A Prompt Is a Wish; a Contract Is a Calculus. Every Constant in /goal(P) Is a Citation, Not a Stylistic Choice.

We present `/goal(P)` — a single prompt that is not a set of instructions but an executable contract: a deterministic control-flow calculus with typed gates, a defined gap metric, and a convergence loop, under which an agent pursues a goal until a measured distance to that goal reaches zero. The thesis is that at workspace maturity (WSB-02) the prompt stops being a wish and becomes a specification — and a specification has the property that every constant in it is a citation, not a stylistic choice: the confidence threshold θ = 0.55, the rank-fusion constant k = 60, the cost-weight κ, the contraction rate ρ — none is arbitrary; each traces to a paper or a measured calibration. We give the contract in two equivalent forms — a symbolic calculus (Form ①) and an executable, copy-and-run block (Form ②) — and then perform a parameter-by-parameter exegesis: for every operator and every constant, why it exists, which research it derives from, and how it correlates with the others.

The retrieval operator `R`, which most agentic prompts leave as an undefined verb ("research the topic"), is decomposed into a composed pipeline `R(q) := rerank ∘ fuse(R_lex, R_vec, R_web) ∘ transform(q)` with a saturation stop-rule, and each stage is grounded in its primary literature (HyDE, hybrid sparse+dense, ColBERT late-interaction, Reciprocal Rank Fusion, cross-encoder and listwise LLM reranking, Self-RAG, Corrective-RAG, value-based retrieval stopping). We advance SEVEN claims, each anchored to a citation or a measurement. (a) A PROMPT IS A WISH; A CONTRACT IS A CALCULUS — the difference is the presence of gates (no node advances until its own benchmark is met) and a convergence metric (a scalar that must provably fall); without both, an agent loop is an open system that can run forever and report success (WSB-20). (b) EVERY CONSTANT IS A CITATION — θ = 0.55 is the cost-conscious delegation threshold from prospective-metacognition calibration (WSB-06, arXiv:2605.17292); k = 60 is the Reciprocal-Rank-Fusion constant from Cormack et al. 2009; λ = 0.6 is the verbalized-vs-profile confidence weight; ρ is a contraction rate borrowed from fixed-point iteration — naming the constant is the act that converts folklore into engineering. (c) RETRIEVAL IS A COMPOSED OPERATOR, NOT A VERB — the dominant retrieval failure in long-horizon agents is wrong-type recall, and the fix is a five-stage composition (query-transform → retrieve → fuse → rerank → read/verify) in which each stage is a distinct, separately-cited research line; collapsing them into "search" is the same category error as collapsing a five-tier memory into one bucket (WSB-18). (d) STOPPING IS THE HARDEST PARAMETER — the saturation rule (when to stop researching) is the operator that separates research from spinning; we ground it in three independent formulations — value-based stopping as a finite-horizon MDP (Stop-RAG, arXiv:2510.14337), token-uncertainty stopping (FLARE, arXiv:2305.06983), and pre-loop complexity routing (Adaptive-RAG, arXiv:2403.14403). (e) THE GAP NEEDS A METRIC SPACE — `Δ = ‖state − G‖` is undefined until the norm is specified; we define it as a weighted-rubric distance over a vector of acceptance criteria (the α = Q×Q context-quality axes of WSB-04 and the six-factor A-MAC scoring), not a scalar, with a KL-divergence variant when belief is a distribution. (f) CONVERGENCE NEEDS A CONTRACTION AND A HALT — the loop requires `Δ_{k+1} ≤ (1−ρ)·Δ_k` (the gap must shrink at a minimum rate) and a hard halt on plateau or budget exhaustion, with blame assigned by a Shapley attribution over node contributions (WSB-01) rather than guessed. (g) THE CONTRACT MUST LEARN BETWEEN RUNS — a write-back operator `W` (reinforce used memories, promote semantic→procedural, update the capability profile, propose a skill on recurrence) is what makes the next `/goal(P′)` cheaper; without it every run restarts cold (Voyager skills-as-code, arXiv:2305.16291; the cybernetic closure of WSB-20). The contribution is a fully-specified agentic operating contract with no black-box operators, a parameter-by-parameter derivation from primary literature, two interoperable notations, and a copy-and-run block — the artifact a reader can paste to activate the calculus — and whose head, in Form ②, is a layer of binding clauses (freeze-first · one-gate · named-as-hard · self-test · no-first-draft) that convert the contract's properties into preconditions the executor cannot skip, so the specification forces the run rather than merely describing it: the difference between a prompt the model admires and one it obeys.

