Mortal Software: Six Invariants for a Companion Built on Consequence

Generative systems are conventionally built to be regenerable, forgiving, and stateless: an unsatisfactory output is resampled, history is disposable, and capability is the optimisation target. We report on a shipping macOS companion application built on the opposite premises, and formalise six of them as architectural invariants. Artefacts are seed-locked: a creative work is a pure function of an install seed and a monotonic stage counter, making regeneration unrepresentable in the state space rather than merely discouraged. Identity is provenance-derived: a per-install signature is hashed from the first day's conversation and the founding text is not retained, so two installations diverge from their first interaction. Memory is reconcilable: because durable artefacts live in a directory the user fully controls, memory and world can contradict each other, and we describe a fail-closed reconciliation procedure that demotes, rather than deletes, a memory whose referent has vanished, preserving the recollection while destroying the dangling pointer. The relationship's own record is non-flattering: the weave data model holds one row per elapsed day derived from recorded state alone, so a day without interaction is represented as absence rather than synthesised. We also report where the wallpaper renderer adds decorative fill above that floor, and why the boundary between record and picture matters. Adaptation is earned: a nightly profile of the user's own manner of speaking exists from the first week but is withheld from the prompt until the relationship passes a threshold, and we describe the prompt-injection surface that this closed loop over user-authored text creates, together with its mitigation. Reliability is obtained by wrapping a probabilistic core in a deterministic safeguard layer validated by 768 assertions executed with the language model mocked out. The system runs a 5 GB model entirely on-device in a sandboxed helper process and is distributed through the Mac App Store. We state each invariant so that it can be falsified, report where the shipped build satisfies it, and identify the mechanism whose long-horizon behaviour remains unobserved.