← Architecture

Shipped (0.0.5 preview) · June 2026 · public adaptation

Hooks and watches

"May the system act on its own?" produces paralysis or marketing. Emacs deflates it: timers and sentinels have fired code without a keypress for decades. The narrower, answerable question is — under whose authority, and into which work's custody, does an autonomous firing record?

Hooks: invited extension

A script can declare, in one line, "after a capture, record this note." The declaration is part of the session's durable record; each firing is recorded next to it with the exact form that triggered it. Hooks have no authority of their own and no life outside the session — and the lenses can explain any of them: which line declared it, what fired it, what it produced.

Watches: admitted standing autonomy

Standing autonomy is admitted, never assumed. Admitting a watch requires declaring every bound: the work it is bound to, the record kinds it observes, a firing budget, a time-to-live (standing authority dies unless re-admitted), and a declaration of what each firing produces — so that absence is judgeable, not just presence.

The watch's state derives entirely from durable records: there is no in-memory cursor to lose in a crash, and polling is not firing — only the job record is the firing. Budget exhaustion and TTL expiry suspend with a record, never silently. By default a watch is blind to records produced by watches: the re-trigger graph is broken unless explicitly opted into, because feedback loops should be a decision, not a surprise.

Source status: this page records fourth-generation design context. The repository's main line is now the Gen5 clean-sheet implementation; its accepted architecture and current maturity live in architecture/system.md with the feature and capability maps. This page summarizes historical design pressure rather than serving as a current implementation contract.