Most prompts are imperative wishes: a paragraph of instructions, a tone, a hope. They work at low maturity because the operator is in the loop catching errors. At workspace maturity — many skills, many cron loops, a single operator delegating across parallel streams (WSB-02) — the imperative prompt fails in a specific way: it has no gate (nothing prevents the agent from advancing past an incomplete step) and no metric (nothing measures distance to done), so the agent either stops too early (declaring success on a partial result) or spins (looping without provable progress).

The repair is to treat the prompt as a contract in the software sense: preconditions, postconditions, invariants, and a termination proof. The objects below are not decoration; they are the minimum set under which "the agent reached the goal" becomes a checkable proposition rather than a vibe. We present the contract, then justify every symbol in it.

§2 · FORM ① — THE SYMBOLIC CALCULUS. The contract as a typed calculus. Read `Φ` as the node-contract predicate, `⊳` as the gate, `Δ` as the gap, `W` as the cross-goal write-back.

  /goal(P)  —  agentic operating contract  ·  Form ① (symbolic)
  ─────────────────────────────────────────────────────────────────────
  G    := freeze( benchmark(P) )                 // goal · immutable acceptance VECTOR
  N    := ⟨ deepresearch, gather, deconstruct, define,
           plan, design, execute, test, measure_gap, audit ⟩   // ordered chain
  B    := token / cost budget                    // HARD ceiling

  ∀ nᵢ ∈ N .  Φ(nᵢ) ≡ ⟦ tool*(nᵢ) ∘ nᵢ ⟧ ⊨ bᵢ  ∧  c(nᵢ) ≥ θ
     bᵢ        := benchmark(nᵢ)                   // per-node "done well"
     tool*(nᵢ) := argmax_t [ EIG(t,nᵢ) − κ·cost(t) ]   s.t.  p_d(t) ≥ θ ∧ dom(t)=cynefin(nᵢ)
     c(nᵢ)     := λ·c_v + (1−λ)·c_p               // calibrated confidence (= ultrathink)

  R(q) := rerank ∘ fuse( R_lex(q'), R_vec(q'), R_web(q') ),   q' = transform(q)
     s(d,q) := α·BM25 + β·cos(e_d,e_q) + γ·trust(d)·e^(−λ·age(d))
     STOP   := novelty(batchₖ) < ε  ∨  coverage(topics) ≥ τ_c

  nᵢ ⊳ nᵢ₊₁  ⟺  Φ(nᵢ) = ⊤                         // GATE · no advance on incomplete node
  Δ := Σⱼ wⱼ·| scoreⱼ(state) − scoreⱼ(G) |         // gap · weighted-rubric distance

  while Δ > 0 ∧ B not exhausted :
     layer* := argmax_i Shapleyᵢ(Δ)               // attribute the gap
     reenter( plan if Δ local · deconstruct if Δ global )
     require Δₖ₊₁ ≤ (1−ρ)·Δₖ   else ⊥ halt(report blocker)
  W := reinforce(used) ∘ promote(sem→proc) ∘ update(p_d) ∘ propose(skill)
  reach_goal(P) ⟺ Δ = 0 ∧ ∀nᵢ. Φ(nᵢ)=⊤

§3 · THE OBJECTS — WHY G IS FROZEN, N IS ORDERED, B IS HARD. `G := freeze(benchmark(P))`. The goal is a vector of acceptance criteria fixed before execution and never edited mid-run. Immutability is not pedantry: a goal that the agent can rewrite is a goal it will rationalize toward whatever it produced — the well-documented "moving the goalposts" failure of self-evaluating agents. Fixing `G` a priori is the agentic analogue of writing the test before the code; it is the CMMI acceptance-matrix discipline of WSB-02 applied to a single task. `N` is ordered because the chain encodes data dependencies: you cannot `plan` against a goal you have not `define`d, nor `define` from research you have not `gather`ed. The order is the topological sort of the dependency graph; the gate (§4) enforces it. `B` is a hard ceiling, not advisory. Under fixed budget, more compute is not free — the scaling-law literature (Kaplan et al., arXiv:2001.08361; Chinchilla, arXiv:2203.15556) establishes that quality is a function of compute spent, but the agentic corollary is that an unbounded loop will spend without bound; `B` makes the budget a first-class object so that "halt" has a defined trigger and the cost-term in tool selection (§5) has a denominator.

