Vision
The six commitments
FP1
Structural data sovereignty
→
Rules out
Schemas that assume the platform must be able to read user data for core application logic to work. · Storage architectures with no path to user-held encryption keys.
Generates
The cell as the unit of ownership. The cell is the mechanism through which structural ownership is realised: one user, one cell, sovereign by construction. Cells have a defined boundary (the membrane), a defined interior (the four-partition), and a defined identity (single-owner, sovereignty-anchored). The cell architecture is detailed in `/paradigm/digital-cell-vision.md`. · The three-tier sovereignty ladder.
FP2
Truth is contested; provenance is not
→
Rules out
Tags or labels that assert relationship or identity on behalf of the user without confirmation (e.g., auto-labelling a Person as "spouse" or "ex" because relationship is contested). · AI-generated summaries that present derived claims as factual without source attribution.
Generates
Raw input as primary; derivations are projections (Store heuristic). The original, unprocessed input is the authoritative object; every structured entity is a re-runnable derivation. The substrate is immutable; interpretations layered on it are revisable. · Three-register data architecture (Store heuristic). Raw is immutable, emergent is prunable, deliberate acts are themselves captured as raw. Contestation is structurally accommodated: emergent interpretation can be revised without losing the audit trail of the deliberate acts that built it.
FP3
Capture friction is the existential constraint
→
Rules out
Required fields at capture (Event, Person, Location, Date, Tags, anything). · Pre-capture decision points (which album, which thread, which space).
Generates
Capture now, make sense later (Capture heuristic). Input must be instant and frictionless; organisation and insight happen asynchronously, post-capture, in review. · Everything is optional at capture time (Capture heuristic). A memory can arrive with just a text body. No field blocks capture. No tag is required. No event assignment is required. The substrate accepts the input as-is.
FP4
Meaning lives in arenas, not coordinates
→
Rules out
Database-shaped models where the primary entity is the photo file, the calendar event, or the GPS pin. · Surfacing models where the primary axis is chronological (year-in-review feeds, on-this-day notifications, anniversary surfaces).
Generates
Moment as the experiential unit (Enrich heuristic, L2 Emergent). The anchoring unit is the lived Moment; calendar events, photos, voice memos, location pings, listening history, communications are *data points that belong to* a Moment. Fuzzy time windows, overlappable, nestable, expandable. The Moment is FP4 made architectural. · Threads vs. tags — the narrative-continuity test (Enrich heuristic). Threads carry a story across time; tags color individual moments. The test: *can you tell its story across time?* If yes, thread; if no, tag.
FP5
Avoid preconceived structures. Let them emerge.
→
Rules out
Pre-designing schema for features that don't yet exist. · Modelling all of life upfront because "we'll need it later."
Generates
The model is additive (Store heuristic). Nullable columns and new tables only; no destructive refactors. The schema grows; it does not pivot. · Object model is layered by origin and function (Store heuristic, the L1–L4 layers). The four-layer model emerged post-hoc from the realisation that objects differed by *how they came to exist* (captured, surfaced, confirmed, authored), not by their data shape. FP5 generated the layering: rather than pre-deciding the entity hierarchy, let the layer assignment fall out of object origin.
FP6
The system serves, the mind drives
→
Rules out
"For you" feeds, curated digests, ranked content streams. · Engagement notifications (you have new tags, your friend captured a Moment, your weekly memory is ready).
Generates
The traditional English butler is the interaction model (Surface heuristic, derived from FP6's kernel). The system is responsive, but not suggestive; keenly anticipative, but never anticipatory at the surface. It keeps everything in order invisibly and answers when asked. The user's mind drives every interaction. · Trust must be visible to the reader (Surface heuristic, derived jointly from FP6 and FP2). Provenance and confidence are surfaced; no opaque "the system says so." The butler does not speak from authority; the butler surfaces records.
Heuristics
Capture ▾
Capture now, make sense later
settled
→ FP3
→
Input must be instant and frictionless; organisation and insight happen asynchronously.
Complexity stays invisible to the user
settled
→ FP3
→
If Remoir ever asks a user to disambiguate ontological categories the system uses, the design has failed. Hard veto test.
Everything is optional at capture time
settled
→ FP3
→
A memory can arrive with just a text body; no field blocks capture.
Capture is not its own reward
settled
→ FP3, FP6
→
No counts, streaks, badges, progress meters, or surface affordances that turn the act of capture into a feedback loop. The reward for capture is the captured record's future utility, not the immediate gesture of feeding the system. Closes FP3's narcissism failure mode at the slice where the failure would manifest; complements the butler heuristic in §Surface, which closes the same mode at the response side.
