# Build Delivery: Cut Map

Date: 2026-09-17

Status: Imagination pass, cut map. Nothing here has landed. Anchors are against
`codex/item-provenance` HEAD `6dc18607`. Ends are owned by
`docs/build-delivery-target.md`; this document owns the means.

Claims marked **(probe)** were run, not read off names. What was run:

- A real batchmode player build of the main tree, Unity closed, output to a
  scratch directory outside the repo:
  `Unity.exe -batchmode -quit -nographics -silent-crashes -projectPath F:\Projects\Aetheria -buildWindows64Player <scratch>\playerbuild\Aetheria.exe -logFile <scratch>\unity-player-build.log`.
  No Editor script was added; `-buildWindows64Player` needs none. Exit code 0.
  It dirtied one tracked file, `ProjectSettings/UnityConnectSettings.asset`,
  which was restored to `6dc18607`; the other 16 modified files in the worktree
  predate this pass. Build output and the zip were deleted afterwards.
- A headless run of the produced player:
  `Aetheria.exe -batchmode -nographics -logFile <scratch>\player-run.log`, killed
  at 25s.
- Reads of `gamecult-ops` inventory, runbooks, `nginx/`, and its deploy scripts;
  Idunn `src/` and `docs/`; `gamecult-site`, `AetheriaLore` and `GameCult-Quartz`
  configs and workflows; the `CultLib-semver` worktree.

No remote host was contacted. No `ssh` was run.

Rulings (operator, 2026-09-17): **F2, the Aetheria site** (`aetheria.gamecult.org`,
repo `AetheriaLore`) owns the download and changelog pages ("That's the Aetheria site, of
course"); `gamecult.org` links to them. **F1 no** (Idunn stays service-only; the artifact
uses the host's existing static path), **F3** semver for builds, commit recorded beside it,
**F4** hand-written changelog, **F5** agent builds, hashes and records while the operator runs
the remote publish, **F6** zip, **F7** a new `aetheria.release` document: Self's defaults,
stated to the operator, who did not object. Reopen any on request.

## 0. What the probes changed about the target

Four findings move the design. Read these before the cuts.

### 0.1 A player build already works **(probe)**

The target says Aetheria "has no player build pipeline"
(`docs/build-delivery-target.md:11`). Half true: there is no build *code* — zero
`BuildPipeline`/`BuildPlayer`/`BuildTarget` references in any tracked `.cs`, and
`Build/` holds only Eve asset bundles and logs, never a player. But the project
itself builds clean today with the stock command-line switch.

- Scripts compiled for StandaloneWindows64 with warnings only (`CS0067` on
  `Assets/Scripts/ServerShared/Behaviors/LockWeapon.cs:44-46`).
- ~9 minutes wall on Starfire with a warm `Library/`.
- Output 212 files, **352.4 MB** on disk; **189.8 MB** as a zip
  (`Compress-Archive -CompressionLevel Optimal`, 35s).
- Scenes come from `ProjectSettings/EditorBuildSettings.asset:8-13`:
  `Assets/Scenes/Main Menu.unity`, `Assets/Scenes/ARPG.unity`, both enabled.
- Scripting backend is Mono, not IL2CPP: `ProjectSettings/ProjectSettings.asset:660-661`
  sets `scriptingBackend` for Android only, so Standalone takes the default.
- `Aetheria_BurstDebugInformation_DoNotShip/` is emitted beside the exe and must
  not ship.

So Cut 1 is not "make a build possible". It is "make a build repeatable,
identified, and complete", which is a much smaller cut.

### 0.2 The catalog gap is silent, not loud **(probe)**

`ActionGameManager.cs:38-41` resolves `GameDataDirectory` as
`new DirectoryInfo(Application.dataPath).Parent.CreateSubdirectory("GameData")`,
and `:45` builds `CatalogPath` from it. In a player that is
`<build>\GameData\Aetheria.cc`. Nothing in the repo copies the catalog there.

The dangerous part is what happens next. `AetheriaStores.cs:13-15` promises the
open "Throws when a `[CultGlobal]` type routed to the catalog has no record", and
`:26-31` implements exactly that. But none of the seven catalog types at
`AetheriaStores.cs:9` is `[CultGlobal]`, so the guard selects nothing and the
open succeeds over a catalog file that does not exist.

