Principles

Each one came from a specific failure in a specific tool, including this one.

Filing is not finding

Scrivener's mistake is using one tree for two things with opposite needs. A manuscript genuinely is a tree — chapters contain scenes, readers move through it in order. Research genuinely is not: a note about a character's mother is also a note about inheritance and also something read in March. A tree forces one home, so you file it wrong, file it three times, or stop filing.

Capture costs nothing. No filing decision is ever required at drop time. Structure is proposed and never imposed — and where the software cannot tell, it says so instead of guessing.

Retrieval is not generation

The model never proposes text. It may always help you find your own.

That line is what allows a writing tool to be genuinely useful without contaminating authorship. Surfacing a note you wrote two years ago is remembering on your behalf. Producing a sentence is something else, and the difference is not a matter of degree.

Everything runs on your machine. A tool built for writers worried about their work being used to train models cannot itself ship that work to a model.

Presence is the signal

An element that is always there becomes furniture, and you go blind to it within a week. So the panel that surfaces relevant material is absent by default — not collapsed, absent — and appears only when something has cleared a real threshold. Its arrival carries the information.

It never appears mid-sentence. A pause while choosing a word is not a pause that wants help, and a tool that interrupts there teaches you to stop pausing.

Invisible until it is needed

The cryptography is not the product. The writing is. Provenance that asks an author to understand it, maintain it, or think about it while working has already failed — a novelist is not obliged to hold a mental model of a hash tree, and a tool that requires one has mistaken its own machinery for the thing being made.

So it runs underneath. Marking a state is one deliberate act with a plain meaning, and everything downstream of it — the fingerprint, the link to the entry before, the witness — happens without asking. The correct experience of a provenance record is not noticing that you have one.

Invisible is not hidden, and the difference is the whole design. Every hash is always there to be looked at, because a program that concealed its own workings would be asking to be taken on faith — which is precisely what this one refuses to ask. The rule is not that the machinery is out of sight. It is that it never speaks first. A draft is labelled with the name you gave it and the digest sits quietly beside it; an automatic save says “Saved” and nothing more, because it is a notification nobody requested. Ask a question that only a hash can answer — verify this, compare these, certify that — and the hash is the answer, in full.

And the hoped-for outcome is that it stays that way permanently. This is insurance. Most people who take out insurance never claim on it, and that is not a waste — it is the good ending. The record earns its place on the day someone questions the work, which for almost everyone is never.

This is also why there is no score, no meter, no completeness badge and no streak. Anything that turns the record into something to tend converts insurance into homework, and then into anxiety — and an author who is thinking about their provenance record is an author who is not thinking about their sentence.

If this app dies, the books live

Open documented format. A plaintext copy of the current state, always, in a place you can find without us. No capability that exists only inside the application.

This is why the record is a directory of ordinary files rather than a database, why nothing requires an account, and why the verification procedure deliberately uses tools we did not write.

Two caches, one record

The editing log and the search index are disposable and rebuildable. The content-addressed store is the record. Knowing which is which at all times is what makes it safe to change almost anything else later.

Determinism is permanent

Hash the plaintext and compress afterwards. Version the canonicaliser and never change a released one. These cost nothing now and are unfixable later.

Frozen vectors verify stability, never correctness

They prove that today's output matches yesterday's. They cannot prove either is right. Something outside the hash layer has to establish that first — here, two independent implementations agreeing on real documents, checked by eye before anything was frozen.

Claim only what's provable

The verification screen states what it cannot establish as prominently as what it can. A pending timestamp is never displayed as a confirmed one. An imported timeline never renders identically to a lived one — asserted history and witnessed history are different things, and an interface that blurs them is a fabrication with a nice interface.

The same discipline governs ordinary vocabulary. Edits made after a draft is cut are working toward the next draft, never the next draft — claiming a completion the author hasn't declared would make the whole gate meaningless. Before the first cut there is no draft at all. Just writing.

Accessibility is structural

Screen-reader support over a rich-text surface, full keyboard operation including the spatial canvas, and dictation as a first-class input mode are all hard because they are structural. They cannot be added to a finished interface without rebuilding it.

Right-to-left is in the same category, and it is not hypothetical here — the working corpus contains Ladino set in Hebrew script. Bidirectional text cannot be retrofitted onto a text pipeline cleanly, so it is handled from the start.

The corollary: never penalise assistive input. Unusual editing rhythms mean a touch typist, or dictation, or an assistive device — and treating them as anomalous would reintroduce at the presentation layer exactly what the record format refuses to encode.