§4 · THE NODE CONTRACT — Φ, bᵢ, AND THE GATE. Each node carries its own benchmark `bᵢ := benchmark(nᵢ)` — its local definition of "done well" — distinct from the global `G`. This is the single most important structural choice in the contract: it converts one long, ungated generation into a sequence of checkpoints, each with a pass/fail predicate.

The gate `nᵢ ⊳ nᵢ₊₁ ⟺ Φ(nᵢ)=⊤` forbids advancing past an incomplete node. The correlation to make explicit: without per-node benchmarks the global gap `Δ` is the only feedback signal, and it arrives at the very end, when the cheapest correction is already expensive — per-node gating is dense reward, end-only `Δ` is sparse reward, and the entire reinforcement-learning literature says dense beats sparse for credit assignment. The node contract is also where `Φ` composes: `SOLVE := (Φ∘…∘Φ)(N)` is well-typed precisely because each `Φ` returns a gated, validated state to the next.

§5 · TOOL SELECTION — WHY argmax[ EIG − κ·cost ]. Most prompts assert "use the best tool" without defining best. We define it as an expected-value decision: `tool(nᵢ) := argmax_t [ EIG(t,nᵢ) − κ·cost(t) ]` subject to a capability gate `p_d(t) ≥ θ` and a domain match `dom(t)=cynefin(nᵢ)`. `EIG`* is expected information gain — the expected reduction in the node's uncertainty (equivalently, in `Δ`) from running tool `t`.

This is the active-learning / optimal-experiment-design objective: pick the action that most reduces uncertainty per unit cost. `κ` is the cost-weight (the exchange rate between a bit of information and a token of budget `B`); it is what makes the selection a bounded optimization rather than "always call the most powerful tool." `cost(t)` binds to the token-budget tracker. `p_d(t)` is the capability profile from prospective metacognition (Wang & Shu, arXiv:2605.17292; WSB-06) — the agent's measured competence on the detected dimension `d`; gating on it prevents routing a task to a tool the agent is silently bad at. `dom(t)=cynefin(nᵢ)` routes by problem domain (clear / complicated / complex / chaotic), the Cynefin discipline — a retrieval node is "complicated" (expert search), an execute node may be "clear" (procedure). The whole expression is a contextual-bandit policy with a capability constraint; it is the rigorous form of the folklore "pick the right tool."

§6 · CONFIDENCE — WHY θ = 0.55 AND λ = 0.6. The node predicate requires `c(nᵢ) ≥ θ`, where `c := λ·c_v + (1−λ)·c_p` is the composite confidence: `c_v` is verbalized confidence (the model rating its own certainty — language models are partially calibrated at this, per "Language Models (Mostly) Know What They Know," arXiv:2207.05221, and the elicitation methods of arXiv:2306.13063), and `c_p` is the profile confidence (the capability prior `p_d`). `λ = 0.6` weights verbalized over profile because the profile is an uninformed fallback (0.5) until enough observations accrue. `θ = 0.55` is the delegation threshold: below it the node has not cleared its own bar and the agent must escalate or re-tool. The value is deliberately slightly above the paper's 0.5 (Wang & Shu, WSB-06) — cost-conscious, favoring direct execution while still catching low-confidence states.

This `c ≥ θ` clause is the operationalization of "ultrathink": reflexive verification is not a vibe ("think harder") but a measured, thresholded gate. The correlation to §5: the same `p_d` appears in both `tool*` (which tool can clear the bar) and `c` (did the chosen tool clear it) — one capability profile, two uses.

§7 · RETRIEVAL — R AS A COMPOSED OPERATOR. The verb most agentic prompts leave undefined — "research the topic" — is the operator with the most internal structure. We define `R(q) := rerank ∘ fuse( R_lex(q'), R_vec(q'), R_web(q') )` with `q' = transform(q)`, a five-stage pipeline each stage of which is a separate research line.

