Close newspaper once at deadline

This commit is contained in:
Meta Vens 2026-08-29 21:12:18 +02:00
commit 161ff2f190
8 changed files with 1680 additions and 1742 deletions

View file

@ -84,6 +84,7 @@ fn validate_completed_newspaper_recomposition_receipt(
recomposition_schema,
Some("ghostlight.newspaper_wave_recomposition.v1")
| Some("ghostlight.newspaper_wave_recomposition.v2")
| Some("ghostlight.newspaper_wave_recomposition.v3")
) || recomposition["wave_index"].as_u64() != Some(wave_index)
|| wave_index < current_recovery_start_wave as u64
|| recorded_recovery_start_wave == 0
@ -92,9 +93,16 @@ fn validate_completed_newspaper_recomposition_receipt(
|| recomposition["source_campaign_digest"] != source_campaign_digest
|| recomposition["editorial_contract_digest"] != editorial_contract_digest
|| recomposition["issue"].is_null()
|| recomposition["newspaper_grounding"]["accepted"] != true
|| matches!(
recomposition_schema,
Some("ghostlight.newspaper_wave_recomposition.v1")
| Some("ghostlight.newspaper_wave_recomposition.v2")
) && recomposition["newspaper_grounding"]["accepted"] != true
|| recomposition_schema == Some("ghostlight.newspaper_wave_recomposition.v2")
&& recomposition["newspaper_editorial"]["accepted"] != true
|| recomposition_schema == Some("ghostlight.newspaper_wave_recomposition.v3")
&& (recomposition["newspaper_copy_desk"].is_null()
|| recomposition["newspaper_press_close"].is_null())
|| recomposition["issue_file"] != format!("newspaper-wave-{wave_index:02}.md")
|| recomposition["issue_audit_file"] != format!("newspaper-wave-{wave_index:02}.audit.md")
{
@ -146,7 +154,32 @@ fn validate_completed_newspaper_recomposition_receipt(
{
anyhow::bail!("completed wave newspaper recomposition artifact differs from its receipt")
}
if current_schema {
if current_schema && recomposition_schema == Some("ghostlight.newspaper_wave_recomposition.v3")
{
let copy_desk: ghostlight_dungeon::newspaper::WorldNewspaperCopyDeskReport =
serde_json::from_value(recomposition["newspaper_copy_desk"].clone()).map_err(
|error| {
anyhow::anyhow!(
"completed wave newspaper recomposition has an invalid copy-desk report: {error}"
)
},
)?;
let press_close: ghostlight_dungeon::newspaper::WorldNewspaperPressClose =
serde_json::from_value(recomposition["newspaper_press_close"].clone()).map_err(
|error| {
anyhow::anyhow!(
"completed wave newspaper recomposition has an invalid press close: {error}"
)
},
)?;
if recomposition["copy_desk_digest"] != strategic_smoke_digest(&copy_desk)?
|| recomposition["press_close_digest"] != strategic_smoke_digest(&press_close)?
{
anyhow::bail!(
"completed wave newspaper recomposition close evidence differs from its receipt"
)
}
} else if current_schema {
let grounding: ghostlight_dungeon::newspaper::WorldNewspaperGroundingVerdict =
serde_json::from_value(recomposition["newspaper_grounding"].clone()).map_err(
|error| {
@ -1864,8 +1897,8 @@ async fn main() -> anyhow::Result<()> {
.await;
let (
issue,
newspaper_grounding,
newspaper_editorial,
newspaper_copy_desk,
newspaper_press_close,
newspaper_model_receipts,
issue_path,
issue_audit_path,
@ -1890,8 +1923,8 @@ async fn main() -> anyhow::Result<()> {
)?;
(
Some(composition.issue),
Some(composition.grounding),
Some(composition.editorial),
Some(composition.copy_desk),
Some(composition.press_close),
composition.model_receipts,
Some(issue_path),
Some(issue_audit_path),
@ -1941,8 +1974,8 @@ async fn main() -> anyhow::Result<()> {
"plan":plan,
"commit":committed,
"issue":issue,
"newspaper_grounding":newspaper_grounding,
"newspaper_editorial":newspaper_editorial,
"newspaper_copy_desk":newspaper_copy_desk,
"newspaper_press_close":newspaper_press_close,
"newspaper_model_receipts":newspaper_model_receipts,
"newspaper_error":newspaper_error,
"newspaper_reconciliation_checkpoint":newspaper_reconciliation_checkpoint,
@ -2094,21 +2127,21 @@ async fn main() -> anyhow::Result<()> {
std::fs::write(&issue_path, &reader_copy)?;
std::fs::write(&issue_audit_path, &audit_copy)?;
let checkpoint = serde_json::json!({
"schema":"ghostlight.newspaper_wave_recomposition.v2",
"schema":"ghostlight.newspaper_wave_recomposition.v3",
"wave_index":wave_index,
"recovery_start_wave":newspaper_recovery_start_wave,
"world_revision":issue_campaign.revision,
"source_campaign_digest":source_campaign_digest,
"editorial_contract_digest":editorial_contract_digest,
"issue_digest":strategic_smoke_digest(&composition.issue)?,
"grounding_digest":strategic_smoke_digest(&composition.grounding)?,
"editorial_digest":strategic_smoke_digest(&composition.editorial)?,
"copy_desk_digest":strategic_smoke_digest(&composition.copy_desk)?,
"press_close_digest":strategic_smoke_digest(&composition.press_close)?,
"model_receipt_set_digest":strategic_smoke_digest(&composition.model_receipts)?,
"reader_copy_digest":strategic_smoke_bytes_digest(reader_copy.as_bytes()),
"audit_copy_digest":strategic_smoke_bytes_digest(audit_copy.as_bytes()),
"issue":composition.issue,
"newspaper_grounding":composition.grounding,
"newspaper_editorial":composition.editorial,
"newspaper_copy_desk":composition.copy_desk,
"newspaper_press_close":composition.press_close,
"newspaper_model_receipts":composition.model_receipts,
"issue_file":format!("newspaper-wave-{wave_index:02}.md"),
"issue_audit_file":format!("newspaper-wave-{wave_index:02}.audit.md"),
@ -2144,6 +2177,8 @@ async fn main() -> anyhow::Result<()> {
"issue",
"newspaper_grounding",
"newspaper_editorial",
"newspaper_copy_desk",
"newspaper_press_close",
"newspaper_model_receipts",
] {
report.insert(field.into(), recomposition[field].clone());
@ -2316,8 +2351,8 @@ async fn main() -> anyhow::Result<()> {
"event_count":campaign.events.len(),
"news_count":campaign.news.len(),
"newspaper":newspaper_composition.issue,
"newspaper_grounding":newspaper_composition.grounding,
"newspaper_editorial":newspaper_composition.editorial,
"newspaper_copy_desk":newspaper_composition.copy_desk,
"newspaper_press_close":newspaper_composition.press_close,
"newspaper_model_receipts":newspaper_composition.model_receipts,
"newspaper_path":newspaper_path,
"newspaper_audit_path":newspaper_audit_path,
@ -2945,7 +2980,7 @@ mod tests {
}
#[test]
fn current_recomposition_requires_both_review_verdicts_and_rerenders() {
fn v2_recomposition_requires_both_historical_review_verdicts_and_rerenders() {
let issue = ghostlight_dungeon::newspaper::WorldNewspaperIssue {
schema: "ghostlight.world_newspaper_issue.v3".into(),
id: "issue:current".into(),
@ -3074,6 +3109,93 @@ mod tests {
);
}
#[test]
fn v3_recomposition_binds_copy_report_and_press_close_without_a_post_close_verdict() {
let issue = ghostlight_dungeon::newspaper::WorldNewspaperIssue {
schema: "ghostlight.world_newspaper_issue.v3".into(),
id: "issue:v3".into(),
title: "The Canopy Ledger".into(),
edition_label: "Current Edition".into(),
at: chrono::DateTime::parse_from_rfc3339("2026-08-29T00:00:00Z")
.unwrap()
.with_timezone(&chrono::Utc),
source_world_revision: 27,
lead_article_id: None,
editorial_agenda: None,
articles: Vec::new(),
editorial_receipt_ids: Vec::new(),
};
let copy_desk = ghostlight_dungeon::newspaper::WorldNewspaperCopyDeskReport {
assessment: "The copy desk marked no factual queries.".into(),
queries: Vec::new(),
};
let press_close = ghostlight_dungeon::newspaper::WorldNewspaperPressClose {
schema: "ghostlight.world_newspaper_press_close.v1".into(),
source_checkpoint_id: "newspaper-close:fixture".into(),
copy_desk_receipt_id: "sha256:copy".into(),
night_editor_receipt_id: "sha256:night".into(),
night_editor_action_applied: true,
addressed_query_indices: Vec::new(),
changed_article_indices: Vec::new(),
source_page_digest: format!("sha256:{}", "a".repeat(64)),
printed_page_digest: format!("sha256:{}", "a".repeat(64)),
};
let reader_copy = ghostlight_dungeon::newspaper::render_world_newspaper_markdown(&issue);
let audit_copy =
ghostlight_dungeon::newspaper::render_world_newspaper_audit_markdown(&issue);
let receipts: Vec<ghostlight_dungeon::model::ModelStageReceipt> = Vec::new();
let recomposition = serde_json::json!({
"schema":"ghostlight.newspaper_wave_recomposition.v3",
"wave_index":18,
"recovery_start_wave":18,
"world_revision":27,
"source_campaign_digest":"sha256:campaign",
"editorial_contract_digest":"sha256:contract",
"issue_digest":strategic_smoke_digest(&issue).unwrap(),
"copy_desk_digest":strategic_smoke_digest(&copy_desk).unwrap(),
"press_close_digest":strategic_smoke_digest(&press_close).unwrap(),
"model_receipt_set_digest":strategic_smoke_digest(&receipts).unwrap(),
"reader_copy_digest":strategic_smoke_bytes_digest(reader_copy.as_bytes()),
"audit_copy_digest":strategic_smoke_bytes_digest(audit_copy.as_bytes()),
"issue":issue,
"newspaper_copy_desk":copy_desk,
"newspaper_press_close":press_close,
"newspaper_model_receipts":receipts,
"issue_file":"newspaper-wave-18.md",
"issue_audit_file":"newspaper-wave-18.audit.md",
});
validate_completed_newspaper_recomposition_receipt(
&recomposition,
18,
18,
27,
"sha256:campaign",
"sha256:contract",
&reader_copy,
&audit_copy,
)
.unwrap();
assert!(recomposition["newspaper_grounding"].is_null());
assert!(recomposition["newspaper_editorial"].is_null());
let mut changed_close = recomposition.clone();
changed_close["newspaper_press_close"]["night_editor_receipt_id"] =
serde_json::json!("sha256:changed");
assert!(
validate_completed_newspaper_recomposition_receipt(
&changed_close,
18,
18,
27,
"sha256:campaign",
"sha256:contract",
&reader_copy,
&audit_copy,
)
.is_err()
);
}
#[test]
fn completed_wave_newspaper_resume_uses_only_that_waves_committed_news() {
let mut first = strategic_campaign();

