"The single door was the right idea. It was built inside the wrong body. Moving it out took a day — and a list of everything the old host had been doing without anyone writing it down."
A Door Inside Another Body
The previous lesson traced the loop as it ran when that lesson was written: every generation passed through the brain, the one door into the engine. Look closer at where that door stood. The workspace's backend — its routes, the bridge the plugin and the app connect to, its job coordination, its lineage store — lived in the brain's repository and ran in the brain's process. The brain's startup started it, the brain's shutdown stopped it, and its records sat in the brain's database. That is exactly the fused boundary the triad's first lesson warns about, only wearing a network address: the workspace had a limb grafted onto the brain's body. And the brain is the body that changes most often, so every brain restart took the drawing tool's server down with it.
The Move
On 2026-09-21 Dad asked for the separation, and it happened in a day. The workspace's backend moved, nearly verbatim, into a small service of its own: one process on the artist's workstation, listening only on that machine, serving both HTTPS and the bridge's secure socket. Its data was copied rather than moved — every lineage row verified against the original, every stored image checked by hash, every ID unchanged — and the old copy was left untouched for rollback. The plugin kept its address; the same local door simply had a new landlord behind it. The brain took the workspace out of its startup and its routes, stopped writing the workspace's records (the old table stays behind, frozen, as the rollback copy), and left the drawing loop entirely.
What the Old Host Had Been Doing
The move surfaced that list the honest way: one item at a time.
- A cross-site guard. The brain's middleware refused requests from web pages the machine had not served itself. The moved routes had no such check, so until the fix landed, a web page open on that machine could have sent a request that deleted every stored candidate. A cold review caught it the same day, and the fix restored the old rule.
- The family's lock modes. When the family locks its services down, the brain had been refusing the workspace's requests along with its own. The new service had no view of that posture until it learned to read it; now it pauses its HTTP surface the same way.
- Backups. The brain's backup fan-out carried the brain's database to the other machines. The workspace's new store had to be added to that fan-out, and to the snapshot job, by name.
- A bounded shutdown. The plugin parks a long-poll for up to a minute. The brain's worker had a two-second limit on graceful shutdown. The first install of the new service had none, and without one a parked poll holds the service open until the operating system kills it — and a killed process runs none of its shutdown hooks.
- A refusal to start empty. The new service refuses to start if its migrated store is missing, instead of quietly creating a blank one where a moved folder used to be — a guard the brain never needed, because the data had never lived anywhere else.
Where the Single Door Went
The principle survived the move. The door changed address, and it split along the line between the two jobs it had been doing. For the workspace's own clients — the plugin and the native app — the door is now the workspace's service: lineage, job coordination, the candidate store, and the cross-site guard live there, and even the batch fan-out that steps a locked seed moved there verbatim. For generation, the door is now the engine itself. The brain's image tool, the workspace's service, and the cover-image composers across the family's apps all call the engine's one API, and the engine owns the model IDs, the catalog, the archives, and the queue. There is still exactly one door into the engine. It is the engine's own.
A Scheduler Can Only Place What It Can See
The same week handed the fan-in a new job. When the engine began choosing which of its machines runs each job, the workspace briefly kept per-machine locks of its own, holding jobs back until it judged a machine free. About seventy minutes later those locks were deleted. The workspace now submits every job to the engine at once, so the engine's scheduler sees the whole backlog. A client that queues privately hides demand from the only component able to place it well. That is the fan-in argument again, arriving from a direction the previous lesson never drew: one door is not only where the rules are enforced. It is where the whole picture is visible.