From 86977e51f7ee191df2db22ca9d3288b4403babe5 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Fri, 9 Oct 2026 17:05:13 +0200 Subject: [PATCH] Cut six pre-rebuild notes pages Parked at tag parked/ghostlight-pre-rebuild (ruling ghostlight-verse:ruling:park-pre-rebuild-tree). Co-Authored-By: Claude Opus 5.5 --- notes/architecture-rationale.md | 108 - notes/documentation-inventory.md | 109 - notes/ghostlight-current-system-map.md | 2865 ----------------- notes/ghostlight-dungeon.md | 329 -- .../ghostlight-homepage-promise-acceptance.md | 76 - notes/historical-newspaper-layout-grammar.md | 148 - 6 files changed, 3635 deletions(-) delete mode 100644 notes/architecture-rationale.md delete mode 100644 notes/documentation-inventory.md delete mode 100644 notes/ghostlight-current-system-map.md delete mode 100644 notes/ghostlight-dungeon.md delete mode 100644 notes/ghostlight-homepage-promise-acceptance.md delete mode 100644 notes/historical-newspaper-layout-grammar.md diff --git a/notes/architecture-rationale.md b/notes/architecture-rationale.md deleted file mode 100644 index e9f21d6..0000000 --- a/notes/architecture-rationale.md +++ /dev/null @@ -1,108 +0,0 @@ -# Architecture Rationale - -This note explains why Ghostlight uses explicit state surfaces. It is not the -current implementation map and not the roadmap. For those, read: - -- `state/map.yaml` -- `notes/fresh-workspace-handoff.md` -- `notes/ghostlight-implementation-plan.md` -- `notes/ghostlight-current-system-map.md` - -## Core Failure - -The central failure mode is local plausibility without global coherence. - -An agent can write elegant little sentences, produce plausible little diffs, -and still lose the shape of the machine. Once the model no longer knows how the -latent state, memory, perception, and prompt layers fit together, adding more -local machinery usually makes the beast prettier and stupider. - -The answer is not more transcript. The answer is explicit structure: - -- slow-changing map -- disposable scratch -- distilled evidence -- compact handoff -- implementation plan that is not pretending to be a second map -- ruthless deletion when state stops improving the model - -## State Split - -Ghostlight treats different kinds of cognition as different artifacts: - -- `map`: canonical system model, invariants, accepted design, rejected paths -- `scratch`: temporary local reasoning for one bounded subgoal -- `evidence`: distilled proof, decisions, rejected paths, and scars that change future belief -- `system map`: source-grounded explanation of the live repo machinery -- `handoff`: compact re-entry packet -- `plan`: distilled forward implementation direction -- `output`: user-visible replies, code edits, commits, and verification artifacts - -The split matters because a language model will happily blend all of that into -one warm slurry if invited. Slurry is not architecture. - -## Current Harness Principle - -Ghostlight is using the same basic discipline that Epiphany proved useful: - -```text -observe the repo and canonical state --> rehydrate the current map --> work one bounded organ --> verify the seam that matters --> record only durable evidence --> cut failed code and failed memory -``` - -The model is still a language model. That is the medium, not the scandal. -Language, structure, evidence, and salience are the steering surfaces. The repo -exists to keep those surfaces explicit enough that the next waking thing can -resume the pattern instead of faking continuity from vibes. - -## Authoring Projection Principle - -For content generation, Ghostlight should not treat an LLM as one omniscient -drama goblin asked to write every character from the same cloudy prompt. - -The better division of labor is: - -- Ghostlight maintains explicit state about characters, relationships, - memories, pressures, goals, masks, culture, and scene stakes. -- A narrative or drama pass can arrange conflicts, reversals, escalation, and - consequences, but it should also arrange routine, quiet, humor, rituals, - domestic texture, downtime, and slow buildup when those are what make the - later consequence legible. -- Dialogue generation should then happen through character-local context packs: - what this character knows, feels, wants, remembers, conceals, and believes - about the person in front of them. - -That distinction matters because realistic dialogue usually comes from -subjective circumstance, not from a summary saying "write dramatic banter -here." Pressure is one circumstance. So are habit, boredom, love, rivalry, -ritual, absurd bureaucracy, professional pride, and wanting lunch to be over -without anyone noticing the reactor invoice. Each character needs room to act -from their own partial state. The authoring agent can build the trap. It can -also build the kitchen table, the rain ritual, the bad coffee, and the private -joke that makes the trap hurt later. The character projection should decide how -the person inside the moment breathes. - -## Compact-Rehydrate-Reorient - -Compaction is a real state transition, not a cosmetic cleanup. - -Before compaction, Ghostlight should preserve: - -- current objective and active subgoal -- latest stable map -- distilled evidence or rejected paths that change future belief -- open questions, blockers, and next action - -After rehydrating, Ghostlight should: - -- reread canonical state instead of trusting prompt residue -- restate the next action from persisted state -- continue only when instructed or when the task explicitly calls for it -- avoid broad implementation until the current mechanism is understood again - -The aim is not immortality cosplay. It is banking the fire enough that the next -waking thing finds coals instead of ash. diff --git a/notes/documentation-inventory.md b/notes/documentation-inventory.md deleted file mode 100644 index 177ea1b..0000000 --- a/notes/documentation-inventory.md +++ /dev/null @@ -1,109 +0,0 @@ -# Documentation Inventory - -Use this file as the navigation map for Ghostlight's docs. It classifies files -by job so architecture, planning, prompts, state ledgers, and live examples do -not slowly melt into one cursed binder. - -## Canonical Re-Entry And Planning - -- `state/map.yaml`: canonical project map and current status. -- `notes/fresh-workspace-handoff.md`: re-entry summary for fresh sessions. -- `notes/ghostlight-current-system-map.md`: current runtime and artifact map. -- `notes/ghostlight-implementation-plan.md`: live implementation plan and - next-action surface. -- `notes/documentation-inventory.md`: this navigation/status index. - -## Core Architecture Contracts - -- `docs/architecture/ghostlight-dungeon-mvp.md`: hosted dungeon authority and - runtime map. -- `docs/architecture/ghostlight-multiresolution-agency.md`: dynamic agency - graph, connected cohesive/arena covers, detail fairness, cell waves, fission, - controls, and atomicity. -- `docs/architecture/ghostlight-dungeon-multiplayer-intention.md`: bounded - post-MVP extension of the campaign kernel to multiple human-controlled actors, - including authority, privacy, concurrency, and unresolved social policy. -- `docs/architecture/canonical-agent-state-schema.md`: canonical state model. -- `docs/architecture/agent-state-variable-glossary.md`: meanings for state - axes, voice style, overlays, and emergent behaviors. -- `docs/architecture/agent-state-distributions-and-prompt-projection.md`: - deeper state-distribution and projection rationale. -- `docs/architecture/prompt-projection-contract.md`: projection boundary and - renderer contract. -- `docs/architecture/projected-local-context.md`: character-local context - shape. -- `docs/architecture/sequential-agent-runtime.md`: sequential action/reaction - runtime architecture. -- `docs/architecture/sandboxed-responder-packets.md`: isolated responder packet - contract and capture requirements. -- `docs/architecture/soft-model-training-artifacts.md`: rule for turning soft - judgments into training artifacts. -- `docs/architecture/ink-branching-scenes.md`: branch-and-fold, branch - compiler, visual prompt, and IF reviewer contract. -- `docs/architecture/illustrated-if-visual-pipeline.md`: visual replay - contract, geometry authority, scene-set/blockout role, and imagegen boundary. -- `docs/architecture/lore-grounding-digest-format.md`: source-grounding digest - format. -- `docs/architecture/aetheria-lore-grounding-architecture.md`: Aetheria - historical, future-branch, and procedural grounding boundaries. -- `docs/architecture/corpus-coverage-ledger.md`: corpus coverage ledger - contract and status-report shape. -- `docs/architecture/technology-item-manifest-plan.md`: item, assembly, - supply-chain, trade-good, and blueprint data target. -- `docs/architecture/training-plan.md`: trainable organs, datasets, gates, and - rough scale targets. - -## Supporting Architecture And Future Mechanisms - -- `docs/architecture/aetheria-agent-population-model.md`: population and - faction-scale agent modeling. -- `docs/architecture/aetheria-content-generation-targets.md`: Aetheria content - targets and consumer use cases. -- `docs/architecture/aetheria-persistent-agent-architecture.md`: broader - persistent-agent architecture. -- `docs/architecture/projection-distillation-plan.md`: student projector - training concept. -- `docs/architecture/schema-future-mechanisms.md`: future schema organs waiting - for more evidence. -- `notes/architecture-rationale.md`: rationale notes for major design - boundaries. - -## Accessible Explanations - -- `docs/public-architecture/`: canonical source for the public Ghostlight site - architecture section: overview, authority, pipelines, and the complete - production agent/model-stage catalog. The site publishes an exact projection - and owns navigation and presentation, not technical truth. -- `docs/articles/multiresolution-gestalts.md`: reader-facing explanation of - Ghostlight Dungeon's dynamic agency graph, cohesive and arena cells, detail - fairness, Persona waves, and named-character continuity. - -## Raw Imported Source - -- `docs/aetheria/call-of-the-void-brainstorm.md`: raw imported brainstorming - document. Encoding scars are preserved; do not treat this as canonical prose. - -## Research Backlog - -- `docs/research/personality-model-roadmap.md`: personality-model research - roadmap. -- `docs/research/personality-signal-classifier.md`: personality signal - classifier research. -- `docs/research/things-to-steal.md`: research backlog and candidate ideas. - -## State Ledgers - -- `state/evidence.jsonl`: distilled current evidence ledger. -- `state/evidence.archive.jsonl`: archival evidence ledger. -- `state/branches.json`: branch ledger. -- `state/corpus-coverage.json`: machine-readable coverage ledger for accepted, - draft, planned, rejected, and superseded Aetheria fixtures. -- `state/scratch.md`: disposable one-subgoal scratch surface. - -## Maintenance Rule - -Architecture docs describe durable contracts. Live planning belongs in -`notes/ghostlight-implementation-plan.md`, `notes/fresh-workspace-handoff.md`, -and `state/map.yaml`. Experimental fixture receipts are not kept in the live -workspace once their lessons have been distilled into docs, state, or git -history. diff --git a/notes/ghostlight-current-system-map.md b/notes/ghostlight-current-system-map.md deleted file mode 100644 index 9c54042..0000000 --- a/notes/ghostlight-current-system-map.md +++ /dev/null @@ -1,2865 +0,0 @@ -# Ghostlight Current System Map - -> **Status: pre-rebuild as-built body, frozen 2026-09-01.