Store ▾
Object model is layered by origin and function
settled
→ FP5
→
Four functional layers (L1 Substrate → L2 Emergent → L3 Structural → L4 Deliberate), each further from raw substrate than the one before. The layer reflects how an object comes to exist and what stage of meaning-making it is in.
Raw input as primary; derivations are projections
settled
→ FP1, FP2
→
The original, unprocessed input is the authoritative object; every structured entity is a re-runnable derivation.
Non-destructive correction layer
settled
→ FP1, FP2
→
User corrections are stored as a separate metadata layer linked to the original, not as overwrites. Both the captured state and all corrections remain queryable. Any correction is revertible at any time without data loss. The corrected view is displayed; the audit layer preserves the original.
Per-field provenance
settled
→ FP1, FP2
→
Every metadata field on every Substrate object tracks its source as one of four categories: `device` (auto-captured by sensors), `external` (imported content with unreliable metadata), `user_enriched` (manually added by the user), `user_corrected` (non-destructive override of an earlier value). Trust decisions at the membrane — cross-cell access, AI confidence weighting — read from these categories.
Three-register data architecture
settled
→ FP2, FP5
→
Raw is immutable, emergent is prunable, deliberate is captured as raw. Raw data records facts of capture and is never pruned; emergent data records interpretations and reshapes continuously; deliberate acts of meaning-making are themselves captured as raw, pinning emergent patterns to historical engagement without making the patterns themselves immutable.
The model is additive
settled
→ FP5
→
New features bolt on without modifying existing tables; nullable columns and new tables only.
Entities exist independently
settled
→ FP5
→
Place, Event, Person are first-class; can be created and linked before any memory references them.
Canonical records are reference data, not user data
settled
→ FP2
→
Users never create canonical records directly; admin-curated reference layer.
Match, don't merge
settled
→ FP1, FP2
→
User-created rows are never rewritten or deleted when mapped to a canonical; mappings are reversible joins, not rewrites.
Mapping is reversible and auditable
settled
→ FP1, FP2
→
Every canonical mapping has a documented revert path and an audit trail.
User experience is unchanged by canonicalisation
settled
→ FP3, FP6
→
The user does not perceive that canonicalisation happens.
Reversibility is mandatory for automated decisions
settled
→ FP1, FP2
→
Anything the matcher writes autonomously must have a documented one-action revert path; auto-confirm and human-confirm have identical audit shape.
"Fed but not read" — canonical layer as one-way valve
candidate
→ FP1, FP2
→
The canonical layer can be contributed to but not directly queried; data surfaces only via legitimate user encounter with sufficient match specificity.
Canonical layer regime split (world-data vs person-data)
candidate
→ FP1, FP2
→
At least two regimes with different access and consent rules; leave room for additional regimes.
Enrich ▾
Lazy enrichment at memoir-generation time
settled
→ FP6
→
External knowledge is pulled in only when memoir is being generated, not at capture or storage.
Threads vs. tags — the narrative-continuity test
settled
→ FP4
→
Threads carry a story across time; tags color individual moments. *Can you tell its story across time?* If yes, thread; if no, tag.
Tags grow into threads through use, not upfront design
settled
→ FP5
→
Promotion is suggested by usage patterns; the user decides.
Tags graduate to richer objects through pattern persistence
settled
→ FP5
→
A tag can graduate to Topic/Thread (Emergent) or to Event/Organization/Place (Structural) when the pattern clarifies.
Emergent precedes Structural; deliberate confirmation is the gate
settled
→ FP4, FP5
→
Structural objects (Events / People / Places / Organisations) are further from raw than Emergent; they require deliberate user confirmation to crystallise from emergent proposals. Without confirmation, candidate Structural objects stay Emergent and remain prunable.
Moment is the experiential unit
settled
→ FP4
→
The anchoring unit is the lived Moment; calendar events, photos, voice memos, location pings, listening history, communications are data points that *belong to* a Moment. Fuzzy time windows, overlappable, nestable, expandable. FP4 applied to the object model itself.
Insight as deliberate authoring
settled
→ FP4, FP6
→
An Insight is a deliberate user-authored act asserting meaning, composed of an authoring input (captured as a Raw Input) plus zero or more bindings to existing objects. Categorically human-authored — distinct from AI-surfaced Moments. Each authoring act is itself captured as a Raw Input; the Insight object is a projection over those acts.
Verification, not authorship
settled
→ FP2
→
The editorial role verifies external knowledge; it does not author family memory.
