), while the *capability* gap is large — and even
  a 32B is still **10×+ faster and cheaper than a Fable-class frontier call.** So there is latency
  headroom at this tier, and the right move is to **spend it on capability.** A 32B (Qwen2.5-32B class)
  is the likely sweet spot; a 3B may *under-judge* the in-loop manage/reload/exit decisions.
- **Make it a config / System-Profile axis and SWEEP it — as the SIZE axis of the §7 breakout map.**
  Watcher size is a `ConfigId` axis: **3B / 7B / 14B / 32B**, crossed with the family and training-regime
  axes (§7) and measured against **grade × latency × cost**. "**How small can the watcher be while
  holding the grade?**" is the size-projection of the breakout map — a publishable result that sets the
  cascade's *actual* economics.
- **Practicality.** 32B is still light: it runs quantized on a Mac Studio / single GPU, fine-tunes
  affordably (LoRA or full), and grammar-constrains on Fireworks/Together — so the size sweep is not a
  heavy commitment.

### 9. What is NOT decided here

This ADR decides the *architecture* and the *interface*. It does **not** implement anything: no code
has landed. The seven questions it originally left open are now **answered and owner-approved**
([Resolved](#resolved-owner-approved-2026-07-14)) — they bind the build rather than block it; what
remains genuinely undecided is only what the build itself will measure (where the breakout lands, what
the swept cadence budget costs). It does not change any determinism-core contract, any
admission-Gate rule, any surface grammar (the surfaces are *reused*, not extended — the only grammar
work, `STAND-DOWN`/`SHOW VIEW`/`CANCEL`, is ADR-0031's, not this ADR's), or any existing ConfigId axis.

---

## AMENDMENT (owner-approved 2026-07-14, evening) — the five-layer cascade

### 10. The cascade is FIVE layers, and there are TWO cheap-model roles

#### 10.1 The layer this ADR was missing sits UPSTREAM of the strategist, not downstream

§1's cascade begins at an *already-chosen* candidate. It answers **"who manages the armed Plan?"** — it
never asks **"where did the candidate come from, and who decided the strategist should look at it?"**
Today the answer is implicit and expensive: a fixed Coverage (or a human) hands the strategist a name,
and the frontier model looks at whatever it is pointed at. That is fine for one Book and one ticker. It
is also **the binding constraint on breadth** — and breadth is where the undiscovered money is.

The amendment names the missing layers, and the load-bearing point is the same one §2 makes one level
up: **both of them already exist in the glossary.**

#### 10.2 The SCAN is the discovery layer — and it is already a Kestrel surface

CONTEXT.md (**Scan**) already defines it, and we use *its* word, not a retail one:

> "A **Wake** whose scope is a **universe** rather than a coverage — wide and slow (all NYSE/NASDAQ at
> `move(1d) > p99`) where a coverage Wake is narrow and fast. **The discovery layer**: a Scan fires →
> the PM evaluates → may author a new leaf (Book + Coverage + thesis + budget) into the pod. **Breadth
> × window-length is the attention economics that keeps a wide universe affordable.** *Avoid*:
> screener (the retail noun; Scan is the Wake kind)."

So the bottom layer is **not new plumbing either**: a Scan is a **Wake over the trigger algebra**,
evaluated by the **deterministic runtime**, over **named series** in the Registry. It is **free code** —
a wide net across the ~10k-name equity universe on cheap technical/calendar series (volatility
compression, range, open interest, calendar distance). It is **HIGH RECALL, LOW PRECISION BY DESIGN**,
which is the correct posture for a discovery layer, and *precisely why something must stand between it
and the frontier model.* (Never "screener", never "filter" — the Scan is the Wake kind.)

#### 10.3 The WATCHER-GATE — a second cheap-model role, and one binary call

Between the Scan and the strategist sits the **watcher-gate**: a **cheap/small model** that makes, for
each surviving candidate, **ONE BINARY CALL** —

> **"Is this worth spending strategist tokens on, or stand down?"**

That is all it does. It authors no Kestrel, arms nothing, sizes nothing, holds no position. It
**allocates the strategist's attention**, and nothing else. It is a **value-of-information** decision
(§11) — and it is a genuinely *different job* from the watcher-manager's: **the manager reacts inside an
armed frame; the gate decides whether a frame should be authored at all.** One is in-loop execution
judgment; the other is a purchasing decision about judgment itself.

**The five layers:**

| # | Layer | Clock | Cost / decision | Fires | Its job | Status |
|---|---|---|---|---|---|---|
| 1 | **Scan** — deterministic, free code | wide + slow | ~free | across the universe (~10k names) | **Discovery.** A Wake whose scope is a universe; cheap technical/calendar series. High recall, low precision *by design*. | CONTEXT.md **Scan** — the surface exists; no detector portfolio built |
| 2 | **Watcher-GATE** — cheap/small model | per candidate | fractions of a cent | thousands/day | **Attention allocation.** One binary call per candidate: spend strategist tokens, or stand down. **Authors nothing.** | **NEW — this amendment** |
| 3 | **Strategist** — frontier model | a few times/day | dollars | **only on what the gate PASSED** | **The frame.** Plan + Brief + Mandate + View (§1). **It never sees a dropped candidate.** | §1 — exists |
| 4 | **Watcher-MANAGER** — cheap/small model | wake cadence | pennies | thousands/day | **In-loop management of the ARMED Plan**: reload / exit / trim / size-within-budget (§5). | §1 — **this ADR's original "watcher"** |
| 5 | **Human** | rare | — | oversight | Sits above the root (CONTEXT.md **Pod**); the instruction lands as a **typed Bus event** (ADR-0035). | ADR-0035 — designed |

The **deterministic runtime is not a layer in this table** — it is the **floor beneath all five**,
unchanged (§1, §3): it evaluates the Scan's triggers, fires armed Plans at machine speed, and **admits**
every action either model tier authors.

#### 10.4 The gate is WHAT MAKES A WIDE SCAN PORTFOLIO AFFORDABLE

CONTEXT.md already states the constraint the gate exists to relieve — **"breadth × window-length is the
attention economics that keeps a wide universe affordable."** Read it as arithmetic. A Scan's *breadth*
is free (deterministic code over series). What is **not** free is the *judgment* applied to what the Scan
surfaces — and a high-recall Scan surfaces mostly noise. Pointing a frontier model at every survivor is
ruinous, and it is the **same bad economics §1 rejected at the management end, reappearing at the
discovery end**:

    ungated:   strategist_cost × (Scan survivors)                        ← breadth is unaffordable
    gated:     gate_cost × (survivors)  +  strategist_cost × (PASSED)
               └──── ~0 ───────────┘      └── the gate is the coefficient on the only line that GROWS ──┘

**The gate is a direct multiplier on the one cost line that grows with breadth.** Drive the pass-rate to
a few percent and a 10k-name universe costs roughly what a handful of names cost today. **Without the
gate there is no wide Scan portfolio; with it, breadth becomes a tunable** — traded against gate
precision, which is exactly the quantity §11's reward function optimizes.