Proven, not inferred: the built player launched, reached Main Menu, ran for 25s,
and wrote `<build>\GameData\player.cc` (1,964 bytes) — while `Aetheria.cc` was
absent the whole time. No exception, no log line about the catalog. The only
errors were `Stardust` compute-shader nulls, which are `-nographics` artefacts.

A player shipped without its catalog therefore does not refuse. It boots to a
menu and fails later, in the ARPG scene, with an empty world. That is worse than
a crash, and Cut 1 has to close it.

### 0.3 Idunn structurally cannot carry a file artifact

The target invariant reads "Idunn owns deployment to Yggdrasil"
(`docs/build-delivery-target.md:44`). Idunn cannot own this one.

- `Idunn/src/deployment.rs:33` — `TargetDeclaration.service` is a plain
  `ServiceDeclaration`, not an `Option`. Every deployment unit is a service.
- `Idunn/src/deployment.rs:110-141` — a `ServiceDeclaration` requires an
  `executable_artifact`, a transport, and a mandatory `health` declaration;
  `:851` refuses a plan whose service executable is not a declared artifact.
- Admission does not complete until the workload publishes its own signed
  presence and health (`Idunn/docs/deployment-authority.md:84-92`). A zip cannot
  sign presence.
- The only workload drivers are `SystemdTransient` and `HostActuator`
  (`Idunn/src/deployment.rs:442-450`) — both process supervisors. There is no
  oneshot path.
- The only route drivers are `NginxStreamTcp`/`NginxStreamUdp`
  (`Idunn/src/deployment.rs:698-701`), writing stream fragments to
  `/etc/nginx/idunn-stream-routes/`. Idunn has no concept of an HTTP `root`,
  `try_files`, or a web root anywhere in `src/`.
- Idunn has no push transport at all. It pulls: `GitSourceDriver`
  (`Idunn/src/drivers.rs:682,714`) fetches the admitted ref on the host. Even the
  remote Windows actuator fetches its own source
  (`Idunn/docs/host-actuator.md:27-47`). Bytes never travel *from* Idunn.

`ArtifactOutput` (`Idunn/src/deployment.rs:91-101`) can carry an arbitrary blob
with an `expected_sha256`, and `required_adjacent_artifacts` (`:115`) ships
non-executable files — but only alongside a supervised executable. There is no
unit shaped like "a file at a URL".

Meanwhile Yggdrasil already serves static files, twice, through a different and
proven authority (see 0.4). The target invariant should be narrowed to "Idunn
owns *service* deployment to Yggdrasil"; static bytes already have an owner, and
it is not a second deployment authority invented for this migration. See **F1**.

### 0.4 The site is GitHub Pages; only the bytes can live on Yggdrasil

`gamecult.org` is GitHub Pages out of `GameCult/gamecult-site`
(`gamecult-ops/inventory.md:728-738`, `runbooks/gamecult-pages-cutover.md:1-19`),
built by the shared engine `GameCult/GameCult-Quartz` through a reusable workflow
(`gamecult-site/.github/workflows/deploy-quartz.yml`,
`GameCult-Quartz/.github/workflows/quartz-pages.yml:24-72`, ending in
`actions/deploy-pages@v4`). `aetheria.gamecult.org` is the same mechanism out of
`GameCult/AetheriaLore` (`AetheriaLore/site/quartz.config.ts:66`,
`gamecult-ops/inventory.md:801-806`).

A 190 MB zip cannot go in either repo: GitHub blocks files over 100 MB, and
Pages has its own soft limits. So the split is forced and is exactly what the
operator asked for — the *page* is on the site, the *bytes* are on Yggdrasil.