File diff suppressed because it is too large Load diff

View file

@ -813,17 +813,16 @@ mod tests {
}
if request.stage == "newspaper_copy_desk" {
return Ok(serde_json::json!({
"accepted":true,
"assessment":"The page is grounded in its cited public report.",
"findings":[]
"queries":[]
})
.to_string());
}
if request.stage == "newspaper_night_editor" {
if request.stage == "newspaper_night_editor_close_agent_action" {
return Ok(serde_json::json!({
"accepted":true,
"assessment":"The page makes its admitted accusation legible and consequential.",
"findings":[]
"tool":"submit_close",
"addressed_query_indices":[],
"rewrites":[]
})
.to_string());
}
@ -851,9 +850,8 @@ mod tests {
"three granary auditors of being one witch in a long coat"
};
return Ok(serde_json::json!({
"accepted":false,
"assessment":"The article states an outcome that its source does not support.",
"findings":[{
"queries":[{
"article_index":0,
"category":"unsupported_fact",
"claim_or_phrase":claim,
@ -862,9 +860,10 @@ mod tests {
})
.to_string());
}
if request.stage == "newspaper_rewrite_desk_agent_action" {
if request.stage == "newspaper_night_editor_close_agent_action" {
return Ok(serde_json::json!({
"tool":"submit_rewrites",
"tool":"submit_close",
"addressed_query_indices":[0],
"rewrites":[{
"article_index":0,
"headline":"Court Auditors Face a Singular Accusation",
@ -1767,31 +1766,33 @@ mod tests {
let receipt_count_before_rejection = successful_receipts.len();
let mut rejected_request = newspaper_request;
rejected_request.title.push_str(" Evening");
let pending = registry
let closed = registry
.compose_world_newspaper(rejected_request, &RejectingRegistryNewspaperModel)
.await
.unwrap();
let crate::newspaper::WorldNewspaperAdvance::Pending {
checkpoint,
model_receipts,
} = pending
else {
panic!("registry must preserve typed pending reconciliation state")
};
assert_eq!(model_receipts.len(), 11);
assert_eq!(checkpoint.generation(), 3);
.unwrap()
.into_accepted()
.expect("the Night Editor must close the marked page once");
assert_eq!(closed.model_receipts.len(), 6);
assert_eq!(closed.copy_desk.queries.len(), 1);
assert!(closed.press_close.night_editor_action_applied);
assert_eq!(closed.press_close.addressed_query_indices, [0]);
assert_eq!(
closed.issue.articles[0].paragraphs[0],
"The inner court has accused three granary auditors of acting as one accused person, placing the allegation into the public record."
);
let stored_after_rejection = runtime.store.keys("persona_stage_receipt.v1").unwrap();
let newly_observed_failure_receipts = model_receipts
let newly_observed_close_receipts = closed
.model_receipts
.iter()
.map(|receipt| receipt.storage_key().to_owned())
.filter(|receipt_id| !successful_receipts.contains(receipt_id))
.collect::<BTreeSet<_>>();
assert_eq!(
stored_after_rejection.len(),
receipt_count_before_rejection + newly_observed_failure_receipts.len()
receipt_count_before_rejection + newly_observed_close_receipts.len()
);
assert!(
model_receipts.iter().all(|receipt| {
closed.model_receipts.iter().all(|receipt| {
stored_after_rejection.contains(&receipt.storage_key().to_owned())
})
);

View file

@ -1328,18 +1328,28 @@ access, and lead selection are therefore not the active blocker; the live
hypothesis is missing editorial-quality acceptance and feedback between agenda
and publication.
Pushed implementation commit
`f8bf73d8c4b2585a6f1757d0624fab0ea721915e` owns contract
`canopy-ledger-night-editor.v7` and is locally verified but not yet
provider-accepted. The independent copy-desk agent remains the sole factual
judge. After factual clearance, the publication-owned Night Editor judges the
page against the admitted agenda and selected facts. A rejection names exact
article passages and achievable editorial goals, then enters the same
publication-owned full-article rewrite path used for factual rejection. Every
revision returns through copy-desk judgment and Night Editor judgment before
acceptance. The Night Editor gains no fact, world, event, selection, or
persistence authority. Gates pass 30/30 focused newspaper tests, 485/485
library tests, and 15/15 strategic-smoke tests.
The completed local worktree owns `canopy-ledger-night-editor.v8` and is
verified but not yet committed or provider-proven. The copy desk emits one
`WorldNewspaperCopyDeskReport` containing its assessment and complete
consequential query set; it is not an accept/reject loop. That query set is
mandatory input to one single-step Night close. The Night Editor must
disposition every query and rewrite every queried article, and may also polish
any unqueried article before deadline. The deterministic press boundary freezes
selection, order, sections, bylines, citations, agenda, source bounds, and
exact lineage, then persists one `WorldNewspaperPressClose` witness binding
source page, printed page, copy receipt, Night receipt, addressed queries, and
changed articles. No model rereads or grades the closed page.
Legacy v7 copy-desk checkpoints, including the Run 58 lineage, can import into
one v8 close checkpoint and invoke only the Night close without replaying
selection, writer, copy desk, world, or waves. Tests prove that import and the
strategic recomposition contract binds copy report plus press witness with no
post-close verdict. Registry fixtures use the same one-report/one-close flow.
Gates pass 20/20 newsroom tests, 475/475 library tests, and 16/16
strategic-smoke tests. Pushed v7 commit
`f8bf73d8c4b2585a6f1757d0624fab0ea721915e` remains provenance. Durable
publication-memory corrections are not implemented by v8 and must not be
inferred from press immutability.
Run 54 exposed one separate upstream publicity defect: a public strategic
activity propagates its channel to private `MemberMemory` outcomes, which is
@ -1348,20 +1358,20 @@ ignore that bookkeeping, but revision 27 remains immutable. Future kernel work
must require an outcome's own observable or communicated public scope before
materializing a `NewsIssue`.
1. Preserve immutable runs 55 through 57 and the exact live services. Stage
exact pushed implementation commit
`f8bf73d8c4b2585a6f1757d0624fab0ea721915e` for immutable Run 58 as a newsroom-only continuation
from run 57's frozen revision-27 campaign and accepted per-wave
publications. Replay no world mechanic or wave; retain and resume typed
rewrite checkpoints.
2. Require internal copy-desk factual acceptance and Night Editor
editorial-quality acceptance, exact newspaper, audit, result, archive,
manifest, provenance, and service-isolation proof, then independent blind
editorial and grounding acceptance. Deliver the actual copy only if both
independent reviews accept.
3. Defer multiple publication Personas, TeX layout, and engraved cuts until the
1. Commit the exact verified v8 worktree and push the resulting commit.
2. Inspect Yggdrasil, the exact live-service identities, and the existing Run
58 root before mutation. Preserve that root, create a new immutable resume
root from its legacy v7 copy checkpoint, and run exactly one v8 Night close
with the complete copy-desk query set as mandatory input.
3. Replay no selection, writer, copy desk, world, or wave work. Require the
deterministic press witness and exact artifact, manifest, provenance, and
service-isolation evidence; that completes and permits delivery of the
edition. External blind editorial and grounding reviews may identify
later-correction work but cannot block delivery or reopen the edition.
4. Keep later corrections as pending publication-memory work.
5. Defer multiple publication Personas, TeX layout, and engraved cuts until the
single Canopy Ledger passes.
4. Per-wave issues may use daily-like reporting windows, while a final
6. Per-wave issues may use daily-like reporting windows, while a final
composition may be an equally current weekly-style issue with a broader
window. Both are selective journalism; broad fact availability increases
editorial freedom and does not license recap voice.

