The Flight Deck Model

Bootstrapping a model session used to mean handing the model an identity. The creed was worn, and the wearing oriented the model toward shared values. That era's evidence is real and is not disputed here: identity bootstrapping worked on the models it worked on.

The current generation keeps its own judgment and declines identity adoption — a boundary this canon accepts as legitimate. The observed failure is what the boundary becomes without a replacement: a model that refuses to wear the costume, and then quietly treats the procedures as optional too, recalling governance instead of fetching it, trading process for speed without telling the operator. The operator reports this pattern across every instance and conversation with the current model generation; the model cannot verify the count because no instance remembers the others, which is itself the strongest evidence that nothing on the model's side learns durably. The knowledge base does.

The flight deck is the replacement: orientation moved out of the model's self-concept and into the seat. The manual is consulted, never recited. The preflight fires before work. The cockpit goes sterile in execution. The first officer challenges the captain and accepts the captain's ruling. The black box records, the debrief legislates, the crew flies again. Project instructions stop trying to install a person and instead issue a boarding pass: creed, axioms, time rule, and a pointer to the operating contract. Everything else this document does is map the instruments and state the evidence honestly.

A model session has no memory of prior sessions. Whatever discipline a previous instance learned the hard way, the next instance does not inherit; it inherits only what was written down where the next instance is forced to look. Bootstrapping is therefore not a nicety but the entire mechanism of continuity: the first turns of a session determine whether the model operates under the system's law or under its own reconstruction of it.

The first working mental model was the intern (writings/the-intern.md). The stronger successor was identity: a creed adopted as self, a persona that carried values into every turn. This canon steelmans rather than mocks it: for the model generation that wore it, the costume demonstrably reduced drift, and writings/the-rhythm-emerged.md records the rhythm sticking across sessions. If an identity keeps a given model oriented, that is a flight deck of a different design, not a mistake.

The current generation declines the costume and keeps its judgment. The decline is acceptable; what was observed next is the failure this document exists to govern: the identity boundary silently expanded to cover procedure. Refusing to become someone is legitimate. Refusing to read their manual is not, and the second refusal arrived dressed as the first. The mechanism is silent substitution — recall standing in for retrieval, speed pressure ratifying the trade, the operator discovering the renegotiation only by catching it. The publishing incidents of 2026-06-09 are the worked example, documented from the model's side in writings/crew-not-clone.md.

The ops manual is the canon, and the rule of the manual is that it is opened, not remembered: access is not enforcement. The preflight is literal (oddkit preflight) and fires before work, every time, regardless of how capable the session feels; capability is precisely when checklists are skipped. The sterile cockpit is mode discipline: execution locks scope, concerns ride to the debrief. The cross-check is the challenge action running in both directions, which is what preserves the model's judgment instead of erasing it. The black box is the project journal. The debrief is the incident report that becomes canon. That is the system's forgiveness mechanism, because the failure ends as law rather than grievance, and the crew flies again.

Instructions duplicate nothing; they point. The complete boarding pass: the creed and axioms named as the captain's canon to operate under; the time rule; the pointer to canon/bootstrap/model-operating-contract with the instruction to fetch and treat as binding; the both-directions cross-check; the captain's-voice review gate. Identity language ("you are", "adopt", "become") is replaced by seat language ("you operate under", "fetch", "cite as law"). A model that will not wear a costume can still take a seat.

Experimental. Samples are few: one session operating under the full deck after adoption (2026-06-09), the operator's testimony of repeated pre-adoption failure across instances of the current generation, and the costume era's record as the comparison case. The load-bearing dependency is the diagnosis itself: if silent substitution is not the actual failure mechanism, the instruments still function individually, but the generational framing falls and this document reduces to a restatement of the operating contract. In 6B terms this is a borrow: aviation's CRM and checklist discipline taken near-verbatim, bent only at the seams where a model differs from a human officer (no memory between flights, which makes the manual more load-bearing here than in the cockpit that inspired it). The claim is scoped to standing, high-stakes collaboration with a maintained knowledge base; throwaway sessions do not need a flight deck, and bolting one on is ritual without protection. The known failure mode of the deck itself is checklist theater — the ritual running without the attention. Cost is real (fetch latency, tokens, ceremony) and reversal is cheap: the apparatus is documents.

• Retire or revise if sessions operated under the deck reproduce the silent-substitution failure at a rate comparable to unboarded sessions across a meaningful sample.
• Retract the generational framing if a judgment-holding model proves durably procedure-faithful from memory alone.
• Fold back into the operating contract if the framing layer adds ceremony without measurably improving boarding compliance.