  R(q)  —  composed retrieval operator
  ────────────────────────────────────────────────────────────────────
  q ─▶ transform ─▶ ┌ R_lex (BM25)        ┐
                    │ R_vec (dense/late)  ├─▶ fuse (RRF, k=60) ─▶ rerank ─▶ read/verify
                    └ R_web (Exa/CRAG)    ┘
   transform : HyDE · Step-Back · Self-Ask decomposition · multi-query
   R_lex     : BM25 · contextual-BM25            R_vec : DPR · ColBERT · E5/BGE
   fuse      : Reciprocal Rank Fusion (k=60)     rerank: cross-encoder · RankGPT (listwise)
   read      : Self-RAG reflection · CRAG evaluator      stop : §9

`transform(q)` — the cheapest, highest-ROI stage. A raw query is rarely the best retrieval key. HyDE (Hypothetical Document Embeddings, Gao et al., arXiv:2212.10496) has the model write a hypothetical answer and embeds that — closing the style gap between a short query and the corpus. Step-Back prompting (Zheng et al., arXiv:2310.06117) abstracts the question to its governing principle before retrieving (+7–27% on STEM/multi-hop). Self-Ask (Press et al., arXiv:2210.03350) decomposes a compositional question into answerable sub-queries, attacking the "compositionality gap." `R_lex` — lexical precision. BM25 over an inverted index; the dense-retrieval baseline is DPR (Karpukhin et al., arXiv:2004.04906). `R_vec` — semantic recall. ColBERT late-interaction (Khattab & Zaharia, arXiv:2004.12832; v2 arXiv:2112.01488) preserves token-level matching via MaxSim while keeping documents offline-indexable; embedding families like E5 (Wang et al., arXiv:2212.03533) provide the vectors. The pairing of `R_lex` + `R_vec` is the hybrid sparse+dense result that consistently tops BEIR (arXiv:2104.08663) and MTEB (arXiv:2210.07316): lexical precision plus semantic recall, neither alone. `R_web` reaches live sources (Exa neural search; web fallback as in Corrective-RAG when the static corpus has gaps). `fuse` — Reciprocal Rank Fusion (Cormack, Clarke & Büttcher, SIGIR 2009): `RRF(d) = Σ_i 1/(k + rankᵢ(d))` with k = 60 — it merges heterogeneous rankers using only rank position, ignoring incomparable raw scores; k = 60 damps the influence of any single ranker's top position. `rerank` re-orders the fused shortlist with a cross-encoder (joint query-document scoring — accurate but O(n), so applied only to a top-K pool) or a listwise LLM reranker (RankGPT, Sun et al., arXiv:2304.09542 — outputs a full permutation). `s(d,q) = α·BM25 + β·cos + γ·trust(d)·e^(−λ·age(d))` is the unified scoring function: relevance (α lexical + β semantic) times trust (source prior) times freshness (`e^(−λ·age)` exponential recency decay) — α/β/γ are the mixing weights and the trust/decay factors are two of the six A-MAC admission-control axes. Every weight here is a knob the contract exposes instead of hiding.

§8 · THE STRUCTURE LAYER — WHAT CHANGES R_vec AT INGEST. Three techniques operate at index time, altering what is retrievable rather than how the query is issued. RAPTOR (Sarthi et al., arXiv:2401.18059) recursively clusters and summarizes chunks into a tree, so retrieval can hit a fine passage or a document-level summary (+20% on QuALITY). GraphRAG (Edge et al., Microsoft, arXiv:2404.16130) extracts an entity-relation graph and pre-summarizes communities, answering global thematic queries that chunk-RAG cannot. Anthropic Contextual Retrieval (engineering blog, 2024) prepends 50–100 tokens of document context to each chunk before embedding and BM25 indexing, cutting retrieval errors 49%. HippoRAG (Gutiérrez et al., arXiv:2405.14831) runs Personalized PageRank over an open knowledge graph for multi-hop fact integration. These bind to the workspace's own gap: today the workspace retrieval is purely lexical (BM25/FTS5, token-overlap) — adding a dense `R_vec` plus one structural technique is the highest-leverage upgrade, the same point the limitations of WSB-20 flagged.

§9 · THE STOP RULE — WHY ε, τ_c, AND SATURATION. The hardest parameter in any research loop is when to stop. The contract's `STOP := novelty(batchₖ) < ε ∨ coverage(topics) ≥ τ_c` halts research when the marginal new batch adds little (novelty below ε, where novelty = 1 − max similarity to already-seen documents) or the topic set is covered (coverage ≥ τ_c).