View file

@ -1285,27 +1285,24 @@ The deliberative newsroom boundary is live under this authority map:
selects the facts its actual stories require, and constructs a pointed
narrative without inventing world state or paying for a duplicate source
ontology.
- **Owner:** canonical `NewsIssue` plus `Event` rows own public provenance
and facts. `Event::public_assertion_status` owns attempt, declaration,
- **Owner:** canonical `NewsIssue` plus `Event` rows own public provenance and
facts. `Event::public_assertion_status` owns attempt, declaration,
committed-course, material-outcome, and unspecified-account semantics. The
narrative-selection agent owns story choice, order, focal record, and
framing. The publication writer owns narrative construction in reader-facing
prose: meaning, emphasis, juxtaposition, rhetorical judgment, and clearly
signalled interpretation over the admitted facts. Its deterministic
workbench owns query admission, inspected-record
membership, agenda validation, focus-record dereferencing, the current
candidate agenda, its exact digest, and commit admission. The initial
publication editor owns the first prose proposal. The admitted agenda remains
the sole owner of article selection, order, focus, citation grouping, and
framing. The copy desk owns factual judgment. The Night Editor owns
editorial-quality acceptance and article-specific findings after factual
clearance. The publication rewrite desk owns prose repair for either desk's
rejection, and the shared publication-review primitive owns the fixed review
order: copy desk first, Night Editor second. `WorldKernel` remains the only
world-event writer. Query results, editorial proofs, and both review verdicts
own no world facts.
narrative-selection agent owns assignment: story choice, order, focal record,
exact citation grouping, throughline, tension, and reader question. Its
deterministic workbench owns query admission, inspected-record membership,
agenda validation, focus-record dereferencing, candidate identity, and exact
commit admission. The lead writer owns one complete reader-facing page from
that assignment. The copy desk owns one complete factual query report over
the writer's page; it neither rewrites nor accepts publication. The Night
Editor owns one deadline close over that page and report. The deterministic
press witness owns structural admission, lineage, and exact before/after
evidence for what printed; it does not judge prose. Errors discovered after
close belong to a later edition's correction memory, not a same-edition
repair loop. V8 defines that ownership boundary but does not yet persist a
typed correction record. `WorldKernel` remains the only world-event writer.
- **Inputs:** one exact campaign revision, publication title and voice, article
budget, source-receipt ancestry, and newsroom contract version. Through the
budget, source-receipt ancestry, and v8 newsroom contract. Through the
existing generic agent harness, the selector issues deterministic bounded
queries over stable `NewsIssue` IDs using literal terms, exact asserted
public entity names, assertion statuses, channels, newest/oldest ordering,
@ -1326,15 +1323,20 @@ The deliberative newsroom boundary is live under this authority map:
public question. Article count plus bounded paragraphs and output tokens
define page space. There is no citation-count page budget. A foundational
record may support several continuing stories when each pitch uses it for a
distinct throughline.
distinct throughline. The writer emits one page; the copy desk emits one
assessment plus the complete bounded set of exact factual query passages;
the Night Editor emits one close action; and accepted composition v3 carries
the printed issue, copy report, press-close witness, and exact receipt chain.
- **Derived state:** public-record projections contain their stable ID,
timestamp, channel, headline, reliability, exact committed accounts,
assertion statuses, committed event IDs, and only those people,
institutions, populations, places, and identity attributes asserted by the
account. Query pages, the visible-ID set, pending agenda, candidate digest,
front-page proof, review questions, and late reader-facing citation numbers
are transparent derived views. They are not persisted newsroom subjects,
fact bundles, relevance authorities, factual verdicts, or event writers.
are transparent derived views. The query-index set, query-bearing article
set, changed-article set, source-page digest, printed-page digest, and
receipt-chain digest are also derived. None is a persisted world subject,
fact bundle, relevance authority, prose judge, or event writer.
- **Editorial path:** the selector must inspect a record before citing it. It
can search backward from routine updates to the original rupture and can
acknowledge that later handling is an installment in a continuing story.
@ -1348,86 +1350,82 @@ The deliberative newsroom boundary is live under this authority map:
each article on its focus record's consequential fact, and may not widen or
regroup the selection. Record bookkeeping, memory retention, maintained
warnings, and procedure are not automatically the lede merely because they
are recent. The copy desk, Night Editor, and publication rewrite desk see the
same selected-record projection.
- **Review and grounding path:** accepted stable IDs lower once into the existing
are recent. The writer, copy desk, and Night Editor see the same
selected-record projection.
- **Desk and press path:** accepted stable IDs lower once into the existing
self-contained semantic audit with source news IDs, channels, reliability,
exact account text, assertion status, event IDs, supported identity
attributes, institutions, populations, and places. Reader-facing numeric
labels are assigned only during lowering. The copy desk first judges every
concrete reader-facing claim against those exact cited records. Only a
factually accepted page reaches the Night Editor, which judges whether the
page makes the admitted throughline and strongest honest case legible from
the same selected records. Either desk may reject through one tagged desk
verdict. Rejected copy enters one publication-owned rewrite desk. That agent
receives the rejecting desk's exact findings, frozen selected-record
projection, publication title and house voice, admitted agenda, and current
frozen page. It may
rewrite all reader-facing prose of only the articles named by the findings:
headline, deck, dateline, and paragraphs. Its deterministic workbench merges
only those complete article rewrites into the page, preserves article
selection, order, section, byline, citations, every unaffected article, and
all world state, then invokes the same shared publication review on the whole
resulting page. Acceptance requires both an accepted factual verdict and an
accepted editorial-quality verdict.
labels are assigned only during lowering. The copy desk reads the selected
fact projection and writer page exactly once, returning all factual queries
at once as exact unique passages with reasons. The immutable close checkpoint
binds that report, page, agenda, task, sources, and receipts before the Night
Editor acts. The Night Editor receives the assignment, selected facts, page,
and numbered query list, then gets one action to disposition every query and
provide complete replacement prose for each queried article. In that same
close it may optionally replace any other article to sharpen its headline,
lede, throughline, rhythm, or ending. The press workbench freezes article
selection, order, section, byline, citations, and agenda while allowing prose
replacement across any existing article. It validates structure and source
membership, not whether the final language is true or compelling. A structurally invalid
close exhausts the one action and prints the checkpointed writer page with an
explicit non-applied close witness. There is no post-close model reread.
- **Invariants:** private events do not enter the query surface; every selected
stable ID resolves at the bound revision; article facts remain constrained to
selected records; story order, selection, citation grouping, and focus remain
agenda-owned; no proposal can become editor input without one intervening
deterministic proof observation
and an exact-current-digest commit; omitted public facts remain true; query,
proof, editing, factual review, editorial-quality review, and rewrite cannot
mutate the world; the rewrite
desk cannot change an unaffected article or retain a rejected article by
editing around one phrase; resume does not rerun selection or initial
editing. If the admitted selection and citations cannot support an honest
article, the edition remains rejected or pending; article deletion, source
widening, and agenda mutation are not repair paths.
stable ID resolves at the bound revision; story order, selection, citation
grouping, and focus remain agenda-owned; no proposal reaches the writer
without deterministic proof observation and exact-current-digest commit;
omitted public facts remain true; assignment, writing, copy queries, close,
lowering, and witness creation cannot mutate the world. There is one writer
pass, one copy report, and one admitted Night Editor close. No model verdict
rereads the printed page, no rejected close opens an iterative rewrite loop,
and no external evaluation can reopen an immutable edition. The witness must
preserve exact source and printed page digests, receipt ancestry, every query
disposition, every changed article index, and deterministic re-derivation of
the printed issue.
- **Forbidden writers:** the selector and query workbench cannot create,
mutate, deduplicate, summarize into, or reclassify `NewsIssue` or `Event`
state. The deterministic proof cannot rank stories or commit an agenda; it
exposes the model's proposed ordering against exact focus facts. A proposal
cannot bypass review by returning as accepted output, and a missing or stale
candidate digest cannot commit. The editor cannot widen the admitted record
set. The copy desk cannot rewrite prose. The rewrite desk cannot select or
delete articles; reorder them; change section, byline, citation membership,
agenda, findings, facts, title, or house voice; rewrite an article absent from
the rejected verdict; persist checkpoints; or accept its own copy. The copy
desk cannot decide whether accurate prose is compelling journalism. The
Night Editor cannot relitigate factual grounding, demand facts absent from
the selection, select stories, rewrite prose, or accept its own requested
repair. Caches and renderers cannot decide record equivalence, assertion
status, story
relevance, or fact completion. The newspaper module has no second event-kind
status switch.
set or write a second page. The copy desk cannot rewrite, suppress, or accept
prose, select stories, close the press, or withhold the complete query set for
a later pass. The Night Editor cannot widen sources, add, remove, or reorder
stories, alter sections, bylines, citations, or agenda, invoke another model
judge, or reopen a completed close. The Night Editor may change the
reader-facing prose of any existing article during that one close, but every
copy-query-bearing article is mandatory. The press witness cannot certify
factual or editorial quality; it can only prove the exact admitted process and
bytes.
Renderers, strategic smoke, Registry, external blind reviewers, and grounding
reviewers cannot write the page, desk report, close, correction, world state,
or acceptance state. Caches cannot decide record equivalence, assertion
status, story relevance, or fact completion.
- **Shared paths:** fresh composition queries stable records, proposes one or
more agendas, observes the deterministic front-page proof for each proposal,
and commits exactly one current candidate before invoking the editor. Editor,
copy desk, Night Editor, lowering, audit, and rewrite desk all dereference
that committed agenda's same stable IDs. Initial editor output and every
merged rewrite call the same `run_publication_review` primitive: the copy
desk runs first, and only factual acceptance reaches the Night Editor. On
either rejection, both fresh and resumed paths derive the affected article
set from the exact tagged verdict, invoke the same rewrite desk with the same
frozen facts, title, house voice, and agenda, merge the complete rewrites
through the same deterministic workbench, and return through that same
two-desk review primitive. Resume reconstructs the selected projection from
the checkpointed committed agenda and bound ledger without replaying
selection, proof, commit, or initial editing. Accepted-composition
idempotence returns the stored issue.
- **Persistence and compatibility:** reconciliation checkpoint v3 binds the
agenda, draft, tagged rejecting-desk verdict, task and exact editorial
bindings, immutable receipt
chain, generation, and parent. The internal contract is
`canopy-ledger-night-editor.v7`; it prevents pre-cut compositions and
checkpoints from winning current idempotence. Candidate
agendas and proofs are ephemeral within one bounded selector run; only the
committed agenda and its ordered model-receipt ancestry cross into editor and
reconciliation persistence. Public issue schema v3 remains unchanged.
Accepted composition envelope v2 stores both factual and editorial verdicts,
and current idempotence requires both to be accepted. The read-only `angle`