What Yggdrasil already has:

- nginx with real static vhosts: `gamecult-ops/nginx/erycina.org.conf:4`
  (`root /srv/erycina-site/site/current`), `nginx/velvet.erycina.org.conf:4`.
- An immutable-release store pattern:
  `scripts/deploy-erycina-site-yggdrasil.sh:33-50` unpacks into
  `/srv/<site>/site/releases/<UTC-stamp>` and moves `current` atomically.
- A generic TLS publisher: `scripts/publish-static-site-tls-yggdrasil.sh:1-60`,
  parameterised by `SITE_HOST`/`SITE_ROOT`, refusing to run unless DNS already
  resolves to this host (`:40-56`). certbot/Let's Encrypt throughout.
- Transport: `scp ... ygg:` then `ssh ygg 'sudo -n bash /tmp/...'`
  (`runbooks/erycina-org-site-deploy.md:78-81`).

One thing does **not** transfer. The site-release pattern rotates: a `current`
symlink plus `KEEP_RELEASES=5` pruning
(`scripts/deploy-erycina-site-yggdrasil.sh:50-56`). The target requires the
opposite — "A published version stays published"
(`docs/build-delivery-target.md:32`). The artifact store is append-only, with no
`current` symlink and no pruning. Cut 4 says so explicitly, because copying the
erycina script wholesale would silently delete published downloads.

## 1. Authority map (whole migration)

- **Owner of the release record:** a new CultCache store
  `Releases/aetheria.releases.cc` in this repo, one `aetheria.release` document
  per published build. The Aetheria repo owns the facts about Aetheria builds.
- **Inputs:** the built artifact's bytes (size, sha256), the commit it was built
  from, the platform, the build host, the version, and a hand-authored changelog
  entry.
- **Outputs:** the artifact zip; the release document; a derived feed and derived
  changelog pages in the site repo.
- **Derived state, never authored:** the browser-facing JSON feed, the download
  page, and every changelog page. All are projections of the release store,
  regenerated wholesale. Editing them by hand is the failure the target names at
  `docs/build-delivery-target.md:30-31`.
- **Forbidden writers:**
  - The *game* must never read or write the release store. It is not added to
    `AetheriaStores.cs:9-11`, and `ActionGameManager.cs:56` keeps opening exactly
    three stores. A release record is publishing state, not game state.
  - Idunn does not write the artifact, the feed, or the pages (0.3).
  - The site repos never author release facts; their content files for downloads
    and changelog are generated and overwritten.
  - `Build/` stays gitignored (`.gitignore:8`) and never becomes an artifact
    store.
- **Shared paths:** there is exactly one publish primitive. A manual publish, a
  re-publish, and any future automated publish all go through the same
  `release publish` verb; none of them writes the feed or the pages directly.
- **Deletion line:** the vacuous catalog guard at `AetheriaStores.cs:26-31` is
  replaced before Cut 1 adds any build code, and
  `docs/build-delivery-target.md:11-14` is corrected once Cut 1 lands.

**Atomicity, honestly.** The target asks that publishing "publishes the artifact,
the feed entry and the changelog entry together, or it publishes nothing"
(`:28-29`). Three destinations — a remote filesystem, a git-tracked store, and a
second git repo — admit no real two-phase commit. The invariant that actually
protects a visitor is narrower and is the one to enforce: **no feed entry exists
without verified bytes already fetchable at its URL.** Order is artifact → verify
by re-downloading and re-hashing → release document → projection → site push.
A failure before the release document leaves unreferenced bytes, which are inert
and which the next publish of the same version may overwrite only when the hash
matches. A failure after it leaves a pending page, which the next site build
fixes. Neither produces a download link that 404s.

