The Owner Says What It Speaks

You Cannot Upgrade a Fleet of Live Owners on One Day

The shared-input contract changed what the session owner does with bytes. But an owner is only replaced when someone restarts it, and restarting it ends every job it holds. Installing a new app never restarts a compatible owner, on purpose. So on the day the new contract shipped, Macs across the fleet were running a new app in front of an owner that still spoke the old one — and some of those owners held live Anvil seats Dad was not ready to end. A flag day was impossible. The answer was a greeting.

The Hello Is a Capability List

Every connection to the owner starts with a hello, and the hello says what this owner speaks. The first mobile contract advertised input-lease-v1. Owners started from a build with the new contract advertise shared-input-v1 beside it. The September review added prompt-frames-v1 and a build identity. Clients read the list and behave accordingly; nobody guesses from a version number.

A gateway in front of an owner that advertises only the old capability serves the old exclusive lease unchanged and says so in its own hello to the phone. The phone then shows Take Control on that Mac's chip only, and the Macs sheet labels the row Control available instead of Typing shared. The Mac app keeps its take and release verbs for that owner. Two contracts coexist, per Mac, and every surface knows which one it is talking to.

The Switch Is a Restart, Made Per Mac

Moving a Mac to the new contract means restarting its owner, which ends its jobs, so each Mac waited for its own decision. On 2026-09-17 the office Mac and the MacBook were restarted on Dad's explicit go; the office restart ended the Anvil seats running there, as he approved. The seven other Macs were restarted only after checking that their owners held no child process at all, so nothing ended. By that afternoon every owner in the fleet spoke the shared contract — and the legacy path stayed in the code, under test, for the next owner that might be older than its app.

Capabilities Also Protect What a Surface Sees

The same mechanism keeps private things private. The native Mac pane uses Smolder's own escape-sequence frames to prove where the shell prompt is, which the proposal and completion features depend on. Those frames mean nothing to a phone and must not leak into its screen or anyone's copied text. A surface that does not declare prompt-frames-v1 receives output with those frames filtered out — and the sequence numbers stay continuous, even if that means an event carrying no bytes, so the phone's replay can never mistake a filtered frame for a gap.

Let the owner say what it speaks, and let every client honor the answer. New contracts arrive beside old ones, the switch happens per machine when its operator allows it, and filtered output never breaks sequence.

Code

Reading the hello·text

owner hello: capabilities
  input-lease-v1      the first mobile contract: one writer, Take Control
  shared-input-v1     every input surface types; optional hold   (2026-09-17)
  prompt-frames-v1    private prompt frames for surfaces that declare it
  build identity      lets an installer say "this owner is older than the bundle"

gateway in front of the owner
  owner has shared-input-v1    -> phone types at once; row says "Typing shared"
  owner has only input-lease-v1 -> serve the old lease unchanged
                                  hello tells the phone; Take Control on THAT chip
                                  row says "Control available"
  read-only device              -> row says "Read only"

moving one Mac to shared-input = restart its owner
  ends that Mac's live jobs -> needs its operator's go, per Mac
  a Mac whose owner holds no child process -> restart ends nothing

surface without prompt-frames-v1
  private frames filtered out; sequence numbers stay continuous

Exercise

Pick a service you run on several machines whose protocol you want to change. Write the hello you would add: which capabilities, old and new. Then write what an old client does against a new server, what a new client does against an old server, and who decides when each machine switches.

Hint

If any row of your table depends on comparing version numbers, replace it with a capability. If a switch ends running work, someone with authority over that work has to say yes, per machine.

You Cannot Upgrade a Fleet of Live Owners on One Day

The Hello Is a Capability List

The Switch Is a Restart, Made Per Mac

Capabilities Also Protect What a Surface Sees

Code

External links

Exercise

Progress

Comments 0