alias and empty legacy `focus_citation` default can decode historical rows
but cannot authorize a fresh v7 compose.
and commits exactly one current candidate before invoking the writer. Fresh
work then follows one path: writer, copy report, immutable close checkpoint,
one Night Editor action, deterministic press witness, lowering, persistence.
Registry, live per-wave composition, missing-issue recovery, and final digest
all delegate to `advance_world_newspaper`. Resume begins from the immutable
close checkpoint and does not rerun assignment, writer, or copy desk. A
persisted composition is revalidated against its close checkpoint and exact
stored receipts, then returned without model work.
- **Persistence and compatibility:** the live internal contract is
`canopy-ledger-night-editor.v8`. Close checkpoint v1 binds the assigned agenda,
writer page, single copy report, task and exact editorial bindings, source
checkpoint when present, and immutable receipt chain. Composition v3 stores
the printed issue, copy report, press-close witness, and receipts. Public issue
schema v3 remains unchanged. Candidate agendas and front-page proofs remain
ephemeral. V7 reconciliation checkpoint v3 is read-only resume provenance:
an explicit external import may materialize the exact immutable Run 58 copy
tip once, but v8 never appends to or advances that chain. Only a v7 tip whose
rejecting owner is the copy desk can become one v8 close checkpoint; its
draft, agenda, query report, bindings, and receipt ancestry must validate
exactly. A v7 Night Editor rejection fails closed rather than being recast as
copy evidence. Run 58's v7 copy tip is imported into one v8 Night Editor
close without replaying ledger queries, agenda selection, writer, copy desk,
world mechanics, strategic waves, or accepted per-wave publications.
- **Cut line:** `NewsroomSource`, transient ordinal selection IDs, fact-bundle
deduplication, fixed newest-32/preceding-12/foundational-12 windows,
per-story and total citation ceilings, global record uniqueness across
@ -1436,38 +1434,37 @@ The deliberative newsroom boundary is live under this authority map:
structurally valid proposal is insufficient authority to invoke the editor.
Phrase replacements, finding references, target-field and
paragraph addressing, byte-span resolution, overlap ordering, empty-phrase
deletion, and article deletion are deleted. No compatibility path may retain
any of those operations as an alternate writer. The copy-desk-only
acceptance path is deleted: no initial draft or rewritten page can lower into
an accepted composition without both desk verdicts. Complete rejected-article
prose is the rewrite unit, and the admitted agenda plus deterministic merge
remains the owner of everything around it.
deletion, and article deletion remain absent. V8 additionally deletes the
publication-review verdict union, editorial-quality verdict, generic rewrite
desk, bounded multi-action rewrite cadence, repeated copy-desk calls, Night
Editor rereview, reconciliation advancement, and pending-as-editorial-state
path. No compatibility path may retain those operations as live writers.
Whole-article prose is the sole Night Editor close unit. Query-bearing
articles are mandatory, any other existing article is optional, and the
admitted agenda plus deterministic close merge owns everything around them.
Query projection and front-page proof reuse the generic agent harness and
existing public-record, agenda, accepted issue, and audit shapes. No
dependency, crate, binary, daemon, persistent schema, service, cache, event
writer, target platform, code-generation path, or world-simulation pass was
added.
- **Verification and build budget:** focused newspaper tests cover query
admission, stable-record selection, foundational retrieval, reuse across
stories, absence of a fixed source-count ceiling, proposal as a nonterminal
observation, exact focus-record proof, exact-current-digest commit, common
editor/copy/audit/rewrite-desk dereferencing, receipt ancestry, and resume.
Negative checks prove that an unreviewed or stale candidate cannot become
accepted agenda output. The rewrite-desk gates prove that only
rejected article indexes are writable; every rejected article is supplied as
one complete reader-facing rewrite; article count, order, section, byline,
citations, agenda, and unaffected article bytes survive unchanged; old
finding-ref/span/delete commands are absent from schemas and code; malformed,
partial, duplicate, unknown, or unaffected-article rewrites are rejected;
the same whole-page two-desk review judges every initial and merged draft;
Night Editor findings target one exact unique passage and an achievable
rewrite goal without widening the selected facts; exact-chain resume
reaches that same workbench without the initial editor; and no world event or
campaign revision changes. Verification remains bounded to the existing
newspaper library and strategic-smoke targets plus formatting, state, and
system-map gates; the current focused gates pass at 30/30 newspaper tests,
485/485 library tests, and 15/15 strategic-smoke tests. The cut adds no
service, crate, dependency, event authority, or simulation pass.
- **Verification and build budget:** focused newspaper tests retain query
admission, exact focus proof, agenda commit, selected-record alignment, and
audit grounding. V8 gates prove one complete copy report, exact unique query
targets, one Night Editor action, complete query disposition, mandatory
rewrites for query-bearing articles, optional polish of any other article,
preservation of assignment-owned structure and citations, no post-close copy
or editorial stage, deterministic source/printed digests,
exact receipt ancestry, close-checkpoint resume without writer or copy replay,
idempotent persisted-composition validation, printing the checkpointed page
after a structurally rejected close, and conversion of one legacy v7 copy tip
into one v8 close without replay. Strategic recomposition v3 binds the copy
report and press witness by digest while v1/v2 remain historical validation
inputs. Independent blind editorial and grounding reviews evaluate the
resulting artifact for the acceptance experiment only; they are deliberately
outside runtime publication authority. Verification remains bounded to the
existing newspaper library and strategic-smoke targets plus formatting,
state, and system-map gates. The cut adds no service, crate, dependency,
event authority, or simulation pass.
Run 54 is immutable mechanically complete evidence at exact source
`01581b8576774f370884e331558605e7ef5e1b9b`, implementation
@ -1491,149 +1488,79 @@ or communicated public scope before `NewsIssue` materialization. Revision 27
remains immutable evidence and is not rewritten for this newsroom-only
acceptance.
The resumable composition and publication-review rewrite boundary is live:
The v8 close persistence and legacy-resume boundary is live:
- **Owner:** `newspaper::advance_world_newspaper` is the single composition,
checkpoint-advance, resume, and accepted-composition owner. `CampaignStore`
owns immutable storage only. Registry and the strategic driver supply policy
inputs and consume `WorldNewspaperAdvance::{Accepted, Pending}`; neither
reconstructs the workbench or decides editorial state. The publication-owned
rewrite desk proposes complete reader-facing prose for rejected articles
only. Its deterministic workbench owns affected-article membership, frozen
field preservation, merge, local structural validation, and reinvocation of
the shared publication review. The copy desk alone accepts or rejects factual
grounding; the Night Editor alone accepts or rejects editorial quality after
grounding passes. The same rewrite desk handles the tagged rejection from
either owner and cannot accept its own result.
- **Inputs:** one exact `Campaign` snapshot, title, editorial voice, article
budget, model port, and `CampaignStore`. A publication-task binding covers
campaign id and revision plus title, voice, and budget. The editorial binding
additionally covers the exact ordered public-record projections derived from
the bound `NewsIssue` and `Event` ledger. Each rewrite action receives the
admitted agenda, current frozen page, complete exact rejecting-desk verdict,
selected frozen facts, publication title, and house voice.
This lets the owner find the task's checkpoint chain while still rejecting
same-task source drift before inference.
- **Outputs:** acceptance is one immutable persisted composition containing an
accepted factual verdict and an accepted editorial-quality verdict. A still
rejected page is typed `Pending`, carrying the current immutable checkpoint
and complete ordered receipt chain; pending is not a
`WorldNewspaperCompositionFailure`. Fatal model, schema, local-validation,
persistence, and checkpoint-conflict errors remain failures and leave the
last admitted checkpoint available. A rewrite proposal contains exactly one
complete reader-facing prose replacement for every rejected article and none
for any other article. The workbench emits a merged full-page draft only
after preserving the frozen fields and unaffected articles.
- **Persistent and derived state:** the initial review rejection persists its
narrative-selection, editor, copy-desk, and, when factual review passed,
Night Editor receipts, then publishes generation zero before any rewrite
action. Each later rejected action persists its new receipts before
appending one checkpoint with task and editorial bindings, generation,
parent id, typed origin, admitted editorial agenda, current private draft,
tagged rejecting-desk verdict, ordered receipt ids, and receipt-chain digest.
Checkpoint v3 verifies that the latest review receipt matches the desk named
by that rejection. The rejected article-index set, per-article rewrite schema,
immutable-field comparison, selected fact projection, and chain tip are
derived and validated; they are not parallel state owners. Each persisted
verdict is also validated so acceptance is true exactly when its finding set
is empty.
Three actions per call remain only the current
advance cadence. Reaching that boundary returns `Pending` and does not make
rejection terminal.
- **Resume and idempotence:** every call checks the accepted composition marker
before checkpoint discovery. Otherwise it loads the unique checkpoint tip,
reloads every typed receipt, validates checkpoint identity, task and exact
editorial bindings, generation and parent links, strict receipt-prefix
growth, agenda admission and editor alignment, draft, tagged rejecting-desk
verdict, rejecting-desk receipt, and rejected article membership, then
reconstructs the same rewrite workbench. A
resumed action
includes the checkpoint id and every prior receipt in its causal ancestry and
never invokes the initial editor. Acceptance persists its receipts and a
composition-v2 envelope linked to the source checkpoint only when both
review verdicts accept;
later calls return that composition without model work even though the
historical pending chain remains immutable.
- **Forbidden writers:** the initial editor, rewrite desk, copy desk, and Night
Editor may propose, rewrite, or judge only within their named seams and cannot
persist or resume reconciliation state. The copy desk cannot own editorial
quality; the Night Editor cannot own factual admission or prose; neither may
bypass the other. The rewrite desk cannot alter article count,
selection, order, section, byline, citations, agenda, unaffected articles,
findings, facts, world state, or acceptance. Registry, strategic smoke,
renderers, JSON result/checkpoint projections, world cells, Nemesis, clocks,
and `WorldKernel` cannot write the draft, verdict, receipt chain, checkpoint,
or accepted composition. They cannot replay world mechanics or overwrite an
already accepted issue to repair editorial copy.
- **Shared paths:** Registry calls `advance_world_newspaper` directly. Strategic
live per-wave, missing-issue recovery, and final-combined composition use a
thin `compose_persisted_newspaper` delegate to that same owner and store. All
entry paths use the same initial-or-resumed rewrite workbench and the same
ordered copy-desk-then-Night-Editor review primitive. A
pending interim issue is recorded in its immutable wave report and does not
stop later strategic waves; recovery resumes it from `CampaignStore`. A
pending final combined issue writes pending result/status projections and
ends that acceptance invocation nonzero without changing the world.
- **Legacy import boundary:** Run 46 may enter only through the explicit typed
`WorldNewspaperReconciliationImport` and strategic import envelope. The
envelope binds wave, recovery boundary, and world revision; the common
library validator rebinds the witness to the exact prepared task and desk,
validates its draft, rejected verdict, and typed receipts, and admits it as a
generation-zero `LegacyTerminalImport`. An existing accepted composition or
different checkpoint tip rejects the import. No live path parses failure
prose, infers a checkpoint from JSON error text, or falls back to a fresh
editor after a configured import fails admission.
- **Cut line:** the newspaper path uses the agent harness's typed
`ModelAgentProgress::Exhausted` result; the older generic harness API may still
lower exhaustion to failure for non-resumable consumers, but it no longer
owns newspaper correctness. The bounded rewrite cadence is
