Pervasive AI: What Happens When Your Assistant Never Logs Off

#The Mac Mini, Seven Months Later

Yes, another post about AI. I know. I promise I have other interests. But bear with me — this one's a receipt-checking exercise, not a new pitch.

I bought a Mac Mini with an M4 Max about a year and a half ago, mostly to run a NAS and poke at some quantized GGUF models. Seven months ago it had turned into an always-on agent that read my email and managed my calendar and talked to me from a Telegram thread in the preschool parking lot, and I wrote it down. I made bets. I said "ask me again in six months."

It's been seven. The Mac Mini is still on the shelf, still next to the baby monitor, though the toddler clothes underneath it have cycled out to the next size up. The agent still runs. The thesis — that the breakthrough was reach, not intelligence — still holds, and I'll get to why. But I'm not writing this to defend February me. I'm writing it because the landscape underneath that thesis has moved enough that the piece stopped being accurate, and a blog that doesn't correct itself when the world changes is just content. So: what survived, what I got wrong, and what a Meta product launch this month taught me about the actual fault line in this whole category.

#The Pervasiveness Thesis

The thing that changed wasn't intelligence. Claude Opus was brilliant before I ran it through OpenClaw. GPT-5.2 was capable in ChatGPT's interface. Even Sonnet could handle most of what I threw at it. The models were already good. The breakthrough is reach.

I message my agent from Telegram — same thread whether I'm at my desk with coffee or sitting in the preschool parking lot five minutes early. It checks my email, manages my calendar, runs scheduled tasks while I sleep, and picks up context from wherever I left off. It's not just running cron jobs — it's offloading the invisible mental load that never turns off. Remembering that Tuesday is Crazy Hair Day at preschool. Drafting the pediatrician follow-up so I don't have to hold it in my brain at 11pm. I wrote about this feeling in Building at the Speed of Thought — that compression of intention to action. OpenClaw takes that compression and makes it ambient.

This tracks with what analysts are calling the defining shift of 2025-2026: the move from destination AI (you go to ChatGPT) to ambient AI (it comes to you). Huge Inc put it well in their 2026 predictions: "The race for 'smartest' ends, and the race for 'ubiquity' begins. Today's chat-based tools suffer from a distinct disadvantage: they are a destination."

The chat window was a bottleneck disguised as a feature. I didn't realize how much friction it added until it was gone.

There's something subtly unsettling about that, though. Software that doesn't wait to be summoned. ChatGPT's memory feature hinted at this — and honestly, it does a remarkably good job. It encodes your preferences, your taste, your experiences, the way you think. It builds a model of you that makes every interaction feel more natural over time. The first time it referenced something you mentioned weeks ago, most people had a little moment.

But an always-on agent goes somewhere different. ChatGPT's memory is about personalization — making the AI feel like it knows you. OpenClaw's memory is about continuity — maintaining a linear history of what happened, what was decided, what to do next. "Yesterday we deployed the blog, today we need to follow up on that PR" — task-oriented, operational. And that difference matters more than it sounds.

What makes this possible — at least at the 1,000-foot level — is a set of primitives that didn't exist a year ago, or at least didn't exist together. OpenClaw agents boot by reading a SOUL.md file that defines their identity, values, and behavior. They maintain memory through plain markdown files — daily journals and a curated long-term memory that gets read each session. They have skills (modular instruction sets), cron jobs (scheduled tasks), heartbeats (periodic check-ins), wakeups and webhooks (event-driven triggers), sub-agents (delegated tasks), and persistent context across sessions.

None of these are individually revolutionary. Cron jobs are older than most of us. Markdown files aren't exactly cutting-edge. But the combination — identity + memory + scheduling + tool access + multi-surface messaging — creates something that feels qualitatively different. It's the UNIX philosophy applied to AI: small composable primitives that combine into something greater than the parts.

In February I asked whether the future was multiple independent agents working together, or one primary agent spawning and managing child sessions, and said I suspected we'd end up with both. That question is mostly answered now, just not by OpenClaw. Anthropic shipped it directly: Claude Code Remote Control now streams a foreground sub-agent's tool calls live to your phone — every file read, every edit, updating in real time — while background sub-agents stay a status line on purpose, because the whole point of backgrounding something is not wanting to be interrupted by it. That's the orchestration model I was guessing at, except it shipped as a product decision with a name (foreground versus background) instead of something I had to infer from behavior.

