The Surface Has Two Readers

The Transcoding Layer assigned structured text to the system because text is the agent's native medium and no human needs to read the ledger at the tempo it is written. That assignment assumed the agent reads state from the record. It does, when the record is its own. Increasingly it also reads state from somewhere else: the same screen the human is looking at.

In October 2024 Anthropic described training a model to operate a computer the way a person does. The model "looks at screenshots of what's visible to the user, then counts how many pixels vertically or horizontally it needs to move a cursor in order to click in the correct place", and the post records that "training Claude to count pixels accurately was critical". It also records a limitation: the "flipbook" nature of the model's view — "taking screenshots and piecing them together, rather than observing a more granular video stream" — means it "can miss short-lived actions or notifications". The current documentation adds a zoom action for reading "small text or dense UI that isn't legible in a downscaled full screenshot", and specifies that every coordinate the model issues "is in the pixel space of the full-display screenshots you return".

The Machine-Readable Interface remains the corpus's answer to how an external agent should transact with a business — a structured, API-first layer built for agent inference, not a screen. This memo is not a retreat from that. It is about a narrower and unavoidable case: a surface that a human and an agent must both verify, where the agent's reading has to agree with the Steward's. That surface now exists in two places in the corpus's own architecture, and it has two readers.

Where the two readers meet

The rule that governs both places comes first, because without it the rest of the memo reads as an invitation to put agents on the dashboard, which the corpus has spent a year refusing. Agents read the Operational Ledger. The Steward's surface is a rendering of the same ledger state. The requirement this memo adds is that the rendering be a deterministic function of that state and nothing else, so that a human glancing at the surface and an agent reading the record are reading one fact through two projections. The Fact Has Seven Versions forbade one fact carrying different values across surfaces; this chapter forbids the fact's address moving. The first failure is a fact with seven values. The second is a fact with one value and seven places, and a glance survives neither.

The first place the two readers meet is review. The Agent Council is the layer of specialised review agents governing execution outputs before escalation to the Steward, and its function is to look at what an execution agent did and decide whether a human needs to. The Council reads the record. The Steward, when the escalation arrives, glances at the rendering. If the rendering is not a deterministic projection of the record the Council read — if it is a dashboard assembled per session from a log — then the corpus has two views of one system with no guarantee they agree, which is the condition Context Collision names at the agent layer and nobody has named at the governance layer.

The second place is the boundary. Reach Is State established that the Reach Record is written by the same layer that enforces the mandate, and that the Steward watches drift against it. The Steward watches by glancing at a rendering. An agent charged with checking the same drift — a Council reviewer, or a counterparty's agent verifying that what an Arco agent presented matches what it touched — checks by reading. When both read from one deterministic rendering of one record, they are checking the same fact. When the rendering is generated per session, the Steward's glance and the agent's parse are of different objects, and the agreement between them is an accident of the generation.

Why the same rules serve both

The three rules of the Fixed-Function Surface were derived for a human on the verification route. Each of them is, without modification, what makes a surface more reliably parseable by a screen-reading agent.

One place per state gives the Steward a known address to glance at. It gives the agent a stable pixel coordinate. A model that locates elements by counting pixels from a screenshot is doing, mechanically, what the Steward does by eye: going to where the thing was last time. A surface that moves the element defeats both in the same way, and the documentation's zoom action is the machine's version of the human's search — a second look because the first did not land.

One meaning per signal gives the Steward a colour that means one thing. It gives the agent a signal with less to interpret. Interpretation is where an agent's reading and a human's diverge, because an agent resolves ambiguity by inference and inference is not deterministic across model versions — Interpretation Drift is the corpus's term for the same inputs read differently by a new model. A signal with one meaning leaves the agent less interpretation to resolve across releases; a model can still misread a colour, a spatial relation or a small label, which is why the rule reduces the divergence rather than removing it, and why a generated surface, which adds composition to the list of things to interpret, widens it.

One function per element gives the Steward an element that will not act when they meant to look. It gives the agent the same guarantee, which matters more for the agent, because the agent acts by clicking at a coordinate and cannot hover to find out first.

The flipbook limitation adds a fourth rule, and it is the only new constraint the chapter adds after the three in the previous memo. An agent that sees the screen as a sequence of stills misses anything that appears between them. A Fixed-Function Surface has no transient state: nothing appears and vanishes, nothing animates in, nothing is a notification that goes away. Every state has an address and stays at it until the state changes. That is already what the Steward needs, for the reason the previous memo gave — an animation delays the state by the length of the animation. For the agent it is the difference between a state it can read and one it was never shown.

One source, two renderings, no drift between them

The Transcoding Layer's assignment stands: the system reads text on the ledger, the Steward sees a rendering. What this memo adds is the constraint between the two. The rendering the Steward glances at and the record the agent reads have to be projections of one source, produced by a deterministic function of the ledger's state, so that anyone — human or machine — reading either one is reading the same fact. A surface generated per session breaks the constraint at the root, because the function from state to surface is no longer deterministic. Two Stewards, or one Steward and one agent, looking at "the same" system through generated surfaces are looking at two systems.

This is the reason the arc's rule is stricter than usability. Consistency for a human is a convenience with a cost when absent. Determinism between the human's surface and the machine's record is a governance requirement, because the Stewardship Model's claim that a human governs the system rests on the human and the system agreeing about what the system's state is. A Fixed-Function Surface is how that agreement is enforced at the surface. The Operational Ledger is where it is enforced underneath.

The Operator's Verdict

An operator who has applied the previous two memos to the Steward's surface has, without intending it, built a surface a screen-reading agent parses more reliably. The rules are the same, and the audit is the same: every state at a fixed address, every signal with one meaning, every element with one function, and nothing on the surface that is not there the next time it is drawn.

What the operator should add is the constraint underneath. The surface is a function of ledger state and nothing else — not of the session, not of the model, not of who is looking. If two readers can be shown the same ledger state and see different surfaces, the surface is not verifying the ledger. It is decorating it.

Technology changes what is possible. One source of state determines whether two readers see the same thing.