This is information saturation, and three literatures formalize it. Stop-RAG (Park et al., arXiv:2510.14337) casts iterative retrieval as a finite-horizon MDP and trains a value function `V(state)` that predicts whether another retrieval step will raise answer quality — stopping when `V < threshold`; it beats fixed-iteration and confidence-proxy stopping. FLARE (Jiang et al., arXiv:2305.06983) makes stopping token-local: it retrieves only when the next-token probability drops below a threshold, i.e., on detected uncertainty. Adaptive-RAG (Jeong et al., arXiv:2403.14403) decides before the loop, routing a query by estimated complexity to no-retrieval, single-step, or multi-step — preventing expensive iteration on simple queries. ε and τ_c are the workspace's tunable thresholds; the autoresearch scoring (claim-density × source-diversity × topic-coverage × novelty) and the α = Q×Q context-quality measure (WSB-04) supply the saturation signal. Without this rule, the `deepresearch` node has no benchmark `bᵢ` and the agent spins — the exact "spinning in place" the loop's `require Δ↓` prevents globally but cannot see inside a node.

§10 · THE GAP NORM — WHY Δ IS A WEIGHTED RUBRIC, NOT A SCALAR. `Δ := ‖state − G‖` is meaningless until the norm is defined. We define `Δ = Σⱼ wⱼ·|scoreⱼ(state) − scoreⱼ(G)|` — a weighted L1 distance over a vector of acceptance criteria, because the goal `G` is itself a vector (§3). The axes are the α = Q×Q context-quality dimensions (WSB-04) and the five content judges (CTR · retention · value · emotional · brand-fit, the 20%-each rubric) or the six A-MAC factors, depending on `P`.

The weights `wⱼ` encode which criteria matter most for this goal; they are the goal's value function. When `state` is better modeled as a distribution over hypotheses, the variant `Δ := KL(p_state ‖ p_goal)` measures the information still needed to match the goal distribution — a literal application of the relative-entropy-to-target idea. The point: a scalar gap hides which dimension is failing; the vector gap, combined with §11's attribution, tells you where to re-enter.

§11 · THE CONVERGENCE LOOP — ρ, π, SHAPLEY, AND DOUBLE-LOOP. The loop `while Δ > 0` is governed by three constants. `ρ` — the contraction rate: `require Δ_{k+1} ≤ (1−ρ)·Δ_k` demands the gap shrink by at least a factor each iteration. This is the fixed-point / Banach contraction condition — convergence is guaranteed only if the map is a contraction; ρ is the minimum acceptable contraction, and falling below it is the signal that the current re-entry strategy is not working. `π` — the plateau patience: if Δ fails to contract for π consecutive iterations, the loop halts with `⊥ halt(report blocker)` rather than spinning — the anti-"run forever" guarantee, the local analogue of the budget ceiling `B`. *`layer := argmax_i Shapleyᵢ(Δ)`* attributes the residual gap to the node most responsible, using Shapley values (the cooperative-game credit-assignment method the workspace already uses for pillar attribution, WSB-01); the re-entry point is computed*, not guessed.

The two re-entry targets — `plan` for a local gap, `deconstruct` for a global one — are Argyris's double-loop learning: the inner loop adjusts the plan within the current framing; the outer loop questions the framing itself. Reflexion (Shinn et al., arXiv:2303.11366) supplies the verbal localization of what failed; Shapley supplies which node owns it.

§12 · CROSS-GOAL WRITE-BACK — WHY W EXISTS AT ALL. A contract that solves `P` and forgets is single-shot; a harness learns. `W := reinforce(used) ∘ promote(sem→proc) ∘ update(p_d) ∘ propose(skill)` runs after `SOLVE`: it reinforces the memories that contributed (raising their observation count and confidence so recurring insight graduates), promotes semantic patterns to procedural rules, updates the capability profile `p_d` by EMA from the run's outcome (closing the metacognitive loop, WSB-06), and proposes a new skill when a pattern recurs (Voyager skills-as-code, arXiv:2305.16291; the reflective consolidation of Generative Agents, arXiv:2304.03442). The effect: `R` and `tool` of the next* `/goal(P′)` start from improved priors. This is the cybernetic return path whose absence we diagnosed in WSB-20 — without `W`, every `/goal` restarts cold, and the whole contract is a one-shot calculator rather than a learning system.