**And it costs nothing in safety.** The gate sits **below the authoring line**: it emits a verdict, never
an `AgentTurn`. It cannot place an order, arm a Plan, or widen a Mandate — so the §3 keystone does not
even have to reach for it: **there is nothing to admit.** A bad gate is a bad *purchase* (wasted
strategist tokens) and a bad *miss* (foregone EV) — **never a risk event.** *A weak gate costs money in
attention and in opportunity; it can never cost money in risk.* Fail-closed, applied as the
non-negotiable requires: a gate verdict that is unparseable or UNKNOWN → **STAND DOWN with a logged
reason**, never a silent pass — and because a silent *drop* would be its own dishonesty, that candidate
enters the **audit sample** (§11.2), where the strategist eventually prices the miss.

#### 10.5 The standing, compounding asset is a PORTFOLIO OF SCANS — not a portfolio of Plans

The product consequence, and it falls straight out of the glossary's own lifecycles:

- **A Plan is ephemeral.** CONTEXT.md **Plan**: a bounded-risk contingent program with a **bracket,
  invalidation, and TTL** — it *expires by construction*. Yesterday's fade-the-poke Plan is worth nothing
  today.
- **A Scan is standing.** CONTEXT.md **Standing**: authored, armed, versioned, superseded — it **persists
  and acts over time.** A detector that finds money in July is still finding it in August.

So **the asset a desk compounds is its DETECTORS, not its trades.** A portfolio of Scans is the thing
that accumulates, forks, and is worth ranking — which is why §13 grades the Scans, and not merely the
P&L.

#### 10.6 The first detector to build is the FORWARD-LOOKING CALENDAR SCAN — and it needs NO grammar change

**A calendar is just another Series.** CONTEXT.md **Series**: *"anything with a name whose value changes
over time — the universal operand of the language (trigger operands, panes, grade columns are all series
references)."* So `earnings.in_days`, `fomc.in_days`, `expiry.in_days` are ordinary registry entries, and
**the trigger algebra already runs on them.** The Scan is authorable in today's grammar:

    WHEN earnings.in_days <= 1 AND iv_rank > p80

Three properties put it first, and the ordering is not close:

1. **It is nearly FREE to evaluate** — a table join across the universe. **No tick data needed.** It is
   the cheapest Scan that exists.
2. **It surfaces the BEST candidates** — you want to be positioned **before** the catalyst, not chasing
   it after. *Cheapest scan, best candidates.*
3. **It is DATE-BLIND BY CONSTRUCTION, so it preserves the blinding the holdback tier rests on.** The
   agent sees *"earnings in 1 day"* — **relative** time, exactly like "T-92m to close" — and **never**
   `2026-07-15`. This is the discipline the **SourceWatermark** already enforces (CONTEXT.md: `asOfSeq`
   is *"an **ordinal, never a wall clock**… no date ever rides a Field"*). A calendar Scan that leaked an
   absolute date would hand a training-cutoff-aware model the answer key and **burn the holdback tier**;
   a relative one structurally cannot.

The only new dependency is a **calendar/events feed** — trivial next to the tape sourcing already
underway.

### 11. The gate is a VALUE-OF-INFORMATION decision — and the BEST RL TARGET in the system

#### 11.1 The decision, posed honestly

The gate is **not** asked *"will this trade win?"* — that is the strategist's job, and asking a small
model to do it is the **small-only** arm §7 already rejects. It is asked a **strictly easier, strictly
better-posed** question:

> **Is the expected value of LOOKING at this candidate greater than the cost of looking?**

That is a **value-of-information** decision in its classic shape: *pay a known, small cost now (strategist
attention) to buy information whose value is uncertain.* As a policy:

    PASS  iff   E[ realized EV | the strategist authors on this candidate ]  >  strategist attention cost
    else  STAND DOWN

Two things follow at once. **(a)** The gate's task is **narrow and well-posed** — exactly the regime where
this ADR's own standing hypothesis bites (**Resolved 5: PERCEPT-FIT BEATS RAW SIZE** — a small model
SFT'd + RL'd on a proprietary graded corpus beats a frontier model prompted zero-shot on a narrow,
well-posed task). **(b)** The gate's decision is **denominated in attention** — the unit the platform
already meters (CONTEXT.md **Wake**: *"spends **attention** (tokens, wakes), never risk"*) and the
leaderboard already ranks (`ev_per_ktoken`, ADR-0012 §5). **The gate optimizes the exact quantity the
grade already measures.**

#### 11.2 Why the GATE, not the manager, is the best RL target

§8's component program (prompted cold-start → SFT → RLVR) was written with the manager in mind. **The
amendment re-orders it: train the GATE first.** Not a preference — the *shape of the reward*:

| | **Watcher-GATE** | **Watcher-MANAGER** |
|---|---|---|
| **Reward density** | **DENSE** — one label per candidate, thousands/day | **SPARSE** — one outcome per managed episode |
| **Credit assignment** | **TRIVIAL** — one decision → one outcome | **HARD** — dozens of in-loop wakes share one P&L |
| **Horizon** | **SHORT** — the label lands with the strategist's next turn | **LONG** — the whole life of the position |
| **Confounding** | **LOW** — the strategist's frame is *downstream* of the decision being graded | **HIGH** — a good manager on a bad frame still loses (that is what `strategist_alpha` exists to separate) |
| **Cost of one labeled example** | **~one cheap call + a strategist call you were paying for anyway** | one full managed episode |

**Dense, cheap, fast.** That is the whole argument. And the two error classes are *both* observable
without a single hand-labeler:

- **FALSE POSITIVE — DIRECTLY OBSERVED, for free.** The gate passed; the strategist **looked**; it spent
  tokens and then **stood down** (ADR-0031 `STAND-DOWN` — the honest "nothing here") or authored and
  lost. **Every PASS is a self-labeling example at zero marginal cost**, because that strategist call was
  going to be paid for anyway.
- **FALSE NEGATIVE — the SAMPLED AUDIT.** A drop produces no observation *by construction* — the
  selection-bias trap every gating system walks into. So **run the strategist on a random sample of the
  DROPS.** The audit is a deliberate, budgeted purchase of counterfactual labels; it is the only honest
  way to price a miss, and it is cheap **because it is a sample, not the population.** (The sampling rate
  `p` is a `ConfigId` axis, swept like every other — Resolved 4's discipline.)