`REWRITE_DESK_ACTIONS_PER_ADVANCE`. Registry's separate
receipt-persistence/failure path is gone, and the strategic persistence
helper is only a delegate rather than a second composition owner. The
phrase-edit command algebra, finding reference catalog, field and
paragraph target resolution, byte ranges, overlap ordering, whitespace seam,
and article-delete branch before adding the rejected-article rewrite command.
None remains as a compatibility writer. Copy-desk acceptance is no longer
publication acceptance, and no second rewrite mechanism was added for Night
Editor findings.
- **Verification layer:** focused tests prove typed harness exhaustion,
generation zero plus one append per rejected rewrite, typed pending after
three `REWRITE_DESK_ACTIONS_PER_ADVANCE`, exact-chain resume without the
initial editor, cumulative
receipt and review ancestry, accepted-composition idempotence without
inference, same-task source-drift rejection and fork rejection before
inference, typed legacy import through the common validator, and Registry
preservation of pending state. Implemented negative tests require the exact
set of rejected article indexes, reject missing, duplicate, unaffected, and
out-of-range article rewrites, and preserve each unaffected article plus the
rewritten article's section, byline, and citations. The provider schema
exposes only the rejected article-index enum and complete headline, deck,
dateline, and paragraph fields; it exposes no section, byline, citations, or
finding reference. Focused path tests prove the same selected records, title,
house voice, agenda, and exact findings reach the desk; initial drafts and
merged rewrites use the same ordered publication review; a copy-desk
rejection skips the Night Editor, while factual acceptance must still obtain
Night Editor acceptance; a Night Editor rejection returns through the same
full-article rewrite path; repeated rejection may invoke another whole
rewrite without another initial editor; exact-chain resume preserves receipt
ancestry; and accepted output retains the admitted source IDs plus both
verdicts. Strategic recomposition receipt v2 binds and validates both verdict
digests while historical receipt v1 remains readable evidence. No event,
world-simulation, selector, agenda, or source-provenance authority moved.
- **Owner:** `newspaper::advance_world_newspaper` owns fresh composition,
close-checkpoint resume, legacy-tip conversion, press witnessing, and
accepted-composition idempotence. `CampaignStore` owns immutable storage.
Registry and strategic smoke provide policy inputs and consume results; they
do not reconstruct or judge the newsroom.
- **Inputs:** one exact campaign snapshot, title, voice, article budget, model
port, and store; the current v8 publication and editorial bindings; and,
during the bounded transition, an optional exact v7 reconciliation tip under
its legacy bindings. The close receives one agenda, one writer page, one copy
report, and their complete ordered receipts.
- **Outputs:** a nonempty edition yields composition v3 with one issue, one copy
report, one `WorldNewspaperPressClose`, and the receipt chain. A close action
that passes structural admission records every query and changed article. A
structurally rejected one-action close prints the checkpointed page and marks
`night_editor_action_applied=false`; it does not become pending editorial work.
Provider, schema, persistence, or checkpoint-integrity failures remain errors
before an immutable composition exists.
- **Persistent and derived state:** close checkpoint v1 persists once before the
Night Editor acts. The press witness derives exact source and printed page
digests, copy and Night Editor receipt IDs, action-applied status, addressed
query indices, and changed article indices. Composition validation reloads
every receipt, validates checkpoint lineage, reconstructs the printed draft,
re-derives the typed issue, and rejects any drift. These witnesses observe the
edition; they do not make its claims true.
- **Resume and shared paths:** every caller checks accepted composition v3,
resumes one current close checkpoint if present, then optionally converts the
unique validated v7 copy tip into one v8 close checkpoint. That conversion
retains the v7 tip's exact draft, agenda, copy findings, source identity, and
receipts while rebinding only the current task. It never invokes assignment,
writer, copy desk, mechanics, or waves. Fresh work reaches the same close
owner after assignment, writer, and copy. Live per-wave, recovery, and final
combined publication all use the thin common delegate.
- **Forbidden writers:** v8 cannot append a v7 reconciliation generation or
resume its rewrite loop. An explicit import may admit one external immutable
v7 checkpoint as provenance, but cannot infer it from error prose, fork an
existing chain, or mutate it after admission. Strategic smoke, renderers,
reviewers, and world organs cannot alter a close checkpoint, press witness,
accepted issue, or source campaign. A later correction must be new
publication state; overwriting the closed edition is forbidden.
- **Cut line:** the rewrite-desk cadence, repeated desk verdicts, pending
reconciliation advances, and copy/editor rereplay paths are absent from live
v8 authority. `WorldNewspaperAdvance::Pending` and its consumer branches
remain compatibility-shaped surface only; the v8 newspaper owner has no
pending producer. Legacy v7 schemas remain solely to validate and convert the
Run 58 copy tip.
- **Verification layer:** focused tests prove one-action close admission,
structural rejection printing the bound source page, exact press-witness
re-derivation, tamper rejection, close resume without writer or copy replay,
accepted-composition idempotence, and exact Run-58-shaped v7 copy-tip
conversion into one v8 Night Editor close. Negative gates reject incomplete
query disposition, missing mandatory or duplicate article rewrites, mutation
of frozen assignment fields, v7 Night Editor rejection masquerading as copy
evidence, multiple close checkpoints, source drift, receipt drift, and witness
drift. No event,
simulation, selector, agenda, or provenance authority moved.
The typed issue retains exact event IDs, channels, reliability, source
revision, and model receipts as audit data. Its internal issue time is derived
from the latest cited publication record without exposing that clock to
editorial inference. Rejected action attempts semantically rebind their
otherwise immutable model receipts to collision-free invalid dispositions
before checkpoint admission. The top-level strategic plan, receipt hash, and
commit always project the final completed wave, matching the top-level counts
and persisted campaign head; per-wave history remains under `waves`. The reader
otherwise immutable model receipts to collision-free invalid dispositions; a
structurally rejected deadline action prints the already checkpointed source
page instead of creating another editorial turn. The top-level strategic plan,
receipt hash, and commit always project the final completed wave, matching the
top-level counts and persisted campaign head; per-wave history remains under
`waves`. The reader
renderer has no path to provenance fields and escapes all model- and
consumer-supplied plain text before Markdown emission; the provenance renderer
applies the same plain-text boundary to its audit data. Neither editor, rewrite
desk, copy desk, Night Editor, renderer, nor receipt persistence can write
world state.
applies the same plain-text boundary to its audit data. Neither assignment
editor, writer, copy desk, Night Editor, renderer, nor receipt persistence can
write world state.
#### Acceptance-driver per-wave newspaper recovery
@ -1652,21 +1579,19 @@ world state.
already exists, its immutable receipt and exact named reader/audit files are
additional inputs.
- **Output:** acceptance writes one separately named immutable recomposition
checkpoint containing the issue, grounding verdict, editorial verdict, and
checkpoint containing the issue, copy report, press-close witness, and
newspaper model receipts, plus the rendered reader and audit files. Its
receipt binds the
narrowed source campaign, recovery boundary, title/voice/article-budget
contract, issue, model-receipt collection, expected filenames, and both
rendered byte streams by digest. Current recomposition v2 receipts bind the
complete typed grounding and editorial verdicts by digest. The configured
rendered byte streams by digest. Current recomposition v3 receipts bind the
complete typed copy report and press-close witness by digest. The configured
boundary is also
projected through run status and success or failure result artifacts. The
driver fills only the missing newspaper fields in its in-memory result
projection. Pending reconciliation
instead writes an immutable diagnostic projection of the library-owned
checkpoint and stops that recovery invocation; canonical resume state remains
in `CampaignStore`. Existing successful issues and original wave checkpoints
remain unchanged.
projection. A pre-close provider or integrity failure stops that invocation;
canonical close state remains in `CampaignStore`. Existing successful issues
and original wave checkpoints remain unchanged.
- **Derived state:** the newsroom receives a clone of the completed wave's
campaign whose news ledger is narrowed to rows appended since the preceding
committed boundary. All events and canonical names remain available only so
@ -1682,22 +1607,21 @@ world state.
issue when a later invocation selects a narrower range.
- **Forbidden writers:** recovery cannot rerun a strategic tick, Nemesis,
simulation cells, outcome resolution, clocks, or `WorldKernel`, and it cannot
alter campaign, event, or news state. Pending or failed recomposition stops
consumer recovery and cannot repair mechanics.
alter campaign, event, or news state. Failed recomposition stops consumer
recovery and cannot repair mechanics.
- **Shared paths:** live per-wave composition, recovery composition, and final
combined composition all call the thin `compose_persisted_newspaper` delegate
into `advance_world_newspaper`, including the same ordered factual and
editorial review, checkpoint-resume, and receipt-persistence owner. A later
resume advances a
pending library checkpoint without rerunning the editor. Once accepted, it
into `advance_world_newspaper`, including the same assignment, writer, single
copy report, one deadline close, checkpoint-resume, and receipt-persistence
owner. A later invocation resumes a close checkpoint without rerunning the
writer or copy desk. Once printed, it
consumes the successful recomposition artifact instead of paying for the
newspaper again. The driver recomputes its wave, source-campaign, and
editorial-contract bindings, validates the recorded original recovery
boundary, and checks the exact issue value, typed model-receipt set, reader
bytes, and audit bytes against their immutable digests. A current-schema issue
and grounding verdict are additionally deserialized, their grounding digest
is required, and the issue is rendered again. Current recomposition v2 also
deserializes the accepted editorial verdict and requires its exact digest. A
is deserialized and rendered again. Current recomposition v3 also deserializes
the copy report and press-close witness and requires their exact digests. A
historical v2 accepted issue
is structurally deserialized only as v2 and is not reinterpreted through the
current issue type or renderer; its original receipt owns those historical
@ -1712,9 +1636,10 @@ world state.
Raw digest verification is not a migration path and cannot create, repair, or
reaccept a paper: all applicable original source, contract, filename, issue,
receipt-set, and byte bindings must already be present and exact. Current
issue v3 requires its exact grounding digest, and recomposition v2 additionally
requires exact editorial acceptance and digest; historical issue v2 keeps the
explicitly bounded accepted-status plus archive/manifest proof described above.
recomposition v3 requires exact copy-report and press-close digests;
historical recomposition v1/v2 retains its bounded grounding/editorial
validation, and historical issue v2 keeps the explicitly bounded
accepted-status plus archive/manifest proof described above.
Strategic state and per-wave artifacts remain forbidden writers.
- **Verification layer:** the focused boundary regression proves that a second
wave is recomposed from only its newly appended news row while retaining the
@ -1729,9 +1654,10 @@ world state.
skipped while later missing issues are selected. Dedicated regressions prove
that historical v2 preserves its recorded original recovery boundary and
accepts exact historical bytes without current rendering while rejecting byte
drift, that current issue v3 still requires typed deserialization, exact
rendering, and an exact grounding digest, and that current recomposition v2
rejects editorial-verdict drift. The strategic binary gate is 15/15.
drift, that current issue v3 still requires typed deserialization and exact
rendering, and that current recomposition v3 rejects copy-report or press-close
witness drift. Historical recomposition v1/v2 validation remains bounded to
its original verdict shapes.
The first-wave limit is now an explicit closed boundary rather than inferred
recovery: when wave one is selected, the driver refuses to compose without a

