locu.systems — locus hosting: the direction

Version: 0.1 Status: Ruled direction. `spec` rung. Nothing in it is implemented. Audience: Engineering, and whoever operates it first Ruled: 2026-09-14, by Travis, on registering locu.systems. Not yet entered in the root REVISION_REGISTER.md; that entry is the ruling of record, this file is the design.

What this supersedes. 80_SERVICE_MANAGEMENT_PILOT.md was written earlier the same day and proposed service management for agent businesses, with locus hosting as a later phase. Travis ruled the later phase to be the direction and registered a domain for it. So §6a of that document is now this one, and its phase-one package — the weekly website health report — is not being built. That document is banded, not rewritten: it is a dated design record and the reasoning in it is why this one exists. What this does NOT supersede: the retraction. Claims made on webhost.systems that had no witness were retracted in place on 2026-08-16, and they are quoted on this surface still. A new domain name does not retire a retraction. Publishing under a new name while quietly dropping the list of things we said and could not back would be the precise move the retraction exists to prevent.

1) What locu.systems is

A host for ComputeDriven loci. The customer deploys a locus — the thing that carries state, the authority it was granted, and continuity across restarts. The machine underneath is a carrier: rented, replaceable, and never the customer's identity. The meter counts admitted transitions, the steps the world actually took.

The vocabulary is not coined here. Each word has a published pattern and the site links it:

2) The claim the pricing makes

You are billed for what got admitted, not for how busy the machine was.

Utilization is printed on every screen because it is the number that finds a thrashing locus. It is on no invoice, because a carrier can sit at full utilization and admit nothing — charging for it would be charging the customer for our own placement decisions.

Every figure anywhere on this surface is a placeholder. The measured production floor is a few hundred cycles per transition, so a million transitions is a fraction of a second of one core. A price is not derivable from that until a kernel counts admitted transitions under load, and until then no number on the site may be presented as a rate anyone could pay.

2a) The shape of the meter

Not ruled. A design constraint on the meter that gate 1 in §4 will build, recorded here because the record shape is a one-way door: once evidentiary counts exist, reshaping them means rewriting receipts, and this tree does not rewrite receipts.

A transition records a class, not a cost. The meter writes a small class symbol per admitted transition — countable by a kernel taught nothing about cycles — and the cost lives in one calibrated scale per (transition class × epoch), recorded once per group. An invoice is Σ (count × scale).

Three things follow, and they are why the shape is fixed before the kernel exists:

• The counter ships before the price. The counts are evidentiary and arrive with gate 1; the

scale is a separately versioned artifact that arrives with gate 4. The absence of a price is then visible in the data — there is no scale row — rather than maintained by a launch gate refusing to print one. §2's prohibition stops being a promise and becomes a missing column.

• A repricing does not rewrite evidence. Re-pricing a past period reissues one versioned scale

against immutable counts. Per-event pricing would make the same correction a rewrite of every record in the period.

• The record stops outgrowing the work. Per-event storage is O(transitions); this is

O(classes × epochs), flat in volume. At §2's floor of a few hundred cycles per transition a per-event record is larger than the work it describes: a saturated core at a 0.1 % duty cycle produces on the order of 10^10 transitions a month, and a 32-byte record each makes the billing data cost more than the compute it bills. This is not a performance argument — the meter is not on a hot enough path for that to matter. It is that the naive record is inverted.

Group by transition class and epoch. Never by carrier occupancy, and never across tenants. A scale shared between loci makes one customer's invoice move when another's loci behave differently, and carrier-multiplexing puts more loci than slots on a carrier by design — so a carrier-scoped scale spans customers. That is §2's utilization ban in a new outfit: the same coupling, the same objection, harder to see. Volume pricing is where someone will reach for it.

Expensive classes get their own group. A group's scale is dominated by its largest member. A rehome, a large state migration or a cold seal re-establishment averaged in with a few-hundred-cycle ordinary transition either overbills every ordinary transition in the group or eats the outlier. Ternary weight quantization, where this representation comes from, spreads outliers by rotating the basis before rounding; a bill cannot be rotated, so the only answer left is to keep those classes in groups of their own, or on their own invoice line.

2b) Settlement — how a customer pays, and what paying does not buy

Three clauses RULED 2026-09-19 — R89, R90, R91 in the root `REVISION_REGISTER.md`. The mechanism is unwritten and nothing is built. They were ruled ahead of the mechanism for §2a's own reason: the shape is a one-way door. Once a balance has moved between two parties it cannot be made non-transferable afterwards, and once admission consults a payment rail the floor's latency claim is a claim about somebody else's ledger. The full contract, its ten refusals and their controls are 91_SETTLEMENT.md; this section is what it means for this surface.

What is sold is what §2a counts: admitted transitions of a class. A purchase credits a balance denominated in the versioned scale per (transition class × epoch) — not in dollars, not in requests, not in machine-hours. So settlement inherits §2a whole: counts stay immutable, a repricing still reissues one scale row against them, and the absence of a price is still a missing scale row rather than a promise.

The rail is x402, and we are the seller — never an issuer. Design, not ruled. HTTP 402 Payment Required, settled in stablecoins by the payer's own facilitator. It requires us to mint no instrument, run no chain and hold no float beyond an unspent balance. It is also the shape an agent can use without a human in the loop, which is the only shape that matches a locus that runs while nobody is watching. A coin was considered and is not the direction; the five gates below are what a coin would have to clear, and none of them is cleared.

The invariant, which is `custody-model.md`'s with one word changed:

Paying for something cannot grant lifecycle authority over it.