**The reward function:**

    gate_reward  =   Σ_passed  realized EV
                 −   Σ_passed  strategist attention cost
                 −   (1/p) · Σ_audited-drops  realized EV the strategist would have earned

The inverse-propensity term `(1/p)` is what makes the sampled audit an **unbiased** estimator of the
foregone EV of the **whole** drop population, not merely of the sample. In one sentence: **the gate is
paid for the money it let through, charged for the attention it spent, and charged for the money it threw
away.** Every term is directly observed or unbiasedly estimated — **nothing is a proxy**, which is the
same standard §8.3 already sets ("the reward is the platform's honest grade, not a proxy").

The **manager's** RLVR program (§8.3) is **unchanged and still wanted**. It is simply *harder and later* —
and now correctly named `manager_alpha` (§12).

#### 11.3 The gate joins the breakout map

The gate takes **its own** `(family × size × training-regime)` sweep (§7), its own `ConfigId` axes, and
its own headline: **"what is the smallest, cheapest gate that HOLDS THE YIELD?"** Its economics are *more*
size-sensitive than the manager's — it fires an order of magnitude more often — so the breakout map
matters **more** here, not less. And §8's two stacked distillations apply with unusual force: the gate's
inference-time scaffold is the Scan's **own detector name and thesis** (CONTEXT.md **Lineage** — *"names
are data"*) plus the Coverage thesis (CONTEXT.md **Coverage**: *"instruments **plus the thesis for
why**"*). The gate, too, **applies** a frontier-authored frame rather than deriving one.

#### 11.4 The gate's thinnest slice

Mirroring the tracer bullet below, and reusing it: a **calendar Scan** (§10.6) over a small universe → a
**PROMPTED** small model as the gate (**no fine-tuning** — §8.1's cold-start discipline, unchanged) → the
existing frontier strategist on the passes → the existing graded Bus. Exactly **one** new moving part: the
**audit sample** (run the strategist on a random `p` of the drops). That yields a complete, honest
`gate_reward` corpus from day one — **the SFT/RLVR curriculum falls out of ordinary operation, with no
annotation pass.**

### 12. The attribution ladder gains a tier — FIVE levels

§6's ladder (extended to four by Resolved 3) becomes **five**. The method is unchanged — **frozen
counterfactuals over the same recorded tape and fill model** — and the rename carries no change of
meaning:

    runtime  →  GATE  →  STRATEGIST  →  MANAGER  →  HUMAN

    gate_alpha        = EV(strategist attention ALLOCATED BY THE GATE)
                      − EV(the SAME attention budget allocated AT RANDOM over the Scan's survivors)

    strategist_alpha  = EV(frozen strategist Plan/Brief, replayed pure-algo)      − EV(benchmark)

    manager_alpha     = EV(cascade: manager manages the strategist's armed Plan)  − EV(frozen Plan, no manager)
                        ── this is §6's `watcher_alpha`, RENAMED; same counterfactual ──

    human_alpha       = EV(session as run)  −  EV(session replayed with the human event ABLATED)

**Why `gate_alpha`'s counterfactual is BUDGET-MATCHED and not "ungated".** The naive baseline — *pass
everything* — is precisely the thing the gate exists to make unaffordable, so it cannot be the control:
you would have to buy the ruinous arm in order to measure the cheap one. The honest baseline is **the same
attention spent stupidly**: allocate the **identical token budget** uniformly at random across the Scan's
survivors. That isolates **the gate's selection skill** from **the Scan's raw yield**, and — the practical
virtue — **it costs the same, so it can actually be run.** The two then read separately:

- **`gate_alpha` carries it** → **selection** is the product. The gate is finding needles; a *wider Scan*
  is the next dollar.
- **The Scan's raw yield carries it** (`gate_alpha` ≈ 0) → **the detector** is the product: every survivor
  was worth a look, and the gate is only *saving* money, not *making* it. Still a win — just booked on the
  cost line rather than the alpha line.
- **Neither** → an honest null on this detector: the Scan is surfacing noise. **Cull it.** The glossary
  already writes this rule for detectors (CONTEXT.md **Regime tag**: *"Grade culls them — a gate that
  doesn't beat its ungated counterfactual is refuted-as-posed"*); we are applying it to Scans.

The five-level ladder is the desk made fully literal: **who found it (Scan) → who decided it was worth a
look (gate) → who framed it (strategist) → who traded it (manager) → who oversaw it (human)** — each
independently attributable and falsifiable, and each hand-off **decomposing** rather than paying one level
in full for another level's dollars (Resolved 3's rule, applied one layer deeper).

### 13. GRADE THE SCANS — the detector leaderboard

**A leaderboard of DETECTORS is more valuable — and more forkable — than a leaderboard of P&L.** *"Which
screens actually find money"* is the question a desk genuinely wants answered, and the platform can
already answer it with primitives it has:

- **A Scan is an authored name.** ADR-0006 is *"grade everything authored; names are data"*; CONTEXT.md
  **Lineage**: *"the name is the leaderboard key… clustering names with their graded outcomes discovers
  emergent strategy families and sub-regimes nobody hand-defined."* A Scan is a **named, standing Wake** —
  **already a legible, gradable aggregation key.** No new primitive.
- **The Ledger already indexes it.** CONTEXT.md **Ledger**: *"the queryable, regenerable index across
  Blotters — runs, plans, lineages, grades — the substrate the leaderboard and lineage queries read."*
- **The Armory is already the fork registry.** CONTEXT.md **Armory**: *"entries carry provenance and a
  replay record; **trust is graduated by provenance**"*, and **Lineage**: *"name-families with earned
  records graduate into the Armory."* A Scan with an earned record graduates the same way — and because
  **documents are modules** (ADR-0003), **forking someone's detector is an `import`, not a feature.**

**The per-Scan Grade columns** (every one derived from the Bus; none is new *data*):

| Column | What it answers |
|---|---|
| `candidates` | how wide is the net — the Scan's raw yield |
| `pass_rate` | how much of it survived the gate |
| `ev_per_candidate` | **the detector's yield — the headline** |
| `ev_per_ktoken` | the attention-normalized yield (ADR-0012 §5's existing axis) |
| `gate_alpha` | how much of the yield is *selection* vs *the detector itself* (§12) |
| **`audited_recall`** | **what the Scan + gate MISSED** — estimable *only* because §11.2's audit sample exists |

That last row is load-bearing, and it is the second reason the audit sample is **not optional**: without
it, **a Scan's Grade only ever sees what the gate passed** — a leaderboard ranked on a selection-biased
sample of its own decisions. **The audit sample is simultaneously the gate's false-negative estimator and
the Scan's unbiased-yield estimator.** One purchase, two honest numbers.

