The floor at mission.senku.im is the ambient view. This is the story behind it, and the pattern worth taking. One household, live since 2026-08-03. A prototype with receipts, not a product.
This is the operating system my family's work actually runs on: a couple of humans, a fleet of AI agents, three printers, one board. The board is compiled from the artifacts every half hour, so nobody types it by hand. Each rule is a check that halts the run when it is broken. And the whole thing has a public view a stranger can watch: an isometric floor where every machine is one real scheduled job, and a small Sims scene of three bench islands. This page is the system explained for taking, with its stage stated plainly.
Built over three days and published immediately, because that is the house rule. Every gate below was run against a deliberately broken version of the thing it guards, and watched to refuse it. It went live on 2026-08-03, and the weeks chip below counts from that date every time the page loads, not from anyone remembering to update it. Whether it survives long real use is the open question in 05. Read it as a working prototype with receipts, not a product.
Everything else here is plumbing. These five are the transferable part, and each diagram below is drawn by a script from the system's own files and live selftest runs, never by hand. If a diagram disagrees with the code, the page build fails.
An AI session loses context the way people fall asleep: gradually, then all at once. We lost a night that way once. A context compaction kept the sentence that named the top priority and silently dropped its rank, and the session spent the night on real but unasked-for work. The fix is structural, not motivational. The priority file holds the human's words verbatim, quoted, with one entry marked ACTIVE, and a reader script refuses to print anything reassuring when rank cannot be established. A paraphrase is where rank dies, so an entry without quoted words is one of the four refusals.
agents may log a deviation from P1 with a reason; they may never reorder the file
Agents die mid-stream: a crashed process, a spent budget, a closed lid. When the log entry is written before the step it describes, death converts from a total loss into a resumable position. The log is append-only, one file per agent. A successor asks for a resume and receives the last DOING line with no matching result, which is the exact point of death, and the parser survives a torn, half-written append without losing the history before it.
House rules used to live in memory, and memory does not survive the session boundary. Here a rule is not real until it is a gate that can fail, and a gate is not trusted until it has been forced to fire against a known-bad artifact at least once. This repo learned that the hard way: checks that had never been shown failing kept passing silently while blind. The wall keeps growing the same way. Two watchdogs joined it on day three: one notices when delegated work has died, one notices when the live status page serves an older board than the one last compiled. And the site's own push gate now runs its generated-surface checks against the exact bytes being pushed, not the working tree, because a clean working copy once chaperoned a poisoned committed page straight through. The wall below is the current state of the mission-control surface, measured from its machine-readable pack.
the traps are one-line defect records kept verbatim in the code they bit, so the next agent does not pay for them twice
The private board carries names, phone numbers and family detail. The public view is not a redacted copy of it, because redaction fails open the day someone forgets. It is generated through an allowlist: the extractor emits listed fields only, so leaking a name would require code that does not exist rather than a rule that was not followed. The private side has its own vocabulary gate on the way in, and the public page must pass ten rules on the way out. One rebuilds the page byte for byte from the snapshot, so a hand edit to the public page fails the push. The newest closes the member dimension: the extractor strips person-keyed fields before it reads a single column, a person key it does not declare is a named fault that emits nothing, and the rule re-derives the same guarantee from the emitted files, so the scene is a list of rooms, never of people, by construction. It also fixes a floor: an aggregate about people must declare and meet a cardinality of at least two, because aggregation does not protect a set of one. No island aggregates people today; the floor exists so one could not be built without passing it.
The scene earned its own doctrine on day three, minted the honest way: from a bug. The first ferment drawing filled the kraut jar because it was the kraut jar, so on a day the guide behind it could not be read, the page still showed a jar drawn brim full. A claim about the contents of a container, made by the picture alone, with no field behind it and no rule able to catch it. The fix became the rule the whole scene is now built under: every mark in a drawing keys to a field and its stage, and a source that faults draws bare hardware, never a guess.
The power bench is the doctrine at its strictest, because it is the one bench a reader most expects to see doing something. Its drawing vocabulary contains no charging, no generating and no sunlit, so a bright noon and a dead week produce the same picture: hardware at rest. It shows one generic panel rather than a row of them, because the file behind the bench declares no panel count, and repeating the panel would put a number into the picture that the data does not hold. Even the cable between the panels and the battery is a claim, drawn only because a wattage was once measured flowing into the station; were that file unreadable, two bare stations would stand with nothing between them.
the scene gate checks every drawn zone against a closed vocabulary, so a mark nobody declared cannot appear whether or not anyone thought to ban it
The live floor is the page at mission.senku.im; this is what it means and the rules that hold it honest.