## 2. Cuts

### Cut 1. A player build that is repeatable, identified, and carries its catalog

- **Repo/branch:** Aetheria, `codex/build-delivery` from `6dc18607`. Depends on
  nothing.
- **First:** keep the probe numbers in 0.1 as the baseline — 212 files,
  352.4 MB, 189.8 MB zipped, ~9 min warm. A first landed build that differs
  wildly means the build options diverged from the stock switch.
- **Deletes first:**
  - `Assets/Scripts/ServerShared/AetheriaStores.cs:13-15` (the comment promising
    a guard that does not fire) and the guard body at `:26-31`, replaced rather
    than supplemented.
- **Adds:**
  - `Assets/Editor/AetheriaBuild.cs` — one static entry point for
    `-executeMethod`, taking version and output root from the command line. It
    goes under the existing `Assets/Editor/` (whose only current file is
    `Epiphany/EpiphanyEditorBridge.cs`) and compiles into the existing
    `Assembly-CSharp-Editor`; no new asmdef, no new assembly.
  - A catalog staging step in that entry point.
- **Per-file changes** (against `6dc18607`):
  - `Assets/Scripts/ServerShared/AetheriaStores.cs:16-32`: `Open` refuses a
    `catalogPath` that does not exist, unless `catalogWritable` (the seed case
    already exempted at `:24-25`). Keep the existing global check as a second,
    narrower guard; it is not wrong, it is merely inert for today's type set, and
    it will bite the moment a catalog type is marked `[CultGlobal]`. The new
    check is the one that protects a shipped player.
  - `Assets/Editor/AetheriaBuild.cs` (new): `BuildPlayerOptions` with
    `scenes` read from `EditorBuildSettings.scenes` filtered on `enabled` — the
    same two scenes at `ProjectSettings/EditorBuildSettings.asset:8-13`;
    `target = BuildTarget.StandaloneWindows64`. Sets
    `PlayerSettings.bundleVersion` from the passed version, superseding the
    stale `0.1` at `ProjectSettings/ProjectSettings.asset:152`. After the build:
    copy `GameData/Aetheria.cc`, `GameData/Narrative/**` and
    `GameData/SoundbanksInfo.json` next to the exe; delete
    `Aetheria_BurstDebugInformation_DoNotShip/`; fail the run on a non-empty
    `BuildReport` error list.
- **Authority map:**
  - Owner: `AetheriaBuild` owns what a player build contains.
  - Inputs: `EditorBuildSettings.scenes`, `GameData/`, a version string, an
    output root.
  - Outputs: a complete player directory, and the build report.
  - Derived: `PlayerSettings.bundleVersion` is now set by the build, not authored
    in `ProjectSettings.asset`.
  - Forbidden writers: nothing else sets `bundleVersion`; nothing else decides
    the scene list.
  - Deletion line: the inert-guard comment goes before the entry point is added.
- **Verification:**
  - builds: the entry point produces a player; size within ~10% of 352.4 MB.
  - negative: `git grep -n "Aetheria_BurstDebugInformation"` finds only the
    deletion in `AetheriaBuild.cs`.
  - test: a `Aetheria.Shared.Tests` case pins that `AetheriaStores.Open` throws
    on a nonexistent read-only catalog path, and still opens a writable empty one
    (the seed case at `AetheriaStores.cs:24-25`). This is the regression that 0.2
    proves is live today.
  - operator: launch the staged build by double-click, reach Main Menu, start a
    game, confirm the world is populated. Then rename `GameData/` beside the exe
    and relaunch: it must refuse loudly, not boot to a menu.

### Cut 2. The release record

- **Repo/branch:** Aetheria, same branch. Depends on Cut 1 for the fields it
  records.
- **Adds:**
  - An `aetheria.release` `[CultDocument]` type, declared in the tools assembly,
    not in `ServerShared` — the game must not link it.
  - `Releases/aetheria.releases.cc`, tracked in git. Small: a few KB per release.
- **Shape.** Model the fields on the one existing GameCult type that already
  describes a versioned build artifact,
  `CultLib/src/GameCult.Mesh/CultMeshCdn.cs:130-171`
  (`gamecult.mesh.cdn_artifact_manifest`): `Version` (`:145`), `ContentHash`
  sha256 (`:151`), `SizeBytes` (`:156`), `MimeType` (`:160`), `CreatedAtUtc`
  (`:164`). Note `CultMeshCdnArtifactKinds.Build = "build"` at `CultMeshCdn.cs:34`
  is documented as "Executable build or install/update payload" — this exact case.
  Add what that type lacks and the target requires: `Commit`, `Platform`,
  `BuildHost`, `Url`, and the changelog body. See **F7** on reuse vs a new type.
- **Authority map:**
  - Owner: the release store is the authority on what exists
    (`docs/build-delivery-target.md:30`).
  - Inputs: Cut 3's publish verb only.
  - Derived: everything a browser sees.
  - Forbidden writers: the game (`AetheriaStores.cs:9-11` unchanged,
    `ActionGameManager.cs:56` unchanged); the site repos; any hand edit.
  - Deletion line: none — nothing exists to replace.
- **Verification:**
  - negative: `git grep -n "aetheria.release"` must not match anything under
    `Assets/Scripts/ServerShared/`. Checked against the `aetheria.*` schema names
    already in that tree so it cannot collide.
  - test: reopening the store yields the same documents; a published version is
    refused on re-publish with different bytes.

