The Chip, Not the Canvas

Four memos have specified the form of the Steward's surface. A Surface That Moves Cannot Be Glanced At named Layout Drift, the condition in which a surface changes the position, form or meaning of its elements between reads and turns every glance into a search. One Element, One Meaning, One Place named the remedy, the Fixed-Function Surface: one function per element, one meaning per signal, one place per state, fixed at design time and held constant. Decoration Is Overhead separated the disciplines that make state legible from the ornament that does not, and kept only the first. The Surface Has Two Readers showed that the same rules make the surface parseable by an agent, and placed the constraint underneath: the surface is a deterministic function of ledger state and nothing else.

This memo is about why the rule gets stricter as the Steward's work changes shape, and about where the rule sits in the architecture the last two chapters built. The short version is the title. The industry is building the Steward a canvas — a surface the model paints fresh for each moment. The Steward needs a chip.

What the multimodal Steward does with the screen

The Steward-interface chapter moved most of the Steward's work off the screen. Under the Transcoding Layer, the Steward commands by voice because speech is their fastest output, and the system reads text on the ledger because that is its native medium. The screen is left with one route: verification, because vision is the human's fastest input. Heard Is Not Meant then made the screen the place where a spoken command lands before it executes. Under Round-Trip Commit, a command that would clear the Physical Intervention Threshold is not executed as heard but rendered back to the Steward on the verification route as the specific state change it will produce, and executed only on confirmation.

Read those two together and the screen's job has narrowed to something precise. It is no longer where the Steward works. It is where the Steward confirms — where the state the system holds, and the state a command is about to produce, are put in front of a person who has to check them and move on. A surface with that job has one requirement above all others: the Steward must find the rendered state in the time a glance takes, without searching for it, every time. A commit the Steward has to hunt for on the screen is a commit the Steward will confirm without finding, because the voice channel is faster than the search and the Steward is already speaking the next command.

That is why the multimodal Steward needs the Fixed-Function Surface more than the screen-bound Steward did. When the screen was the whole interface, reading it cost the Steward little; they were there anyway. When the screen is the confirmation surface for a Steward who is speaking, listening and moving, the screen is glanced at between other things, and a glance at a surface that has moved is a glance at nothing. The less time the Steward spends looking at the screen, the more the screen has to be exactly what it was the last time they looked.

The same holds as the surface leaves the desk. A confirmation rendered on a display the Steward wears or carries is glanced at under worse conditions than a monitor — smaller, briefer, in motion, with the Steward's attention on the physical work the system is acting in. Every property the chapter specified matters more on such a display, not less. The corpus makes no claim about any particular device. It claims that the smaller the window and the shorter the glance, the less the surface can afford to have moved.

Where the surface sits in the architecture

The reach chapter closed with two recurring obligations on the model release cycle. Every release that makes agents faster widens the Governance Tempo Gap and reopens the Steward's routes for review, so the Transcoding Layer's route assignment is revisited per release. Every release that makes agents more capable extends what they can reach, so the Encoded Mandate is revisited per release. Both age with the agent's capability, and both are re-examined on a schedule Arco does not control.

The Fixed-Function Surface is the layer a model release must not silently change. It changes — by a committed redesign, when the Steward's role, the business, or the set of states worth verifying changes — and it changes then only. Its whole function is to be the thing that stays still while everything around it moves on a schedule nobody chose. The routes may be reassigned as models change — verification is on vision now, and the Transcoding Layer entry says the assignment is a current reading. The mandate is rewritten as reach extends. The values on the surface change on every allocation. But the address of each state, the meaning of each signal and the function of each element are fixed by a committed decision at design time, and a model release is not a committed decision. A new model does not get to move the commitment count, recolour the exception band, or turn the confirmation panel into a chart because it judged the chart clearer.

This is the point at which the form chapter and the reach chapter say the same thing from different sides. The reach chapter placed the agent's boundary in the architecture rather than in the model, because a boundary the model holds is Nominal Containment — the system judged safe because the agent stopped. The form chapter places the Steward's surface in the architecture rather than in the model for the same reason. A surface the model designs is the model deciding what the Steward gets to verify and where, and a Steward verifying through a surface the system composed is verifying what the system chose to show. The Steward's channel and the agent's boundary are the two edges of the system, and neither edge is the model's to draw.

What the chapter adds to the Stewardship Model

The Stewardship Model said a single competent operator oversees an agentic stack as architect and exception handler. The Steward-interface chapter said how the operator reaches the stack and at what tempo. The reach chapter said what the stack may reach and where that limit lives. This chapter says what the operator looks at, and it can be stated as a specification rather than a preference for the first time.

The Steward's surface is a Fixed-Function Surface: every element one function, every signal one meaning, every state one address. It carries state and accepts commands and nothing else; the disciplines that make state legible are applied with more care than the customer product receives, and everything that only makes the surface pleasant is removed as overhead. It is a deterministic function of ledger state, so that a Steward and an agent reading the same state see the same thing. It has no transient state, so that neither a glancing human nor a screenshot-reading agent is shown something that will not be there on the next look. It is specified at Full-System Design time alongside the thresholds and the mandate, and it changes only by a committed redesign, never by generation and never by release.

None of it exists in an Arco venture. Every memo in the chapter is a design requirement derived from the corpus's prior principles, an industry precedent that reached the same conclusion under similar pressure, and public documentation of what agents and generative interfaces now do. Each says so.

The Operator's Verdict

An operator who takes one thing from the chapter should take the test in its title. Look at the Steward's surface and ask whether it is a chip or a canvas. A chip has components with one function each, at fixed addresses, carrying signals with one meaning, and nothing on it that is not doing a job. A canvas is repainted for the occasion. The industry is offering canvases and the offer is well made. The Steward's surface is the wrong place to accept it.

The checks run without building anything:

1. For each element on the surface, name its one function. An element that shows or acts depending on context is two elements sharing an address.
2. For each colour, shape and position used as a signal, name its one meaning and confirm it is used for nothing else — including brand.
3. For each state the Steward is expected to verify, name its address and confirm it has not moved in the last ten sessions.
4. Remove every element for which no state and no command can be named.
5. Render the same ledger state twice, in two sessions, and confirm the surfaces are identical. If they are not, the surface is a function of something other than the state.
6. Confirm nothing on the surface appears and vanishes. A notification that goes away is a state that was never at an address.
7. Diary the surface against the model release calendar and confirm that a release changes nothing on it. If it does, the model has been given the layout, and the layout was the one thing it was not supposed to have.

Technology changes what is possible. What does not move determines what can be verified.