Ask the matter a question. Work in what comes back.

At rest the cockpit is an editorial brief over the conversation: a serif greeting, one co-counsel sentence carrying urgency without a wall of alarm chips. Valuation, the calendar, discovery, billing and the case map summon beside the chat; closing the last returns the resting pane.

The artifact registry is a typed switch over twenty kinds: sixteen have a panel renderer, and the rest render through the same component their standalone route uses, so the two cannot show different things. The default branch is an exhaustiveness check rather than a placeholder.

The identifier for an open surface is derived from the matter, the kind and the view as a name-based UUID, in one module shared by the launcher's click and the assistant's own capability. An already-open calendar dedupes and refreshes instead of spawning a second copy.

When an action succeeds, the matter surface it touched opens beside the chat and re-pulls if already up. A capability is mapped only where that renderer displays its result: a reply to opposing counsel is unmapped, because the thread surface renders the client portal conversation.

A capability whose workflow contract is a durable artifact must name the surface rendering it. A census fails on any naming neither a surface nor a written exemption, or on one under forty characters. The ten name identities a blind matter pane could not carry.

The co-edit surface has one author at a time, arbitrated by a server lock, not merge. Taking over grabs the lock; every change is fenced by a monotonic version. Handing back persists a tracked-change draft and nothing else: no send, no signature, no phase change.

Three of these panes were once separate implementations, which is how the cockpit listed a matter's expenses while its billing page showed none. Each now renders the same component in an embedded variant, so the panel and the matter tab cannot disagree about the number.

The linked-authorities memo renders in the split-pane reader the standalone brief route and the document surface also use, so the three cannot drift. A citation click opens the cited case or record on the right at the pincite; its own tab is the secondary move.

Sending, signing, moving trust money and changing a matter's phase stop for a confirmation whatever the autonomy settings say, and an evaluation may lower a different capability to draft-to-review at most. The floor is clamped again at the registry.

An action taken from a warm panel runs the same role check, conflict block, single-use token, idempotency and audit chain the chat path runs; the surface route adds owner scope and a token re-bind and reimplements nothing.

A gated capability refuses to act until a server-minted, single-use token bound to the exact action, matter, user and arguments comes back. The token routes to the interface only, and your approve click re-runs the action with it injected server-side.

Nine approvals once cost eighteen clicks across nine contexts. The review sends ids only: the first pass executes nothing gated and returns each item's summary, structured proof and a fresh token. Every item renders an unticked box; the second pass confirms only what is ticked.

The two capabilities that launch a run are removed from this surface, held by two contract tests. Staging happens on its own route, and the thread learns through a persisted event carrying identity alone, so the row survives a reload and reaches the phone.

A reply that says it sent, calendared or filed something is checked against the exact ledger of capability calls that turn. An action waiting behind the confirm gate is not a performed action. The check is advisory, silent when clean and when it fails itself.

The resting pulse carries three states per input, and the sentence saying nothing is pressing is reachable only once both reads have succeeded. A failed deadline read is unavailable, never an empty list, and a rejected contradiction read keeps the last verified cards.

The detectors fire on a schedule and on ingest, so a board can show a verdict formed before the thing the attorney just did. The re-scan control runs a fresh matter-scoped pass and re-reads the board after it returns. A scan that failed says so.

Review rows label responsiveness and coding by where the value came from, and missing provenance reads unknown, not reviewed. A total from a bounded page walk prints as at least that many. A section nobody could read is a stated gap, not empty.

One shortcut fuses a free-form ask, fuzzy matter search and navigation; a second summons the cockpit with your scope and no question. The destinations derive from the one route index the rail and launcher use, after a hand-synced copy re-diverged: six routes double-keyed, badges dropped.

Each matter keeps one authored narrative and a ranked agenda. The deterministic composition always runs, and the model polish falls back to it on any failure, with the author recorded. Agenda items derive live from the task ledger at compose time, never copied into storage.

A finding resolves to its destination through one table naming the surface and the subject key. Precedence is explicit: a safe app-relative link, the canonical destination, a client mirror for an older server, a recorded platform gap, the matter door. The phone mirrors that table.