**The ranking fence is INHERITED, not invented.** A detector leaderboard is a *ranking*, so it obeys the
already-decided epistemic line rather than re-deriving one: a **practice**-tier Scan record is
**NON-RANKING** — the catalog is public and the events well-known, so a detector "discovered" on it is
**overfit by construction** (CONTEXT.md **Practice tier / Holdback tier**) — and a **served** (paid
holdback) record is likewise retired from any evidence role. **Only a sealed, never-served, frozen-
submission season is ranking-eligible** (KM-ADR-0018's three-tier addendum). In one line: **sell holdback
sims; RANK only on sealed seasons.** This ADR re-decides neither half.

### 14. Two consequences this amendment must RECORD (both are decided elsewhere)

#### 14.1 The training corpus — the consent problem DISSOLVES (this closes Resolved 3, caveat (b))

Resolved 3 left a caveat open: *"Training on PLATFORM users' instructions is a CONSENT/LICENSING question,
not a technical one."* **The five-layer cascade dissolves it**, because of what the two cheap models
actually need to learn:

- the **gate** needs `(candidate features → gate decision → strategist outcome → realized EV)`;
- the **manager** needs `(frame → action → outcome)`.

**Neither requires the user's Brief, Plan text, or thesis.** The line is clean enough to say out loud:

> **We learn from how the market responded to ACTIONS. We never train on your IDEAS.**

And the **bootstrap dependency vanishes with it**: the **personas are our own agents on our own corpus** —
**unlimited training data, zero consent exposure.** Customer telemetry becomes a **bonus, not a
dependency**, which is the only position from which a data policy can be negotiated honestly. The policy:

| Source | Policy |
|---|---|
| Our own personas / prop runs | **Train on everything.** It is ours. |
| **Practice**-tier runs | **Train freely.** Practice cells are public, well-known events (CONTEXT.md) — **there is no edge in them to protect.** |
| **Managed paid** runs | **Tactical `decision → outcome` telemetry ONLY**; opt-out available. **NEVER the Brief / Plan / thesis.** |
| **OSS / BYO-direct** | **NEVER.** Nothing leaves the machine — the standing differentiator (Resolved 3, caveat (b)). |

#### 14.2 The pricing consequence — the gate is a multiplier on the growing cost line

**Recorded here, decided in the platform repo** (**KM-ADR-0012**, *agent runtime hosting and token
reselling* — note this is the **platform's** ADR-0012, **not** this repo's Simulator-seam ADR-0012 — and
**KM-ADR-0028**, *pricing structure is data*):

- **The architectural fact.** Per §10.4, the gate multiplies down **the only cost line that grows with
  breadth**: strategist tokens. It is therefore not a quality knob — **it is the coefficient on the
  platform's largest variable cost**, and every point of gate precision books straight against it.
- **Two pricing bases, and they do not conflict.** **Resold third-party inference** (BYO / frontier via a
  gateway) stays **cost + 50%** — **KM-ADR-0012 unchanged and correctly scoped**: on that path we are a
  *reseller*, and cost-plus is the honest basis. **Kestrel's own models — the GATE and the MANAGER — are
  VALUE-priced**, decoupled from their cost. This is checkable rather than greedy: **a frontier model
  cannot do either job at any sane price** (the gate fires across a ~10k-name universe; the manager fires
  at wake cadence thousands of times), so **Kestrel can hold a high margin and still be the cheapest
  option on the board.** High margin *and* cheapest, simultaneously, is a real moat — and its credibility
  rests on this ADR's own hypothesis (**Resolved 5: percept-fit beats raw size**), which the breakout map
  (§7, §11.3) **measures** rather than assumes.
- **The ATTENTION METER is the margin-capture mechanism, not cosmetics.** The customer buys **attention** —
  the glossary's own unit (CONTEXT.md **Wake**: *"spends attention (tokens, wakes), never risk"*) — **not
  raw tokens.** That is what lets the model underneath be **swapped** while the efficiency gain is
  **kept**. Bill raw tokens instead and **every training win leaks straight to the customer**: you would be
  funding a model program whose only effect is to lower your own revenue. **The consequence is a
  sequencing fact, and it is sharp: THE METER MUST SHIP BEFORE THE MODELS ARE GOOD.** ("Simplified token
  usage" and "proprietary watchers" are not two products — **they are the same play.**)
- **The fence that keeps it honest.** KM-ADR-0028 forbids tier-gating **algorithmic capability**. So the
  gate and manager models are sold as **hosted inference** — never as a feature gate on the language, the
  runtime, or the Grade. The OSS package runs a **prompted** gate and a **prompted** manager and is
  architecturally complete (§8.1's cold-start is the shipped default, not a crippled one); **the platform
  sells the TRAINED ones.**
- **Not re-decided here.** Subscription mechanics are **already decided** (KM-ADR-0028: an Offer minting a
  **recurring Envelope** whose per-period budget expires — *"use-it-or-lose-it is the Envelope's existing
  budget expiry, not a new mechanic"*), and KM-ADR-0028 explicitly leaves the consumption-vs-subscription
  blend to be **A/B tested, not architected** — so tiers and price points stay open. **This ADR adds no
  pricing decision. It adds the multiplier.**