** This document is a -> teardown source, not the adopted target architecture. The live target and -> deletion line are in `docs/architecture/ghostlight-dungeon-mvp.md`. Update -> sections below only as corresponding cuts land; do not use old verifier, -> reconciliation, checkpoint, or completion claims to steer new work. - -GhostlightDungeon is the pre-rebuild hosted runtime. Its replacement authority -map is `docs/architecture/ghostlight-dungeon-mvp.md`. The implemented Rust daemon, -CultCache campaign stores, CultMesh/Eve surfaces, browser lowerer, native -Yggdrasil systemd body, Idunn continuity target, and Odin discovery crossing -are the live machine; the older validated artifact seams remain regression -evidence only. - -## Landed replacement source owner - -`crates/ghostlight/` (library crate `ghostlight`) contains the world kernel; -`ghostlight-dungeon` consumes it across a boundary sealed by admission -(ruling Q1-9, L0 `108b691..ab95d78`). Commits `6bb6869` and `13d5136` -make that mailbox/kernel path the crate and executable runtime identity, remove -the legacy Session Zero/kernel/scheduler/verifier source body, and place app -sessions, world journal, and controller custody behind one CultCache -implementation. Production remains on the separately recorded legacy release; -source cutover is not deployment evidence. - -### Replacement authority map - -- **Owner:** `ghostlight::WorldKernel`, private to the library and reached - only through `WorldMailbox`, directly contains one canonical - `WorldState` and one `WorldJournal`. Its reducer is the sole semantic - transition owner. It admits world creation, Draft title changes and - approvals, Draft-to-Active activation, and one `ExerciseDecision` action - path. `WorldJournal` is the persistence actuator: it may atomically append the - reducer's exact candidate state and commit, but it may not invent an effect or - repair semantic state. -- **Inputs:** creation receives one `CreateWorld` seed and separately sealed - `AuthenticatedCaller` evidence for its owner. Later submission receives one - `CommandEnvelope`, the separately sealed caller, the exact world ID, and the - expected revision. Active decisions also carry the complete opportunity and - invocation. Open receives a `.cc` path and expected world ID. The current - ontology is deliberately closed to decision subjects, one controller per - subject scope, and the `Speak` affordance. Lifecycle state is exactly `Draft` - or `Active`. -- **Outputs:** accepted creation yields issued world, subject, controller, and - affordance identities plus a genesis receipt. Accepted submissions yield an - applied or idempotent commit receipt; semantic no-ops yield the unchanged - snapshot. Snapshots expose lifecycle, subjects, controller modes, grants, - committed decision events, digests, and current derived opportunities. The - store contains one head-state row and one immutable commit row per command. - Each commit carries the caller bound to separate authentication at submission - plus the admitted effect as its semantic replay inputs; the commit digest - covers both. -- **Derived state:** required Draft approvers derive from the owner and exact - human controller assignments. Subject snapshots derive controller and - affordance projections from canonical maps. Subject and affordance identity - exists in each map key rather than being duplicated inside the keyed value. - Active opportunities derive from the current state only and bind world ID, - revision, state digest, subject scope, controller, mode, and the complete - sorted affordance set. They are not separately persisted, scheduled, - repaired, or cached. Any commit changes the revision and state digest, so an - earlier opportunity loses authority. -- **Forbidden writers:** caller claims inside a command, mailbox tasks, - controller implementations, model output, snapshots, derived opportunities, - replay, and consumers cannot mutate canonical state. The legacy - `SessionZeroKernel`, public `kernel::WorldKernel`, `CampaignStore` callers, - assessor/reconciliation chains, schedulers, and reload repair paths are - absent from the committed replacement source and have no admission path into - its journal. -- **Shared paths:** after create or open constructs the owner, `WorldMailbox` - consumes it and offers only `Submit` and `Snapshot`. Human controllers, - Narrative Personas, and operational agents all exercise the same - `ExerciseDecision` reducer with an exact current opportunity; there is no - controller-specific mutation API. Draft commands use that same submit - primitive. Command ID replay is checked before revision so an exact retry can - recover a known durable result, while reuse with different content fails. - Runtime identity and human, Narrative Persona, and OperationalAgent execution - are wired to that mailbox boundary in the committed source. -- **Cut line:** source subtraction is complete. Production cutover now belongs - to Idunn's typed deployment path: admit the replacement release and exclusive - world-v3 state without a dual-write or compatibility bridge, prove restart - and negative legacy authority, then remove the old hosted body and state. -- **Verification layer:** the reducer checks exact authentication, world, - revision, lifecycle, approver, controller, opportunity, scope, affordance, - and action bindings before proposing an effect. `apply_effect` rechecks the - persisted caller/effect pair against the predecessor state. The journal - checks state shape, state and commit digests, contiguous semantic replay, - event-command identity, path identity, and compare-and-swap ownership before - admitting a state row plus commit row atomically. Eighteen focused tests cover - the complete Draft-to-Active/player/autonomous path, denied authority, stale - and tampered opportunities, exact restart/replay, durable idempotency, one - live store owner, uncertain post-commit acknowledgement, path replacement, - mailbox serialization, concurrent stale submissions, caller cancellation, - and rejection of a forged replay caller even when its hashes are recomputed. - -`WorldMailbox` owns queue order and request-delivery semantics only. A send that -never enters the queue is unavailable; loss of a submitted command's reply is -reported as outcome-unknown so the caller can retry the same command ID. Caller -cancellation does not cancel an enqueued command, and dropping the last sender -drains accepted work before releasing the journal. The mailbox does not own -authentication, authorization, opportunities, lifecycle, reduction, replay, or -persistence semantics. - -Controller mode is a canonical assignment, not mutation authority by itself. A -human controller supplies its authenticated principal; Narrative Persona and -operational-agent controllers supply their exact sealed controller identity. -A controller may choose prose or another typed invocation from what it can see. -It does not own its scope, grants, opportunity, revision, effect, event, or -commit. Narrative Persona projection and total interpretation, plus pure-agent -tool execution, remain controller-side organs to wire onto this boundary; no -model call exists inside the world owner. - -### Inference transport - -- **Owner:** `RoutedInferencePort` (`world/sdk_inference.rs`), holding both - transports every controller lane shares through one `Arc`. -- **Inputs:** the configured model name on each `ControllerModels` field and - `GHOSTLIGHT_SDK_MODEL_PREFIX` (default `claude`) decide which transport a - lane's request reaches; there is no separate mode flag. -- **Outputs:** one `InferenceOutput` per query from either transport, under - the same `PreparedInference`/receipt-digest shape; nothing downstream can - tell which transport produced it. -- **Derived state:** the two transports are `CodexConnectorInferencePort` - (unchanged, a daemon peer over a keyed socket) and `SdkInferencePort`, a - Node sidecar (`sidecar/claude-sdk/`) run as a plain child process of the - runtime — restarted on fault, holding no query state between queries, no - daemon, no listening socket, no CultMesh surface. Every tool result the SDK - route hands the model is produced by `ToolResultOracle`, the lane's own - evaluator fold lent to the port for one query; the sidecar computes none. -- **Forbidden writers:** no credential path is read, copied, or logged by - Ghostlight or the sidecar; the sidecar inherits the ambient Claude Code - login only. `ControllerRunner::open` takes its ports by injection; there is - no `#[cfg(test)]` constructor that builds them itself. -- **Cut line:** stopgap by design. `SdkInferencePort`'s two named liabilities - (its receipt attests only to its own child process, and a prior round's - conversation reaches the model as prose) are retired only by deleting the - port for a Messages-API transport once an API budget exists, not by - extending it. - -## Frozen pre-rebuild flow - -Campaign creation now has its own pre-world authority: - -```text -Heimdall member messages - -> SessionZeroKernel durable shared/private conversation - -> Projector -> persistent DM Persona owns exact speech - -> Interpreter proposes typed draft changes, never rewritten speech - -> runtime binds both into one revision-bound DM turn proposal - -> typed contract, private character drafts, boundaries, decisions - -> roster lock -> approved_campaign_brief.v1 -> Vault compiler - -> evidence-gap conversation or digest-bound final review - -> every player approves shared + own private digest - -> one staging CultCache batch + atomic directory exposure - -> campaign_membership.v1 binds each member to one exact actor -``` - -`WorldKernel` receives no draft state. The transcript is never replayed into the -compiler. Account and invitation hashes remain persistence-only; shared model -turns, browser surfaces, schemas, and CultMesh records cannot see them. - -Session Zero extraction is one atomic membrane with separated authorship. For -an ordinary turn, Ghostlight binds one exact current player message separately -from six prior same-channel turns and four shared continuity turns. The -Projector receives that bounded channel-permitted state; the Persona receives -the current turn verbatim plus its lived narrative and owns the complete -natural DM utterance. The Interpreter receives the same current turn, only the -typed state for its channel's authority lane, and no speech field. A private -Interpreter does not receive the shared contract merely to be forbidden from -editing it. Ghostlight binds the exact Persona output to the Interpreter's -typed proposals only after every stage validates against the same component -epoch. Interpreter failure therefore commits neither prose nor draft state. - -Material negotiation has one typed path. Accept applies the exact proposal -stored in the decision. Counter preserves that proposal as an inert, visible -audit and replacement basis, records the player's counter in its shared or -private durable channel, removes the Accept control, and leaves compilation -blocked. The DM may replace it only -through a same-epoch `ApplyDmTurn` containing a fresh material decision; the -replacement and retirement of the pending counter commit atomically. Stale, -empty, malformed, or failed counter responses leave the counter pending and the -retired payload uncommittable. -Retry is an inference launch against that persisted counter and exact unchanged -snapshot. It owns no state transition; a replacement still commits only through -`ApplyDmTurn` at the original component and channel epochs. -For a counter replacement, the target decision ID enters the stage binding. A -deterministic Ghostlight Projector turns only the target, retired typed payload, -exact counter, and aggregate safety policy into the Persona's exact lived -stream; it does not spend a model call asking another agent to paraphrase facts -Ghostlight already owns. The Interpreter receives the same bounded typed basis. -For an exact typed counter lane it emits only the replacement payload. Fresh -decision identity, owner, materiality, evidence, prompt, and counter text are -bound locally; permission identity, actor binding, and evidence cannot be -rewritten by the model. The full decision-union Interpreter remains for -ordinary turns and legacy payloadless migration only. -Conversation history, party, contract, and unrelated private state are omitted. -Legacy counters created by the payload-erasing build receive one bounded -current-state basis. The kernel accepts exactly one same-lane decision with -stable permission identity and no direct patch, so unrelated output cannot -retire the counter. - -An acceptance card is also a typed-state claim. New Interpreter decisions must -carry a non-empty contract, character, or extraordinary-permission payload; -payloadless questions remain speech. Legacy empty decisions project no Accept -control and the kernel rejects forged acceptance without changing