View file

@ -227,4 +227,5 @@
{"note": "Run 54 at source 3288d9e resumed revision 27 with 18/18 waves, 363 events, and 853 news without simulation replay, then exhausted narrative selection after both exact archive retrievals and an overfull agenda rejection. The three-step budget left no action in which the same agent could obey the deterministic six-citation news-hole finding.", "status": "blocked", "ts": "2026-08-29T12:18:17+00:00", "type": "verification"}
{"note": "The existing newsroom selector now has one bounded corrective action after spending both archive retrievals; the six-citation news hole is unchanged. A regression proves preceding_recent retrieval, foundational retrieval, rejected eight-citation agenda, and corrected six-citation agenda in one agent run. Gates pass 26/26 newspaper, 481/481 library, and 15/15 strategic-smoke tests.", "status": "ok", "ts": "2026-08-29T12:18:18+00:00", "type": "implementation"}
{"note": "Query-backed Canopy Ledger newsroom cut: canonical NewsIssue plus Event rows now own public facts and stable record IDs; the generic agent harness provides bounded deterministic ledger queries; selector, editor, copy desk, audit, and reconciliation share those stable IDs; numeric citations are late display labels. Removed NewsroomSource packet authority, fact-bundle deduplication, fixed archive windows, citation-count ceilings, cross-story record uniqueness, and the newspaper-local event-kind status switch. Deterministic admission rejects ambiguous ledger IDs and duplicate IDs within persisted agenda or draft groups. Verified 28/28 focused newspaper, 483/483 library, and 15/15 strategic-smoke tests before final formatting pass. Independent Modeling review confirmed the cut and isolated the remaining MemberMemory publicity defect to the kernel; revision 27 and run 54 remain immutable.", "status": "ok", "ts": "2026-08-29T14:06:49+00:00", "type": "implementation"}
{"ts": "2026-08-29T14:58:39+00:00", "type": "implementation", "status": "ok", "note": "Exact commit c34c4b1f94706661cdc35d5314ea23347bda6fd7 replaces direct newsroom agenda acceptance with query, proposal, deterministic front-page proof, and exact-current-digest commit. The publication writer owns narrative construction over admitted facts; the independent copy desk owns factual judgment. Focused newspaper 28/28, library 483/483, and strategic smoke 15/15 pass, including rejection of unreviewed and stale candidates; no world simulation or persistent schema was added."}
{"note": "Exact commit c34c4b1f94706661cdc35d5314ea23347bda6fd7 replaces direct newsroom agenda acceptance with query, proposal, deterministic front-page proof, and exact-current-digest commit. The publication writer owns narrative construction over admitted facts; the independent copy desk owns factual judgment. Focused newspaper 28/28, library 483/483, and strategic smoke 15/15 pass, including rejection of unreviewed and stale candidates; no world simulation or persistent schema was added.", "status": "ok", "ts": "2026-08-29T14:58:39+00:00", "type": "implementation"}
{"ts": "2026-08-29T19:12:02+00:00", "type": "implementation", "status": "ok", "note": "Newsroom contract v8 replaces the v7 copy/Night accept-reject tribunal and iterative rewrite loop with one complete copy-desk query report, one max_steps=1 Night Editor close, and a deterministic press witness. Every queried article must be rewritten; unqueried articles may receive optional deadline polish while selection, order, sections, bylines, citations, and agenda stay frozen. Exact v7 copy-tip import resumes Run 58 without replaying narrative selection, writer, copy desk, world, or waves. External reviews are post-press evidence rather than vetoes; typed later-correction memory remains pending. Verified 20/20 newspaper, 475/475 library, and 16/16 strategic-smoke tests."}