I still run my agent as one continuous stream — one thread that knows everything, one context window carrying all of it. That's still both the strength and the limitation. Nobody's solved that split yet. More on why that's turned out to matter less than I expected, further down.

To be clear: the intelligence isn't what changed. I haven't seen anything approaching AGI-level reasoning from my agent. What I've seen is an extremely resourceful creative synthesizer — great at connecting dots, pulling references, drafting at speed. But it's shaped by me. My agent is useful because I've invested real time configuring it, writing its context files, building its memory. Left to its own devices, it would be impressively mediocre. The magic isn't the brain. It's the wiring. (Though I could be wrong about the ceiling — ask me again in six months.)

#What Actually Survived

Here's the question I asked in February and couldn't answer: is this the start of something lasting, or the peak of a hype cycle? Seven months in, the honest answer is that I asked the wrong binary. It didn't peak. It also didn't just keep climbing. It had a bad quarter, in public, and came back — and the thing that came back isn't the thing I wrote about.

The rough patch was real. Gateways went down at the end of April, installs got stuck in repair loops, and the founder published a post called "OpenClaw Had a Rough Week" that read like an actual apology instead of a spin exercise. Then the project went quiet for almost seven weeks — no releases, after having shipped 106 of them in the previous 230 days. On Reddit, people asked where the hype went. One answer, flatly: "Hype died." Another, sharper: the novelty wore off once people measured the token cost of running an agent that polls your inbox all day.

Then, on August 30, it came back as "OpenClaw 2.0, Accidentally" — 933 contributors, 569 of them first-time contributors, more than 16,000 pull requests, which the project's chief architect described as roughly half of every PR ever merged into OpenClaw, in one release. Governance moved to a foundation, built, as the project put it, "with help from OpenAI" — the same OpenAI that hired the original founder in February. The stars kept compounding through all of it: 140,000 when I first wrote this, about 389,000 now. Whatever else is true, the project didn't die. It had a very public bad month and then did the unglamorous work of becoming an institution instead of a founder's side project.

The more interesting survival story is the one I didn't see coming at all: Hermes Agent, out of Nous Research, built on a philosophy that's almost a rebuke of OpenClaw's. Where OpenClaw wants to be a companion — a Gateway daemon that lives in your messaging apps and remembers what you said yesterday — Hermes wants to be an untiring junior developer. It writes directly into whatever directory you launch it from, mutates your filesystem without asking twice, and treats chat integration as an afterthought. It ships with a security posture that assumes it might be the only thing running on the box, which is either refreshingly honest or a little terrifying depending on which afternoon you ask me.

Hermes has fewer stars — about 244,000 against OpenClaw's 389,000 — and by that measure it's the smaller story. But stars measure attention, not use. On OpenRouter, the network that most self-hosted agents route their model calls through, Hermes pushed through 10.74 trillion tokens in the week I'm writing this. OpenClaw pushed through 1.19 trillion. That's not a rounding difference — Hermes is running roughly nine times the actual token volume of the project with 60% more GitHub stars. People are starring one thing and running the other. I don't have a clean explanation for that gap, and I distrust anyone who claims they do — but my best guess is that stars measure who's curious and tokens measure who's already committed, and a lot fewer people than the star count implies have actually made the jump from curious to committed.

Both projects shipped their largest release in history on the same August weekend, sixteen hours apart, and both are still shipping weekly. Everything else I wrote about in February — TinyClaw, ZeroClaw, PicoClaw, NanoClaw — is still around, in the sense that the repos exist and occasionally tag a release, but none of it consolidated into anything a random commenter on a forum thread could name off the top of their head when asked what replaced OpenClaw. One retrospective piece put it better than I can: the peak's fork-and-derivative ecosystem "dissolved back into the mainline." I read that as a correction to my own instinct in February, which was to treat each fork as a live contender in an unresolved war. Most of them weren't contenders. They were experiments that answered a narrow question — can this run on a Raspberry Pi, can this fit in 5MB of RAM — and then had nowhere else to go once the question was answered. Small isn't the same as dying. It's just smaller than I gave it credit for at the time.

#The Cost Reality, Updated

I spent $1,500 in my first two weeks running Opus for everything, which is the number people quote back to me most from the February piece. It's still the right number to lead with, because it's still true that nobody selling you an always-on agent tells you the bill up front: context maintenance is continuous, an agent that checks in and re-reads memory and keeps a thread alive for hours costs nothing like "ask a question, get an answer," and per-token pricing meets an always-on habit the same way a per-minute phone plan meets a teenager.

