L4 — Decision runtime architecture

L4 turns plant conditions into at most one owned PrescriptionWhat to do, why, who, check plan (direction; as built: prescription.json 1.0.0 / card-proposal) draft (as built: card proposal) — or withholds / abstains with a full trace. Humans decide and execute. L5 owns the live card (ClosureStateEleven code states on the live card (direction; as built: stamped_l5_domain/cards/states.py)). L3 owns detection methods and money calculation. L2 owns plant source-of-truth records. L4 owns DecisionRuntime, the derived Plant Situation Model, and the opportunity ledgerStore of every blocked candidate with gate id and later outcome if known.

The live compile path is DecisionRuntime (stamped_l4.runtime + worker/decision_runner.py). Legacy LangGraph prescription-compiler graphs may remain in the consumer tree; they are not the EvidenceLayer contract for detector output (direction; as built: Finding finding.json 1.2.0) → card compile path. See 30-as-built.md.

flowchart TB
    %% house-style: l4-readme-runtime
    subgraph in["Intake"]
        direction LR
        ev["L3 Evidence<br/>(as built: Finding)"]
        disc["Discovery / shift sweep"]
    end
    subgraph rt["DecisionRuntime"]
        direction LR
        q["Plant work queue"]
        dc["DecisionCase + PSM"]
        st["Stage graph + portfolio"]
    end
    gate{{"Kernel re-check"}}
    l5["CardSink → L5 Prescription"]
    tr(["↩ DecisionTrace + opportunity ledger"])
    in --> q --> dc --> st --> gate
    gate -->|"emit / supersede"| l5
    gate -->|"withhold / abstain / hold"| tr

    classDef govc fill:#fff4d6,stroke:#c99a2e,color:#000
    classDef agentc fill:#e8f0ff,stroke:#5b7bd5,color:#000
    classDef loopc fill:#eef7ee,stroke:#4f9a4f,color:#000
    class gate govc
    class tr loopc

Eight ideas this set leads with#

1. A small kernel of rules; everything else is replaceable. Code owns terminals, hard stops, money references, constraint checks, and the one-card rule. Models, prompts, and registries live inside and swap by release (D9).
2. See the whole plant, decide about one thing. The Plant Situation Model holds structure, history, and state. Each run gets a focused, provenance-tagged slice.
3. Constraints are code, not prose. Typed predicates return satisfied, violated, or unknown. A model may explain; it never evaluates a gate.
4. Evidence before words. Every claim cites a ledger row. Uncited claims are dropped. Models never assign an evidence tierContract tier on claims: measured / confirmed / modeled / unknown; quantity labels per D13 or a rupee (D13).
5. Two ways in, one way out. Evidence (FindingAs-built L3 detector output admitted to L4 (finding.json 1.2.0)) and discoveries meet the same floor, the same constraint check, and the same portfolio.
6. The plant is a portfolio. Cards carry footprints; overlapping footprints conflict; owners have a per-shift budget (exceptions exempt via registry).
7. Built to change, including at the core. Domains, families, workflows, stages, analyses, patterns, constraint kinds, tools, prompts, memory missions, and model pins are versioned registry entries under one release lockfile. The kernel never names a specific domain.
8. Nothing is silently lost, and every block teaches. Soft-gate blocks reach the opportunity ledger and the owner's backlog. Exploration measures whether blocked items would have helped. Soft gates then move on evidence.

Reading order#

Fast loop (direction): plant-side twin, writer and message budgets live outside L4; L4's touch points are 15 section 13 and 22 (missed-savings vs opportunity ledger). Design: ../fast-loop/.

ADRs#

Research#

• Peers and literature: ../../research/plant-efficiency-exploration-2026-09/19-l4-agent-peer-systems.md
• Vision wins on conflict: ../../research/plant-efficiency-exploration-2026-09/09-stamped-founder-vision.md

What this is not#

Not code. Not a schedule optimizer. Not equipment write. Not a second plant UI. Not a graph product in L2.

v1 slice vs later#