Scope the interpretation boundary to the library, and mark step 16 as cutting

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

notes/ghostlight-implementation-plan.md

@@ -897,10 +897,12 @@ rule; (D2) the Session Zero Eve surface; (D3) travel affordance and
 per-affordance player controls, which closed the playtest gate until the
 2026-09-22 ruling.
 
-### 16. The play agent — target adopted; cut map next
+### 16. The play agent — cutting; Cuts 1 through 14 landed or landing
 
 Adopted 2026-09-22. Target `docs/architecture/ghostlight-play-agent.md`
-(commit `cb0b604`); its means will be in `ghostlight-play-agent-cut.md`.
+(commit `cb0b604`); the means are in
+`docs/architecture/ghostlight-play-agent-cut.md`, which owns each cut's
+status, findings PA.f1 onward, and every ruling.
 This step is the playtest gate (the target's "Playtest gate"). One
 Dungeon-owned operational agent replaces the Interpreter and the
 cover/cell/catalog/owner-click orchestration on Dungeon's play path; the

state/map.yaml

@@ -52,7 +52,7 @@ mission:
 hard_boundaries:
   - The pre-rebuild Ghostlight pipeline is teardown evidence, not an authority to preserve. Do not add a model stage, semantic verifier, reconciliation agent, retry loop, model-routing exception, timeout exception, context adapter, checkpoint, or compatibility path merely to keep it running. Structural ontology and referential integrity belong to the single deterministic reducer.
   - Seal world authority before widening ontology. Only WorldKernel may hold mutable aggregate state, issue canonical IDs, invoke the reducer, or write the journal. The public seam is create/open, immutable snapshot, CommandEnvelope submission, and typed receipt. Empty reductions do not commit; translation gaps remain non-fictional inference/evaluation evidence outside WorldState.
-  - Every autonomous authority scope has exactly one decision controller. NarrativePersona preserves the Projector-Persona-Interpreter prose membrane; OperationalAgent may use a permissioned typed view and tools for operator-shaped cognition. Interpretation is total: representable material becomes typed proposals and unrepresented material becomes exact translation gaps. Neither mode changes authority, falls through to the other for a gap or infrastructure fault, or exercises the same opportunity twice.
+  - Every autonomous authority scope has exactly one decision controller. NarrativePersona preserves the Projector-Persona-Interpreter prose membrane; OperationalAgent may use a permissioned typed view and tools for operator-shaped cognition. Interpretation is total: representable material becomes typed proposals and unrepresented material becomes exact translation gaps. Neither mode changes authority, falls through to the other for a gap or infrastructure fault, or exercises the same opportunity twice. On Ghostlight Dungeon's play path the operational play agent, not the Interpreter, lowers a Persona turn (operator ruling 2026-09-22); the library retains total interpretation for offline simulation.
   - Sparse causal sufficiency, not actor count, defines a valid world horizon. Counts, cover ratios, interestingness, political diversity, and prose quality are evaluation evidence and cannot admit ontology, reject a structurally valid mutation, or declare the world complete. Liveness is a separate authored claim: the seed's WorldScaleIntent (design target 2,400 subjects / 240 cells / 10% cover) is a scale deficit the elaborators pursue, and cover budget is the deliberate choke; validity never waits on it and it never gates admission.
   - Ghostlight Dungeon is a consumer of the Ghostlight library, which serves all GameCult narrative simulation. Dungeon concepts (Session Zero, Vault choice, players, sliders, starting locations) are Dungeon authority and never shape the library; the library offers consumer-neutral capabilities and each consumer supplies its own policy. The world kernel lives in the `ghostlight` library crate; `ghostlight-dungeon` consumes it across a public boundary (L0, commits `108b691` and `f859d2c`). The boundary is sealed by admission (ruling Q1-9): public ID types, ScopeDigest and DecisionOpportunity derive Deserialize, so external code can hold a syntactically valid value, and the kernel rejects every one it did not issue, proven by crates/ghostlight/tests/external_admission.rs.
   - Prompt text is projection, not truth storage.