²⁵AI at Work, and Where It Stops

Machines did most of the work on this site, under a person's direction, so the honest account is a list of who did what. The owner directs the research and makes the decisions that bind. Claude Code coordinates: it owns the intake manifest, routes the work and records what was decided, and it alone drives a change into the accepted record. Codex CLI and the models reached through a self-hosted gateway do the heavy lifting. They go through scans in batches and set down what they find as staged observations, while a second such model reads the consequential material again, independently, to argue with it and report back. These are roles more than brands; a different model could fill any of them. The arrangement enforces one rule: whoever reads does not accept, and whoever checks does neither. A model can propose anything, but only the coordinator, together with the gate described in the last chapter, can make it stick.

The project's strictest rule grew out of a mistake it had already made. When a claim rests on a value read from handwriting (a name, a street, a house number, a date, an act number, a signature), that value is never registered on a single reading. Two readers of different makes read the tight crop cold, one of them the project's own and at least one from outside it. Unrelated readers are less likely to repeat each other's mistakes. When two of them, reading blind, land on the same value, their agreement counts for more than one reader's confidence in its own answer. That is not proof, but it is a better test than a single confident reading. Neither reader sees the other's answer, and neither is handed a candidate to confirm, because offering an answer is how a wrong one gets confirmed. The two readings are then weighed against the scan, and the resolved value is accepted only on human review, never on a model's say-so.

The rule exists because a hand was once misread and believed. In two Rotterdam birth acts of 1922 and 1923, the painter's family home street had been transcribed as Eendrachtsstraat. Read again, blind, both readers landed instead on the -hoorn- street, and once weighed against the address books and the city's street index the value was fixed as Eenhoornstraat¹. The discarded reading was not erased. It stays on the record as a value the project has dropped, so no later draft can wander back into it. The blind cross-read note sets out the full case, including a second reader's near-miss on the same crop.

Where each kind of document is read decides where the material leaves the building. The routing is declared in a manifest dated 26 August 2026, and that manifest is the authority on it. The Gemini API transcribes printed pages and tables, with GLM-OCR on the Z.ai service as its only escalation; local transcription is switched off. The Gemini API also describes photographs, drawings and maps. Handwriting that a claim will rest on is never trusted to one reading, and never to a local one. It goes to the mandatory blind cross-read across at least two model families: the project's own reader and an outside one such as Gemini. A separate pass may locate a hand on a page, to find where the thing of interest sits, but it is only an aid and may never promote a reading into the record.

Only one leg runs on the project's own machines: the search over the whole corpus. It fuses a lexical match with a semantic one, whose embeddings an embeddinggemma model computes locally under Ollama, with nothing sent out. The older claim that printed transcription or picture description run locally is therefore not true of what runs now. Both go to the Gemini API, and only retrieval stays home. For the readings that carry the most weight, the handwriting cross-reads, a note beside the scan records who read what, and how each document is read sets out the full routing, capability by capability.

Before a model reasons over a document, the document is usually turned into a structured form. A PDF, an office file, a web page or a scanned document is converted to DocLang, which keeps the headings, tables and reading order that a flat text dump would lose, and the model works over that rather than over raw bytes. The conversion has three limits. The conversion is deterministic, with no model in the loop, so it makes no judgement of its own. The converted form is a finding aid and never the cited artefact: a claim still points at the preserved scan, not at the DocLang. And any value that matters is checked back against the original before it is registered, with a load-bearing handwritten one also going through the blind cross-read. Plain text, Markdown, code and a page wanted as an image are left alone, since converting them would add nothing. The same routing behind how each document is read makes that call.

No model may invent an archive reference, an inventory number or a link. Every identifier a model proposes is checked against the repository before it is registered, because a confident model will produce a plausible catalogue number that does not exist. No model may promote a claim: calling something confirmed, probable or a lead is a reviewed human judgement, and no amount of agreement between models moves it. No model writes the accepted record; the gate closes that path to them. And nothing a model generates, whether a summary, a graph or a dashboard, is ever cited as proof. The proof is the preserved document underneath.

Those models were pointed at real archives. The next chapter says which ones, and how the material was got out of them.