---

## Consequences

- **The missing middle tier is named and placed.** The desk is now literal across three tiers: runtime
  (obligations), watcher (in-loop judgment), strategist (the frame). The org model's PM/Trader/Book/
  Coverage maps onto the model tiers exactly.
- **No new inter-tier plumbing.** The strategist and watcher speak Kestrel's existing surfaces to each
  other. Building the cascade is composing two `Agent`s over one Session, not designing a protocol.
- **A cheap learned model is safe in the hot loop.** Because the watcher authors above the line and the
  Gate admits (never trusts) its actions against the Mandate, a weak/adversarial watcher cannot exceed
  its envelope. Judgment is bought cheaply; authority is kept by the runtime. The
  obligation-preserving-standing-authority guarantee now spans two model tiers.
- **The economics invert.** Pay the frontier brain a few times a day; the cheap specialist handles the
  thousands of in-loop reactions. The `ev_per_ktoken` axis is where this shows up as a measured Pareto
  win — or an honest null.
- **Determinism and replay are untouched.** Both tiers are ADR-0012 `Agent`s; `recordedAgent` replays
  the whole cascade byte-identically; `SimRunId` is unchanged.
- **The Grade attributes across tiers — all FOUR of them.** The `management_alpha` ladder tells us
  whether the frame (strategist) or the execution (watcher) earned the P&L — the two-tier thesis becomes
  falsifiable — and, because the human's instruction is a typed Bus event on a deterministically
  replayable Bus, an **ablation replay** yields an honest **`human_alpha`** on top. The by-product is the
  real prize: every human intervention is stamped with **the dollars it caused**, which is a $-labeled
  supervision signal for the watcher's SFT/RLVR program (§8) — the overseer becomes a teacher whose
  lessons are auto-labeled with money. It grades the human, too.
- **The benchmark subject becomes an architecture, and the headline result is a breakout map.**
  frontier-only / small-only / cascade are three System Profiles; the cascade's value is a measured
  Pareto claim, not an assumption. The core scientific contribution is the **watcher breakout map**
  (family × size × training-regime) — *where* viable in-loop trading judgment emerges and how cheap the
  smallest one that holds the grade is — measured cheaply because the frontier plan is a shared,
  content-hashed, replayed-many fixture (strategy held fixed, only the watcher varies).
- **The watcher can be small for a concrete reason.** Two stacked distillations — frontier judgment in
  the watcher's *weights* (SFT/RL, train time) and in its *context* (Brief/Thesis/View/inline
  comment-reasoning, inference time) — mean the watcher *applies* a well-reasoned frame rather than
  deriving it, pushing the breakout threshold lower than intuition suggests.
- **A concrete component program for the watcher.** Prompted cold-start → SFT-distill → RLVR, with CFG
  for loop-speed validity, forced-comment reasoning for legibility, and the frozen View as curriculum —
  and the watcher's *(family, size, regime)* as a first-class sweep that sets the cascade's real economics.
### From the 2026-07-14 amendment (§10–§14)

- **There are TWO cheap-model roles, not one.** The **watcher-GATE** (upstream of the strategist,
  allocating its attention) is a different job from the **watcher-MANAGER** (downstream, managing the
  armed Plan). The cascade is **Scan → Gate → Strategist → Manager → Human**, with the deterministic
  runtime as the floor beneath all five.
- **The gate is what makes a WIDE SCAN PORTFOLIO affordable.** It is the coefficient on the only cost
  line that grows with breadth (strategist tokens) — *"breadth × window-length is the attention
  economics"* (CONTEXT.md **Scan**), with the gate as the multiplier. Without it, a 10k-name universe is
  unaffordable; with it, breadth becomes a tunable.
- **A weak gate cannot hurt you in risk — only in money and in misses.** It authors nothing and crosses
  no `AgentTurn`, so §3's keystone has nothing to admit. Its failures are wasted attention (FP) and
  foregone EV (FN), and both are *measured*.
- **The GATE is the best RL target in the system** — dense, cheap, fast reward; **false positives are
  directly observed** (the strategist looked and stood down, at no marginal labeling cost) and **false
  negatives are priced by a SAMPLED AUDIT**. The manager's reward is sparse, long-horizon, and confounded
  by the frame — so **the gate trains first.**
- **The attribution ladder is FIVE levels:** runtime → **`gate_alpha`** → `strategist_alpha` →
  `manager_alpha` (§6's `watcher_alpha`, renamed) → `human_alpha`. `gate_alpha`'s counterfactual is
  **budget-matched** (the same attention spent at random), because the "ungated" arm is the very thing
  the gate exists to make unaffordable.
- **GRADE THE SCANS — the detector leaderboard.** *"Which screens actually find money"* is answerable on
  existing primitives (Grade + Lineage + Ledger + Armory), and it ranks the **standing, compounding**
  asset: **Plans are ephemeral (TTL); Scans are standing.** The **audit sample** is what makes a Scan's
  yield unbiased instead of selection-biased. Ranking-eligibility is **inherited, not invented**: sell
  holdback sims, **rank only on sealed seasons** (KM-ADR-0018).
- **The first detector is the forward CALENDAR Scan, and it needs no grammar change** — a calendar is
  just another **Series** (`earnings.in_days`), the trigger algebra already runs on named series, and it
  is **date-blind by construction** (relative time only), so it *preserves* the blinding the holdback
  tier depends on.
- **The consent problem dissolves** (closing Resolved 3, caveat (b)): the gate and manager learn from
  `decision → outcome`, never from the Brief/Plan/thesis. *"We learn from how the market responded to
  ACTIONS. We never train on your IDEAS."* Our own personas supply unlimited training data at zero
  consent exposure; customer telemetry is a **bonus, not a dependency**.
- **The pricing consequence (recorded, not decided here).** Two bases: **resold third-party inference
  stays cost + 50%** (KM-ADR-0012, unchanged — we are a reseller there); **Kestrel's own gate + manager
  are value-priced**, and can be high-margin *and* the cheapest option simultaneously, because a frontier
  model cannot do either job at any sane price. **The attention meter is the margin-capture mechanism** —
  bill raw tokens and every training win leaks to the customer — **so the meter must ship BEFORE the
  models are good.**
- **New surfaces to build (all later, none in this ADR):** a driver that runs two `Agent`s at two
  cadences over one Session; the escalation-Wake reading + re-brief handoff; the attribution projection
  (now **five-tier** — `gate_alpha` + `strategist_alpha` + `manager_alpha` + the human-ablation replay
  that yields `human_alpha`); the watcher-tier config axes in the System Profile; the watcher training
  pipeline — **plus, from the amendment:** the **Scan runner** (a universe-scoped Wake over the trigger
  algebra) and the **calendar series** (`earnings.in_days` / `fomc.in_days` / `expiry.in_days`) + its
  events feed; the **watcher-GATE role** (a per-candidate binary verdict, above the line but below
  authoring, fail-closed to STAND-DOWN-with-reason); the **audit sampler** (run the strategist on a
  random `p` of drops — the FN estimator *and* the Scan's unbiased-yield estimator); the **gate's
  `ConfigId` axes** (family × size × regime × `p`); the **detector leaderboard** projection over the
  Ledger; and the **`gate_reward` corpus** for the SFT/RLVR program. All additive; **no determinism-core
  change.**