### Cut 3. One publish primitive

- **Repo/branch:** Aetheria, same branch. Depends on Cuts 1 and 2.
- **Keeps and reuses:** `tools/AetherDb` — the existing headless .NET console over
  Aetheria's CultCache stores, with store-path resolution already written at
  `tools/AetherDb/AetherDb.cs:15-32`. A `release` verb group there adds **zero**
  build targets and reuses the csproj, the `Aetheria.Shared` reference, and the
  path walk. A second console would add a target for nothing. See **F5** on who
  runs it.
- **Adds:** `release build`, `release publish`, `release project` verbs, and
  `CHANGELOG.md` at the repo root in the Keep-a-Changelog shape CultLib just
  adopted (`CultLib-semver/unity/org.gamecult.cultlib/CHANGELOG.md:1`).
- **Per-file changes:**
  - `tools/AetherDb/Program.cs`: new verb dispatch. `release build` shells the
    Unity entry point from Cut 1 and zips the result, excluding nothing further
    (Cut 1 already removed the Burst directory). `release publish` computes
    sha256 and size, reads the `CHANGELOG.md` section for the version, writes the
    `aetheria.release` document, and emits the projection. `release project`
    regenerates the projection alone from the store, so the pages can be rebuilt
    without a build.
  - Follow the deterministic-packaging precedent in
    `CultLib-semver/scripts/build-unity-package.ps1:41-52`, which clears
    intermediates and disables source-revision stamping so a rebuild is
    byte-comparable. The target asks for reproducibility from a commit
    (`docs/build-delivery-target.md:36-37`); say plainly in the doc what Unity
    does *not* guarantee there rather than claim byte-identity that Cut 1 has not
    demonstrated.
- **Authority map:**
  - Owner: `release publish` is the only writer of the release store.
  - Derived: the feed JSON and the markdown pages, regenerated wholesale, never
    merged into.
  - Shared paths: a first publish and a re-publish use the same verb.
  - Forbidden writers: no script writes the feed or pages directly.
- **Verification:**
  - test: `release project` run twice produces byte-identical output.
  - negative: nothing outside `tools/AetherDb` opens `aetheria.releases.cc`.
  - operator: none yet; Cut 5 carries the smoke.

