The Surface Pane

Abstract. This is a high-level design for the physical Surface: no battery required, no refresh loop, no processor worth the name, a pane that holds a key, sends sealed words, and rearranges its pixels when a moment arrives. It is written to preserve the vision, and the component choices are illustrative of what exists today rather than commitments, since the architecture is the point. The store is a brain in a closet you own, one story to a person, and the Surface is a window, and a window does not compute the garden, it admits it. This is the point the whole design is built to defend against the centralized server: the closet is your home, not a datacenter, and the key is yours.

0. The one-paragraph device

A sheet of electrophoretic (e-ink) or electrowetting display, pixels that hold their state at zero power and change only when written, is bonded to a thin bezel that carries five small things: a secure element, the keyhole, a signing chip that holds the I key and never lets it leave the silicon; a low-power radio, the moment channel; an energy-harvesting power path, a photovoltaic film and a supercapacitor, with no battery, charge gathered from ambient light exactly as the world's own solar appliance was designed; a touch layer for taps and chords, the acting and composing modes; and a microcontroller small enough to be honest, not a computer but a decoder that turns arriving face bytes into pixel writes and turns touches into words for the secure element to seal. There is no operating system, no apps, no local knowledge of any world, and no clock driving a refresh. The pane is off between moments. It wakes when touched or when the radio hears its name, draws the face, seals what is spoken, and goes dark but showing, the last moment persisting on the glass at zero watts, like ink, because it is ink.

1. Why the doctrine permits this hardware

Every discipline in the Surface design turns out to be a hardware simplification.

Design rule (Surface)	Consequence (hardware)
Repaint at moment seams, never on a tick	No refresh loop, so e-ink is enough. Pixels rearrange only on a push, and between moments the display draws no power and still shows the world.
Faces arrive composed; the glass never decides	No processor beyond a decoder. The fold did the thinking upstream, so the pane only maps face bytes to pixel regions, a small controller and not a computer.
No client state but a cache and the key	No storage subsystem. A few megabytes of frame and cache memory, the key sealed in a secure element, and nothing worth stealing in the glass.
The speakable words are the buttons	Touch is input, not interaction logic. A tap composes a word and a seal stamps it; the pane never interprets, it transcribes.
Seeing is free	Reading costs nothing here either. A shown moment persists unpowered, so the economics of the world and the physics of the ink agree.
The world runs headless in the closet	The pane needs no compute because the story holds it all. Losing the glass loses nothing, and a new pane with your key resumes the moment.

The deep alignment is that e-ink is an append-only display: it holds what was last written until something new is written. The industry treats that as a limitation, no video and slow refresh, but for a moment-driven world it is the correct behavior, the display's own physics matching the chain's.

This is the projector of the Surface doc made physical. The e-ink cells are the reel, each write is a frame, the fold is the lamp, and the resting glass is a held frame at no cost, so that an append-only display and a moment-driven projector turn out to be one claim said twice, once in the physics of the ink and once in the language of film.

2. Block diagram: five organs, one spine

        ┌─────────────────────────────────────────────┐
        │                THE GLASS                     │
        │   e-ink / electrowetting voxel field         │
        │   (bistable pixels: hold state at 0 W)       │
        └────────────────────▲─────────────────────────┘
                             │ pixel writes (only on a moment)
   touches / chords          │
        │              ┌─────┴─────┐        ┌──────────────┐
        ▼              │  DECODER   │◄──────►│  RADIO       │
  ┌───────────┐        │  (MCU)     │  face  │  BLE / WiFi/ │
  │ TOUCH     │───────►│ face-bytes │  bytes │  LoRa module │
  │ LAYER     │ words  │ to regions;│  words │  (the moment │
  └───────────┘        │ words to   │   up   │   channel)   │
                       │ seal req   │        └──────────────┘
                       └─────┬─────┘
                             │ sign this
                       ┌─────▼─────┐
                       │ SECURE     │   the keyhole: the I key is born
                       │ ELEMENT    │   here, never leaves, and signs
                       │ (SE chip)  │   sealed words; a gate is optional
                       └───────────┘
        ┌─────────────────────────────────────────────┐
        │ POWER PATH: PV film (bezel/back), then a     │
        │ harvester IC, a supercapacitor, 1.8 / 3.3 V  │
        │ (no battery; a dark-start reserve in the cap)│
        └─────────────────────────────────────────────┘

Every arrow is event-driven, and nothing in the diagram runs continuously.

3. The organs, with today's parts as proof they exist

The glass, the voxel field. Electrophoretic film of the kind already shipping, monochrome to a few colors today, with fuller color and electrowetting and color-filter variants maturing. It is bistable, so the image persists unpowered for as long as you like, and partial-region update is native, which means a dug cell can rearrange its own pixels without touching the sky. The world's woodcut look, banded gradients and flat derived color at the grain, is not a compromise on this display but its native tongue. Transparent and segmented electronic paper already exists for the clear-pane vision; a first build is an opaque sheet, and the clear glass is a later material over the same protocol.