Knowledge is not identity
settled
→ FP2
→
Separate tables for canonical knowledge vs. canonical identity; different lifecycles and trust models.
Public vs. private canonicals is structural, not policy
settled
→ FP1
→
The distinction is enforced by schema, not by access rules.
Surface ▾
The traditional English butler is the interaction model
settled
→ FP6
→
The system is the exo-skeleton for the mind: responsive, but not suggestive; keenly anticipative, but never anticipatory. It keeps everything in order invisibly and answers when asked, drawing on the full canonical layer. It does not surface, recommend, notify, or assert. The user's mind drives every interaction. See FP6 for the full treatment.
Trust must be visible to the reader
settled
→ FP2
→
Provenance and confidence are surfaced in the reader UI; no opaque "the system says so."
Family memory wins conflicts
settled
→ FP2
→
When family-stated memory and external knowledge disagree, family memory takes precedence and is never silently corrected. Direct expression of FP2 in the family/canonical case.
Cross-cutting ▾
No-foreclosure of Tier 3
settled
→ FP1
→
No architectural decision today forecloses cryptographic per-cell separation against the eventual third-party ecosystem. Tier 3 enforcement becomes salient when the platform opens to third-party developers and the membrane becomes a public API surface to actors Remoir does not control. The abstraction is built from the first moment; the cryptography arrives later, bounded by the gate at which the cell first touches data and parties outside any trusted circle — past that gate, deferral becomes foreclosure. Build the seams before the walls.
Tier 3 readiness checklist
settled
→ FP1
→
What "the abstraction is in place" means concretely: every user-owned row carries a cell-id (which today may equal user-id, but the column exists and is referenced); read/write paths route through a cell-scoped boundary function that is currently a pass-through; an export endpoint exists from the cell's first moment; a key-slot column on the cell record exists, unused; all knowledge-graph and review surfaces read through the cell API, not directly from tables; no cross-cell joins in application code, even though the database does not yet enforce it.
Audit transparency as a sovereignty primitive
candidate
→ FP1, FP2
→
Visibility into what the system has captured and processed is structural proof of cell ownership; glanceable by default, exhaustive on demand.
Three-axis data architecture (scope × stage × character)
settled
→ FP1, FP5
→
Data has three orthogonal properties: scope (private / connection-gated / public), stage (raw / curated / canonical), character (factual / contested / opinion / promotional). Character is a cross-cutting tag, not a fourth scope or a separate layer. Every datum has all three properties; orthogonal to the four-layer object model and to the three-register persistence axis.
Aggregation-as-attack is a first-class design concern
settled
→ FP1, FP6
→
The canonical layer's value proposition is precisely aggregation, and aggregation of individually-innocuous data points is the structural shape of doxxing, profiling, and platform-facilitated stalking. Match thresholds, capture audit trails, subject-side visibility, and anomaly detection on reconnaissance-shaped capture patterns are all designed-in from the outset.
Consent-gated zone graduation
settled
→ FP1
→
No datum moves between scopes (private → connection-gated → public, or any transition across the three-axis matrix) without explicit consent from the party controlling the source zone. Default-deny; opt-in, granular, revocable.
Privacy by default for cross-cell discovery
settled
→ FP1
→
Cross-cell discovery is opt-in; default is private. Holds whether or not peer cells exist.
Governance ▾
Inaction is the correct default on contested governance
settled
→ FP1
→
The federation is structurally biased toward stasis on contested decisions; for a multi-decade archive, this is a feature.
Not all data value is equal — the value stack
settled
→ FP1, FP6
→
Four types of data value (collection, maintenance, interpretation, custom metrics) have different monetisation stances; lower-stack = commons-protective, higher-stack = more freely commercial.
Provenance and attribution are foundational
settled
→ FP1, FP2
→
All monetisation presupposes the ability to track who did what, when, with what quality; a system property, not a feature.
Activation economics per dataset, not user-count thresholds
settled
→ FP1, FP6
→
Commercial viability is determined per-dataset (activation rate × payout), not by global user count.
No surveillance corner
settled
→ FP1, FP6
→
Architectural choices today must not foreclose non-surveillance monetisation viability at scale. The trap is not "no early monetisation plan"; it is building data-collection patterns and cost structures that leave surveillance ads as the highest-yield viable exit at 10× / 100× scale. Mirror of *no architectural decision forecloses cell/membrane* applied to monetisation.
Activation as the unit of value
settled
→ FP1, FP6
→
Data has no monetisable value sitting in storage; value exists only at the moment of activation — when data surfaces to a user and produces utility. Reframes payout, viability, attribution, anti-hoarding incentives.