### Cut 4. The artifact host on Yggdrasil

- **Repo/branch:** `gamecult-ops`, its own branch. Depends on Cut 3 producing a
  zip. Independent of Cuts 1-3 landing.
- **Adds:**
  - `nginx/<host>.conf` modelled on `nginx/erycina.org.conf`, keeping the ACME
    location (`:11-14`) and the security headers (`:7-9`), but with
    `root /srv/aetheria-builds`, `autoindex off`, and **no** `try_files`
    fallback and **no** `error_page` rewrite — a missing version must 404.
  - `scripts/deploy-aetheria-build-yggdrasil.sh`. Modelled on
    `scripts/deploy-erycina-site-yggdrasil.sh` but with the rotation removed:
    the release path is `/srv/aetheria-builds/<version>/`, it **refuses** to
    write into a version directory that already exists, there is **no** `current`
    symlink, and there is **no** pruning. Copying `:50-56` unchanged would delete
    published downloads and break
    `docs/build-delivery-target.md:32`.
  - A runbook alongside `runbooks/erycina-org-site-deploy.md`.
- **Reuses unchanged:** `scripts/publish-static-site-tls-yggdrasil.sh` for the
  vhost install and certbot run — it is already parameterised by
  `SITE_HOST`/`SITE_ROOT` (`:1-60`) and already refuses to run before DNS
  resolves to this host (`:40-56`).
- **Hazard to carry into the runbook:** five existing `*.gamecult.org` records in
  `gamecult-ops/inventory.md` still say `A -> 94.130.223.131`
  (`:746, :764, :771, :777, :785`) while Yggdrasil is at `159.195.114.249`
  (`:363, :387`). The new record must use the current address, and the stale rows
  are a follow-up outside this migration.
- **Authority map:**
  - Owner: the release directory tree on Yggdrasil is append-only and root-owned.
  - Inputs: a zip and its sha256, scp'd by the operator.
  - Forbidden writers: nothing overwrites a published version directory; Idunn
    does not touch this tree (0.3); no pruning job exists.
  - Deletion line: the rotation and pruning logic is removed when the script is
    adapted, not left in and disabled.
- **Verification:**
  - operator: `curl -I` the artifact URL returns 200 with the right
    `Content-Length`; TLS valid; the parent directory does not list;
    a nonexistent version returns 404.
  - negative: re-running the deploy script for an existing version exits nonzero
    and changes nothing.
  - budget: ~190 MB per release on a ~2 TB root
    (`gamecult-ops/inventory.md:355-392`). Ten releases is ~1.9 GB. Retention
    owner is the operator; append-only is the default and nothing prunes.

### Cut 5. The download page and the changelog pages

- **Repo/branch:** the chosen site repo (see **F2**), its own branch. Depends on
  Cut 3's projection and Cut 4's URL.
- **Adds:** generated content files under the site's content dir — one downloads
  page, one page per release — plus the feed JSON under `static/`.
- **Mechanism.** Do not write a Quartz emitter plugin. The established precedent
  in these repos is pre-build generation into committed files:
  `gamecult-site/scripts/generate-vn-repo-doc-tree.mjs` and
  `generate-vn-eve-surface.mjs` write JSON into `GameCult/static/...`, invoked by
  the local launcher (`scripts/quartz/quartz.ps1:38-52`) and **not** by CI, so the
  outputs are committed artifacts. Cut 3's `release project` fills that same role.
  The site's existing workflow then publishes with no change at all.
- **Brand.** Follow `gamecult-site/docs/brand-design-language.md` and the config
  it describes, not invention: Montserrat 100-300 for titles, Ubuntu 300 body,
  IBM Plex Mono uppercase and letter-spaced for the structural labels a download
  page is mostly made of (version, date, platform, size, hash). Ground `#07111a`,
  panels `#16212c`, body `#b7c7d9`, headings `#eef5ff`, accent `#ff8a2a`, links
  `#59b7ff`. Reuse the existing component classes rather than adding a page-type
  variant: `.gamecult-repo-facts` / `-fact-label` / `-fact-value`
  (`gamecult-site/site/quartz/styles/custom.scss:953-1008`) is already a
  label/value fact table, and `.gamecult-action`
  (`custom.scss:2246-2360+`) is already the button. Note the brand defines no
  success/warning/error colour (`brand-design-language.md:135-138`); a download
  page needs none.
- **Authority map:**
  - Owner: Cut 3's projector owns every byte of these files.
  - Derived: all of them. A hand edit is overwritten on the next projection and
    that is the intended behaviour.
  - Forbidden writers: no human edits the generated pages; changelog prose is
    authored in the Aetheria repo's `CHANGELOG.md` and flows through Cut 3.
  - Shared paths: the site's existing Pages workflow is untouched.
- **Verification:**
  - builds: the site's Quartz build succeeds with the generated pages present.
  - negative: re-running `release project` leaves the working tree clean.
  - **operator, the real check:** from a machine that has never held the repo —
    open the download page on the public site, click the link, let it download,
    verify the sha256 shown on the page against the file, unzip it, run
    `Aetheria.exe`, start a game, confirm the world is populated. Then confirm
    the changelog page for that version says what actually changed. This is the
    only check that proves the whole path; every other verification above is a
    component test.

