The design for the third face, agreed in conversation and written up before any code.
The mechanic: neglect kills it over ~7 days through visible stages, death is permanent for that pet, a new one is born on the next activity rather than automatically, and a cemetery records each one. Everything derives from timestamps, so sleep, reboots and daemon restarts are irrelevant by construction.
The architecture: the Swift app polls a Rust one-shot. Decoding the wire in Swift was rejected as a second implementation of the privacy boundary; a streaming sidecar was rejected as child-process supervision inside a GUI app.
Rejected alternatives and the reasoning for each are recorded, since those are the parts that will look arbitrary in six months.