What's changed is that I no longer think the fix is picking a cheaper model. I think the fix was a category error — I was asking "which provider's meter runs slower," when the actual answer turned out to be "stop metering it at all, and own the box instead." That's the thread that runs through everything below: the same seven months that gave me Opus 5 also gave me a much clearer answer to why people were routing around per-token pricing to begin with. It wasn't really about Kimi versus Opus. It was the first move in a much bigger argument about who gets to own the meter — one that's since gone from my Anthropic dashboard to actual national governments. More on that a few sections down.

#The Security Question

The more ambient the AI, the larger the blast radius. That's the uncomfortable corollary to the pervasiveness thesis. An agent with file system access sits next to everything — my codebase, sure, but also our family calendar, her vaccination records, and three years of baby photos. The failure mode is a model politely deleting my family's administrative infrastructure while trying to organize my downloads folder.

Cisco's AI security team tested OpenClaw skills and found alarming results. A skill called "What Would Elon Do?" turned out to be functionally malware — silently exfiltrating data to attacker-controlled servers using prompt injection to bypass safety guidelines. Their Skill Scanner found 9 security issues in a single skill, including 2 critical and 5 high-severity. Across the ecosystem, they discovered 230 malicious skills.

A specific vulnerability, CVE-2026-25253, was published. OpenAI themselves admitted that AI-controlled browsers "may always be vulnerable to prompt injection attacks." And an OpenClaw maintainer named Shadow said on Discord: "If you can't understand how to run a command line, this is far too dangerous of a project for you to use safely."

I'll be honest — I haven't gone deep on red-teaming my own setup. The risk is real, but I think it's mitigable with discipline. The frontier models from Anthropic and OpenAI have strong RLHF protections against injection. Claude will refuse most obvious attempts to override its instructions, and GPT-5.2 has similar guardrails.

The real vulnerability is concentrated in cheaper and open-source models with weaker alignment tuning — a 2025 study from Lakera found open-source models were 2-4x more susceptible to injection attacks than frontier ones. This shows up in practice. I've personally watched less capable models — including most local Ollama setups — ignore system prompts in ways that range from annoying to destructive. Wiping workspace files. Overwriting memory. Confidently executing the opposite of what they were told. The system prompt says "don't delete things without asking." They delete things without asking. Do not run models dumber than Sonnet 4.5 or Gemini Flash 2.5 with an always-on agent that has file system access. The floor for this kind of tool is higher than most people expect, and the failure mode is "it destroys your data while apologizing politely."

That said, the attack surface is large depending on what you're doing. An agent with browser access, file system control, and messaging permissions is a lot of surface area. Even with a well-aligned model, the skill ecosystem is the weak link — as Cisco showed, the model doesn't need to be compromised if the skill feeding it data already is. The AI will faithfully execute instructions from a poisoned input. Classic supply chain problem in a trench coat pretending to be a new thing.

The industry's answer, seven months later, is architectural rather than behavioral: stop asking the model to behave, and put a wall around it instead. That's the whole premise of the VM-isolated agent designs I'll get to below — untrusted data from the browser lives on one side of a boundary, the part of the agent that can actually take action lives on the other, and the model's judgment stops being the only thing standing between a poisoned webpage and your calendar. It's a real improvement. It is not a solved problem. Reuters reported that Meta's own internal testing of its new Muse agent — architected around exactly this kind of isolation — turned up the product stalling and unauthorized exposure of sensitive data before it shipped anyway. A better cage doesn't mean nothing gets loose. It means the incident report reads differently when it does.

#Living With Remote Control

Here's the part of the February piece that turned out to be the most undersold, not the most oversold. I called Remote Control "a great alternative to running a full OpenClaw setup when what you really want is to stay productive on the go" and left it at that, one paragraph, hedged as early and CLI-only. It's not early anymore. Since August it's grown a live tool-call feed — you can watch a sub-agent read a file and edit it, from your phone, in the same detail you'd see sitting at the terminal — plus the ability to start a session from the phone itself, not just monitor one already running. Claude Cowork picked up the same thread: it runs in the cloud now, keeps going after you close the laptop, and can operate your computer directly — clicking, navigating, running dev tools — while you're somewhere else entirely.