## 3. Operator forks

**F1. Does Idunn carry the artifact?** *Most blocking — it decides Cut 4.*
- **A:** Extend Idunn with a static-artifact deployment unit (optional `service`,
  a file workload driver, an HTTP root route driver).
- **B:** Use the existing `gamecult-ops` static release path — scp, a root-owned
  append-only release script, an nginx vhost, certbot — the same authority shape
  that already serves `erycina.org` and `velvet.erycina.org`.
- **Recommended: B.** A is a large change in Rust to the one daemon whose whole
  design premise is that it depends on no managed target and supervises signed,
  health-reporting processes; it would mean making `service` optional
  (`Idunn/src/deployment.rs:33`) and inventing an HTTP-root route driver, to make
  Idunn do the thing it is deliberately not shaped for. B is not a second
  deployment authority — it is the *existing* file-serving authority on that
  host. This does mean narrowing the target invariant at
  `docs/build-delivery-target.md:44` to name service deployment; that edit
  belongs to whoever lands Cut 4.

**F2. Which site owns the download page?**
- **A:** `gamecult.org` (`gamecult-site`) — what the target's invariant names
  (`docs/build-delivery-target.md:46`).
- **B:** `aetheria.gamecult.org` (`AetheriaLore`) — the game's own live site,
  same engine, same brand family.
- **Recommended: B, with A linking to it.** A download for Aetheria belongs on
  Aetheria's site, and per-release changelog pages will accumulate; parking
  dozens of them in the studio site's tree is noise there and natural there. The
  honest counter: `AetheriaLore` is a *lore vault* (`Aetheria/Lore`, `Fiction`,
  `Worldbuilding`) and release notes are not lore, so B needs a new top-level
  section and a masthead entry
  (`AetheriaLore/site/quartz/components/AetheriaMasthead.tsx:19-39` is a
  hardcoded route list). This one is close; the target's wording points at A and
  only the operator can say whether that wording was deliberate.

**F3. Versioning scheme for game builds.**
- **A:** semver, next is `0.2.0`, commit recorded as a separate field.
- **B:** CalVer, `2026.09.17`.
- **C:** commit-derived, `0.1.0+g6dc1860`.
- **Recommended: A.** It reuses the policy work already in flight:
  `CultLib-semver/scripts/check-changelog-semver.mjs` demands exactly one
  major/minor/patch step per release (`:39,:62`), refuses a version with no
  changelog entry (`:79`), and treats `0.y.z` minor as the breaking lane
  (`:98,:139`) — which is exactly right for a game whose saves will break.
  Caveat the operator should know: that script is **untracked** on its branch,
  and the `docs/semver-policy.md` it cites at `:4` does not exist in any CultLib
  worktree. It is package-only and says nothing about builds, so adopting it here
  is a decision, not an inheritance. B tells a player nothing about whether their
  save survives. C puts a commit in the version string where the target already
  wants the commit as its own field (`docs/build-delivery-target.md:26-27`).

**F4. Hand-written or commit-derived changelog?**
- **A:** Hand-written per release in `CHANGELOG.md`, ingested at publish.
- **B:** Derived from commit subjects between tags.
- **Recommended: A.** B produces a build log, not release notes — and GameCult
  already has that experiment running by hand:
  `gamecult-site/GameCult/Projects/VoidBot.md:53-57` and `Ghostlight.md:56-57`
  are dated commit-subject lists, and they read like machine output. A also
  matches what CultLib just adopted for its own packages. The cost is that
  publishing blocks on someone writing prose, which is the correct thing for it
  to block on.

**F5. Agent-run or operator-run publishing?**
- **A:** Fully agent-run, including the Yggdrasil push.
- **B:** Agent builds, hashes, writes the record and the projection, and opens
  the PRs; the operator runs the two remote scripts.
- **Recommended: B.** `gamecult-ops` already draws this exact line, in a comment
  worth quoting: "putting a name on the public internet is a separate decision
  from having bytes on disk"
  (`scripts/deploy-erycina-site-yggdrasil.sh:9-11`). A published version is
  permanent by the target's own rule, so the irreversible step is the one a human
  should take. Everything expensive and mechanical stays automated.