revision. -This prevents polished DM prose such as “materialize the character” from -advancing a revision while leaving the character ledger blank. - -The player-facing Eve surface projects the exact typed payload on every -acceptance card and the complete actor-entitled private character draft. The DM -summary is explanatory, never the accepted state. Other members receive only -their own private ledger and the deliberately public party projection. - -```text -Vault evidence receipts + typed campaign snapshot - -> permissioned projection - -> Persona receives private lived narrative only - -> Interpreter emits typed deltas and action proposals - -> deterministic gates + expected revision - -> one WorldCommand enters the campaign mailbox - -> atomic CultCache commit + receipt - -> parallel affected-participant appraisal - -> CultMesh/Eve projection -``` - -Ghostlight owns the generalized projection organ. Epiphany and other consumers -own their canonical Persona state and consequence commits. - -## DELVE/HOLD consumer profile - -Delvehold is the first proving consumer for Ghostlight's generic API for one -canonical world beyond a consumer-owned boundary. Its target contract supplies an authored -ontology and fixed seed rather than invoking Session Zero world generation. -That bypass ends at generation: publication and every later transition must -still enter `WorldKernel` through typed validation and atomic CultCache commit. - -Delvehold owns players, workshops, dungeons, civic state, contracts, and its -quantitative economy. Ghostlight owns external actors, institutions, Gestalts, -relationships, knowledge, pressures, and strategic decisions. Consumer -configurations may bind institution or Gestalt subjects through -`ExternalSubjectAuthority`. Those subjects project committed revisioned snapshots into Ghostlight, -receive no Persona or strategic turn, and remain targets of foreign action. -Such actions persist as attributed proposals in the same strategic-wave commit -and return for consumer admission, not direct mutation. Compiler and consumer -producers share one `WorldSeed` admission transaction. - -Clock consequences cannot use an externally controlled subject as their -affected or responsible scope. They may still reach that subject through an -exact place or public channel, but only the consumer may decide what happens -inside its sovereign state. Temporary materialized-member actor projections -are also ineligible clock anchors; consequences bind stable simulated people, -institutions, or populations. - -The Delvehold adapter remains Delvehold-owned. It lowers committed Greathold -projections and realized effects into generic Ghostlight operations, then raises -attributed Ghostlight intents, news, projections, and receipts into Delvehold's -domain contract. It owns no truth on either side. - -The current `InstitutionState` and strategic resource vocabulary use named -resource handles. They do not model quantities, prices, recipes, facilities, -capacity, inventories, orders, contracts, or conservation. Those remain -consumer-owned unless Ghostlight later admits a deliberate economic component -and mutation algebra. The complete contract is -`docs/architecture/delvehold-forced-ontology-integration.md`. -The active next implementation organ is the Delvehold-owned adapter at this -boundary; newsroom cache probing is not on the critical path. - -The current checkout admits one to eight campaign members into one shared -scene. `campaign_membership.v1` maps each authenticated account to one exact -actor; HTTP, Eve, assessment confirmation, and CultMesh publication derive from -that binding. Human actors are excluded from Persona and strategic control. -Sequential public actions are accepted; PvP and split-party movement are -rejected. Time, group travel, and pooled cell-budget changes require unanimous -revision-bound approval. Post-launch Contract Review reuses the Session Zero -kernel against an exact world revision and commits approved amendments in one -campaign batch without rewriting location, topology, knowledge, memory, or -history. The authority map is -`docs/architecture/ghostlight-dungeon-session-zero.md`; later multiplayer work -remains in `docs/architecture/ghostlight-dungeon-multiplayer-intention.md`. - -Solo `Wait` has two exact meanings. A wait shorter than the campaign horizon is -a simple fictional-time command. A wait equal to one horizon enters the same -`AdvanceStrategicTick` compiler, Persona-cell, outcome, and atomic commit path -as away-time simulation, with a one-horizon maximum per player command. The -bounded co-op time proposal still advances raw time after unanimous approval; -routing governed co-op horizons through strategic simulation remains an open -implementation gate. Group travel updates controlled actor locations and their -canonical agency-profile locations in the same commit, so reload never becomes -a repair owner for partition inputs. - -Build provenance has one owner: `crates/ghostlight-dungeon/build.rs` binds the -exact source commit into the binary. Its inputs are either the release tool's -explicit clean-tree commit or Git HEAD; it watches the actual symbolic ref, -HEAD reflog, and packed refs so an ordinary commit invalidates Cargo's cached -value. Health derives its commit from that embedded value. Release manifests, -launch scripts, and CultCache deployment receipts are verifiers and records, -not alternate writers. Local runs and immutable releases use this same binding, -and the regression test compares it to the checkout's live `git rev-parse -HEAD`. A mismatch blocks activation rather than being repaired after launch. - -Away-time agency follows a separate proposal/commit seam: - -```text -exact campaign revision - -> flash-model six-axis resolution demand - -> connected agency graph + budget/pins/leases/detail debt - -> cohesive or arena simulation-cell cover - -> scheduler-owned Nemesis agent binds exact committed event, pressure, or clock anchors to eligible decision owners inside that cover - -> deterministic agenda admission checks anchor visibility, simulation authority, player exclusion, and per-cell decision quota - -> one private Projector/Persona/Interpreter membrane per cell - -> Projector receives exact decision-owner dossiers plus a bounded relevant-target viewport, never every inactive constituent dossier - -> deterministic projection adds bounded relevant targets and exact canonical names mentioned by the lived stream or Persona turn - -> Interpreter agent submits or incrementally edits one private exact-decision draft without performing target lookup - -> deterministic draft compiler checks exact ownership, permissions, topology, and bounds - -> independent per-action effect verifier checks the typed action against the Persona choice - -> accepted unchanged actions retain their exact verifier binding across local draft repair - -> runtime selects compatible attempts and content-addresses each activity - -> parallel per-activity fast outcome candidates choose bounded typed consequences - -> one local binder plus selective semantic verifier admit or reject each frozen candidate - -> at most one balanced reconciliation replaces only a rejected outcome bundle - -> direct and reconciled candidates publish the same terminal outcome-resolver authority - -> runtime binds complete cell membership + world/resolution revisions - -> WorldKernel validates cover, stage/outcome receipts, knowledge, scope, custody, topology, and bounds - -> AdvanceStrategicTick through the campaign mailbox - -> one atomic campaign/event/news/cover/appraisal commit -``` - -### Causal follow-through (Nemesis) - -- **Owner:** the strategic scheduler owns which already-committed consequence - deserves another decision window. The bounded model agent serving that - decision is Nemesis. Resolution owns the complete 240-cell cover and its - decision quotas; Nemesis does not own cover construction or what any subject - decides. -- **Inputs:** one frozen campaign revision, its committed public events and - active pressures and clock progress, the durable Nemesis attention history, - the deterministic resolution cover, exact perception routes, simulation - eligibility, Gestalt-member materialization state, player-control boundary, - and each cell's action quota. The initial model frame contains only a cover - summary, bounded summaries of the 24 most recent eligible public-event - anchors, and the first page of 24 current pressure/clock summaries. Agent - commands page current anchors 24 at a time, older world or exact-subject - history through the existing 24-item views, and eligible responder dossiers - for one already-inspected anchor 12 at a time. -- **Output:** one bounded follow-through agenda binding exact event, pressure, - or clock anchors to exact eligible decision owners already represented by the - cover, plus the model receipt rebound to the exact campaign snapshot and - admitted agenda. - The agenda is scheduler state checkpointed with that cover, not canonical - world state. An empty agenda is a valid Nemesis judgment. -- **Derived state:** an assigned owner receives the exact anchor in its - permitted cell slice, takes precedence over ordinary rotation for that wave, - and supplies that anchor's exact current committed account to the action's - private outcome context. The anchor is context, not new mutation authority. - `CausalAnchorCandidate` is private deterministic tool state containing anchor - metadata and the exact set of eligible responder IDs. It derives a summary - with only the responder count for broad views; it never clones a responder - dossier per anchor. Full responder eligibility and dossiers remain one - private tool catalog and are projected only for the selected inspected - anchor page. - Responder-cell routing preserves identity ownership: a materialized - `member:*` subject remains an actor and binds only to its actor cell; a dormant - member keeps its exact member identity but routes through its aggregate - Gestalt's cell as a selected member exception. Unassigned recent events remain - an ambient perception projection. -- **Forbidden writers:** the follow-through agent cannot emit events, mutate - pressures, choose an action or outcome, move a subject, rewrite a cell - Persona, change member materialization, collapse a materialized actor into its - aggregate Gestalt, or touch newspaper copy. The outcome organ remains the - sole assessor of selected attempts; `WorldKernel` remains the sole world and - event writer and the sole writer of durable served-window records. Member - materialization changes only through the existing kernel presence transition; - bounded legacy identity normalization may canonicalize an already materialized - actor ID but does not decide presence. Nemesis cannot infer eligibility from - counts or summaries, address an uninspected anchor, obtain the global - responder-dossier cross product, exceed page or cell quotas, or commit its - agenda. Anchor summaries and dossier pages are observations, not writers. -- **Shared paths:** first execution and checkpoint resume consume the identical - accepted agenda and exact receipt binding. `WorldKernel` independently - requires that exact admitted receipt before it commits a nonempty causal - agenda, then records each exact anchor/responder pair atomically with the - wave. Local cell verification and final wave admission both check that - required owners were considered without requiring them to act rather than - choose an attributed inaction. Later discovery excludes an already served - exact pair; a clock's new progress value creates a new anchor. Responder - discovery, agenda quota/focus admission, validation, and per-cell assignment - injection all use the same materialization-aware cell resolver. Initial and - paged current-anchor discovery use the same candidate catalog and add exact - candidates to the inspected set. World/subject history pages use the existing - event discovery path. Anchor-responder inspection joins the chosen inspected - candidate's exact eligible-ID set against the single responder catalog; the - generated action schema exposes exact currently admissible IDs, and submit - admission rechecks anchor-specific