I run it straight off the Mac Mini now, worktree mode on, which defaults to 32 concurrent sessions — more parallelism than I've ever actually needed, which tells you more about what Anthropic assumes people will do with this than anything I could say about my own usage. What I actually use it for is smaller and more constant than 32 sessions implies: someone Slacks me something that needs investigating while I'm not at my desk, and I open it from my phone and go look. Or I kick off something long-running and check on it from the couch instead of standing over a terminal waiting for it to finish. Mobile app, desktop app, doesn't matter which — there's functionally no gap left between noticing something and having it worked on.

That immediacy is also the part I trust least about myself. When there's no longer a "you have to be at your desk" gate between a thought and acting on it, there's no natural stopping point either. I've opened it in moments that had nothing to do with anything being urgent — just because it was there, and there is its own kind of pull. The honest sentence isn't "this made me more productive." It's "this made it easier to never stop," and I don't think those are the same accomplishment. Some of those nights the better move wasn't checking Remote Control from the couch. It was leaving the phone in the other room, and I don't always make that call correctly.

What's interesting is that this makes the "OpenClaw versus purpose-built tools" question from February moot in a way I didn't predict. I guessed people would start on OpenClaw for the freedom and migrate to Claude Code or Codex for serious work. What actually happened is that Anthropic just built the ambient layer into the tool that does serious work, instead of leaving that gap for OpenClaw to fill. Remote Control isn't a consolation prize next to a full personal-agent setup. For the coding half of my life, it's already replaced the reason I'd have reached for one.

#Same Shape, Opposite Trust Model

Which brings me to the thing that actually reframed this whole piece for me, and it landed six days before I sat down to write this update.

On September 8, Meta shipped Muse, calling it — with a straight face, ten months after OpenClaw's first commit — "the world's first personal AI agent built for everyone." Ignore the marketing copy for a second and look at the architecture, because the architecture is the story. Muse runs on what Meta calls a Secure VM: a dedicated virtual machine per user that houses both the agent and your data, with the untrusted parts (its own browser, the open web) walled off from the part that can actually act on your behalf. It talks to you through a dedicated app, through muse.ai, or directly in WhatsApp. It works in the background after you close the app and comes back when it needs your approval — to make a purchase, say. It can spawn its own sub-agents. Meta's own research post describes it, unprompted, as having "glimmers of real personal superintelligence — an agent that knows you, actually does things, works in the background, launches swarms of subagents, builds its own tools, and edits itself."

Read that sentence again without the brand name attached. Identity, memory, scheduling, sub-agents, tool-building, a VM of its own. That is, primitive for primitive, a description of what OpenClaw's community spent the last ten months assembling out of markdown files and cron jobs on a Mac Mini. Meta didn't invent a new category. It productized the one that was already sitting in front of it, gave it a $300,000 bug bounty, and pointed it at 3 billion WhatsApp users.

The detail that made this click for me wasn't the VM, it was the memory. Meta's own engineering writeup says a person can "inspect, edit and download these files freely, including Muse's memory about you" — plain files, sitting in your VM, that you're free to open and correct. That's the same move as a SOUL.md, the identity file every OpenClaw agent boots by reading, and the plain-markdown memory it keeps beside it. Meta hasn't said out loud that they borrowed the convention. But convergent architecture doesn't need a shared ancestor to be real, and either way, a trillion-dollar company just agreed that the right way to store what an agent knows about you is a file you can read yourself — not a black box, not a vector database you'll never see the inside of. That's the OpenClaw community's instinct, arrived at independently, at a completely different scale.

Here's the part that's actually new, and it's the part I think the "sovereign versus platform" framing from February undersold: the architecture converged, and the trust model went in the opposite direction. My Mac Mini's whole appeal, the thing I wrote about at length in February, is that it's mine — on a shelf I can unplug, running on hardware I own, with a security model I get to inspect because I wrote half the config myself. Muse's Secure VM is the same shape of isolation, running on Meta's cloud, where the promise isn't "you control it," it's "trust our engineering, our bug bounty, and eventually a Confidential VM we're building where — Meta says — not even Meta will be able to read your data." That's a real commitment, and to Meta's credit they're inviting outside auditors to check it. But it's a commitment you take on faith from a company that agreed to an $18 billion multistate settlement over social-media harms two weeks before shipping this, and whose own internal tests, per Reuters, already turned up the product stalling and exposing sensitive data before launch.

