Where your identity keys actually live is precise about a detail that matters: the key material proving you are you belongs inside the encrypted store your recovery words already cover. It is written there after every successful start, read back and compared field by field before it's believed, and only replaced once the loose file that used to sit beside it is confirmed gone — so losing that stray file can't cost you the identity it was never really supposed to hold.

The companion piece, Refusing To Overwrite What You Cannot Open, names the actual rule: keys with no password reset get exactly one guarantee — nothing may overwrite key material it cannot itself open first. Where that rule lives is the whole story here: enforced at the write itself, not trusted to every caller that might attempt one.

Captured on 30 September 2026 from current code on a throwaway test daemon. The Office package was published to that daemon's own local catalog, without the large ONLYOFFICE editing engine, and installed through the real Marketplace. The "No special access requested" line is accurate for this package: its manifest declares no capabilities. The earlier version of this picture showed a calendar test package instead.

The App Brings Its Own Rulebook answers a question that used to have an unscalable answer: what is a newly installed package allowed to write into your memory? The old answer was a list baked into the core, which meant the core had to know in advance about every piece of software that would ever exist. It doesn't any more.

The Thousand Events Behind You and There Is No Ungoverned Route To A Model both describe things staying responsive and honest under load: finishing setup while the system writes a thousand records behind you without the field you're typing into going numb, built so unrelated writes never queue together; and reaching outward to a model at all being off by default, with any grant to do so written down — an always-auditable answer to what may leave your machine and who allowed it.