## Rejected alternatives

1. **One frontier Agent at every wake (the status quo, scaled up).** Rejected on economics: paying a
   frontier model for thousands of cheap in-loop reactions is ruinous, and the alternative (wake it
   rarely) leaves the book unmanaged between re-frames. This is the exact bad choice the middle tier
   removes.
2. **Push in-loop judgment down into deterministic Plans (no middle model).** Rejected: a Plan trigger
   is a boolean over the series algebra — it cannot exercise *judgment* (read an ambiguous tape, weigh a
   thesis, decide manage-vs-escalate). The whole point is that the middle tier reasons; a richer Plan
   language would just be re-inventing a model badly.
3. **A single small model doing both jobs (small-only).** Rejected as the default (but kept as a
   benchmark arm, §7): a small model under-judges the *frame* — the thesis, the allocation, the
   regime read — which is exactly where a frontier brain earns its price. small-only is the control that
   proves the strategist tier is worth its cost.
4. **Trust the watcher's self-policing (let it enforce its own mandate).** Rejected, non-negotiable:
   this would import the watcher's weakness into the risk surface. The Gate admits, never trusts (§3).
   A learned model's mandate is enforced by the deterministic runtime or it is not enforced at all.
5. **A new inter-tier message protocol (a PM↔trader RPC).** Rejected: the protocol already exists — it
   is Kestrel's surfaces (§2). Inventing a second channel would fork the "authored outside, measured
   inside" language and create a surface the Grade cannot see.
6. **Hard-code the watcher at 3B (or any fixed size).** Rejected per the owner refinement (§8): 3B may
   under-judge; there is latency headroom at the second-scale tier to spend on capability; the right
   answer is an empirical sweep for "the smallest model that holds the grade," not a guessed constant.
7. **Fine-tune the watcher before proving the architecture.** Rejected as sequencing: the prompted
   cold-start watcher makes the cascade testable *immediately* (§8.1, and the tracer bullet below).
   Training is an optimization of a working system, never a gate on demonstrating it.

### Added by the 2026-07-14 amendment (§10–§14)

8. **Point the strategist straight at the Scan's survivors (no gate).** Rejected on the economics that
   motivate the whole ADR, one layer up: a high-recall Scan is mostly noise, so paying a frontier model
   to read every survivor makes breadth unaffordable — which is precisely the *"wake the frontier brain
   often and pay a fortune"* horn of §1's bad choice, reappearing at the discovery end. **The gate is the
   coefficient on the only cost line that grows with breadth** (§10.4).
9. **Make the gate a deterministic threshold (tighten the Scan instead).** Rejected for the same reason
   §2 of the *Rejected alternatives* rejects pushing in-loop judgment into Plans: a Scan trigger is a
   **boolean over the series algebra** — it can be *narrowed*, but narrowing trades recall for precision
   at a fixed exchange rate and **cannot exercise judgment** (weigh a thesis, read an ambiguous setup,
   price the value of a look). Tightening the Scan destroys recall, which is the one thing the discovery
   layer is *for*. The gate reasons; the Scan does not.
10. **Fold the gate into the strategist ("let the frontier model triage its own inbox").** Rejected: the
    triage call *is* the expensive call — the frontier model must read the candidate to decide the
    candidate is not worth reading. That is the cost you were trying to avoid, paid in full.
11. **Fold the gate into the manager (one cheap model, two jobs).** Rejected: they are different jobs
    with **different reward shapes** (§11.2) — the gate's reward is dense, short-horizon, and nearly
    unconfounded; the manager's is sparse, long-horizon, and confounded by the frame. Collapsing them
    would blend a clean RL signal into a noisy one and forfeit the best training target in the system.
    (They may well share a *base model*; they must not share a *head or a reward*.)
12. **Train the manager first.** Rejected as sequencing (this **re-orders §8**, it does not retract it):
    the gate's reward is dense, cheap, fast, and *self-labeling from ordinary operation*, while the
    manager's needs a full episode per example. **Train the gate first; the manager's RLVR program stands
    unchanged, later.**
13. **Skip the audit sample (grade the gate only on what it passed).** Rejected as dishonest by
    construction: a gate graded only on its passes is graded on a **selection-biased sample of its own
    decisions**, and a Scan graded through it inherits the bias. **A false negative is invisible unless
    you buy the counterfactual** — so buy a *sample* of it (§11.2). This is the same discipline the
    support partition already enforces (CONTEXT.md **Raw / Bankable**): never let the record hide where
    the money went.
14. **Bill raw tokens rather than attention.** Rejected — and the reason is structural, not commercial:
    under a raw-token meter **every efficiency win from the model program flows straight to the customer
    as a discount**, so the platform would be funding a training program whose only effect is to lower
    its own revenue. **Attention is the glossary's own unit** (CONTEXT.md **Wake**), it is what the
    customer actually buys, and metering it is what lets the model underneath be swapped while the gain
    is kept (§14.2).

## Resolved (owner-approved 2026-07-14)

The seven questions this ADR opened on 2026-07-13 were reviewed and **answered by the owner on
2026-07-14; every one was approved as recommended.** Each is recorded below with **the question as
asked** (so a reader sees what was in doubt) and **the decision as taken** (which now binds
implementation). Nothing here relaxes a determinism or fail-closed non-negotiable.

**1. Escalation-policy specifics (§4).**
*Asked:* the exact triggers and thresholds — the uncertainty threshold's shape and how it reads the
watcher's forced-comment certainty; which event classes a Brief may flag as always-escalate; whether
mandate-edge escalation is automatic or itself a watcher judgment.
**Decided — HYBRID, and the split is a fail-closed one.** **Mandate-edge escalation is AUTOMATIC**: the
cheap tier never pushes the risk boundary on its own judgment (making it a watcher judgment would put
the envelope in the hands of the weakest model — precisely the thing §3 exists to prevent).
**Brief-flagged event classes** (e.g. a regime break) **always escalate**, regardless of watcher
certainty — the strategist pre-declares what it wants to be woken for. **Ambiguity escalation** is the
watcher's own call, read off its **forced-comment certainty threshold** (§8.5) — the one trigger that
is genuinely the watcher's judgment, and the one the SFT/RL program can train.

**2. Watcher tactical-authority scope (§5).**
*Asked:* may the watcher arm a *new bounded Plan within the existing Coverage and Mandate*, while a new
Coverage/thesis/allocation stays strategist-only? Pin the line between "manage within armed Plans" and
"arm new bounded authority."
**Decided — YES.** The watcher **may arm a new BOUNDED Plan within the existing Coverage and Mandate.**
**New Coverage, a new thesis, and allocation stay STRATEGIST-ONLY.** The rule that generates the line
is the org model's own: **authority only narrows downward** (CONTEXT.md) — applied to *tiers*. The
watcher acts strictly inside the envelope it was handed and can never widen it; and the Gate still
admits **every** action either tier authors (§3), so "may arm a bounded Plan" is a statement about
*authoring*, never about *trust*.