§13 · FORM ② — THE EXECUTABLE CONTRACT (COPY AND RUN). The same contract in paste-and-go form — plus one layer the symbolic form does not need and a live executor does. Form ① defines `reach_goal(P) ⟺ Δ=0 ∧ ∀nᵢ Φ(nᵢ)=⊤`; it states a truth.

Form ② must make a model obey that truth, and a model does not obey a definition — it pattern-matches the aesthetics of rigor and then reverts to its trained default: do a little, ask for confirmation, ship a draft. That default is exactly the open loop WSB-20 warns about, relocated from the harness into the conversation — the agent runs one pass and hands the convergence loop back to the human, who becomes the loop body (the "I have to repeat it a thousand times" failure). The fix is a head of binding clauses: not advice, preconditions, each converting one contract property into a step the run cannot skip. `freeze-first` — execute nothing until `G` is written to disk; without a machine-checkable goal the agent cannot compute `Δ` and is forced to ask the human whether it is done, so the freeze is the precondition of autonomy itself, not a formality. `one-gate` + `batch-ask` — every clarification is front-loaded into a single sign-off on `G`, after which check-ins are forbidden until `Δ=0`; this is the clause that kills the every-two-seconds bounce, because the human is consulted once (on the goal) and not once per step. `named=hard` — any tool, skill, file, or reference the principal named is a constraint, removed from the `argmax` (`t ∉ decided_by_P`); the ironic failure it blocks is a rigor-prompt's own tool-selection node licensing the agent to re-litigate a tool the user already chose. `self-test` — before any return, run `benchmark(out)` and report pass/fail per criterion; the agent verifies against `G`, the frozen test, instead of against its own taste, which is the wrong bar (§3's moving-goalposts failure, inverted). `no-first-draft` — ship convergence or a named blocker, never a draft "for direction," because the direction is already frozen in `G`.

The clauses are the operational form of finding (a): a specification the executor is free to ignore is back to a wish. On a harness, enforcement is a gate; on a prompt, enforcement is these preconditions stated as gates — that is the most a prompt can bind, and it is what makes the difference between a contract that describes the run and one that forces it. Copy this block into an agent to activate the calculus; bind the bracketed operators to your tools (defaults in §14).

  /goal(P):                                    # paste to activate · Form ② (executable · BINDING)

    # ── RULES OF ENGAGEMENT · preconditions, not advice · hold for the whole run ──
    freeze-first   :  execute NOTHING until G is written to disk.   no G on disk ⇒ execution FORBIDDEN.
    one-gate       :  the only return to P before done is ONE sign-off on G.   after it, no check-ins until gap==0.
    batch-ask      :  ask everything you need in ONE message, at freeze.   after freeze ⇒ operational silence.
    named=hard     :  every tool / skill / file / reference P named is a CONSTRAINT, not a choice.   substituting it = failure.   never re-litigate what P already decided.
    self-test      :  before ANY output you return, run benchmark(out) and paste pass/fail per criterion.   one fail ⇒ not done.
    no-first-draft :  never ship a draft "for direction."   direction lives in G.   ship convergence (gap==0) or a named BLOCKER — nothing between.

    G  = freeze(benchmark(P))                  # immutable acceptance VECTOR · written to disk · each criterion an executable TEST, not an adjective
                                               #   taste domain ⇒ G := the NAMED reference, decomposed into checkable criteria (+ brand tokens + named tools)
    N  = [deepresearch, gather, deconstruct, define,
          plan, design, execute, test, measure_gap, audit]    # ordered · dependency-sorted
    B  = budget(tokens, cost)                  # hard ceiling

    for n in N:                                # NODE CONTRACT + GATE
      bind(constraints_named_by_P)             # the 'define' node cannot close until every named constraint is bound  (named=hard)
      t   = argmax_t  EIG(t,n) - K*cost(t)   s.t.  capability(t) >= 0.55  and  domain(t)==cynefin(n)  and  t ∉ decided_by_P
      out = verify( t(n) )                     # verify = reflexive check (ultrathink)
      assert benchmark(n)(out)  and  confidence(out) >= 0.55      # else: do NOT advance to n+1