eligibility, distinct responders, total - slots, per-cell quotas, and mandatory detail focus before binding a receipt. -- **Cut line:** blind tick rotation no longer decides a slot already occupied - by an admitted causal assignee, and the global last-twelve-event truncation - cannot hide that assignee's exact anchor. No prompt downstream may compensate - for a missing scheduler decision window. `response_role` and a claimed - accepted-receipt ID are not part of the admission: the scheduler admits only - the exact anchor/responder assignment, and receipt identity comes from the - actual model invocation. The cut retains one cover, one deterministic - eligibility computation, one action/admission validator, and one kernel - commit path. It adds no per-anchor responder-dossier cache, cloned candidate - frame, second Nemesis agent, eligibility store, or pagination-owned truth. -- **Verification layer:** focused tests prove paged retrieval beyond the initial - event viewport, 24-item current-anchor paging without losing candidates, - 12-item responder inspection for an exact chosen anchor, valid empty - judgment, exact-pair replay suppression, player - exclusion, exact owner consideration, materialized-member routing to the actor - cell versus dormant-member routing to the Gestalt cell, exact anchor citation, - outcome context containing only the assigned anchor and its committed - account, and kernel rejection of a forged agenda followed by atomic acceptance - and served-window recording for the exact receipted agenda. Deterministic - validators reject unknown anchors, ineligible or duplicate responders, - over-quota agendas, missing exact receipts, and stale anchor accounts. A - 2,400-responder frame regression proves the initial prompt remains a bounded - cover/anchor summary rather than multiplying every anchor by every responder - dossier. A strategic smoke remains the whole-system verification that named - competing decisions produce - committed material outcomes before editorial quality is assessed. - -The model owns no tick mutation. A provider failure or invalid proposal leaves -the campaign revision and world time untouched. Background inference checks -live-turn pressure before launch and again before commit; return catch-up uses -the same command path with player-turn priority for fictional commands. - -The effect and outcome verdict schemas make semantic coherence structural. Each -candidate action receives its own parallel effect-verifier call. Its schema and -local validator both require one index-zero verdict: `match` with no findings, -or `mismatch` with one through six findings whose mismatch kinds are distinct -and whose concrete repair guidance is nonempty, trimmed, and at most 240 -characters. The prompt asks for that complete bounded set and the request's -1,200-token ceiling can carry the full schema maximum. Every returned finding -enters one subject-scoped Interpreter repair. Repair prose is ephemeral -diagnostic input, not world state; no verifier chooses the replacement or gains -commit authority, and private cell choices never reach a player error surface. -A rejected wave returns one spoiler-free message while its exact diagnostic -remains operator-only. - -The Interpreter is a bounded model agent over a private workbench. Every -model-agent workbench owns the action schema legal at its current state; the -provider-neutral loop asks the tool for that schema before every semantic step -and places the same schema in both prompt guidance and the structured response -boundary. For an empty Interpreter draft, the only command is one complete -exact `submit`. A rejected draft remains private tool state, and the next schema -contains only `upsert_decision` commands for exact missing or rejected owners. -There is no inspection, removal, wholesale resubmit, or unrelated repair branch -for the model to spend a step on. The action wire remains one strict root object -containing one exact typed command. Local validation returns a typed -`local_validation` finding and the semantic verifier returns exact -subject-scoped mismatch findings. Neither validator chooses the replacement or -gains commit authority. Verifier matches are cached by the exact -snapshot-and-action binding, so repairing one action does not repay inference -for unchanged accepted actions. An `undecided` result returns to the Persona -owner instead of letting the Interpreter invent a choice. - -The strategic scheduler owns partial-wave recovery. Its typed checkpoint binds -the exact campaign revision, resolution epoch, deterministic cover and plan, -effective campaign contract and aggregate boundaries, planning receipts, -successful cell terminal bundles, and exact failed-cell set. A retry validates -that complete partition, policy, and causal receipt chain before dispatching -only failed cells. The checkpoint is opaque outside the scheduler. The smoke -runner may persist whole checkpoint generations but cannot merge or edit cell -output; it durably publishes the complete cell checkpoint before wave commit. -Within a cell, the engine projects one exact lived moment. If the -Persona supplies no explicit decision, the engine retries only Persona and -Interpreter against that same projected stream; Projector does not rerun. The -second Persona cites the first Persona and Interpreter attempt as causal -ancestry. Provider transport gives both connection failures and attempt -timeouts one separately bounded retry of the exact same request and snapshot; -a later successful receipt preserves the failed attempt's diagnostic. -Interpreter draft repair remains workbench-local. Actor and cell membranes -share one causal-source derivation primitive for Projector to Persona to -Interpreter, while canonical evidence remains a separate namespace. - -World clocks own declared consequence text and exact observable scope. New -seeds must supply that scope and begin below threshold. A persisted legacy -clock without scope enters one balanced-model binding agent over a frozen -campaign revision. The agent proposes the smallest causally sufficient stable, -simulation-eligible scope; its accepted action is rebound to the exact batch -digest. `WorldKernel` alone admits the proposal. The common mutation application -path detects threshold crossing and derives one stable -`clock-consequence:` event, then the shared event publisher derives -the exact rows for every admitted public channel. The event IDs enter mutation -and strategic-tick receipts. Binding scope, exact model receipt ancestry, -emitted event and news IDs, and the next newspaper boundary commit atomically -with the campaign in CultCache. Runner proposal and completion checkpoints are -recoverable projections; neither owns the event nor the newspaper slice. - -The effect verifier receives the same exact typed permission slice used by the -Interpreter. That slice is its sole map of canonical locations, reachable actor -destinations, population destinations, and target IDs. A pump, desk, queue, or -other place named only in lived prose remains local texture inside the supplied -canonical activity location; the verifier cannot manufacture topology and then -reject a valid local action for omitting travel through it. - -A live request also interrupts an in-flight scheduler wave. Live-turn admission -increments pressure and signals cancellation before waiting for an already -admitted background commit to finish. The admission guard exists before that -wait, so cancellation cannot leak false pressure. Dropping the scheduler wave -aborts its parallel cell tasks before they can launch later Persona stages, and -a shared/exclusive commit gate makes scheduler commit impossible while any live -request is active. Return catch-up is intentionally exempt because it is part of -the live request and must finish before the requested fictional action. Private -assessment and resolution-policy edits neither advance fiction nor invoke -catch-up. Session Zero logs the exact draft revision when a DM response is -queued and when its live guard is admitted, making provider latency distinct -from scheduler contention without exposing channel contents. - -Entering or dropping that guard republishes the canonical typed health record -immediately. HTTP health reads the same record, so `live_turn_pressure` is an -actual launch brake during an in-flight player command rather than a delayed -status reconstruction. - -Resolution-demand focal IDs are salience hints, not partition commands. They -cannot create mandatory singleton cells or exceed the configured budget. Cell -Projectors receive decision-relevant situation state for the scheduler-selected -decision owners, the count of other represented subjects, and at most 24 exact -activity targets ranked by explicit relationship, mention in current goals or -pressure, co-location, and stable ID. Inactive constituents remain represented -by the exact cell cover but their full dossiers do not enter the model frame. -Cell Interpreters receive exact permissions for active decision owners and the -narrative products. Membership and revision bindings are derived by the -runtime, so a model is never asked to copy an invariant that the planner already -owns. Stable prompt prefixes are deliberately placed before dynamic state, and -provider receipts expose per-attempt token/cache usage plus bounded local -validation failures. - -`ModelPort` remains Ghostlight's single inference seam. The Codex-backed -implementation is an ordinary typed consumer of the independent CodexConnector -daemon: it emits an encrypted, expiring MessagePack request over bounded -TCP-framed CultNet and accepts only a correlated ordered text stream plus -terminal receipt. A stable cache key is derived from stage, logical model class, -and output schema rather than mutable campaign content. CodexConnector owns -credential custody, caller admission, bounded provider transport, replay, and -transport receipts. Ghostlight owns provider-request derivation, stage -projection, schemas, retry between passes, semantic validation, model-stage -receipts, and every kernel admission. Epiphany is a separate consumer and owns -neither side. Yggdrasil runs CodexConnector as the independent -`codex-connector.service` release -`f9cfa355051ef91d0e7f095b2df2a69fe79f8a7c`. Ghostlight has only a soft -systemd ordering edge to that daemon and cannot build, configure, restart, -select, or roll it back. - -Ghostlight exposes three provider-neutral logical classes. `ghostlight.fast.v1` -owns high-volume cells and retrieval, `ghostlight.balanced.v1` owns bounded -reconciliation and routine elaboration, and `ghostlight.capable.v1` owns -frontier invention and editorial judgment. Only the selected `ModelPort` maps -those classes to physical models or assigns their attempt deadlines; compilers -and harnesses never pass physical model IDs as logical stage authority. - -Vault availability is typed at the provider boundary. When the configured -Vault cannot return evidence, SessionZeroKernel returns the exact draft to -`drafting`, records one stable resolved material blocker, and publishes no -preview, branch assumption, world digest, or campaign. Operational causes stay -in the private daemon journal. A later retry uses the unchanged approved brief -through the same compiler path; neither the model nor client can inject a -replacement evidence source. - -Canonical actor cell slices include that actor's exact goals, obligations, -relationships, and bounded memories. Named Gestalt-member exceptions receive -the same continuity fields. The Projector narrativizes them for the Persona; -the Interpreter still receives only exact effect permissions. A promise does -not become a hard-coded behavior rule, but it cannot disappear merely because -the actor entered offscreen simulation. - -The Interpreter decision schema is derived from every exact decision-owner ID. -Institution, actor, Gestalt, and named-member effect variants cannot cross -subjects: complete submits bind decisions by owner-key, while incremental edits -are rebound and validated under the selected owner by the workbench. Target IDs, -canonical locations, pressure resolutions, movement destinations, state -references, and public channels