The project models architectural composition as a decision trajectory p(τ)=p(a₀…a_T|s₀), with the building as its terminal artifact B=f(τ). Rather than sampling a finished image conditioned on C, ArchFlow constructs a state system that bounds combinatorics, records commitments and supports local revision. Architecture is not sampled into existence; it is committed into being.

Design contains latent intentions. A column exclusion may encode an unspoken sightline, ritual sequence or future façade. ArchFlow does not ask the model to guess these indefinitely; it progressively compiles them into explicit state.

ArchFlow does not claim that design is naturally Markovian. It makes the process operationally Markovian by compiling hidden intent into explicit premises such as parti, function_intent and tradition. Each decision must read those premises, so the next lawful action can be chosen from the current compiled state.

History, proposals and validation are compiled into a minimal sufficient state S_t=(G,C,L,O,U), including the obligation ledger 𝒪_t. Unlike a full chain-of-thought history, compiled state retains only information that can change future lawful actions.

The mask reduces the action menu to the lawful set A_valid; policy chooses only within it. The target is to keep H(A_t|S_t)≈log₂|A_valid| inside a useful interval, preventing both combinatorial explosion and a falsely deterministic process.

D⁺(X)={Y|X⤳Y} is the full downstream closure of decision X. Revision cost follows C_revision ∝ |D⁺(X)|: the cost of changing a decision depends on its causal reach, not on the total size of the finished artifact.

invalidate(D⁺(X)) re-answers a target inside a detached child run. Old/new semantic differences expand the affected closure; unrelated rounds are reused byte-for-byte, affected rounds are recomputed, the parent proof remains read-only and the child proof is resealed.

Retrieved material does not flow directly into token generation. It first becomes sourced, building-level facts, then compiles into commitments, relations and verifiable design deltas. LLMs handle questions, extraction and proposals within lawful menus; formulas and solvers retain ownership of arithmetic, coordinates, boolean operations and support consequences.

An obligation is forward debt: created → discharged. It may be created in one decision and discharged in another; unresolved items remain visible on the ledger. Discharge is checked as a multiset difference, analogous to a proof obligation.

The agenda is an explicit question list. Every decision carries a question; transcript() renders the derivation as a question/answer record. Repair means asking a question again, not painting over geometry.

Every decision uses the same internal form: observe → menu → mask → policy → apply → gate. The mask establishes legality, policy selects an option, and the gate records validity without inventing the answer.

A decision with a real MenuSpec is a true menu. Its policy seat can be deterministic, LLM or human; the answering identity is written to seat and posted to the ledger. Deterministic policy remains the default.

Every constant must first be classified as law or choice. Reusable vocabulary, masks and canon relations may become law; a judgement specific to one design must pass through a policy seat. Otherwise the system collapses into another parameterised recipe engine.

pytest, doctor and selfcheck (16 goldens plus the ruin gate) form the regression boundary. A change to default bytes must declare its effect on the goldens.

With all feature knobs off, output must remain byte-equivalent to V2 Pipeline.run. The frozen golden detects drift. Anti-cheating rules prohibit both result-side special cases and silent regeneration of the test oracle.

Adversarial building cases search for false negatives: validation passed, architecture wrong. Repairs must change law, mask, canon or obligation logic, never the generated artifact directly; the same case is then replayed for A/B evidence.

convert is the sole entry from the floating-point bbox world into discrete voxel delivery space. to_voxels() and conversion_findings() judge existence, bearing and related rules in the same space that is delivered.

When system capacity is insufficient, generation is refused and debt remains on the ledger. A stone post-and-lintel system that cannot span a 20 m hall must not hide the failure behind plausible geometry. Unresolved obligations never enter ValidationResult.