**F6. Zip or installer?**
- **A:** Zip. **B:** An installer (NSIS/Inno/MSI).
- **Recommended: A.** Measured at 189.8 MB **(probe)**. No installer toolchain
  exists anywhere in GameCult, and B drags in code signing, an uninstaller, and a
  new build dependency for no player benefit while launchers and auto-update are
  already out of scope (`docs/build-delivery-target.md:55`). Revisit when there
  is a reason, not before.

**F7. Reuse `gamecult.mesh.cdn_artifact_manifest` or declare `aetheria.release`?**
- **A:** Reuse the CultLib type (`CultLib/src/GameCult.Mesh/CultMeshCdn.cs:130`),
  which already has version, sha256, size, mime, created-at, and a `Build` kind.
- **B:** A new `aetheria.release` type that borrows those field names.
- **Recommended: B, citing A.** The CultLib type is CDN-shaped: its `Chunks` list
  (`:168`) is the point of it, and content-addressed chunking
  (`CultMeshCdn.cs:96-120`) is machinery this migration does not use and should
  not fake. A release also needs `Commit`, `BuildHost`, and changelog prose,
  which do not belong bolted onto a CDN manifest consumed elsewhere. Borrow the
  field shape, not the type. If a CultMesh CDN path ever carries these builds, A
  becomes the transport and B stays the record.

## 4. Subtraction and build budget

This migration is net additive and cannot honestly be made otherwise: it buys a
capability that does not exist today — nobody outside Starfire can play the game.
What it must not do is buy it twice.

| Cut | Removes | Adds | Targets |
|---|---|---|---|
| 1 | inert guard + stale comment, `AetheriaStores.cs:13-15,26-31`; the shipped Burst debug dir | one Editor file under the existing `Assets/Editor/` | +0 assemblies (no asmdef; joins `Assembly-CSharp-Editor`) |
| 2 | — | one document type, one tracked `.cc` | +0 |
| 3 | — | verbs inside the existing `tools/AetherDb`; one root `CHANGELOG.md` | **+0 executable targets** |
| 4 | the rotation and pruning logic while adapting the erycina script | one nginx conf, one shell script, one runbook | +0 (no compilation in `gamecult-ops`) |
| 5 | — | generated markdown/JSON in a site repo | +0 (no workflow change) |

Explicit budget statements:

- **No new executable target anywhere.** Cut 3 reuses `tools/AetherDb` precisely
  so the repo does not gain a second console. If that reuse is rejected, the
  budget changes and the fork should be raised.
- **No new Unity assembly**, no new package dependency, no Addressables
  dependency — `docs/addressables-cut.md` has not landed and this migration does
  not wait on it. The build probed in 0.1 is the pre-Addressables `Resources`
  path, and it works.
- **Build host is Starfire, Windows, Unity 6000.3.24f1**
  (`ProjectSettings/ProjectVersion.txt:1`). The serving host is Debian 13. The
  artifact is Windows-only and produced only on Windows; nothing about Cut 4
  proves anything about the player, and nothing about Cut 1 proves anything about
  the server.
- **Disk.** ~190 MB per release on Yggdrasil, append-only, no pruning. The
  operator owns retention.
- **A fresh clone is not required per release.** The checkout is 1.78 GiB of
  `.git` plus a 2.6 GB `Library/`; the ~9 min build in 0.1 was warm, and a cold
  `Library/` import is far worse. Publishing builds from the working Starfire
  checkout is the assumption; if that ever moves to a clean builder, the import
  cost has to be budgeted then, not assumed away now.

## 5. Open

- Every fork in section 3 is unruled.
- `docs/build-delivery-target.md:11-14` and `:44` both need correcting once F1
  and Cut 1 are ruled; the target currently says builds happen by hand into
  `Build/` (they do not — nothing produces a player) and that Idunn owns this
  deployment (it structurally cannot).
- Follow-up outside this migration: the five stale `A -> 94.130.223.131` DNS rows
  in `gamecult-ops/inventory.md:746,764,771,777,785`.
- Follow-up outside this migration: `CultLib-semver/scripts/check-changelog-semver.mjs`
  is untracked and cites a `docs/semver-policy.md` that does not exist. F3 leans
  on that work; someone should land it there.