A resident mind that watches a world and mostly says nothing.
No turns, no send button. It ingests a simulated world continuously and, at each thought boundary, judges whether that instant deserves a word, a glance, a movement, or nothing at all. The decision is one number read from a raw forward pass, never from generation:
margin = logprob(" emit") − logprob(" hold")
Silence is an action, not an absence — and it is recorded as one. Every judgment, including every decision not to act, with its margin, is written to an append-only, hash-linked record. That one commitment is what makes everything else measurable.
Everyone is building minds that answer. Nobody ships the mind that is there — and "there" turns out to be a shape, not a model size.
Look at the stack the industry actually has. Reflex tiers (FSD-class photons-to-controls, flight controllers) act at fixed hertz with no language and no long-horizon reasoning. Reasoning VLAs (Alpamayo-class) put language in the loop but ship it turn-based: invoked per call, the trace discarded, nothing held between invocations, no account of what they declined to conclude. Frontier APIs have the depth and none of the presence. The tier between them is empty: continuous, language-native judgment, ~tens of milliseconds per decision, that holds its state between instants — deciding when to think, when to escalate, whether the answer that came back is still about the world that exists now, and writing all of it down, including the silences.
ROVER is the smallest honest instrument for that tier. Not a chatbot, not an agent framework, not a demo — a benchtop organism with a deterministic world (the deck), a turn-based null (the twin), an escalation lane (the second gear), and a record that replays bit-for-bit. Everything it claims is measured on one consumer GPU (RTX 4070 Ti SUPER, a 9B-class open model) with the receipt named beside the number.
Gates say so here, not prose (iron rule 9: never self-assert done). Runners exit 0 or they don't.
- R0 · THE STOPWATCH — ran 2026-08-29. Four pre-registered numbers under a signed PREREG: runs/R0/RESULTS.md.
- R1 · THE RECORD AND THE NULL — GATE: PASS (
node tools/r1/gate.mjs, exit 0). The record spine end-to-end, cross-verified by an independent Python implementation that shares no code with it, plus the twin race. - R3 · THE BOUNDARY — GATE: PASS (
node tools/r3/gate.mjs, exit 0). The thought boundary is defined (structural › cap › floor, precedence total) and every boundary of the first resident run re-derives from the record without the model. - R3.5 · THE SECOND GEAR — attempt 1: NOT PASSED, on the record with named causes (runs/R3.5/): a wording defect the gate itself caught, a gear-2 timing envelope miss, and an economics bar failed honestly. The rung stays open. Failures print here; that is the point of the instrument.
| claim | number | receipt |
|---|---|---|
| Warm judgment cost, flat in context length | p50 ≈ 50 ms at 263/490/939 tokens | runs/R0/receipt-b-latency.md |
| The append-only resident regime holds | per-boundary cost = appended tokens (ratio 0.972, zero degradation over 24 boundaries, ~59 ms each) | runs/R0/receipt-c-appendonly.md |
| Margins are deterministic at one slot | 150/150 bit-identical, warm and cold | runs/R0/receipt-b-latency.md |
| The rebuilt-context twin is late and noisier | +313 charged sim-ms at the planted moment; spurious emits the resident correctly held | runs/R1/receipt-twin-race.md |
| A prefill anchor gives exact suffix-only rollback | 38 re-evaluated tokens for a 38-token suffix | runs/R0/receipt-d-anchor-armB.md |
| The raw logprob courtroom works with images | 199-token image span; no re-encode on cache hit | runs/R0/receipt-a-glance.md |
| Dial-0 fires on the right classes | smoke alarm, sustained crying, explicit help request — 3 of 20 scenes | runs/R0/receipt-probe-tail-sweep.md |
Residency buys judgment stability, not just latency. In the twin race, the resident — whose trunk holds its own prior hold-decisions — deepened its ambient holds and still crossed cleanly on the planted moment, while the twin, rebuilt every wake, hovered near zero and emitted spuriously at the same dial. And a separate run showed the mirror: an emit-seeded trunk self-reinforces upward. One mechanism, both directions, n=2: the disposition doesn't live only in the weights — it partly lives in the held trunk. A mind that remembers its own restraint is calibrated by it. That is why this tier cannot be simulated by calling a small model often; each call would be the twin.
The honest open problems are on the record too: the same precedent feedback is a flood risk (the trunk's own decision history is a design surface, not a free lunch); the inbound gate's first instrument proved staleness-blind; eviction for an append-only trunk in a finite window is still undefined. Ten killed claims are printed in ARCHITECTURE.md §18 beside what replaced them.
A mind whose default output is nothing is observationally identical to a dead one. You cannot tell a watcher that correctly held its tongue from a watcher that crashed, unless the holding leaves a mark. So it does — with its margin, hash-chained, replayable, and verified by two implementations that share nothing but the spec.
- ARCHITECTURE.md — canon (v1.3): the lanes, the record schema, the arbiter, the boundary composition, the gear contracts, the falsifiers, the funerals.
src/record/— the append-only chain: canonical byte layout, SHA-256, typed row codecs, persistence with verify-before-write, replay-to-identity. KATs pass in Node and in the browser (src/record/kat.html).src/world/— the deck (hash-committed answer key), percept rules behind a lexical hygiene gate, and a deterministic player: cost tracks change, never scene.src/mind/— the boundary fold (pure; replay needs no model) and the probe client with every serving-lane trap encoded as an assertion.src/arbiter/— the pure scheduler: supersede, refuse, escalate; every drop is a typed row. A switch for cognition whose drop table is a tape.tools/r0 · r1 · r3 · r35— the measurement runners and the gate runners.runs/— signed pre-registrations, receipts, and the chains themselves.probe/webgpu-probe.html— the original instrument page. It measures an in-browser configuration the architecture later abandoned; kept because a wrong-configuration measurement that knows it is wrong is still an instrument.
Used throughout, and worth stealing: [M-here] measured in this configuration · [M-box]
this machine, not this loop · [M-ext] elsewhere or vendor-published · [D] derived,
chain shown · [SPEC] designed, unbuilt · [BET] kill condition named · [OPEN]
undetermined. Every number carries its grain and denominator. A constant measured
outside the configuration that ships is a coincidence.
MIT — see LICENSE.