Admit authorized branch-local world regions

crates/ghostlight-dungeon/src/bin/ghostlight-strategic-smoke.rs

@@ -1189,7 +1189,7 @@ async fn main() -> anyhow::Result<()> {
                 model_receipts: receipts,
                 ..
             } = preview_checkpoint;
-            if preview.requires_approval || !preview.gaps.is_empty() {
+            if !preview.gaps.is_empty() {
                 publish_immutable_checkpoint(
                     &root.join(format!(
                         "world-region-{:02}-terminal-failure.json",
@@ -1203,7 +1203,7 @@ async fn main() -> anyhow::Result<()> {
                     }),
                 )?;
                 anyhow::bail!(
-                    "world-region expansion requires operator approval at index {}",
+                    "world-region expansion has unresolved canon gaps at index {}",
                     index + 1
                 )
             }

notes/ghostlight-current-system-map.md

@@ -1248,6 +1248,10 @@ outside this authority.
   checkpoints, and elaborators cannot directly write campaign state or invent
   Delvehold-owned player, civic, dungeon, contract, workshop, or quantitative-
   economy effects.
+- **Admission policy:** the operator-authorized autonomous run may admit a
+  structurally and semantically valid branch-local destination even though the
+  Dungeon UI would label its preview `requires_approval`. Unresolved canon gaps
+  still stop the run; the driver cannot approve through them.
 - **Shared paths:** fresh and resumed runs use the same frozen ordered plan,
   destination compiler, and kernel admission path. Resume rejects omitted or
   reordered requests, skips a region only when its checkpoint and canonical

state/map.yaml

@@ -84,7 +84,7 @@ live_architecture:
     - Foreground attempts, NPC reactions, strategic cell outcomes, waits, travel, and approval-gated population fission lower into one closed semantic WorldMutationBatch vocabulary. Means and intended effects remain proposals; only the WorldKernel reducer can change canonical components.
     - The mutation reducer validates a complete batch against an exact authority envelope on an isolated component overlay, advances each touched subject version once, and persists component state, authority, batch, mutation receipt, causal receipt, events, and aggregate compatibility projection atomically. Aggregate campaign rows are rejected by component-only mutation ingress.
     - WorldEffectDelta, ActorStateDelta, and StrategicOutcomeEffect are model-boundary migration inputs, not independent writers. Destination identity resolution routes a genuinely new place to bounded region expansion and an exact reachable canonical place to in-place locality elaboration. Both lower places, propositions, populations, institutions, political relations, topology, and the civic manifest through the same typed mutation reducer. Compiler-validated agency profiles remain a companion projection outside the reducer and are an explicit component-migration frontier. Inhabited destination proposals require a civic manifest whose public authority, selection or succession, resources, and redress facts are structurally cross-bound and independently checked for semantic legibility before approval. Initial publication is a fresh-store creation transaction; named-person materialisation/folding is a resolution transaction that advances revision and resolution epoch, clears the cover, preserves the individual delta, and cannot rewrite Gestalt-wide knowledge, custody, pressure, or fictional time.
-    - Full-world acceptance keeps the root compiler bounded-local. The strategic driver may sequentially ask the existing destination compiler agent for at most eight ordered new-region proposals, but only WorldKernel ExpandRegion admission can commit them. An immutable run plan freezes the complete ordered request set; proposal checkpoints close the kernel-commit/checkpoint crash interval; per-region commit checkpoints bind the exact request, origin, committed jurisdiction, kernel receipt, and model-receipt hashes. Resume rejects request drift and trusts only canonical campaign state plus exact receipts. The driver, checkpoints, and compiler agents are forbidden world writers.
+    - Full-world acceptance keeps the root compiler bounded-local. The strategic driver may sequentially ask the existing destination compiler agent for at most eight ordered new-region proposals, but only WorldKernel ExpandRegion admission can commit them. An immutable run plan freezes the complete ordered request set; proposal checkpoints close the kernel-commit/checkpoint crash interval; per-region commit checkpoints bind the exact request, origin, committed jurisdiction, kernel receipt, and model-receipt hashes. Resume rejects request drift and trusts only canonical campaign state plus exact receipts. Operator authorization of the autonomous run admits valid branch-local previews without replaying Dungeon's per-preview UI approval, while unresolved canon gaps still stop. The driver, checkpoints, and compiler agents are forbidden world writers.
     - Ghostlight owns generalized Projector to Persona to Interpreter machinery; consuming Personas retain their own canonical minds and commit authority.
     - Player speech address is a bounded proposal over exact co-present simulation-eligible actor IDs. WorldKernel commits the selected Persona response set with the speech turn; every present actor still appraises, while direct addressees receive explicit response duty and observers retain optional agency. A direct addressee must speak or select typed deliberate silence, which lowers deterministically rather than opening a free-text reaction-effect lane.
     - Foreground action assessment derives a closed structural schema from exact current authority. A compact private scope projection receives only the exact attempt and the structurally available lane names; local validation permits it only to subtract. Causally unselected lanes disappear from the assessor schema and information facts stay out of the prompt when knowledge mutation is unselected. Canonical dynamic effect maps cross the strict model boundary as bounded authority-enumerated entry arrays and lower once into WorldEffectDelta after validation. The admission-bound schema gives required strong/ordinary-success lanes minItems 1 only on the admissible branch and forces every inadmissible effect array empty; local validation repeats both rules after lowering. A separate compact semantic verifier then compares the complete four-band effect bundle with the player's exact means and intended effect. Neither stage can reassess difficulty, choose committed effects, expand authority, or commit. One mismatch produces a private semantic-invalid receipt and bounded same-snapshot assessor correction; a second mismatch aborts. Only structurally and semantically verified proposals enter the cache.