"The engine queues, records, reviews, and serves results. A session executes."
The last refusal
This quest opened on refusals — assays but never advises, four things the product deliberately is not. It closes on one more, and this one is about capability rather than posture.
Monte Carlo simulation and judgment-laden analysis do not run inside the engine. They are delegations: the engine queues a brief, records it, and holds the result behind a review round. The work itself is executed by a session on whichever machine took the brief.
Be precise about where that gate actually lives, because it is not where you would guess. The invariant is real and the CLI enforces it — the client refuses to land a delegation whose verification has not passed. The engine's own routes are more permissive: the archive routes serve any file committed under a delegation's directory without consulting its status, and the landing route checks for a duplicate landing and a non-empty summary rather than for a green verification. So the discipline is enforced at the tool everyone uses, not at the boundary. That is a common and defensible place to start — and it is worth knowing which one you have, because a gate in a client is a gate anyone can walk around by calling the route directly.
The architecture doc names its own mirror image: a sibling application that produces video holds the same line as the engine never renders. Same shape, different verb. In both cases the engine is a workshop rather than a factory — it holds the queue, the record and the gate, and the actual craft happens somewhere it can supervise but not perform.
Why not just run it in the engine
A Monte Carlo is only arithmetic, and a serving process can do arithmetic. The reason is the second half of the sentence: judgment-laden.
A valuation memo or a scenario model is not a computation with one right answer. It involves choosing assumptions, noticing that a chosen assumption is wrong, and revising. Full automation was judged insufficient for that class of work, and so was routing it through a chat interface — the queue is named as the load-bearing decision rather than an optimization.
And once the work happens elsewhere, the durability rules follow: briefs and results are stored, a crashed session re-takes its brief rather than losing it, and a report is material, not truth, until it has passed a review round. The engine cannot do the thinking, so it does the remembering and the gating instead — which is a genuinely useful division of labor rather than a limitation.
One last mechanism: counting instead of guessing
A small thing that earns a place in the closing lesson, because it is the same idea in miniature.
The read model — percentiles, windows, medians over the whole append-only history — is expensive to rebuild. The obvious cache is time-based: rebuild every N seconds. The engine instead caches on its own write counter, and can do so because it is the single writer. Counting attempted writes is cheap and, crucially, never misses one. Look closely at the ordering though: the counter increments before the statement runs, so a statement that fails still advances it and still triggers a rebuild. That makes this conservative invalidation rather than an exact successful-write signal — it can rebuild when nothing changed, and it can never fail to rebuild when something did. For a cache that is exactly the right direction to be wrong in, and it is worth naming rather than claiming a precision the code does not have.
A timer would have been approximately right and occasionally embarrassing: press Refresh, watch nothing change, wonder if the button works. A signal that never misses was available for nothing, because an ownership decision made earlier had already established that there is only one place writes come from.
Where this leaves you
One sentence has run through every track. A measurement that cannot state its own limits is not a measurement — it is a claim wearing a measurement's clothes.
It appeared as a date that did not say whose calendar it used. As a percentile that did not say how long its window was. As a roster that did not say it was incomplete. As a name borrowed from an index whose specification it did not meet. And finally as a number computed where nothing else could read it — the case where the limits could not be stated because there was nobody to state them to.
That is the whole discipline of an instrument that refuses to advise. It does not get to be persuasive, so it has to be checkable. A touchstone tells you what the metal is, shows you the reference needles it compared against, and stops talking.