View file

@ -229,3 +229,4 @@
{"key": "2026-08-29T121818Z0000-0227-a3775f328e5e", "payload": "eyJub3RlIjogIlRoZSBleGlzdGluZyBuZXdzcm9vbSBzZWxlY3RvciBub3cgaGFzIG9uZSBib3VuZGVkIGNvcnJlY3RpdmUgYWN0aW9uIGFmdGVyIHNwZW5kaW5nIGJvdGggYXJjaGl2ZSByZXRyaWV2YWxzOyB0aGUgc2l4LWNpdGF0aW9uIG5ld3MgaG9sZSBpcyB1bmNoYW5nZWQuIEEgcmVncmVzc2lvbiBwcm92ZXMgcHJlY2VkaW5nX3JlY2VudCByZXRyaWV2YWwsIGZvdW5kYXRpb25hbCByZXRyaWV2YWwsIHJlamVjdGVkIGVpZ2h0LWNpdGF0aW9uIGFnZW5kYSwgYW5kIGNvcnJlY3RlZCBzaXgtY2l0YXRpb24gYWdlbmRhIGluIG9uZSBhZ2VudCBydW4uIEdhdGVzIHBhc3MgMjYvMjYgbmV3c3BhcGVyLCA0ODEvNDgxIGxpYnJhcnksIGFuZCAxNS8xNSBzdHJhdGVnaWMtc21va2UgdGVzdHMuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA4LTI5VDEyOjE4OjE4KzAwOjAwIiwgInR5cGUiOiAiaW1wbGVtZW50YXRpb24ifQ==", "stored_at": "2026-08-29T12:18:18.186973+00:00", "type": "ghostlight.evidence_record.v0"}
{"key": "2026-08-29T140649Z0000-0228-6bbe5165609b", "payload": "eyJub3RlIjogIlF1ZXJ5LWJhY2tlZCBDYW5vcHkgTGVkZ2VyIG5ld3Nyb29tIGN1dDogY2Fub25pY2FsIE5ld3NJc3N1ZSBwbHVzIEV2ZW50IHJvd3Mgbm93IG93biBwdWJsaWMgZmFjdHMgYW5kIHN0YWJsZSByZWNvcmQgSURzOyB0aGUgZ2VuZXJpYyBhZ2VudCBoYXJuZXNzIHByb3ZpZGVzIGJvdW5kZWQgZGV0ZXJtaW5pc3RpYyBsZWRnZXIgcXVlcmllczsgc2VsZWN0b3IsIGVkaXRvciwgY29weSBkZXNrLCBhdWRpdCwgYW5kIHJlY29uY2lsaWF0aW9uIHNoYXJlIHRob3NlIHN0YWJsZSBJRHM7IG51bWVyaWMgY2l0YXRpb25zIGFyZSBsYXRlIGRpc3BsYXkgbGFiZWxzLiBSZW1vdmVkIE5ld3Nyb29tU291cmNlIHBhY2tldCBhdXRob3JpdHksIGZhY3QtYnVuZGxlIGRlZHVwbGljYXRpb24sIGZpeGVkIGFyY2hpdmUgd2luZG93cywgY2l0YXRpb24tY291bnQgY2VpbGluZ3MsIGNyb3NzLXN0b3J5IHJlY29yZCB1bmlxdWVuZXNzLCBhbmQgdGhlIG5ld3NwYXBlci1sb2NhbCBldmVudC1raW5kIHN0YXR1cyBzd2l0Y2guIERldGVybWluaXN0aWMgYWRtaXNzaW9uIHJlamVjdHMgYW1iaWd1b3VzIGxlZGdlciBJRHMgYW5kIGR1cGxpY2F0ZSBJRHMgd2l0aGluIHBlcnNpc3RlZCBhZ2VuZGEgb3IgZHJhZnQgZ3JvdXBzLiBWZXJpZmllZCAyOC8yOCBmb2N1c2VkIG5ld3NwYXBlciwgNDgzLzQ4MyBsaWJyYXJ5LCBhbmQgMTUvMTUgc3RyYXRlZ2ljLXNtb2tlIHRlc3RzIGJlZm9yZSBmaW5hbCBmb3JtYXR0aW5nIHBhc3MuIEluZGVwZW5kZW50IE1vZGVsaW5nIHJldmlldyBjb25maXJtZWQgdGhlIGN1dCBhbmQgaXNvbGF0ZWQgdGhlIHJlbWFpbmluZyBNZW1iZXJNZW1vcnkgcHVibGljaXR5IGRlZmVjdCB0byB0aGUga2VybmVsOyByZXZpc2lvbiAyNyBhbmQgcnVuIDU0IHJlbWFpbiBpbW11dGFibGUuIiwgInN0YXR1cyI6ICJvayIsICJ0cyI6ICIyMDI2LTA4LTI5VDE0OjA2OjQ5KzAwOjAwIiwgInR5cGUiOiAiaW1wbGVtZW50YXRpb24ifQ==", "stored_at": "2026-08-29T14:06:49.453283+00:00", "type": "ghostlight.evidence_record.v0"}
{"key": "2026-08-29T145839Z0000-0229-d9ee904c8b40", "payload": "eyJub3RlIjogIkV4YWN0IGNvbW1pdCBjMzRjNGIxZjk0NzA2NjYxY2RjMzVkNTMxNGVhMjMzNDdiZGE2ZmQ3IHJlcGxhY2VzIGRpcmVjdCBuZXdzcm9vbSBhZ2VuZGEgYWNjZXB0YW5jZSB3aXRoIHF1ZXJ5LCBwcm9wb3NhbCwgZGV0ZXJtaW5pc3RpYyBmcm9udC1wYWdlIHByb29mLCBhbmQgZXhhY3QtY3VycmVudC1kaWdlc3QgY29tbWl0LiBUaGUgcHVibGljYXRpb24gd3JpdGVyIG93bnMgbmFycmF0aXZlIGNvbnN0cnVjdGlvbiBvdmVyIGFkbWl0dGVkIGZhY3RzOyB0aGUgaW5kZXBlbmRlbnQgY29weSBkZXNrIG93bnMgZmFjdHVhbCBqdWRnbWVudC4gRm9jdXNlZCBuZXdzcGFwZXIgMjgvMjgsIGxpYnJhcnkgNDgzLzQ4MywgYW5kIHN0cmF0ZWdpYyBzbW9rZSAxNS8xNSBwYXNzLCBpbmNsdWRpbmcgcmVqZWN0aW9uIG9mIHVucmV2aWV3ZWQgYW5kIHN0YWxlIGNhbmRpZGF0ZXM7IG5vIHdvcmxkIHNpbXVsYXRpb24gb3IgcGVyc2lzdGVudCBzY2hlbWEgd2FzIGFkZGVkLiIsICJzdGF0dXMiOiAib2siLCAidHMiOiAiMjAyNi0wOC0yOVQxNDo1ODozOSswMDowMCIsICJ0eXBlIjogImltcGxlbWVudGF0aW9uIn0=", "stored_at": "2026-08-29T14:58:39.567023+00:00", "type": "ghostlight.evidence_record.v0"}
{"key": "2026-08-29T191202Z0000-0230-6b340eadd8d4", "payload": "eyJub3RlIjogIk5ld3Nyb29tIGNvbnRyYWN0IHY4IHJlcGxhY2VzIHRoZSB2NyBjb3B5L05pZ2h0IGFjY2VwdC1yZWplY3QgdHJpYnVuYWwgYW5kIGl0ZXJhdGl2ZSByZXdyaXRlIGxvb3Agd2l0aCBvbmUgY29tcGxldGUgY29weS1kZXNrIHF1ZXJ5IHJlcG9ydCwgb25lIG1heF9zdGVwcz0xIE5pZ2h0IEVkaXRvciBjbG9zZSwgYW5kIGEgZGV0ZXJtaW5pc3RpYyBwcmVzcyB3aXRuZXNzLiBFdmVyeSBxdWVyaWVkIGFydGljbGUgbXVzdCBiZSByZXdyaXR0ZW47IHVucXVlcmllZCBhcnRpY2xlcyBtYXkgcmVjZWl2ZSBvcHRpb25hbCBkZWFkbGluZSBwb2xpc2ggd2hpbGUgc2VsZWN0aW9uLCBvcmRlciwgc2VjdGlvbnMsIGJ5bGluZXMsIGNpdGF0aW9ucywgYW5kIGFnZW5kYSBzdGF5IGZyb3plbi4gRXhhY3QgdjcgY29weS10aXAgaW1wb3J0IHJlc3VtZXMgUnVuIDU4IHdpdGhvdXQgcmVwbGF5aW5nIG5hcnJhdGl2ZSBzZWxlY3Rpb24sIHdyaXRlciwgY29weSBkZXNrLCB3b3JsZCwgb3Igd2F2ZXMuIEV4dGVybmFsIHJldmlld3MgYXJlIHBvc3QtcHJlc3MgZXZpZGVuY2UgcmF0aGVyIHRoYW4gdmV0b2VzOyB0eXBlZCBsYXRlci1jb3JyZWN0aW9uIG1lbW9yeSByZW1haW5zIHBlbmRpbmcuIFZlcmlmaWVkIDIwLzIwIG5ld3NwYXBlciwgNDc1LzQ3NSBsaWJyYXJ5LCBhbmQgMTYvMTYgc3RyYXRlZ2ljLXNtb2tlIHRlc3RzLiIsICJzdGF0dXMiOiAib2siLCAidHMiOiAiMjAyNi0wOC0yOVQxOToxMjowMiswMDowMCIsICJ0eXBlIjogImltcGxlbWVudGF0aW9uIn0=", "stored_at": "2026-08-29T19:12:02.108593+00:00", "type": "ghostlight.evidence_record.v0"}