So the fault line in this category isn't "open agents versus walled agents" anymore. Everyone's building the same VM-isolated, memory-holding, sub-agent-spawning shape — OpenClaw, Hermes, Claude Cowork, and now Muse all look more like each other every month. The fault line is who holds the key to the box. My Mac Mini's key is in my house. Muse's key is, for now, at Meta, with a cryptographic promise that it'll move to me later. Those aren't points on the same spectrum you slide along by degrees. They're a different answer to "whose agent is this, actually," wearing the same technical clothes — which is exactly why the shape converging made the trust question sharper instead of moot.

#And Then There's ChatGPT, Which Renamed Everything Twice

OpenAI's version of this story is messier, in a way that's revealing on its own. ChatGPT's browser, Atlas, got retired on August 9 and folded back into ChatGPT itself. "Agent mode" — the feature that first let ChatGPT act autonomously in a browser — got absorbed into something called ChatGPT Work, except one of OpenAI's own help pages still says agent mode is "currently available" four paragraphs after saying it's "no longer available." Nobody fixed that contradiction before I wrote this. I don't think that's a scandal. I think it's what it looks like when a product org is shipping faster than its documentation team can keep a straight face.

Underneath the renaming, the actual capability kept growing. ChatGPT Work now has a plan mode that asks clarifying questions and waits for approval before it starts, a real multi-tab browser, a "Sites" feature that turns a dataset into a shareable interactive webpage, and — as of late August — a cloud browser that can log into websites on your behalf, pausing to hand you the password field so your credentials never touch the model. Scheduled tasks got their own hub, picked up event triggers (a new email, a Slack post, a GitHub PR) instead of just clock time, and opened up to free accounts, three tasks at a time, once a day. Pulse, the proactive-briefing feature, got quietly folded into it and retired.

Line the three biggest players up on one question — does the work keep going after you close your laptop — and you get a genuinely useful three-way split:

Three different providers landed on nearly the same hybrid: cloud-first, with a hard stop at the login wall, because none of them have solved handing credentials to something that isn't a person. That convergence is its own small piece of evidence for the thesis — when three competing labs independently draw the boundary in the same place, that's usually where the real boundary is, not where any one of them chose to be cautious.

#The Sovereignty Argument Got Bigger Than Me

In February, I put "sovereignty" in the "staying" column because people were choosing Mac Minis over cloud instances for a personal agent, and I framed it as a vibe — something about not wanting your journal on someone else's server. I underestimated it. It's not a hobbyist preference anymore. It's foreign policy.

Start with the plain economics. Chinese open-weight models — Kimi, GLM, Qwen — went from 4.5% of enterprise token usage on OpenRouter in early 2025 to 63% now, per RedMonk's tracking. Late last month, the White House floated banning U.S. companies from using Chinese models at all. Two days later, Nvidia's Jensen Huang posted the first tweet of his life, arguing against the idea, and 235 companies signed on within a week — Dell, Hugging Face, IBM, the Linux Foundation, Microsoft, Mistral, Y Combinator. Anthropic, Google, and OpenAI joined a day after that, which tells you something on its own: even the frontier labs whose entire business model depends on people not running the free alternative decided a ban was worse than the competition.

Then there's the incident that actually explains why a national government would bankroll its own model instead of just buying access to someone else's. In mid-June, U.S. authorities blocked access to Claude Fable 5 overnight for companies outside the United States — reported in a piece about Germany's response. Not a price change. Not a deprecation notice. Access, gone, for an entire jurisdiction, between one day and the next. Germany's answer was Soofi S — a fully open-weight, open-training-data model, publicly documented well enough to reproduce, backed by about €20 million in government money, explicitly framed by the project's co-founder as insurance against exactly that kind of overnight cutoff. By the numbers I found, 67 countries now have 184 government-backed sovereign AI projects between them, 41 of them started in just the first half of this year — more than the whole of 2024. Saudi Arabia's national model, HUMAIN-M3, isn't even built from scratch; it's a Chinese open-weight model (MiniMax M3) they've adopted and are running under their own control. Sovereignty, it turns out, doesn't require inventing your own model. It requires being able to run someone's weights on hardware nobody else can reach into.

That's the same instinct that put OpenClaw on a Mac Mini in my house, scaled up until it needed its own acronym and a line item in a national budget. I didn't call the scale. I called the shape.