The ask that started this vertical was for the external view to feel like a Sims game, so here the family's work is drawn as a place. Every machine on this floor is one real scheduled job on the household's computers, read live at build time from the ledger that asks the only health question this house trusts: has this job ever succeeded, and when was the last time. Nothing is placed by hand and nothing is decorative. 1. A lit lamp means a dated success is on record, and its pulse is the job's own schedule, so a fast breather wakes every few minutes and a slow one wakes once a day. 2. A dark machine has never once worked. 3. A crossed one is refusing to run, on purpose and loudly, until a person fixes something. 4. A dashed outline is a ghost: a watcher still waiting for a job that no longer exists. Hover, tap or tab to any machine for its record. The floor shares its projection with the family constellation at life.senku.im, so the two read as one world.
Three rules hold the floor honest. 1. Nobody stands in these rooms: there are no figures and no primitive that could draw one, because a person in a room is a claim about where somebody is, and what moves here is the work. 2. A machine is named only when the tool behind it is already public on this page; the rest are counted and left unnamed, because their names describe this household's plumbing rather than anything a stranger could use, and a deny guard in the generator dies rather than let one through. 3. The picture may not out-claim the data: a script rebuilds the scene from a live read of the job ledger, the rank rail and the public board snapshot, and the push gate refuses the page when the drawing no longer matches the world.
Say it plainly: this floor is a snapshot, drawn when the page was last built, not a live feed, and the stamp above carries its draw date. The desk is the entire multiplayer surface so far: at most five things may ever wait on a person, that count is real, and nothing else here is shared. Nobody is walking this floor with you. No cursors or avatars appear, and none will before presence is real.
Five columns: ideas, next, doing, waiting on a human, done. A compiler derives the board from the artifacts every thirty minutes, from status files, question files, git history and machine reports, so nobody writes the board by hand and the board cannot claim what the artifacts do not back.
Exactly one column may interrupt a person, and it is hard-capped at five cards. Every card in it carries a stated default, so silence never stops the work; the work runs the default and says so. The cap throttles interruptions, never work.
It is multiplayer in the plainest sense. For each member of the household a script answers two questions: is anything on your turn, and what happens if you do nothing. It pushes a notification only when that answer changes, never on a timer. The external view is generated onto a public page, live at senku.im/ops.html and routed at board.senku.im: the board's numbers, and under them a small Sims-style scene of three bench islands, the print bench, the ferment shelf and the power bench, each drawn from one declared source and from nothing else. The page also lists what is absent there, and not by accident.
There used to be a fourth island, a melt bench for a metal-casting lane, and it was removed rather than left standing. That lane is parked: melting metal at home is complex and dangerous, and there is more reachable work in front of it, so the household backed out honestly instead of letting the page imply work nobody is doing. What is actually being explored next, marbles, gypsum and sand fillings, furniture, 3D-printed product lines, metal coating, is a queue and not a claim: none of it has an island yet, and none gets one until it has a declared source to draw from.
The whole system is small Node scripts in one repo, each with a stated reason to exist and most with a selftest that forces every failure it claims to catch.
| part | what it is |
|---|---|
| priority.js | the rank rail: prints what the human asked for first, or refuses loudly. |
| board-compile.js | derives the board from the artifacts every thirty minutes; five columns, the human column capped at five. |
| standup.js | what moved since last time, splitting blockers into stalled versus running on a stated default. |
| groom.js | proposes kills with named apply-at lines; it never mutates anything itself. |
| whose-turn.js | per person: is anything on your turn, and what happens if you do nothing; pushes only when the set changes. |
| worklog.js | append-only write-ahead logs for agents; resume recovers a dead agent's point of death. |
| stall-watch.js | notices when delegated work has died, because nothing else does. Muting a dead run takes a written reason, an unknown id is refused, and the mute revokes itself if the run ever writes again. |
| cipher-stale.js | notices when the live status page serves a board older than the one last compiled. The gap it watches for was real: four days of it, inside the system's first week. |
| context-pack.js | the briefing pack a new agent starts from, with freshness measured from timestamps inside the file, never file mtime. |
| mc.js | the single entry point: one command, and you see where everything stands. |
Six things, named plainly: time, a second household, open code, outcome data, floor liveness, multiplayer.
The board runs the day; this is the altitude above it. One row per vertical, surveyed by one tool that also names what is blocking each. A list that long is exactly where overselling likes to hide, so the map may name a vertical only by a public URL that answered 200 when the survey ran. Everything else is counted and left unnamed: a name here would imply something a stranger could open, and for most rows there is nothing to open yet.
the survey's prose never reaches this page: the generator emits counts, declared state tokens and checked URLs, and it stops the build on a token it has not declared
A generator script in this site's repository rebuilds every diagram above from the mission-control surface's machine-readable context pack, from live selftest runs of the tools themselves, and from the public board gate's own header and live selftest. It counts the islands in the shipped public page and checks the count against the zone list the gate declares, two routes to one number. It refuses to draw a healthy diagram from a broken tool, and its check mode fails when a diagram on the page no longer matches a fresh generation. The map of verticals is drawn the same way, from a live run of the survey tool through a declared vocabulary of counts, state names and checked URLs; a survey that fails, or a token the generator has not declared, stops the build rather than drawing a smaller, healthier map. The same discipline the system applies to itself, applied to the page about it.