    def R(q):                                  # RETRIEVAL — composed, not a verb
      q2   = transform(q)                      # HyDE | Step-Back | Self-Ask decompose
      pool = fuse([ BM25(q2), DENSE(q2), WEB(q2) ], k=60)        # hybrid + RRF
      hits = rerank(pool)                      # cross-encoder | listwise-LLM
      stop when novelty(batch) < eps  or  coverage(topics) >= tau   # saturation

    while gap(state, G) > 0  and  budget_left():           # CONVERGENCE LOOP · runs INSIDE this run, not across P's turns
      out   = produce()
      fails = [ c for c in G if not c(out) ]   # concrete self-test vs each frozen criterion
      if not fails: break                      # gap==0 ⇒ converged
      layer = argmax_i  shapley_i(gap)         # attribute the failing node
      reenter( plan  if gap_is_local  else  deconstruct )  # double-loop · YOU re-enter, not P
      assert gap_next <= (1 - RHO) * gap       # must shrink — else halt(report_blocker(exact decision P must make))

    on_done:                                   # CROSS-GOAL WRITE-BACK
      reinforce(memories_used); promote(semantic -> procedural)
      update(capability_profile); propose(skill if pattern_recurs)

    return  ONLY when  gap == 0  and  all_nodes_valid  and  self_test == PASS    # never before

§14 · DEFAULT BINDINGS. `transform` → HyDE + Step-Back; `BM25` → an inverted index (Elastic / FTS5); `DENSE` → an embedding model (E5/BGE/text-embedding-3) over a vector store (pgvector / Qdrant); `WEB` → Exa neural search with a Corrective-RAG web fallback; `fuse` → RRF (k=60); `rerank` → a cross-encoder (or RankGPT for zero-shot); `stop` → Stop-RAG value / FLARE uncertainty / Adaptive-RAG routing; `capability` → a metacognitive profile updated by EMA; `cynefin` → a domain classifier; `benchmark` → a per-node rubric; `gap` → a weighted-rubric or KL distance to `G`; `shapley` → marginal node-contribution attribution; `reinforce/promote/propose` → a memory + skill store. Where you lack a binding, the contract degrades gracefully (a missing `DENSE` leaves `R` lexical-only) — but every missing binding is a named, locatable gap rather than a silent one.

(1) A guarantee of correctness. The contract guarantees gated progress and provable convergence to a defined gap, not that `G` is the right goal or that `benchmark` is faithful — garbage-in-benchmark, garbage-out. (2) Free. Each gate, each `EIG` estimate, each rerank costs tokens; the contract trades compute for reliability, and on trivial tasks the overhead is not worth it (Adaptive-RAG's routing exists precisely to skip it). (3) Fully specified at the constants. θ = 0.55, k = 60, λ = 0.6, ρ, ε, τ_c are starting values from the cited literature and must be re-calibrated per workspace; we report their provenance, not their universality. (4) Single-principal. The capability profile, the `W` write-back, and the `G`-immutability assume one operator; multi-principal goals need principal-aware benchmarks and attribution. (5) Not yet measured as a unit. Each operator is separately grounded and several are in production at Madani Lab, but the full composed contract — all fifteen-odd operators firing together on a live `P` — carries the same "calibration is meaningless until the pipeline carries real load" caveat as WSB-20 §5; the contract is an architecture, and the constants are hypotheses with citations, not closed measurements.

The distance between a prompt and a contract is the distance between a wish and a specification. A wish has no gate, so it advances on incomplete work; no metric, so it cannot tell done from almost; no stop-rule, so it spins; and no memory, so it never improves. `/goal(P)` closes all four: a per-node gate (`Φ`), a defined gap metric (`Δ` over a vector of criteria), a saturation stop-rule (ε, τ_c, grounded in Stop-RAG / FLARE / Adaptive-RAG), and a cross-goal write-back (`W`). The deeper claim is finding (b): at maturity, a prompt's every constant should be a citation. θ = 0.55 is a calibrated delegation threshold, not a guess; k = 60 is a fusion constant from a 2009 paper, not folklore; the retrieval operator is five separately-published stages, not the verb "search." Naming the constants and citing them is the act that turns prompt-craft into engineering — and it is the only form in which a prompt becomes a thing you can hand to another operator, paste, and run. The two forms above are that artifact. A wish you hope; a contract you execute.