**3. Grade attribution across tiers (§6).**
*Asked:* confirm the three-level `management_alpha` ladder, and settle the escalation-boundary split —
how to credit an escalation that triggers a profitable re-brief.
**Decided — the three-level ladder is CONFIRMED, and the escalation boundary DECOMPOSES.** Credit the
**WATCHER for the call** (recognizing the moment — the decision to escalate) and the **STRATEGIST for
the answer** (the re-brief's quality — its downstream P&L). **A profitable escalation pays BOTH.** The
reason is incentive-shaped and load-bearing: any split that pays only the strategist teaches the
watcher **never to escalate**, which would break the one channel §4 depends on.

**EXTENDED (owner decision, 2026-07-14) — the ladder has FOUR tiers, and the fourth is the HUMAN.**
ADR-0035 puts a human overseer above the strategist and settles the mechanism: **the human's
instruction enters as a TYPED BUS EVENT** — `seq`-ordered on the graded Bus, never a side-channel.
Two properties of the Bus then make the counterfactual **free**:

- **The Bus replays deterministically.** Replay the session with the human's event **ABLATED** and
  measure the delta. That delta is an honest **`human_alpha`** — computed, not claimed.
- **The Bus makes the honesty non-negotiable.** *"Reasoning rides the bus too (JOURNAL events), so
  pre-hoc vs post-hoc is provable by `seq`, never by convention"* (CONTEXT.md, **Bus**). Nobody can
  retro-claim credit for a call they made after the fact.

The ladder becomes: **deterministic runtime → watcher → strategist → HUMAN.**

    human_alpha  =  EV(session as run)  −  EV(session replayed with the human event ABLATED)

**Beyond reporting: the ablation delta is a $-LABELED SUPERVISION SIGNAL.** It stamps every human
intervention with **the dollars it caused**, which is exactly the reward/supervision signal the
watcher's component program wants (§8: prompted cold-start → SFT → RLVR). **The human becomes a
teacher whose lessons are auto-labeled with money** — no annotation pass, no human-preference proxy;
the grade *is* the label. It composes with **"names are data"**: cluster the instruction **TEXT**
against the graded outcomes and you learn **which KINDS of direction work**, not merely that direction
worked. And — symmetrically — **it grades the human.** An overseer whose interventions carry negative
`human_alpha` is told so, by the same instrument that grades the models.

**Two caveats, stated (they bound the claim, they do not retract it):**

- **(a) Overlapping interventions are not attributable by naive single-event ablation.** When two human
  events interact (or one lands inside the window another opened), ablating one at a time
  double-counts. The **same discipline as the escalation boundary above applies**: decompose the
  contribution rather than assign the whole delta to one event — otherwise a profitable escalation
  *and* the instruction that provoked it are each paid in full for the same dollars.
- **(b) Training on PLATFORM users' instructions is a CONSENT/LICENSING question, not a technical
  one.** The ablation makes the corpus *possible*; it does not make it *ours*. **OSS / BYO-direct
  users' data never leaves their machine** — that is a differentiator, and it means the training
  corpus comes **mostly from the managed tier**, on whatever terms that tier's users agree to.

Tracked as beads issue **`kestrel-8di.1`**.

**4. The latency/cost model.**
*Asked:* how many frontier (strategist) calls/day vs. watcher calls — the actual cadence budget, which
sets whether the §7 Pareto claim holds.
**Decided — do NOT fix it; SWEEP it.** The cadence budget is a **`ConfigId` axis** (ADR-0013 §d), swept
and **measured on `ev_per_ktoken`** — the attention axis the leaderboard already ranks. **Default:
watcher every wake; strategist on regime-break plus a few scheduled re-frames.** This number is also
what decides whether the **OpenRouter free tier is usable** in practice (a cheap watcher on the free
daily quota + a rare strategist on frontier credits) — so the sweep prices the OSS free path, not just
the Pareto claim.

**5. The watcher BREAKOUT MAP (§7) and its sequencing (§8).**
*Asked:* confirm the 3-axis map (family × size {3B/7B/14B/32B} × training-regime {prompted /
CFG-constrained / fine-tuned}) and "the smallest `(family, size, regime)` that holds the grade" as the
headline; confirm prompted cold-start first; where does the breakout land; and confirm the shared
content-hashed frontier-plan fixture as the amortization.
**Decided — CONFIRMED, all four parts.** The **family × size × regime** map stands, with **"the smallest
that HOLDS THE GRADE"** as the headline result. **Prompted cold-start FIRST**; **CFG + fine-tune as the
follow-up** (training optimizes a working architecture; it never gates demonstrating one). The owner's
standing **hypothesis: PERCEPT-FIT beats raw size** — because the watcher **APPLIES** a frontier-curated
frame rather than deriving it (§8's two stacked distillations), the breakout **may land below 32B** —
recorded as a hypothesis to be *measured*, never assumed (ADR-0009/0030 discipline). The
**content-hashed frontier-plan fixture** (`plan_fixture_sha`) is **confirmed** as the amortization *and*
the controlled-comparison mechanism: strategy held byte-identical, only the watcher varies.

**6. The cascade driver seam.**
*Asked:* how two `Agent`s at two cadences share one Session in `runSimulateSession` — a single driver
interleaving two adapters, or a nested driver?
**Decided — a SINGLE driver interleaving two adapters at their wake ordinals. Not a nested driver.**
**One Session, one Bus.** `recordedAgent` replays the **whole cascade** byte-identically, because both
tiers are already above-the-line `Agent`s captured into `CapturedTurns` keyed on wake ordinal (§6). A
nested driver would have bought a second Session and a second place for the graded bytes to diverge.

**7. Watcher View/Brief authorship.**
*Asked:* confirm the strategist authors the watcher's View and Brief, and how a re-brief supersedes them
mid-session without disturbing `recordedAgent` replay.
**Decided — YES, the strategist authors the watcher's View and Brief** (§2), and **a re-brief is a
NORMAL SUPERSEDE** (ADR-0012 `supersede`) — no new machinery, and **replay stays clean**.

