Does "one place per state" mean the surface can never be improved?

It means the surface changes only by a committed redesign — a decision made once, at a known time, with the Steward retrained against the new layout — after which it is fixed again. Improvement is allowed. Self-modification is not. The distinction is the same one the corpus draws between a Steward changing a threshold and an agent changing its own scope.

What about a Steward who governs several ventures with different surfaces?

The rule is per surface, and Layered Stewardship already assumes one Steward per venture at handover. Where one Steward does govern more than one, the surfaces should share a style guide so that meaning and function transfer between them even where position does not — the internal-consistency half of Nielsen's heuristic, applied across a portfolio.

Isn't this just a design system?

A design system is a library of components and tokens for building consistent products. The Fixed-Function Surface is a constraint on what the finished surface is allowed to do: not move, not change meaning, not overload an element. A design system is the tool an operator would use to build one. It does not by itself prevent a per-session generator from composing those components differently each time.

Why derive this from the Transcoding Layer rather than from usability research?

Because the corpus needs the rule to hold at a tempo usability research did not study. Consistency is a usability gain on any product. On the verification route it is the condition under which vision remains the fastest channel at all, and that is a stronger claim with a specific consequence — Verification Blindness — when it fails.

One Element, One Meaning, One Place

A Surface That Moves Cannot Be Glanced At named the failure: Layout Drift, a surface whose elements change position, form or meaning between reads, converting the Steward's fastest input into their slowest. Naming a failure obliges the corpus to name what prevents it, and the prevention is not a preference about interface style. It is a design rule with the same standing as the rules the corpus already applies to logging, thresholds and mandates, and it can be stated in a sentence.

Fixed-Function Surface is a Steward interaction surface in which every element performs one function, every signal carries one meaning, and every state has one fixed position — specified at Full-System Design time and held constant across sessions, model releases and operating conditions, so that verification is a glance at a known address rather than a search of a changing page. The name is deliberate. A chip is specified as a fixed arrangement of components whose function does not change with context: each component does one thing, connects in one way, and is where the layout put it, and the layout is decided once. The Steward's surface is held to the same standard for the same reason: it has to be verified at speed by someone who cannot afford to wonder what an element is for.

Three rules, one property

The definition carries three rules, and each closes a specific way a surface can drift.

One function per element. An element does what its specification names and nothing else. The named function can be a readout, a control, or a readout paired with its control — a commitment count with the release beside it is one function if that is what the specification says — and the rule is that the function is fixed, not that it is small. What an element does not do is change function according to context. The element that displays commitments standing against a line does not become a control for releasing them when hovered, and it does not become a chart when there are more than ten. The failure this closes is modal ambiguity: the Steward has to know, before acting, whether the thing under their hand will show them something or do something, and a surface that decides per context makes them find out by trying. An operator who reads the rule as a ban on paired elements will split the surface into more addresses than the Steward can hold, and recreate the search the previous memo named.

One meaning per signal. A colour, a shape, a position or a sound means one thing everywhere it appears. If red means an exception outside the target band, red means nothing else — not "stopped", not "selected", not a brand accent in the header. The process industries reached this rule the hard way. The ANSI/ISA-101.01 standard treats colour as a means of directing attention that must not be the only way an element is distinguished, and the practice built on it reserves colour for abnormal conditions and renders everything normal in shades of grey, so that colour on the screen is itself the signal. Nielsen's fourth usability heuristic states the general form: "Users should not have to wonder whether different words, situations, or actions mean the same thing." On a consumer product that is a usability gain. On a verification surface it is the difference between a glance and a read.

One place per state. Every state the Steward is expected to verify has a fixed address on the surface and is rendered there and nowhere else. The address is set when the surface is designed and does not move when the value changes, when the model changes, when the session is new, or when a designer thinks the layout would be better another way. The failure this closes is the one the previous memo built the chapter on: a Steward who does not know where to look has to look everywhere.

The three rules produce one property, which is that the surface is predictable to a person who has used it before. That property is the whole point. Vision is the Steward's fastest input because it is parallel; a glance takes in a known region at once and compares it to memory. Every one of the rules exists to make the comparison to memory valid — the element is the same element, it means what it meant, it is where it was.