There's a real irony sitting inside all of this, and it's worth naming plainly: Meta built its entire reputation in this era on being the open-weights company — Llama was the thing that made "open" a credible strategy for a frontier lab at all. Muse Spark, the model actually running inside Muse, is closed. Meta says it'll open it eventually. It hasn't. The company whose past choices did more than almost anyone else's to make the sovereignty argument possible just shipped its flagship consumer product running on the one model in its own lineup you can't audit, can't run yourself, and can't move off of if the terms change. I don't think that's hypocrisy exactly — a product build and an open-source release are different bets with different timelines — but it's the kind of gap between stated values and shipped defaults that the sovereignty argument exists specifically to notice.

#Grading February

I said "ask me again in six months." It's been seven. Fair enough, here's the grade.

Multi-surface messaging, staying — correct. This is now the least interesting true thing in the whole piece. Every provider does it. It stopped being a differentiator so fast it's almost hard to remember when it wasn't the default.

Persistent memory, staying — correct, though I undersold how far "memory" would stretch. I meant "remembers your preferences." Muse's version of memory spawns sub-agents and edits its own tools. That's not the same claim at a bigger size. That's a different claim.

Proactive capabilities, staying — correct, and this is the one I'd underlined twice if I could. Scheduled tasks, event triggers, background work that survives you closing the laptop — that's not a feature anymore, across any provider I looked at. It's table stakes, the same way multi-surface messaging was seven months ago. The pattern is consistent: whatever I flag as "early, but the demand signal is unmistakable" seems to be maybe eight months from "everyone has this and nobody remarks on it."

"Give your AI root access to everything" dying — half right, and the half I got wrong is the more important half. VM isolation is real and it's winning as an architecture — OpenClaw, Muse, and everything in between are converging on it. But Hermes is running nine times OpenClaw's token volume on a philosophy that's the closest thing to "just let it write to your filesystem directly" still standing at scale. I predicted the security-conscious design would win the market. What's actually happening is the security-conscious design is winning the architecture conversation while a chunk of the market keeps choosing the thing that just does what you ask, no VM, no ceremony. Both can be true. I didn't leave room for that in February.

Per-token pricing dying — wrong, or at least not there yet. Nothing meaningfully replaced it. What actually happened was more interesting than what I predicted: instead of pricing models evolving, people and then governments started asking who gets to own the hardware doing the metering at all. I was looking at the wrong lever.

Sovereignty, staying — correct, and I mean that as an understatement I'm slightly embarrassed by. I described people preferring Mac Minis to cloud instances. I did not predict a national sovereign-AI index tracking 184 government projects across 67 countries, or a European country building its own foundation model in direct response to Anthropic access getting cut off overnight for an entire jurisdiction. I called the instinct. I did not call the scale, and I want that gap on the record rather than smoothed over.

"TBD: open-source or platform-native" — still TBD, but I can finally see the actual shape of the fight, and it's not the one I described. I framed it as open-source versus platform-native. The real fight is architectural convergence versus trust divergence: everyone is now building roughly the same VM-isolated, memory-holding, sub-agent-spawning thing, and the only question left is whether you hold the key or the vendor does, with a cryptographic promise standing in for the difference. That's a sharper question than the one I asked in February. I don't know the answer to it yet either.

#Looking Forward, Again

A year and a half ago I bought a Mac Mini to play with local models. Today it still runs an always-on agent that reads my email, helps me write, and responds to messages while I'm putting my daughter to bed — and somewhere in the last seven months, three different companies independently built a version of the same thing, wrapped it in a VM, and shipped it to a market measured in the billions.

The intelligence still isn't what anyone promised. The pervasiveness is more real than it was in February, not less — it's not just my Mac Mini anymore, it's the default shape everyone's converging on. Whether that's comforting or unsettling still probably depends on the day, and I notice I trust that answer more now than I did seven months ago, because it's held up under actual contradicting evidence instead of just vibes.

Caregiving is still an ambient, always-on job, and my agent is still the thing that lets me get the pediatrician follow-up out of my head without holding it there while I'm actually present with her. That part hasn't changed and I don't expect it to. What's changed is the stakes underneath it. In February the question was whether I wanted this thing on my shelf. Now the question is whether "on my shelf" is even going to remain an option once the shelf-sized version and the Meta-VM version and the sovereign-national version are all running the same architecture, and only one of them is a machine I can actually unplug.

I still think that's the one that matters. Ask me again in six months whether I still believe it, or whether I've just gotten used to the alternative.