### From ADR-0035's review (same day) — two resolutions that touch this ADR

Reviewed alongside 0032, [ADR-0035 (the human oversight surface)](./0035-the-human-oversight-surface.md)
settled two questions that land on this cascade:

- **The human-message channel is a TYPED BUS EVENT** — an owner/journal act: auditable, `seq`-ordered,
  replayable. The harness feeds a human chat message into the agent's context **from the Bus**, so
  `recordedAgent` replays it byte-identically. Chat is an **input above the determinism line, never a
  side-channel** — and it never arms risk (a shortcut can only ever SHOW a View; **arming requires an
  explicit verb** — a Plan/Coverage statement or a typed act, fail-closed). The Bus stays the truth,
  which is exactly what keeps the two-tier cascade's replay guarantee (§6) intact when a human is
  watching it.
- **The cascade driver seam is the single interleaving driver** — 0035 depends on this cascade running
  in the *local* BYOK agent (`src/session/harness/live-agent.ts`), and its Phase 0/1/2 phasing is built
  on one Session per Pod-Book. That corroborates **Resolved 6** from the oversight side: one driver, one
  Session, one Bus.

### Status of the work

Beads epic **`kestrel-8di`** ("Two-tier Strategist+Watcher agent architecture (ADR-0032)") was
**BLOCKED on owner review of the 7 open questions.** With this review, **it is UNBLOCKED**: the answers
above bind the implementation, and the tracer bullet below is the first slice to build against them.

Two consequences of the 2026-07-14 owner decisions land on the epic:

- **The cascade is a PARALLEL TRACK, not a downstream phase.** "Single agent" never meant "single
  model": the **org** axis (one Book now; a Pod of N Books later) and the **tier** axis (strategist +
  watcher — *two models inside one Book*) are orthogonal, and **two tiers in one Book is Phase-0
  territory** (ADR-0035 clause (h)). So this epic and the ADR-0035 CLI-session build run **in parallel
  and meet at the protocol contract** — neither blocks the other. The **cascade driver** issue is
  accordingly **re-homed** out of the Pod-fan-out epic and into this one: **`kestrel-1xno.1` under
  `kestrel-8di`, P1** (it builds Resolved 6 — the single interleaving driver).
- **`kestrel-8di.1`** tracks the four-tier ladder + `human_alpha` (Resolved 3, extended): the ablation
  replay, the metric keys, and the $-labeled supervision corpus. **Amended 2026-07-14 (evening):** the
  ladder is **five** — it also carries **`gate_alpha`**, and `watcher_alpha` is renamed
  **`manager_alpha`** (§12).
- **The amendment (§10–§14) adds work, not rework**, and it all lands under the same epic: the **Scan
  runner** + the **calendar series/feed** (§10.6), the **watcher-GATE** role and its fail-closed verdict
  (§10.3–§10.4), the **audit sampler** and the `gate_reward` corpus (§11.2, §11.4), and the **detector
  leaderboard** projection (§13). None of it touches the determinism core, and the gate's cold-start is
  **prompted** — so it is buildable the moment the cascade driver (`kestrel-1xno.1`) lands. **Train the
  GATE before the manager** (§11.2 re-orders §8's program; it retracts nothing).

## Tracer bullet — the thinnest e2e slice that proves the cascade is wireable

**Goal.** Prove the two-tier cascade runs end-to-end through the *existing* Simulate runner, that the
Mandate holds under the watcher, and that the Grade attributes across tiers — with **zero fine-tuning**
and **minimal harness change**.

**The slice.** One cell where two-tier value is visible — **EQ-SCALP-ORB** (the landed bench cell,
`tests/bench/eq-scalp-orb.ts`), run as a *fade-the-fakeout* thesis (the strategist sets "fade the
opening-range breakout fakeout"; the watcher manages the fade in the loop). Concretely:

1. A **frontier strategist** (Fable/opus) authors, at the OPEN, a **Plan + Brief + Mandate + View** for
   the one cell: the fade thesis (Brief), the armed fade Plan with its bracket/invalidation (Plan), the
   risk envelope (Mandate), and a **token-lean View** the watcher watches (Plan/tape/level panes).
2. A **PROMPTED small/fast watcher** (haiku, or a cheap open 30–70B — **no fine-tuning yet**) watches
   the View at wake cadence and authors in-loop reactions (manage/reload/exit/adjust) *within* the Plan
   and Mandate, authoring pure Kestrel (ADR-0031), **escalating via a Wake** when it hits a mandate-edge
   or low-certainty (§4).
3. Graded **e2e through the existing Simulate runner** (`runSimulateSession`), producing one graded Bus,
   one `SimRunId`, and the three-level attribution (§6).

**What it proves.** (a) The cascade *runs* — two `Agent`s at two cadences over one Session produce a
valid graded Bus. (b) The **Mandate holds under the watcher** — every watcher action passes the same
admission Gate; a deliberately over-reaching watcher action is *refused fail-closed*, not admitted
(the safety keystone §3, demonstrated live, not asserted). (c) The **Grade attributes across tiers** —
`strategist_alpha` vs `watcher_alpha` are computed over the same recorded tape via the frozen-Plan
counterfactual.

**What to measure.** The **cost/latency of the cascade vs. frontier-only at similar grade** — the §7
Pareto question, on one cell: does the cascade reach a comparable grade to a frontier-only run at a
fraction of the frontier token spend (measured on `ev_per_ktoken` and wall-cost), because the frontier
strategist wakes a few times while the cheap watcher handles the in-loop wakes? Plus the fail-closed
refusal rate (does the Gate hold every time the prompted watcher over-reaches?).

**The smallest harness change to run it.** Run **two `Agent` instances at different cadences over one
Session**: a strategist adapter invoked at OPEN / re-brief ordinals, and a watcher adapter invoked at
in-loop wake ordinals, interleaved by `runSimulateSession`. Both are existing ADR-0012/0013 `liveAgent`
adapters with different configs (model + profile + cadence); the *only* genuinely new wiring is (i) the
driver interleaving the two adapters at their respective wake ordinals over one Session, and (ii)
routing a watcher-emitted escalation Wake to a strategist `open`/re-brief invocation. No
determinism-core change; both tiers are already above-the-line `Agent`s captured into `CapturedTurns`.

**Spike or tracer bullet? — Recommend a TRACER BULLET (thin but real, kept).** The slice reuses the
production seams end-to-end (real `liveAgent` adapters, the real admission Gate, the real Simulate
runner, a real graded Bus) — nothing is mocked, so keeping it costs little and it becomes the first
regression fixture for the cascade driver and the attribution projection. The *only* throwaway-flavored
part is the prompted (un-fine-tuned) watcher, which is anyway the intended cold-start (§8.1) — so the
prompted watcher graduates naturally into the SFT/RL program rather than being discarded. Build it as a
thin, real, kept slice: the driver interleave and the attribution projection it exercises are load-
bearing for everything downstream, and the fade-the-fakeout EQ-SCALP-ORB run is a real graded cell, not
a mock.