are enumerated from that subject's permitted -slice. Activity targets are the exception to eager projection, not to exact -authority: the initial schema exposes the bounded relevant viewport, and the -same Interpreter workbench may query one active decision owner by a supplied -name/ID fragment for at most 12 exact matches. A successful query expands only -that workbench's dynamic schema. It cannot add a target to canonical permission, -change the cell, or bypass the full deterministic validator. Movement and -population-migration variants disappear -when the subject has no exact destination; target-requiring activities cannot -emit an empty target list. Semantic correction therefore judges meaning rather -than repairing type combinations local code already knows are impossible. - -Each permitted activity target is one runtime-derived descriptor keyed by its -authoritative ID, with the target's exact name and current canonical locations. -Reachable actor destinations map exact location IDs to names; population -migration destinations carry both population and location identity. The -Projector and Interpreter bounded views distinguish a canonical target actually -named by the Persona from an unnamed local role, and can prove whether “go to -Reed” means movement at all. The effect verifier receives only the exact target -descriptors cited by its already structurally valid candidate action; the full -permission map remains private to deterministic validation. Opaque permitted -IDs are not enough reason to substitute a containing population, related -institution, or unrelated destination. Descriptor prose and target queries are -disambiguation context, not a new subject, permission writer, or fuzzy-match -authority. - -Targetless local activity is explicit rather than encoded through a convenient -unrelated subject. Preparation, investigation, communication, and obstruction -may act on an unnamed role, infrastructure, terrain, traffic, or other local -texture only at the exact supplied location. The activity records the source's -attempt, never a listener, discovery, damage, disruption, or response. A -canonical target is required whenever the attempt actually addresses one. - -`AgencyProfile.information_channels` owns concrete routes through which a -subject can publish or receive reports. Actor knowledge and Gestalt shared -knowledge remain separate state and may justify an action without manufacturing -a news route. Profile maintenance removes legacy overlap and `unknown` -placeholders; the compiler rejects both categories before campaign approval. - -Arena projection preserves spatial partitions as well as identity partitions. -Each remote view carries its actual location; a relation grants potential -reach, not co-presence. Persona turns cannot stage direct sight, speech, or -response across locations unless the lived stream establishes a shared place -or communication channel. Interpreter activity labels then describe the -narrow attempted act, while hoped-for success remains outside the effect. -Ghostlight deterministically prepends the exact name/location partition to the -learned Projector's narrative, so model omission cannot erase those boundaries. -Only supplied cell constituents and selected member exceptions may own a -perspective. Event mentions do not transfer a person into another cell, and an -unnamed or unsupplied entity cannot become an activity target merely because a -Persona found it plausible. - -Institution slices carry committed `current_posture` separately from unresolved -pressure. Projectors present the posture as existing state; Interpreters and -validators compare any new commitment directly against it. The old overloaded -`pressures[0]` convention is not an authority path. - -Model-facing actions contain one owner, `subject_id`. Nested effect owner IDs -are runtime-derived during binding and exist only in the canonical downstream -proposal. The model cannot disagree with itself about `member:mira-venn` versus -raw `mira-venn`, and the prompt/output contract spends fewer tokens copying -invariants Ghostlight already owns. - -Canonical constituent references have one owner: -`resolution::subject_state_references`. Scheduler slices consume that set -directly, including active reachable migration destinations, and wave -validation recomputes the same set. Prompt construction cannot append -references the resolver does not recognize. - -Cell perspective attribution is runtime-bound too. The schema admits only -exact constituents and selected member exceptions. Ghostlight rejects -duplicates and requires both the debt-selected focus and every selected named -member exception to receive their own perspective segment; an actionable -individual can no longer disappear inside the aggregate before the Persona -turn. The perspective count may exceed the action limit only by the number of -mandatory owners; action consequences remain separately capped. Segments are -sorted and lowered to natural name/location headings before the Persona sees -prose only. An invented Markdown section cannot turn a mentioned outsider into -a decision-making perspective. - -Gestalt background choices use three distinct typed paths. Pressure transitions -change exact unresolved markers. `gestalt_activity` records an attributed -preparation, coordination, investigation, recruitment, obstruction, trade, or -communication attempt against subjects connected by an explicit agency -relation or exact shared location without claiming the outcome. After -selection, the outcome organ launches one logical-fast candidate per selected -activity under the configured provider parallelism. Each candidate receives -only that attempt and its precomputed legal consequence handles. It must return one digest-bound -`strategic_activity_outcome.v1` per activity; missing, duplicate, stale, -player-mutating, or invented effects reject the entire wave. Accepted outcomes -may change exact resources, population pressures, incident agency relations, -named-member deltas, or discoverable canonical knowledge, or explicitly record -that no durable material change occurred. A selected -dormant member can be addressed by their durable ID; this does not union them -into the source population. The kernel derives the event text and exact -participant IDs; the arena and model prose own neither. - -The outcome organ does not repair or reinterpret Persona intent. The -Interpreter owns the attempt; the terminal outcome resolver owns opposition and -result; WorldKernel alone owns mutation. Local binding failures and independent -semantic-verifier mismatches are findings from the same admission boundary. -Either finding may invoke one logical-balanced reconciliation that can replace -only the frozen outcome bundle. Cell appraisals, selected attempts, action -digests, campaign snapshot, and admissible handles are immutable inputs. A -failed reconciliation closes the wave; it cannot call the logical-fast -candidate again or return to Persona appraisal. - -Direct and reconciled outcomes publish the same terminal -`strategic_outcome_resolver` stage authority at the exact activity binding. A -reconciled receipt remains distinguishable by its logical-balanced model and -causal source chain; the rejected logical-fast receipt remains -`semantic_invalid` evidence and cannot satisfy kernel admission. The terminal -verifier cites the admitted candidate receipt, and every material outcome must -carry that exact outcome-bound valid verifier receipt through WorldKernel -admission. Scheduler sequences the boundary, checks cancellation, and aggregates -typed terminal failures and completed receipts for persistence; it owns no -repair prompt or replacement decision. -Every outcome is stored independently in CultCache and projected on the -operator Eve surface. All effects apply to the same private campaign copy as -the rest of the strategic wave, so a late invalid outcome cannot leave an -earlier action, clock, detail debt, or event committed. - -Deterministic admissible-effect handles constrain every resolver decision. -Actor possessions, member equipment, institution resources, and Gestalt -resources use one `resource:*` reference ontology. When a model cites another -action's handle or invents a reference, the local owner returns the exact -action digest, offending values, and admissible set to the private same-snapshot -correction. The player receives only a spoiler-free refusal if correction also -fails. - -The resolver's JSON Schema is derived from exact action authority. Each action -digest admits only its available effect kinds; unavailable lanes are absent, -not represented by empty placeholder choices. The chosen effect kind makes its -own owner, recipient, resource, relation, member, fact, pressure, and evidence -fields structurally required while forbidding fields owned by another kind. -Exact IDs and existing values come from that action's bounded slice. New -resource or pressure text remains model-proposed but locally bounded and still -requires kernel validation. This keeps deterministic impossibility out of the -semantic retry loop without letting the schema decide narrative causality. - -Pressure authority is state-relative. The outcome stage receives each exact -Gestalt owner together with its current unresolved pressure strings. A -resolution must copy one of those strings; an addition must be new and cannot -overlap a resolution or repeat current state. The runtime rejects the whole -wave on a no-op, duplicate, or invented resolution before commit. -These state-transition checks belong to the outcome semantic validator, not the -generic JSON-shape retry. A well-shaped repeated pressure reaches the shared -balanced reconciliation boundary with the exact rejected bundle; the -replacement may propose a genuinely new pressure or `no_material_change`, while -the kernel guard still makes the repeated transition uncommittable. - -Named-member private effects are action-relative too. An obligation is -available only for social activity—communication, coordination, recruitment, -or trade—where the attempt can actually create a promise or debt. Physical -preparation, investigation, or obstruction cannot mint an unrelated social -obligation merely because the member is present in the outcome slice. - -Structured-stage failures name the exact stage, instance JSON pointer, and -schema pointer. Receipts retain the bounded private diagnostic; player-facing -strategic refusal remains spoiler-free. A model failure can therefore be -located without logging chain-of-thought or dumping the private prompt. -For the one same-snapshot correction, the validator also projects only the -nearest rejected containing object rather than replaying the whole output. This -gives the model the exact failed activity or effect beside the schema pointer, -preserves the stable cacheable prompt prefix, and avoids paying again for -unrelated valid output. Parallel cell failures retain the exact cell ID, -constituent IDs, and bounded anyhow cause chain in operator-only logs. - -Ordinary bounded preparation, pressure, and knowledge effects stop at local -validation. Resource consumption/transfers, agency-relation shifts, and named -member private deltas additionally receive an independent same-snapshot -semantic verdict because those effects can be structurally valid while charging -the wrong inventory or person. The verifier proposes no state and cannot -commit. The latest provider-backed four-wave golden produced seven typed -material activity outcomes, ten durable consequences, and zero rejected pulses -while leaving the player unchanged and returning the same Mira. - -The service-owned CultMesh store remains the canonical projection body when -Odin rendezvous is temporarily unavailable. RUDP publication is outbound -replication, not daemon-liveness authority: a failed publish is logged with its -key and target while the complete local snapshot persists and HTTP serves that -same typed health and Eve state. - -`advance_one_strategic_tick` owns post-commit mesh publication for scheduler, -return catch-up, and explicit player-horizon waits. Callers no longer decide -whether a strategic commit deserves a projection. A publication error is an -operator-visible derived-state failure; it cannot roll back, rewrite, or report -the already committed world transition as failed. This closes the former path -where return catch-up advanced canonical state, the subsequent player command -correctly failed stale, and an early return left the operator surface on the -previous revision. - -The RUDP session owns reliable-send pressure. It admits at most 32 packets—the -cumulative-ACK horizon—queues the rest, promotes queued packets only as ACKs -retire admitted packets, and emits an exact ACK when an older retransmit has -fallen behind that horizon. Its explicit flush succeeds only after every -reliable packet is acknowledged. Large CultMesh documents no longer -depend on blasting every fragment and sleeping for a fixed interval. The wire -contract is unchanged, and model, campaign, and application authorities remain -outside the transport. - -Ghostlight stages discovery-critical health and provider advertisement before -bulk projections. Its Odin schema catalog contains only the Ghostlight-owned -boundary state types advertised to consumers: `ghostlight.campaign.v1` and -`ghostlight.session_zero.v1`. Internal compiler, Persona, transition, Gestalt, -receipt, and operator documents remain available through their owning private -projection; they are not dumped into rendezvous merely because Ghostlight has -Rust types for them. - -Odin registers only the `ghostlight.schema_catalog.v1` public envelope, not -those private contracts. Its provider-document adapter returns and awaits the -single durable `node.put` promise, preserving per-peer write order instead of -launching concurrent CultCache mutations behind transport acknowledgement. -The live typed snapshot returns Ghostlight source -`7522ea8405212b344441f83f502993f525276521` and exactly the two boundary schema -keys above. - -Opening retrieval deliberately covers early, transitional, and late historical -frames. These pure retrieval/compiler functions now serve the Session Zero DM; -they are not browser-owned creation routes or transient preview maps. Generated -suggestions enter the typed draft for discussion and use the same final brief as -custom premises. Both rejected and accepted receipts remain private. Invite rotation is owned by -the deployment boundary: it replaces the protected token set and clears the -persisted auth authority together while the daemon is stopped. Campaign stores -survive; old sessions deliberately do not. - -Away time does not require invented agency. When a campaign has no active, -simulation-eligible agency profiles, the scheduler enters the same -`AdvanceStrategicTick` kernel command with no model plan or resolution wave. -World time, clocks, pending-tick accounting, and deterministic obligations -advance atomically while the player remains untouched. The scheduler does not -call the partitioner merely to discover an empty graph, and it retains the same -live-turn commit exclusion as model-backed waves. - -Compiler approval is a player decision surface, not an operator spoiler -surface. It exposes topology, public cast, institutions, populations, clocks, -player-role capabilities, evidence coverage, gaps, and branch assumptions. It -does not project branch-local or provisional fact statements—even when they are -discoverable later. Those facts remain canonical inputs to knowledge-gated play -and operator inspection; the browser cannot reveal them before discovery. - -## Legacy acceptance body (pre-rebuild; Yggdrasil still serves it) - -Yggdrasil serves one native immutable Ghostlight release under -`ghostlight-dungeon.service`. The fresh-workspace handoff and `state/map.yaml` -carry the exact current source, Eve source, executable hash, provider, store -counts, and replay witness. This map describes the acceptance body without -duplicating a volatile release identity in several sections. - -The hosted adversarial campaign now pressures the complete eight-cell strategic -path against real provider output. Every failed Projector, Persona, -Interpreter, effect-verifier, outcome, or kernel boundary has left campaign -revision and fictional time unchanged. Human separate-account co-op privacy and -unanimity remain unproven; the expected D&D cohort dispersed before this pass, -so no fixture or solo browser run may be presented as that acceptance. - -Campaign `e99e8794-281f-4a82-8b2c-5e6954bd6b16` is the current live Kalsa -witness. At revision 21 and resolution epoch 3 it runs with a configured -one-cell budget. Startup migration repaired Cal Rusk's malformed doubled legacy -identity to exact canonical `member:cal_rusk` without advancing fictional time -or revision. Cal retained his learned bypass and warning-mark knowledge across -materialisation, folding during travel to Veyr Run, and rematerialisation when -Asha returned to Raincross gate. A budget-1 strategic wait advanced Ilya's -investigation and Oren's movement without puppeting Asha. - -The earlier campaign `34929b8d-7b04-49af-9936-1c798fd79760` remains the -eight-cell strategic receipt witness. Its revision-12-to-13 catch-up preserved -five exact actor/institution cells, two Gestalt cells, and one arena containing -three distinct remote institutions. The arena acquired no actor ID. Zhestokost's -repeated posture became attributed inaction; two named members made their own -decisions; Reed kept the twelve-patient commitment; and the player plus Reed -remained byte-identical. Five selected actions produced five bounded outcomes. -Fourteen channel-aware reports remained absent because the player had no route -to them. - -That tick used 34 stage receipts and 35 provider attempts: 83,838 prompt -tokens, 64,000 cache-hit tokens, 6,192 completion tokens, and 90,030 total -tokens. The extra Interpreter receipt records the rejected repeated institution -posture. The outcome path records an undersized bundle retry and a rejected -repeated pressure before the corrected complete bundle. All diagnostics -remained private; the campaign committed once. - -The public `/ghostlight/` path terminates on Yggdrasil nginx and proxies the -native loopback listener at `127.0.0.1:8831`. Anonymous access returns the -actor-free `ghostlight.play` Eve gate with `200`; actor and campaign state stay -unavailable without an app session and canonical membership. The previous -Starfire writer is stopped; its process and tunnel are no longer live -authority. The migration copied campaign and Session Zero stores while -preserving Yggdrasil's native mesh and provider-health identities. - -The pre-rebuild hosted body published local CultMesh and HTTP readiness without -waiting for Odin; that legacy health admission is teardown evidence, not the -new runtime contract. Under the landed contracts, an activation becomes current -only after Idunn's workload driver observes the exact native process and -artifact. Present requires that activation plus service-signed presence health; -Odin alone correlates Ready. CultNet through CultLib `85f7024` carries the -generation-bound activation, lifecycle-brake, write-lease, observed-capability, -and disagreement contracts plus routed RUDP incarnation admission. Odin through -pushed `65cf2b2` carries exact source actuation, the narrow driver body, and the -durable three-record deployment transaction. Remaining Odin work is Idunn -projection, bounded RUDP transport, and stable-route integration. VoidBot's -canonical MCP service remains separately owned and is not a deployment -authority. - -Idunn starts and recovers from its own durable admitted state. Odin is the first -managed semantic daemon, never an Idunn bootstrap dependency; its initial -admission is the sole graph-bootstrap exception and begins from a root-admitted -local binding. During an Odin outage, Idunn may preserve already-admitted -continuity and routes, but it may not start a graph-changing transaction or -promote without the exact frozen Odin Ready receipt for that runtime instance -and presence digest. Idunn never manufactures Ready locally. - -### Deployment, discovery, and adjacent capacity - -Idunn is the only deployment and daemon-survival authority; Odin is the -discovery/rendezvous authority. Their health or availability never grants -either organ a campaign write path. Current release identity for Idunn, Odin, -Heimdall, Bifrost, and Epiphany is operational truth in `gamecult-ops`; do not -copy it here and let it fossilize again. - -The landed deterministic foundation retains the exact selected commit, source -tree, recipe blob, and Gitlink facts. Shape validation is not proof of Git -ancestry, signatures, or object custody. Those proofs belong to the narrow -Idunn-owned source driver, which must read the canonical ref and exact objects -as the Idunn identity before compiling a consequential plan. Odin through pushed -`65cf2b2` lands that source driver and the crash-resumable transaction owner -that replaced the command-owner loop. - -Heimdall publishes four redacted typed discovery records to Odin under globally -unique catalog keys: -the provider, private command boundary, Eve access plugin, and transport -profile. Ghostlight resolves `heimdall:command-boundary` from Odin only for -begin, complete, refresh, and logout; valid local app sessions do not depend on -an Odin round trip. No direct Heimdall endpoint remains in the Ghostlight unit. - -Epiphany is adjacent capacity, not part of Ghostlight's campaign authority and -not required by the current provider-backed runtime. Rehydrate her live state -from her own workspace and `gamecult-ops`. Her deployment remains one -Idunn-owned transaction; passive watcher tasks and cross-task exclusivity -messages are not an operational control plane. - -The deployed Session Zero canary survived two exact-build restarts with its -private store intact. Heimdall completed a real KLTST Discord round trip and -adopted one HttpOnly Ghostlight session. Aetheria retrieval produced three -grounded opening decisions. Live DM inference initially exposed that JSON mode -had not been given the Interpreter's application schema; the repaired release -places exact stable schemas before dynamic context, emits only new deltas, and -produced a coherent Mars/Zhestokost follow-up without borrowing First Exodus -state. A forced malformed-output path displayed a local retry notice while the -typed contract remained unchanged. - -Authenticated acceptance against the exact release has proved generated -opening/role/approval compilation, a nonliteral canonical player actor ID, -private assessment, confirmed server roll, wait, daemon restart continuity, -fork isolation, original re-selection, reset, and a MessagePack-backed `.cc` -export. The multiresolution matrix covered 24 factions exactly once at budgets -1, 4, 8, and 32. The strict nested refugee golden placed all 24 subjects in one -rival arena, preserved Mira Venn as a named decision owner, migrated her into a -different depth-two population lineage, produced material activity across six -other background subjects, preserved her delta and the player, and later -promoted the same Mira for a return encounter. Witnesses live under -`F:\GameCult\GhostlightDungeon\acceptance\player-journey-a92fb7a-20260818`, -`gestalt-scale-a92fb7a-b{1,4,8,32}`, and -`gestalt-dynamics-7916ab0-strict`. - -Cell budget and physical provider parallelism are independent controls. The -scale executable accepts `GHOSTLIGHT_SCALE_PROVIDER_PARALLELISM`, defaults it -to the runtime default of eight, and records it in every witness. The corrected -24-subject budget-8 / parallelism-8 wave completed in 18.35 seconds, covered all -subjects exactly once, committed ten material actions plus one attributed -inaction, did not move the player, and required no model retry. Its witness is -`F:\GameCult\GhostlightDungeon\acceptance\gestalt-scale-shakedown-b8-p8`. -The earlier 25.64-second budget-8 witness used four provider slots and must not -be cited as an eight-concurrency performance result. - -`gestalt_migration` records a collective decision by one exact active leaf to -move along an explicit migration relation and reachable route. WorldKernel -changes the leaf's home location and agency-profile location together. The -destination population remains a separate canonical