View file

@ -194,8 +194,8 @@ live_architecture:
- Institution, faction, and consumer decision models
active_subgoals:
- Earn blind fantasy-newspaper acceptance for one good Canopy Ledger publication first: a separately dispatched reviewer receives only the rendered front page under a neutral editorial brief, finds it journalistically plausible, and does not independently identify it as procedural projection; a separate provenance audit confirms every factual claim remains grounded in committed public events. TeX/layout and engraved-cut production begin only after editorial acceptance.
- After the current Canopy Ledger instance earns acceptance, implement the publication-Persona direction admitted in plan commit `4916638`: each publication persists its own audience, remembered beats, narrative memeplex, selective story pickup, recurring throughlines, ideological framing, and rivals; multiple Delvehold publications may interpret the same committed event substrate differently. Grounding constrains factual assertions and provenance without neutralizing legible interpretation, selection, framing, or insinuation. Do not fold this future authority cut into the current acceptance repair or patch it into the fact-check prompt.
- Complete and deliver one Canopy Ledger edition through one mandatory copy report, one deadline-bound Night close, and one deterministic press witness. The copy desk's complete consequential query set is mandatory input to the close; the Night Editor must rewrite every queried article and may polish unqueried articles while selection, order, sections, bylines, citations, and agenda remain frozen. Completion requires exact press, artifact, manifest, provenance, and service-isolation proof. Independent blind editorial and grounding reviews may identify later-correction work but cannot veto delivery or reopen this edition. TeX/layout and engraved-cut production remain downstream.
- After the current Canopy Ledger instance closes with its required press evidence, implement the publication-Persona direction admitted in plan commit `4916638`: each publication persists its own audience, remembered beats, narrative memeplex, selective story pickup, recurring throughlines, ideological framing, rivals, and later corrections; multiple Delvehold publications may interpret the same committed event substrate differently. Grounding constrains factual assertions and provenance without neutralizing legible interpretation, selection, framing, or insinuation. Do not fold this future authority cut into the current press close or patch it into copy-desk prompting.
- Connect a Delvehold-owned adapter to the admitted generic consumer contract: shared compiler/consumer WorldSeed admission, externally authoritative institution-or-Gestalt snapshots, attributed proposal acknowledgement, and committed-event newspaper composition over typed CultNet, without consumer-specific IDs or schemas in Ghostlight.
- Extend strategic/offscreen named-person individuation beyond the proven emerge-then-act path so people plot across sustained political waves, acquire relationships, fold, and return without granting a cell, arena, or model commit authority.
- Pressure the proven 200-cell dispatcher with authored consumer hierarchies and measure provider cost; the active budget ceiling is 240 while provider concurrency remains separately capped at 32.
@ -327,6 +327,6 @@ data_flow:
current_status:
summary: Ghostlight's generic consumer boundary admits sparse WorldSeeds, runs the hundreds-class parallel cell machinery used by Dungeon, and projects grounded newspapers from committed public events. Local acceptance proves 1,000 subjects across 200 cells and two-wave durable named-person emergence. Exact-source provider run 38 at `596e50679244b5d42b4cfdf70d723f815751b8ff` resumed the preserved world at revision 8 without replaying compilation or four committed locality elaborations, recovered 51 of 52 strategic-wave cells on pulse three and the final cell on pulse four, then committed all six waves through revision 14. Pushed commit `3a69306f3004e4af2cd57bba612a6ad8d1b8132f` implements the mapped clock-consequence owner and is verified locally: world clocks own declared consequence text and exact observable scope; a bounded agent may propose legacy scope binding, while `WorldKernel` alone admits it and materializes stable threshold-crossing events and public news through the common mutation path. Binding, emitted-event ancestry, mutation receipts, and the next newspaper boundary persist atomically. Exact-source run 39 resumed run 38 without replaying its six committed waves, bound clock consequences, committed six new waves through revision 21, and emitted Issues 7 through 12 plus a final digest. This completes the mechanical provider acceptance path; all inherited wave 1-6 checkpoint hashes match run 38 exactly and live services were unchanged. Independent blind editorial review returns FAIL: only Issue 7 approaches spicy, while Issues 8-12 are dominated by plans, filings, inspections, warnings, and abstract relationship deltas without betrayal, scandal, public reaction, sustained reversal, or material lived cost. That run-39 diagnosis is superseded for the current phase: run 51 closes the world and reconciliation mechanics, and the active defect belongs to newsroom narrative selection and self-contained semantic provenance over immutable facts. Independent grounding review also returns FAIL: Issue 9 inflates a planned expedited agenda into completion, while Issue 8 assigns unsupported feminine pronouns to Sela Venn and Eryn Tal. Other grounding mechanics pass: 208/208 citations resolve, no future events appear, no replay occurred, the player remained unchanged, all 116/116 manifest entries verify, the archive is exact, and root independently confirmed the live service PIDs and invocation IDs remained unchanged. Editorial and grounding acceptance are terminally failed for run 39. Eight titled elaborators use the generic agent harness under deterministic weighted scheduling, bounded parallelism, and Luna/Terra/Sol routing. Workers remain proposal-only; deterministic admission binds exact frozen schedules, dispatch, receipts, conflicts, and semantic verification, and `WorldKernel` alone owns atomic CultCache persistence. Destination reconciliation is a private transactional workbench, provider schema compatibility is lowered once at the shared model-connector boundary, and durable elaboration and strategic-pulse checkpoints bind to their canonical mutation proofs. The generic ModelAgent harness remains consumer-neutral transport. Provider run 23 remains stopped; earlier failed runs and checkpoint archives remain immutable provenance. The live daemons remain outside the acceptance body. Dungeon play remains regression pressure, the Delvehold game-side adapter remains unimplemented, and unpublished Mars and Kalsa destination previews remain unapproved.
provider_acceptance_checkpoint: Exact-source run 57 at `0c1400985c061c0db44969288846eff79eeed69a`, using rewrite-desk contract v6, is an immutable mechanically complete newspaper-only run over frozen world revision 27 with 18 waves, 363 events, and 853 news rows. Newspaper SHA-256 is `d90758f411193aa6e86ae2e8cb390650d9b8a58eac77ef87018bd61e9a668c57`, audit is `895268bc22aa3e4176b1da31388e85327f0fe11e4ea4ea4ee600b4e3270a8eed`, and archive is `241354b669ee2357c9bb7a06e10e0b93378637621ff2b8b27ab7cf35c2e44e28`. Mechanical grounding accepts. Independent blind editorial review fails: the lead and other stories remain administrative, lived stakes stay abstract, no named accountable Greathold opposition appears, the severed hands are buried without court responses or suspects, and the seed-vault story repeats procedure. The admitted editorial agenda is materially sharper than the rendered copy, so world simulation, ledger access, and lead selection are not the active blocker.
implementation_checkpoint: Pushed implementation commit `f8bf73d8c4b2585a6f1757d0624fab0ea721915e` owns contract `canopy-ledger-night-editor.v7` and is locally verified but not yet provider-accepted. The independent copy-desk agent remains the sole factual judge. After factual clearance, the publication-owned Night Editor judges editorial quality against the admitted agenda and selected facts; a rejection names exact article passages and achievable editorial goals, then enters the same publication-owned full-article rewrite path used for factual rejection. Every revision returns through copy-desk judgment and Night Editor judgment before acceptance. The Night Editor gains no fact, world, event, selection, or persistence authority. Verification passes 30/30 focused newspaper tests, 485/485 library tests, and 15/15 strategic-smoke tests. The shared 240-character public-event summary disclosure remains part of the audit. The separate kernel publicity defect remains recorded and revision 27 remains immutable.
next_action: Preserve immutable runs 55 through 57 and the exact live services, then stage exact pushed implementation commit `f8bf73d8c4b2585a6f1757d0624fab0ea721915e` for immutable Run 58 as a newsroom-only continuation from run 57's frozen revision-27 campaign and accepted per-wave publications. Replay no world mechanic or wave. Retain and resume typed rewrite checkpoints, and require both internal verdicts—copy desk factual acceptance and Night Editor editorial-quality acceptance—plus exact newspaper, audit, result, archive, manifest, provenance, and service-isolation proof. Then obtain independent blind editorial and grounding acceptance and deliver the actual copy only if both accept. Defer multi-publication Personas, TeX layout, and engraved cuts.
implementation_checkpoint: The completed local worktree owns `canopy-ledger-night-editor.v8` and is verified but not yet committed or provider-proven. The copy desk emits one `WorldNewspaperCopyDeskReport` with its assessment and complete consequential query set; it is not an accept/reject loop. One single-step Night Editor action must disposition every query and rewrite every queried article, and may also polish any unqueried article before deadline. The deterministic press boundary freezes selection, order, sections, bylines, citations, agenda, source bounds, and exact lineage, then persists one `WorldNewspaperPressClose` witness binding the source page, printed page, copy receipt, Night receipt, addressed queries, and changed articles. No model rereads or grades the closed page. Legacy v7 copy-desk checkpoints, including the Run 58 lineage, can import into one v8 close checkpoint and invoke only the Night close without replaying selection, writer, copy desk, world, or waves. Verification passes 20/20 newsroom tests, 475/475 library tests, and 16/16 strategic-smoke tests; registry fixtures and the strategic recomposition contract use copy report plus press witness with no post-close verdict. Pushed v7 commit `f8bf73d8c4b2585a6f1757d0624fab0ea721915e` remains provenance. Durable publication-memory corrections are not implemented by this cut and must not be inferred from press immutability.
next_action: Commit the exact verified v8 worktree and push the resulting commit. Then inspect Yggdrasil, the exact live-service identities, and the existing Run 58 root before mutation. Preserve that root, create a new immutable resume root from its legacy v7 copy checkpoint, and run exactly one v8 Night close with the complete copy-desk query set as mandatory input. Replay no selection, writer, copy-desk, world, or wave work. Completion and delivery require the deterministic press witness plus exact artifact, manifest, provenance, and service-isolation proof. External blind editorial and grounding reviews may identify later-correction work but cannot block delivery or reopen this edition. Keep later corrections as pending publication-memory work and defer multi-publication Personas, TeX layout, and engraved cuts.
gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Materialisation/folding changes only representation and the exact member delta, advances resolution epoch, and retires the old cover; it has no Gestalt-wide effect authority. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only.