The grammar is measured

Kestrel's syntax is not defended by taste. It is defended by a fail-closed parser and evolved by measurement (OSS ADR-0030): aggregated authoring-error clusters, not a designer's intuition, are the evidence for changing both the prompt that teaches the language and the grammar itself.

The measurement that started it

In the first live dry run, three independent frontier models wasted 30 to 47% of their turns on the same parse escape: they collapsed the multi-line PLAN … WHEN … DO … document onto one line. One error, dominating, shared across capable models. That cluster is a measurement with two readings: teach the layout better in the prompt, or bend the grammar toward what capable authors already write. The discipline is to treat both as falsifiable responses to the same instrument, prompt first because it is cheap and reversible, grammar second, owner-gated and frozen deliberately.

This is what capable models are being taught to write, a complete document:

PLAN momentum-breakout budget 0.25R ttl +30m regime {intraday: trend}
  USING signal SPX exec SPY 0dte
  WHEN spot crosses above HOD AND velocity(1m) >= p95
  DO buy 2 +1 C @ min(fair-3c, mid) peg esc fair 2m esc ask 4m cap fair cancel-if spot < VWAP
  EXIT spot < VWAP held 60s @ fair esc mid 30s

Fail-closed: a parse error costs opportunity, never money

The parser is exact and never silently repairs. An unparseable turn fails closed to a stand-down or a pass: no plan arms, the standing book keeps managing under its existing obligations, and the runtime logs exactly what was refused and why. The same posture holds one level down, where the parser refuses whole classes of unsafe statement at parse time:

error  code=PARSE  message=EXIT may not condition on the mark `mid`: marks lie ... (line 9, col 19)
exit=2

A bad author never becomes a bad position. The cost of every authoring failure is a missed opportunity, which the Grade records honestly, never an unbounded action.

Graded error messages and bounded repair

Every invalid author inside the bounded authoring loop (OSS ADR-0029) produces a structured repair event: the shape of what the model wrote, the repair-guiding error the parser returned, and whether the next attempt parsed. Aggregated, that log grades the error messages themselves: a message after which capable models reliably fix their document is a good message; one they cannot recover from names a real ergonomics defect. Repair is bounded, a few re-asks under a budget, and when the budget is spent the outcome is the terminal fail-closed pass. The loop repairs by re-asking the model, never by loosening what the parser accepts.

Grammar-constrained decoding: a layered enhancement

There is a stronger enforcement point than checking after the fact. With grammar-constrained (CFG) decoding, supported by several providers and open inference stacks, the Kestrel grammar is supplied at decode time and invalid syntax becomes unrepresentable at the sampling step: the dry-run-1 failure mode literally cannot be sampled (OSS ADR-0031 §5).

The design treats this as a layered enhancement, explicitly not a dependency:

1. The baseline is complete by itself: free-form generation, forgiving extraction, the exact fail-closed parser, and bounded repair-retry.
2. Where a provider supports CFG constraint, the entire syntactic failure class disappears at decode time.
3. CFG guarantees only syntax. Semantic invariants, a price must resolve to an honest anchor, budgets, never-naked, stay validated after parse, always, with the admission Gate as the final backstop.

Never a blanket "100% correct parsing" claim: syntax at decode time where supported, semantics post-parse everywhere.

What the tracers added

Both cascade tracer runs (N=1 each, synthetic practice-tier tape, never rankable; see The desk) sharpened the finding in an unexpected direction: the grammar friction lives at the frontier tier too. In tracer 1 the frontier strategist repeatedly authored @ spot where the grammar requires an honest price anchor, and armed nothing. In tracer 2 a strategist one model generation newer produced three distinct error varieties across two arms and again armed no Plan, while the untuned 32B watcher authored syntactically valid Kestrel on 7 of 7 wakes. Every failure failed closed to a pass, exactly as designed, but the window where the Plan mattered was spent failing to arm. All three frontier mistakes would be unrepresentable under CFG decoding. One run each; a signal, not a conclusion.

The training arc

Roadmap, not shipped: the same measurement instrument feeds the small-model program. A prompted watcher is the cold start; SFT distills frontier trajectories over the frozen View; RLVR trains against the honest Grade as a verifiable reward. The headline research claim is the breakout map, model family by size by training regime: where does viable in-loop authoring and judgment emerge, and how cheap is the smallest model that holds the grade? Until those results exist they are a research program, not a property of the product.

The language this discipline protects is described in The four statements; what a certified result looks like is described in Evidence.