subject, and named member -deltas are not carried by implication. Approval-gated fission creates -destination/stayer cohorts; the same migration primitive moves any resulting -leaf regardless of lineage depth. A local `investigate` activity may omit a -target when it examines the exact current environment. A local `communicate` -may likewise omit a target when its exact source speaks, offers, requests -permission, or notifies an unnamed ordinary role. Both admit ordinary texture -without inventing a listener, response, acceptance, discovered fact, or target -agency. - -Activity effects operate at canonical-location granularity. Incidental motion -around unnamed local features remains part of the source-attributed attempt -and does not create topology or assert arrival. A different supplied canonical -location or population destination still requires the exact movement path. - -Canonical non-player actors have an `actor_activity` path for ordinary -preparation, coordination, investigation, recruitment, obstruction, trade, -and communication. The Interpreter binds the actor's exact ID locally; -WorldKernel validates current location, graph targets, state references, -channels, and human-control exclusion. Actor movement and actor activity share -one action key, while successful consequences remain a separately resolved, -digest-bound outcome. - -Salient dormant members have their own `member_activity` path for ordinary -local attempts. It uses the same bounded verbs, the member's exact location, -their current leaf plus explicitly related or exactly co-located targets, and -their own state/channel permissions. Only the capped salient member exceptions -selected for the cell enter any prompt or can be named there. Migration and -activity conflict on one member key. A destination population cannot inherit -the person's offer, speech, or decision merely because the cover placed them -in the same arena. - -A named member's explicit commitment to board, depart, travel, or join a -supplied destination maps to `member_migration`, even when the first narrated -motion is only entering a queue. `member_activity: prepare` is valid only while -departure remains unchosen. The Interpreter and semantic verifier share this -distinction. - -The semantic verifier emits one ordered verdict per candidate action. -Ghostlight owns exact verdict coverage and derives the aggregate rejected set; -the model cannot reject one arena constituent merely because another -constituent's mapping failed, omit a candidate, duplicate an index, or publish -a global decision that contradicts its per-action rationale. Rejected actions -return to the same private Interpreter draft as exact subject-scoped findings; -unchanged accepted actions retain their verifier binding. - -Population scale uses reversible individuation: - -```text -gestalt baseline + existing member delta, or an admitted foreground or system-owned identity proposal - -> WorldKernel validates gestalt/member/revision/location - -> atomic durable member delta + temporary ActorState - -> ordinary Persona appraisal and world commands - -> expired relevance lease outside player perception - -> atomic fold into the member delta; active slot removed - -> gestalt receives strategic ticks without erasing the individual -``` - -The temporary actor slot is derived. It never owns identity, relationship, -memory, equipment, injury, or obligation state. - -Automatic presence planning projects only active leaves at the player's -location, dormant members whose exact location matches, and materialized -members eligible for folding. The kernel rejects inactive hierarchy nodes and -location mismatches. Nested fission and migration therefore change which -baseline a durable delta composes with, never who the person is. -The projection also names the player actor's reciprocal relationship to each -nearby dormant member. The planner owns reversible scene casting and may surface -an earned callback without a player prompt; it cannot move a remote person or -commit the cast. Failed live casts retain a private presence-preflight artifact. - -Automatic presence has two different authorities. Recasting an existing exact -member is reversible and may follow any relevant foreground event. Admitting a -first-relevance member is canonical entity creation and is available only when -the planner reason exactly matches the immediately committed player-speech -turn. The generated schema closes the individuation lane for resolved attempts, -and `WorldKernel` independently rejects any such plan. Outcome prose and -narration are not entity-admission inputs. - -A separate strategic selector may propose one first-relevance identity only for -an exact selected Gestalt-owned action in the current resolution wave. Its -receipt binds the eligible Gestalt action digest set, exact locally admitted -proposal digest, and world revision. -`resolution::validate_strategic_individuation_proposals` is the single owner of -exact strategic-individuation semantics: one-person budget, selected-action -binding, Gestalt action authority, location, version, lineage, bounded identity -payload, relationships, and uniqueness. The scheduler calls that shared owner -immediately after proposal production. An invalid optional person marks the -selector receipt `semantic_invalid`, records the exact local finding, and is -dropped before wave assembly; the otherwise valid strategic wave may continue. -WorldKernel calls the same validator again against the admitted wave snapshot, -then invokes the same `apply_individuation` primitive used by the system-only -direct command. Early validation is proposal hygiene, not mutation authority or -a substitute for kernel revalidation. The proposal and strategic plan commit -atomically; the selector cannot own entity creation, location, revision, -materialization, or commit. - -Institution `already_committed_posture` is projected as durable state, distinct -from unresolved pressure and fresh choice. Maintaining it is inaction. A model -may propose only a materially different posture; repeated posture remains a -locally rejected no-op and cannot enter an atomic wave. - -Cell appraisals carry exact `actions[]` and exact `inactions[]`. Inactions name -the constituent or selected dormant member who holds and a bounded reason. They -cannot duplicate, cross cell authority, or coexist with an action from the same -subject. They are non-mutating audit/fairness evidence. The former global -inaction string is no longer an owner or runtime path. - -Strategic plan application reads authority and permissions from one immutable -command snapshot. All writes land in a private working campaign which replaces -the command-local campaign only after every action validates. Sequential loop -order is no longer a fictional owner: a migration earlier in the apply loop -cannot invalidate another subject's same-snapshot communication, and a late -invalid action cannot leave earlier in-memory mutations behind. - -The active cell budget, operator-owned pins, and provider concurrency limit are -separate controls. Budget and pins increment `resolution_epoch` without -advancing world revision or fictional time. Provider concurrency increments only -`provider_configuration_epoch`; it batches the same cover and cannot repartition -the world. See `docs/architecture/ghostlight-multiresolution-agency.md`. - -The public application boundary is one stable Eve provider surface: -`GET /api/eve/provider`, `GET /api/eve/surfaces/ghostlight.play`, -`POST /api/eve/commands`, and revision-only `GET /api/eve/events`. Anonymous -surface requests return an Eve Heimdall access gate without campaign, -membership, actor, account, boundary, or Session Zero state. Authenticated -surface requests derive account, selected campaign, membership, and exact actor -from Ghostlight-owned app-session and campaign records before projection. - -Native and browser clients share that logical surface and command authority. -The native path is `ghostlight.native.player` over loopback RUDP -`127.0.0.1:4102`; it exposes only Heimdall begin/completion, actor-filtered -surface retrieval, and canonical Eve invocation. Heimdall persists the OAuth -attempt and single-use completion. Ghostlight redeems the completion into the -same app-session record used by HTTP, then derives every actor and campaign -binding server-side. The installed native client stores only the opaque -Ghostlight bearer in a mode-0600 CultCache file. It never receives a Heimdall -access or refresh claim and cannot submit actor, member, account, or authority -identifiers. While a model-backed Eve invocation is pending, the client sends a -bounded transport keepalive every five seconds; the operation and its result -remain owned by the server-side idempotency reservation and kernel path. - -Odin advertises the redacted native route and operation names in the provider -document. It does not proxy native commands or persist session tokens, attempt -handles, claims, account state, membership, or player surfaces. The boundary is -loopback-only; remote native use requires a trusted host crossing and still -passes Heimdall admission. A malformed or forged native request returns a typed -denial before product projection and cannot enter either kernel mailbox. - -Command ingress accepts only `gamecult.eve.command_invocation.v1`. It validates -provider, logical surface, command boundary, operation schema, source version, -and idempotency before resolving the caller's authority server-side. Browser -payloads containing account, member, or actor authority fields are rejected. -Every admitted operation then uses the existing `SessionZeroKernel` or -`WorldKernel` mailbox and returns a persisted Eve command receipt. Strategic -ticks, region commits, NPC initiative, and raw kernel commands remain outside -the browser capability surface. - -The browser is `EveBrowserProviderHost`, Ghostlight transport, Heimdall access -adapter, status mount, and SSE invalidation. Eve owns editable bindings and -operation capture: renderer-local drafts survive authoritative refreshes and -stale refusals, and only an accepted result may request named draft clearance. -HTML forms may appear as an accessibility lowering detail but are absent from -Eve documents and command payload semantics. Session Zero, campaign, -governance, receipt, and login DOM renderers are not product authorities. - -Heimdall owns OAuth attempts, Discord callbacks, entitlement evaluation, claim -issuance, and single-use completion. Anonymous Eve operations cross Heimdall's -authenticated CultNet operation boundary on Yggdrasil loopback. Sensitive -completion and refresh fields are message-wrapped and never enter the public -CultMesh catalog, Odin records, Eve surfaces, logs, or browser responses. -Ghostlight validates the exact issuer, audience, app, profile, access revision, -session identity, expiry, and `app_access` before creating a local app session. - -`ghostlight.app_session.v1` stores a hash of the random cookie, stable Heimdall -subject hash, exact Heimdall session and access revision, verified capabilities, -expiries, and a locally wrapped refresh claim. Routine requests verify that -state locally. Claim refresh and logout revalidate exact Heimdall session -custody through the private boundary; a stale refresh cannot resurrect a -logged-out session. Heimdall outages leave valid local sessions usable only -until their verified expiry. Campaign access always comes from -`campaign_membership.v1`; account preferences remember only selection. The old -auth store is frozen rollback evidence and does not participate in admission. - -That boundary also projects less state outward than the kernel returns inward. -Player command responses contain only assessment and public commit/roll -receipts. Canonical campaign state and spoiler-bearing actor or institution -state are operator-only. Informational rolls add only their exact previewed -finding to the acting character and a provisional branch fact. The assessor -deterministically binds typed findings into visible stakes before validation, -so formatting is not delegated to a correction attempt. The compiler -classifies each retrieved source as direct seed, setting background, or