One USB Cable.
One Intent's Full Journey.

FDE's core is a three-ring delivery loop: Echo (go observe real stations and operators) → Delta (validate the highest-risk assumption with the smallest vertical slice) → Product (fix what was validated into boundaries, contracts and reusable components). It is not a waterfall; it is a loop. The token ledger matches this phase: in ISO weeks W21/W23/W25 of 2026, about 127 million tokens sit under the MRRC project name, all from harnesses other than claude-code — claude-code's local logs are only retained from 2026-08-05, and earlier consumption is unrecoverable. The method still lived in a human brain and in documents, and execution scale was still small.

d4a7a32 is the most persuasive commit on the whole timeline: a brand-new project has complete contracts, constraints and gates before its first line of business code. (Strictly it is ft8's third commit — the root commit c545d69 is a one-line README. 7B says the guardian arrived "in the first commit"; the precise statement is the first substantive commit. This correction is kept because it is itself evidence the method works: the kit had matured enough to be reused as a whole package.)

Honesty note: model identifiers are facts as recorded by each harness; the attribution of third-party-routed calls is inference. Cursor records no working directory, so its tokens cannot be attributed to any project.

Each family has its own "primary harness": claude-code carries the bulk of modern / ft8 / MRRC, pi is the main force on ft710 and website, kimi-code is deep in ft710 and ft8, codex concentrates on ft8, opencode only ever appeared on website. This division was not designed — it is the natural sediment of which tool felt right for which task in which repository. But it leaves an important lesson: the precondition for running many harnesses in parallel is that the contract lives in the repository, not inside any tool. AGENTS.md, the SDD and the constraint registry are plain text under git, tool-agnostic — any harness can load the same contract on entry and takes no knowledge away on exit.

Overlaying the timeline (tokens by project × ISO week) shows clear waves: W28–W30 the ft710 vertical slice erupts — 69 commits in one week, 360 M tokens in W30; W31–W33 ft8 erupts — 147 commits in W32, 730 M tokens in W33; W34–W35 modern's platformization (IC-7300 backend abstraction) plus website's start — 1.26 B tokens over two weeks; W35–W36 the website expression-layer sprint — 720 M tokens over two weeks, 89 of its 102 commits.

Chain 1: FT-710 frequency drift — 13 days from field incident to gate interception

$ python3 .agents/skills/sdd-guardian/harness/sdd_context.py check probe_b4_tmp.py
SDD-GUARDIAN: blocking violations found:
[BLOCK] cat-no-dn (AD-014; SDD V1.2 freq-drift incident) probe_b4_tmp.py:2: return c.query("DN;")
$ echo $?
2

Note the structure of this chain: fixing the code is only the first link. Had the story stopped at 72fd6f0, the next session, the next agent, the next product family would make the same mistake. The last three links — ruling, constraint, interception — are what turns "a pit one person stepped into" into "a pit the system will never step into again".

Chain 2: the deployment backup incident — 7 days from a full disk to four same-day fixes

7cfefec (2026-08-29, modern): the server's /var/tmp was filled to 100% by backups — roughly 300 MB per backup, because cp -r whole-site copies swept in the 120–140 MB server-managed binaries under downloads/ and videos/ (13 ft710 backups ≈ 1.7 GB, 18 ft8 backups ≈ 2.0 GB). On 2026-09-05, four repositories received sister commits on the same day: modern 3691b4f, ft710 9c353a1, ft8 a30f76a, website 067f565 — uniformly switching to rsync excludes plus lean backups keeping only 3 rotations per site. The same day's 067f565 also exposed a deeper problem: the website portal deploy script's backups had never worked — the remote heredoc was unquoted, the local shell expanded the variables early, and the script printed a backup path that did not exist while silently skipping every single backup.

And two open boundaries that no other evidence is allowed to excuse: FT710Mobile carries an unresolved P0 PTT safety issue — 439 server-side tests cannot close a client-side safety claim. The EFHW V3.0 tuner firmware is complete, but until PCB fabrication and bench verification happen, its claim status stays design-target — what is not on a board must not be described as existing.

The optimization record of 2026-07-09 defined the problem precisely — upgrade the site from "project showcase" to "a high-trust, high-conversion, shareable open-source home" — and opened by verifying two uncomfortable facts: both demo ports were unreachable at the time, and three of the four GitHub repositories lacked a standard LICENSE. That document's conclusion deserves verbatim quotation: "VLSC already has real engineering value; the shortfall is not in technology but in the expression and evidence system."

And one fresh confession this article must make: during data collection for this very article (2026-09-05, the day 7B was published), yet another measurement-caliber problem surfaced. claude-code's jsonl logs split one API response into multiple lines — thinking / text / tool_use chunks — each carrying the full usage block, so summing by line counts the same response multiple times. Deduplicated by message.id, claude-code's actual API consumption is 1,175,403,254 tokens (7,519 API responses), not the 3,207,496,620 of the census caliber — the line caliber inflates by about 2.7×. Every other tool matches the published census bit for bit and is unaffected; the published census used the line caliber, and the appendix lists both calibers side by side.

The parts that cannot be delegated to agents have been stable for seven months: hardware fabrication and bench bring-up, RF safety, live-station verification, the decision to release or not, and the judgment of whether the evidence is sufficient. The inner loop (Specify → Implement → Test → Review) can be handed to agents wholesale; intent, architectural boundaries and acceptance judgment stay human forever. In the words this article opened with: business intent belongs to the human, execution may belong to agents, but the ruling on "does this count as delivered" cannot be outsourced.

1. Start from an intent that holds without AI

   Save money, save effort, safety, save time — say it in plain language. AI is a means of execution, not the business itself.

2. Acceptance conditions and non-goals before the first line of code

   The acceptance conditions are the referee of every later argument about "is it done".

3. Make constraints machine-readable

   Every rule carries severity, scope, match pattern, and a citation to the decision or incident that produced it. A rule without provenance does not survive three months.

4. Load the live contract at runtime; never paste docs into prompts

   A copy is frozen, and frozen is stale. Keep AGENTS.md / SDD in the repository and load the current version when a session starts.

5. Gating before the write beats reviewing after it

   In mrrc_ft710, mrrc_modern and ft8, a PreToolUse hook stops a violating edit before it lands on disk — an order of magnitude more reliable than hoping someone notices in review.

6. Turn every incident into a rule

   The fix is only the first link; ruling → constraint → interception closes the loop. Thirteen days can carry you from frequency drift to a gate block.

7. Reconcile every important number against a second source

   The first census was wrong by 1.6 billion; what corrected it was another database on the same disk. A single-source number is a hypothesis about a number.

8. Keep process evidence and product maturity in two separate ledgers

   "Our process is strict" and "our product works" are independent claims; evidence for the first cannot vouch for the second.