A balance is a quota, never a grant. Four consequences, each of which is a refusal this surface is bound by:

• An exhausted balance never ends a live locus. It refuses new admissions. Halting a running

locus is a lifecycle event needing a lineage decision and a receipt, exactly like a suspend. If a payment rail can end a locus, payment has become authority.

• A balance never moves between accounts — R89. It may be funded by a third party, spent across

many loci under one account, and refunded to the method that funded it. It may never be sold, gifted, split out or assigned. That is the line between a credit and an instrument, and it is what makes "seller, never issuer" true by construction rather than by assertion.

• The floor never consults a budget — R90. An unfunded request refuses at ingress, before the

floor. Admission may depend on a payment profile's verify; it may never depend on settle. This is forced by the invariant above: if an exhausted balance may never end a live locus, there was nothing the floor needed a budget for.

• Nothing is priced per request. Charging per call is charging for asking, which is §2's

utilization ban in an HTTP header.

• No balance is per-carrier and none is shared across tenants. §2a forbids a carrier-scoped

scale because carrier-multiplexing puts more loci than slots on a carrier; a balance is the same object one step later.

• Admitted is admitted. A settlement that fails after work was admitted is a **debt event

appended to the lineage**, never a retraction of a count. This tree does not rewrite receipts.

`computedriven` owns the count format; locu.systems owns the money — R91. Settlement gets no crate in the substrate: a substrate carrying our billing model cannot be run by anyone who is not us. What remains there is a negative constraint, computedriven/docs/settlement-boundary.md.

Settlement is a fourth clause, beside the three the fabric already states — discovery chooses where we try, authentication decides whom we reached, only the lineage decides what they may do — and it adds: settlement decides how much may be spent; never whom, never what, never where.

What this does not change. §6 still stands in full. Accepting a payment rail is not a plan anyone can buy: there is no price (gate 4), nothing to spend a balance on (gate 1), and nobody to sell to (gate 5). launch-gate.mjs still refuses a plan, a signup, or any figure presented as a rate, and this section is not an argument for relaxing it. Nothing here is built. Settlement is downstream of gates 1 and 4 in §4 and does not advance either — a meter that counts nothing has nothing to bill, and a balance denominated in an uncalibrated scale is denominated in nothing.

The one cheap thing that is honest today is declaring the rail without offering it: a static agent.json saying which agent protocols this surface speaks. It is a machine-readable statement of direction, not an offer, and it is subject to the same gate as every other line on the surface.

3) Carriers

Ruled 2026-09-19 (R93), replacing the list this section previously carried. R4 (2026-08-15) was cited here for the carriers, and R4 did not rule on carriers — STACK_HUB.md §0.7 settled the Cloud v1 control plane, and its own diagram ends "the OS holds the keys, does all the compute." Compute was local in R4's picture. Locus hosting rents machines to run somebody else's compute, was ruled a month later, and inherited a provider list by assumption. The reasoning is CARRIER_PROPOSAL_R4_REVISIT.md; R4 itself is untouched and still governs the control plane.

So the carriers this surface may name are:

• Vultr — the stable plane. Long-lived carriers, and the database and control plane beside them

• DigitalOcean — burst carriers, placed and destroyed by code. Per-second billing, and

single-attach volumes that hold locus state when the carrier under it goes

• The customer's own — a T&R box in their own building is a carrier like any other, and on that

arrangement the carrier bill never reaches our invoice

Cloudflare is not a carrier and cannot become one. It keeps Pages, Workers and R2. A carrier has to give us a kernel we boot — the confinement floor installs its own Landlock ruleset (ABI 9, measured on kernel 7.2.2) and seccomp allow-list, and computedriven/docs/connect-model.md §2 makes the transport credential a WireGuard public key, whose private half lives in the kernel's own WireGuard implementation. Workers and Containers give none of that, and cap an instance at ½ vCPU. This is a capability fact, not a preference.

A carrier must also expose a provisioning API. Gate 2 in §4 is an adapter that places a locus and returns what happened; an adapter cannot be written against a host that is provisioned by filling in a web form. That requirement is what removes KnownHost and HostGator, and HostGator separately forbids the workload — its "unmetered" bandwidth is defined as not exceeding 25 % of system resources for longer than 90 seconds, and a carrier holding loci runs continuously.

Hetzner is dropped (R93). It was named as hosted capacity while its cheap tier is EU-only: the ARM line does not exist in the US, US instances include 1 TB of egress rather than 20 TB, and the 2 vCPU / 2 GB US tier is $21.09 and out of stock.

Naming any other provider requires R93 revisited first. launch-gate.mjs refuses a page or a panel that draws one.

4) What is built

Nothing. In order of what would have to become true:

5) What exists instead

• This document. The direction, written down, which is what the spec rung names.

• `/console/` — a working prototype of the operator console and the client portal, running a

seeded sample fleet in the visitor's own browser, connected to nothing, marked a prototype in a banner it cannot lose. It is where the pricing claim gets argued with before anything is built to charge for it.

• An older control plane and dashboard, built for the agent-deployment direction this domain

abandoned, with a passing test suite and no deployment.

6) What the site may say

The root page is generated from records/surface.json and gated by launch-gate.mjs. It may state the direction, the vocabulary, the pricing claim, and what is not built. It may not:

• offer a plan anyone can buy, or a signup, at a rung nothing has been shipped at;

• present any figure as a rate;

• draw a carrier no ruling permits;

• drop the retraction;

• imply the prototype is a running service.

7) Open items