Capped returns over governance gymnastics
candidate
→ FP1
→
Removing the financial reason for extraction is more durable than building governance defenses against extraction; belongs at the capital-structure layer.
Theory entries
No theory entries yet — Theory is milestone M7 in A1-PH2.
The six arcs
A1 Self-Contained Cell settled · current ▾
phase 2 of 4 · milestone 5 of 14
"The minimum-viable cell. A single user captures the moments of their life on their own terms, with raw input as the authoritative substrate and the canonical layer as the structural backbone. No cell ever talks to another cell at this arc."
Thesis: capture friction can be removed without sacrificing depth; raw-substrate-first discipline is buildable; the butler interaction model holds. Data sovereignty at single-user scale is demonstrated as an architecture, not as a policy.
Arc-closure signal: Production (the arc's exit phase) reaches a state where a single user can trust the cell with their daily life and the system behaves as the household-keeping butler. The architectural readiness for cross-cell behaviour is in place but unused.
A2 Cell-to-Cell emergent ▾
"Multiple cells interacting on terms each cell sets. The canonical layer becomes shared infrastructure: distinct cells reference the same place, the same event, the same person without exposing private content. The membrane handles consent at granular and revocable resolution."
Arc-entry signal: cells exist that have load-bearing reasons to share content under explicit, granular consent.
A3 Remoir Platform Blooms — Injections / Combinations emergent ▾
"The cell expands beyond memoir. New domains of life-data inject into the same substrate: health tracking, financial records, professional knowledge, creative output, family history. The cell holds them all — but the Remoir-specific value comes from the *combinations*: memoir-grade context applied to health data, professional knowledge enriched by lived-experience capture, family history drawing on every domain."
Arc-entry signal: users routinely use Remoir for things other than memoir, and the platform surface answers them coherently rather than awkwardly.
A4 Remoir at Scale — Lost Innocence unknown ▾
"The platform crosses a threshold where it can no longer not be careful. A4 is the arc of consequential mass: many lives depend on Remoir's continuity, durability, and trustworthiness; many cells are interconnected; many third parties build against the platform surface; many users would suffer materially from a cell loss, a compromise, or a governance failure."
Arc-entry signal: a Remoir failure mode would cause material harm to users at scale, and the operating assumption shifts from "we are building the cell" to "we are stewarding the cell."
A5 Remoir Dominance — Pushback from the Regime speculative ▾
"The digital-cell paradigm has become the default expectation in significant parts of digital life, and the incumbent regime — surveillance capitalism, extractive monetization, platform-holds-the-data assumptions — pushes back structurally rather than competitively. A5 is the arc of regime-level resistance: legislative capture attempts framed as user protection but designed to require backdoors; regulatory pressure on canonical-layer access; narrative attacks on cell sovereignty; commercial competition through means other than merit."
Arc-entry signal: the platform faces sustained structural pushback from incumbent actors that competition on merit cannot resolve.
A6 Remoir Event Horizon unknowable ▾
"Past the regime fight. What lies beyond A5 is unknowable from the current vantage; the arc is named, not specified, to preserve the awareness that there is something past A5 and to leave the namespace open for whatever it turns out to be."
Source docs
North-star · long-lived
A single user's lifetime substrate.
"Every moment captured once, surfaced forever. The cell is sovereign by structure: raw input is the authoritative substrate, the canonical layer is the structural backbone, and meaning emerges from use rather than imposed schema."
Read north-star.md →
Working vision · A1-PH2
Foundation.
"Foundations clean enough to build a knowledge graph on without first having to refactor anything. Settled vocabulary, canonical references, the framework the next phase can build on without negotiation."
Read working-vision-A1-PH2.md →
Object model
L1
Substrate
Raw capture as captured. Immutable.
L2
Emergent
Patterns that surface from use.
L3
Structural
Confirmed shape. Deliberate gate passed.
L4
Deliberate
Authored meaning. The user's interpretation.
Raw
Curated
Canonical
Privatethe digital cell
Personal raw — photos, voice memos, notes
Personal curated — tagged knowledge, the user's graph
Personal canonical — user's attested reference (family tree, contacts)
Connection-
gated
gated
Shared raw — group event captures, family photo pools
Shared curated — collaborative notes, team / family knowledge
Shared canonical — group-attested reference (family genealogy, team standards)
Public
Public raw — sensor feeds, weather, government statistics
Public curated — contested entries, deliberative drafts
Public canonical — attested reference (places, history, events, organizations)