The rule is derived, not preferred

The corpus has said that the Steward's surface matters. The Steward Cannot Govern What They Cannot See made the Audit Surface a design requirement. The UI That Runs the Business made Steward Experience a discipline held to product rigour. Neither derived a layout rule, because neither had a tempo to derive it from. The Steward-interface chapter supplied the tempo, and the derivation runs in three steps.

The Transcoding Layer assigns verification to vision because it is the receiver's fastest channel. Vision is fastest only when the target is known; otherwise it degrades to search, which is reading. Therefore the verification surface must make every target known in advance, and the only way to make a target known in advance is to fix it. Function, meaning and position are the three dimensions in which a target can move; fix all three and the target is known. That is the Fixed-Function Surface, and it is not a taste. The Transcoding Layer establishes the modality. The Fixed-Function Surface establishes the spatial conditions under which that modality stays fast across the thousandth verification as well as the first.

The Steward Experience entry added a second requirement the rule also serves: symmetric effort between escalation and de-escalation, because asymmetric friction ratchets a business toward the Authorization Trap through interface design rather than psychology. A surface with one function per element and one place per control makes the two controls equally findable and equally costly by construction. A generated surface makes no such guarantee, because it decides per session which control to foreground.

What the control room specifies, and what Arco does not copy

ISA-101 does not specify colours, shapes or layouts. It specifies a process: a written HMI philosophy, a style guide adopted before the first display is built, a toolkit of standard elements, and a hierarchy of display levels from overview to detail, each with a defined purpose. The layout is fixed by the site's own style guide, and the standard's contribution is to insist that there be one, that it be written first, and that every display conform to it thereafter.

Arco takes the process and not the content. A Steward's surface is not a plant's, its display hierarchy is the corpus's own — the Audit Surface at the top, the Reach Record and the decision trail beneath — and its elements are the states the Stewardship Model already names: Escalation Rate against band, Execution Divergence, exception novelty, commitments standing, reach against mandate. What carries over is the order of operations. The style guide comes before the surface, the surface conforms to the guide, and the guide changes only by a committed decision, never by generation. In the corpus's terms, the Fixed-Function Surface is specified at Full-System Design time, alongside the thresholds and the mandate, because it is part of the same architecture.

The Operator's Verdict

An operator can apply this rule to a surface they already have, without building anything, by asking three things of every element on it. What is its one function; if the answer has an "or" in it, the element is ambiguous. What does its signal mean, and is that meaning used anywhere else on the surface for anything different; if so, one of the two uses is wrong. Where does it live, and has it been there every time the Steward looked; if not, the Steward has been searching.

The rule is stricter than product design usually tolerates, and it is meant to be. A customer-facing product can afford to surprise, because the customer is exploring. The Steward is not exploring. The Steward is checking, thousands of times, that a system running faster than they can read has done what it was meant to do — and a check is only fast when the thing being checked is where it was.

Technology changes what is possible. Where the state lives determines how fast it is seen.

KEY TAKEAWAY

What is a Fixed-Function Surface, and how does Arco derive its rules?

A Fixed-Function Surface is a Steward interaction surface in which every element performs one function, every signal carries one meaning, and every state has one fixed position — specified at Full-System Design time and held constant across sessions, model releases and operating conditions. Arco derives it rather than prefers it. The Transcoding Layer assigns verification to vision because it is the Steward's fastest input; vision is fastest only when the target is known, and a target is known only if it is fixed. Function, meaning and position are the three dimensions along which a target can move, so fixing all three is what the verification route requires. The Transcoding Layer establishes the modality; the Fixed-Function Surface establishes the spatial conditions under which it stays fast. The three rules each close a drift: one function per element removes modal ambiguity — the function is fixed, not necessarily small, and a named readout-and-control pair is one function; one meaning per signal removes interpretation — the process-automation standard ANSI/ISA-101.01 treats colour as a means of directing attention rather than decoration, and Nielsen's fourth heuristic states that users 'should not have to wonder whether different words, situations, or actions mean the same thing'; one place per state removes search. The rule also serves the Steward Experience requirement of symmetric escalation and de-escalation effort, which a per-session generated surface cannot guarantee. Arco takes from ISA-101 its process — philosophy, style guide, toolkit, hierarchy, written before the first display — and not its content: the Steward's hierarchy is the Audit Surface over the Reach Record and decision trail, and its elements are the states the Stewardship Model already names.