The decoder, deliberately not a computer. A small microcontroller or a modest logic tile receives the face bytes the fold composed, the pane atoms and cell entries, maps them to display regions, drives the ink controller, turns touch into key events, and batches chords in the hold window, which is a display setting kept in the decoder's config and never a fact on the chain. The firmware is small enough to audit in an afternoon and carries no vocabulary at all: it knows atoms by promise index and bytes by position, with the rule that fonts carry nothing fixed in read-only memory. There is no operating system and no scheduler beyond wake-on-radio and wake-on-touch.

The keyhole, the secure element. A signing chip of the class used in hardware wallets: the I key is generated inside the chip at its first boot, the pane's own genesis, and is never exportable, so the decoder passes composed words in and signatures come out. A gate is optional, a pattern tapped on the glass or a fingerprint strip on the bezel. Losing the pane loses a key and not a world, and if that key is a facet, a delegated child of your true I, revocation is one act from any other glass and the lost pane's star simply goes dark. The recommended practice is that panes hold facets and never the root, which stays in the closet with the brain, or cold in a drawer.

The moment channel, the radio. Three tiers, chosen for the pane's life: a short-range link for a house pane a few meters from the closet, drawing microwatts; ordinary wireless for a garden pane; and a long-range low-power link for a far cabin pane, kilometers on milliwatts. The moment protocol fits all three, because faces are small, hundreds of bytes to a few kilobytes at the woodcut grain, words are tiny, and there is no streaming because there are no ticks. The radio sleeps and the story's push wakes it by beacon, and a pane that missed pushes simply asks for the current moment on waking, since catch-up folding means the world owes it exactly one composed face and never a replay.

The power path, no battery. A photovoltaic film on the bezel or the back, harvesting even from indoor light, feeds a harvesting circuit and then a supercapacitor sized for a number of display rearrangements, a number of signatures, and the radio bursts between one bit of light and the next. A full capacitor holds days of this duty cycle, because the duty cycle is nearly zero: the pane's resting draw is a sleeping signer and a beacon sniff. The display costs energy only when the world changes, which is the whole thesis written as a power budget, a still world free all the way down to the glass. A coin cell can ride along as a dark-start backstop in a first version, though the vision needs none.

4. The interaction loop, one moment end to end

Rest. The glass shows the last moment. Display draw is zero, the radio sniffs for a beacon, and the signer is asleep.
Wake by the world. The story pushes, the radio wakes the decoder, the face bytes arrive, the decoder writes the changed regions, the glass rearranges those pixels, and it rests again. A splash thrown from another pane ripples onto this one's shore, then stillness, then nothing, forever, free.
Wake by hand. A touch arrives, the decoder resolves the press through the bindings the face itself carried, cached like any face content with no keymap in the firmware, and composes the word. In the acting mode the signer seals at once, by standing consent; in the composing mode the promptline region gathers ink until a seal key, and then the signer signs, the radio sends, and the story answers with the next moment.
Speech, an optional organ. A microphone and a wake-word chip feed dictation as composing-mode input, a voice filling the private weave, and a spoken seal word stamps. The pane still interprets nothing; the membrane upstream does.

No step contains a loop. The pane is a chain of interrupts, which is what a moment-driven client was always going to be.

5. What this device refuses

No battery-backed always-on. If a feature needs constant power, it belongs in the closet, not the glass.
No local rendering logic beyond decoding atoms. The day the firmware improves a face, the glass has started to decide, which the whole design forbids.
No app store, and no update that adds vocabulary. Firmware updates fix decoding and radio only; every new capability arrives from the story as new faces, forever, with no change to the pane.
No identity in flash. Keys live in the secure element or nowhere, so a pane found on a bus is a brick with a pretty picture.
No clock. The pane does not know what time it is. The world does.

6. The family of panes, one protocol and many glasses

The same five organs come at different sizes: the pocket pane, phone-shaped, the traveler's window; the desk pane, a page, the reader; the wall pane, the household's shared window onto a moment of the farm, the family map, the season; the shelf strip, a one-line run of glyphs showing the day's covenant count, the world's clock that is not a clock; and in time the clear pane, a transparent substrate whose voxels light in glass exactly as the vision names it. All of them are the same: a keyhole, a radio, a decoder, ink, and light. All of them are disposable. None of them is the world.

7. The window the world rebuilds

The strangest turn in the whole design is that this pane is not only the honest window onto a world but a thing the world itself must invent. Run any story forward far enough and its beings, knowing nothing of this closet or this glass, are driven by their own conservation to the identical machine, because the thermodynamics of their world simply are the doctrine of the moment: a screen that burns force to repeat itself is a bonfire none of them can afford, and matter that holds its state for free and changes only when something happens is the only display their physics allows. So the world in the glass, watched through a pane, builds that same pane out of its own sand and its own law, the three families of it drawn out in The Living World as phase-ink, the waystone screen, and firefly glass. The window and the world it shows turn out to be made of one thing, discovered twice, once here by design and once inside by physics. A being centuries of dawns into some far story will stand before a sheet of phase-ink fed by a wire from the coast and watch the far waves move its pixels only when the water actually moves, looking into its world through its world, and that is the vision kept in the only way a vision outlasts its keeper, not preserved in a document but entailed by the physics.

The brain hums in the closet, keeping the covenant. The windows hang in the house, dark and full of the last moment, costing nothing. When the world changes, the ink rearranges; when a hand speaks, a key signs. That is the whole device, the old pane of glass finally made honest, because for the first time there is nothing the glass needs to know.