Two states,
one delta,
many faces.
If the graph is what Edition knows, the architecture is how it stays honest at scale — and it comes down to one wall, deliberately built.
The world's state.
Your state.
Edition maintains exactly two models, and keeps them apart on purpose.
structured · sourced · timestamped · shared by everyone
READER STATE what has you been shown?
delivered · opened · followed · where you stopped · yours alone
news = the meaningful difference between them
The world state is one shared thing — there is one reality, and everyone queries it. The reader state is millions of small private ones, one per person. Keeping them physically separate isn't just tidy; it's what makes the whole thing work — and what makes it trustworthy.
Edition doesn't know
what you know.
Everywhere else on this site, "what you already know" is the useful shorthand. Here's the precise version, because the reader model has to obey the same epistemic rules we demand of the newsroom. Reading is not knowing. You skim. You read on a train and retain nothing. You learn things from a friend, a podcast, an argument at dinner — and Edition never sees any of it.
observed_exposure // delivered, opened, dwelled — facts we watched happen
+ explicit_interest // follows, declarations — things you told us
+ last_position // where you left each storyline
+ bounded_inference // familiarity, marked inferred — never promoted
Those four are different kinds of claim, and the system keeps them apart the way it keeps authored facts apart from inferred ones (Article 7). The practical consequence is a system that says "you saw this in Tuesday's edition" — something it observed — rather than "you know this" — something it cannot possibly verify.
This matters more than it sounds. Subtraction is only safe when the model you're subtracting against is honest. Overestimate what a reader absorbed and you get the worst failure this product can have: a calm, confident edition that leaves out the thing they needed, because the machine believed they already had it. When the reader model is uncertain, the correct behavior is to show more and claim less. That risk has its own entry →
Your knowledge
lives with you.
Because the reader model is what Edition has observed about you — everything delivered, opened, and followed — it's the most sensitive data in the system. So it doesn't sit in a central database to be mined across everyone. Each reader gets their own private space that holds their own state and computes their own delta at the edge, near them. There is no cross-reader analytical plane. Privacy isn't a policy bolted on afterward — it's the shape of the thing.
This is, quietly, the descendant of a real piece of Circa's engineering — a per-user view that decided what was new for you. Circa built a crude, brilliant version of it in 2013. Edition makes it the foundation.
Renderers read.
They never write truth.
This is the most important line in the whole design. The part of the system that makes things for humans to read — the email, the app, the audio brief — can read the graph and your state, and produce a rendering. It can never write back. No fact, no edit, no "engagement signal" flows from a surface into the truth. Your interactions (reading, following, flagging) come back in — but through the same front door as everything else, as clearly-labeled observations, checked at the boundary.
Why build that wall? Because once rendering becomes nearly free — and with agents, it is — the idea of a single canonical human-facing version becomes actively harmful. There shouldn't be the Edition version of a story. There should be canonical knowledge, and as many faces as there are ways to need it.
The morning edition, finishable. Reply to follow something.
The brief read aloud, bounded like everything else.
The full graph to wander — entity pages, timelines.
Structured, receipted facts, so it stops hallucinating the news too.
Personalize the telling.
Never the truth.
Edition will know a lot about you — your interests, your depth, what you've read. That's enormous power, and exactly where information systems go rotten: subtly bending not just how something is explained, but which account of it you receive. So the Constitution draws the line in ink (Article 16).
Two readers can get different selections, different context, different lengths, different vocabulary, a different surface, a different moment. But they are querying the same reality. The politics obsessive and the casual reader get the same account of what happened — one just gets more of it, phrased for them. Facts fixed, telling fluid. That's the deal, and it's structural, not a guideline.
Every failure mode
has a name here.
This shape wasn't reasoned from scratch. It was reverse-engineered from a real system's documented failures — the ones the Circa reconstruction surfaced in the code and the newsroom's own words:
| Circa's failure | Designed out by |
|---|---|
| self-DDoS on big alerts | fan-out is messages between private reader spaces, not a stampede on one database |
| "who's editing this?" | each storyline is a single-owner actor — the lock problem dissolves |
| stale overnight facts | machinery watches for drift; humans don't have to (Art. 8) |
| a wrong fact spreading | risk-scored verification before a claim with many dependents is promoted |
The infrastructure choices to run all this — where it's hosted, what it's built on — are settled in a separate technical record and left out here on purpose. They're implementation. The shape above is the idea.
The through-line of the whole architecture is a single inversion. The article isn't the database. The app isn't the product. The newsroom isn't the humans. And the reader isn't an anonymous endpoint at the bottom of a publishing funnel. The product is the synchronization layer between reality and understanding — and every wall, every actor, every boundary exists to keep that layer honest. ← back to the beginning