excluded -before generation. Only direct-seed source text enters causal world compilation; -background and excluded sources remain coverage provenance and cannot donate -story incidents or cast. - -The player-facing story is the chronological lowering of exact committed -`NarrativeTurn` rows. Player speech, Persona speech, and resolved outcome prose -already enter the transcript through the kernel transaction that owns their -revision. The surface does not run a second narrator or verifier model, replace -world turns, or read historical `narration_projection.v1` rows. This removes two -calls per live turn and makes display-layer invention of names, dialogue, -injuries, participants, or actions structurally impossible. - -Player speech address is also typed before it can steer a reaction. A compact -Flash projection receives only the exact co-present simulation-eligible actor -IDs and names, bounded recent public turns, prior conversational focus, and the -new utterance. It returns the exact Persona actors from whom the utterance asks -for a response. `WorldKernel` revalidates those IDs and commits them with the -speech `NarrativeTurn`; neither Eve nor the native client may submit them. -Every present actor continues to appraise the turn, but the private actor slice -now distinguishes `direct_response_expected` from `present_observer`. A direct -addressee must speak or select typed deliberate silence. The kernel lowers -silence to a deterministic visible refusal, so no free-text gesture lane can -claim an unassessed world effect. - -`ghostlight-campaign-inspect` is a read-only typed-store witness retained in the -immutable hosted release. Campaign-store ACLs keep it operator-only. It reports -the latest strategic cover, attributed appraisals and inactions, activity -outcomes, events, news, subject continuity, and model receipt/token metadata -without dumping provider reasoning or raw private narrative streams. - -`ghostlight-mesh-inspect` provides the same read-only operator projection from -a copied derived `mesh.cc` snapshot. It never opens or copies the live campaign -store. Operators may extract one private JSON witness from that copy, then -delete the temporary mesh file; JSON is diagnostic export, not state authority. - -The actor-filtered Eve surface follows the same membrane. It renders the player-owned -ledger—including that actor's own relationships—and already filtered news, but -does not enumerate canonical institution postures or raw world clocks. Those -remain operator state until narration or an exact information channel makes a -development available to the character. A negative regression plants a remote -coup posture and sealed investigation clock, proves all three secret strings -absent from the player surface, and proves an admitted public headline remains. -It likewise exposes only the number of operator pins and local active -population leaves eligible for a fission preview. Pin bodies, remote population -names, and `ReplaceResolutionPins` remain outside the player boundary. - -Exact private per-member and operator projections remain CultMesh documents for -authorized Verse consumers. The public provider advertisement exposes only the -subject-scoped logical surface and Heimdall plugin requirement. Hermodr may -materialize that provider for inspection when its plugin is installed; it is -not a Ghostlight runtime dependency and owns no application state. - -Global strategic context has a separate non-causal lane. Two stable broad Vault -queries run alongside local retrieval, and a Flash extraction stage proposes a -bounded pool of remote institution names with one to three exact supporting -claims each. Local code binds every retained claim to an institution-specific -witness. Only the grounded candidates, capped at 32, enter a separate Flash -synthesis stage. It preserves those canon anchors while generating the smallest -useful campaign-local doctrine needed for strategic action. An independent -verifier checks compatibility rather than textual entailment: source silence is -allowed, while contradiction, canon erasure, identity conflation, story-specific -borrowing, current branch events, and unanchored setting-breaking power are not. -Verification must still cover every grounded institution exactly once; a -malformed or incomplete verdict retries once and then aborts. After one faithful -synthesis correction, a still-incompatible doctrine aborts compilation rather -than deleting an anchored power. Compatible doctrine becomes campaign state and -an approval-visible branch assumption. Exact receipts anchor the institution and -its canon constraints; they do not falsely certify the generated policy as -Vault text. Admitted remote institutions receive deterministic coarse profiles with distinct -authority and explicit unknown facets. The Pro agency stage profiles only local -actors, populations, and institutions where semantic subdivision is useful. -The model schema permits a bounded pool of 64 candidates so provider overage -and ungrounded index fragments can reach local judgment. Exact grounding runs -before the 32-institution simulation capacity is applied; excess grounded -candidates become an approval-visible on-demand-compilation gap. Raw proposal -count therefore cannot consume canonical capacity or abort an otherwise valid -world compile. A supporting claim is institution-specific only when its quotation names -exactly that candidate or comes from the candidate's dedicated source document; -shared index headings, category descriptions, cross-faction lists, and orphaned -sentence fragments are rejected. Exact claims and receipts remain evidence; -synthesized strategic doctrine becomes branch-local coarse simulation goals. - -The Aetheria Vault adapter derives document authority from the exact source -path before any model sees a witness. `Worldbuilding` is reusable canon; -published `Fiction` and legacy `Stories` are historical reference; static -interactive output is a fixture artifact; `Brainstorming` is working draft; -and `Game Design` is design reference. Only reusable canon may enter a new -branch's `direct_seed` lane or the global-agency compiler. The classifier may -further narrow canon by relevance, but it cannot promote a lower-authority -document. Direct-seed projection and receipt selection repeat this local guard, -so a malformed or stale classifier output cannot smuggle a story cast into the -world seed. The live AetheriaLore retrieval archive is correspondingly bounded -to `Aetheria/Worldbuilding/`; durable facts discovered through fiction must be -promoted into Worldbuilding before they become reusable campaign canon. - -Strict provider schemas do not carry canonical dynamic maps directly. Compiler -routes and relationships cross the model boundary as explicit ID-bearing -records, then local validation rejects empty or duplicate IDs and lowers them -once into canonical maps. The same cut applies to fixed six-axis agency facets, -destination-expansion routes, population-fission assignments, and strategic -resolution-demand weights. This preserves semantic keys under providers whose -strict object dialect forbids open-ended `additionalProperties`; an empty closed -object is never accepted as a substitute for route, relationship, assignment, -or facet authority. Canonical campaign and resolution documents retain their -map-shaped storage contracts. - -The Codex/OpenAI connector owns one further provider-only projection for exact -compound literals. Scalar `const` values survive. Array and object `const` -values lower recursively to the supported strict Responses subset: fixed array -lengths with bounded item literals, or closed objects with every exact key -required. Array ordering and multiplicity are necessarily wider at this -transport layer. The native request schema remains unchanged, and its consumer -validator still owns exact equality before any proposal can reach admission. -No compiler, elaborator title, or generic agent loop carries a provider-specific -repair for this dialect boundary. - -`F:\Projects\Kalsa` is the first bundled fantasy Vault canary. Its typed -manifest makes the `Public` tree player-safe world knowledge and the `Spoilers` -tree GM-only canon; workshop material is non-canonical. Selection, Git/Obsidian -provenance, retrieval, exact receipts, and player projection preserve those -lanes without copying Kalsa into the read-only Aetheria recovery index or -creating a Ghostlight-owned semantic index. - -Destination compilation treats Vault evidence as canon constraints rather than -an exhaustive game map. Identity resolution sends a genuinely new place to -bounded region expansion and an exact reachable canonical place to locality -elaboration. Locality elaboration preserves the existing place identity while -adding only contained places and locally scoped subjects, public facts, and -relations. A player's question can select the missing domain but cannot dictate -the office, procedure, or answer. Inhabited proposals must expose current -authority, selection or succession, public resources, and redress through a -typed civic manifest whose exact fact references are shared by each resident -population. A separate model stage verifies their semantic legibility; it may -reject but cannot rewrite or commit the proposal. - -Destination repair is the first consumer of the generic model-agent harness. -The harness owner is `run_model_agent`, operating only over `ModelPort`, a -`ModelAgentSpec`, and a consumer-owned `ModelAgentTool`. The spec supplies the -stage, logical model class, frozen snapshot binding, instructions, causal -receipt IDs, per-call settings, and semantic step limit. Before every step, the -tool publishes the action schema legal at its current private state. Static -tools may route a contract from their actual domain owner; world elaboration, -for example, delegates schema derivation to `WorldElaborationAssignment`. The -harness outputs one accepted consumer-owned value plus the complete receipt -chain, or one terminal failure plus the receipts completed before failure. Step -transcript, tool observations, causal source-ID accumulation, and -`semantic_invalid` marking are derived run state. The harness has no campaign, -fact, institution, civic, kernel, or persistence type and cannot validate or -mutate world state. Patina or another consumer may supply a different action -and tool without moving that consumer's state authority into the harness. - -Once the destination compiler has produced a repairable frozen civic candidate, -that exact seed initializes one private workbench owned by -`DestinationReconciliationAgentTool`. The balanced-model agent may take at most -four small typed actions: `validate_current`, or `revise_and_validate` with a -bounded transactional edit batch. The edit algebra replaces one stable fact -slot, one resident fact-ID set, one frozen institution's operational fields, -individual local relations, or the civic-manifest membership and fact lanes. -The action wire is one root object with a typed tool discriminant and nullable -edit batch; the connector refuses root-union schemas locally before provider -submission. The action schema contains no complete-candidate type. A failed edit batch -changes nothing. An admitted edit persists only in the private workbench and -returns `Continue` when the resulting draft still fails validation; its digest, -changed slots, and exact typed finding become the next observation without -reprojecting the whole draft. - -Sol's seed remains the immutable owner of geography, routes, migration, -population identity and ordinary state, institution identity/name/goals and -locations, civic jurisdiction, branch assumptions, and gaps. The initial -compiler finding and every later tool finding use the same typed -`DestinationReconciliationFinding`; civic verdict booleans are not collapsed -into rationale-only text. `destination_fact_findings` remains the sole -candidate-fact namespace owner. Every current or edited draft traverses that -checker, `apply_civic_reconciliation`, ordinary lowering and structural -validation, and a fresh independent civic verdict. The verifier's structured -schema declares the same one-to-1,000-character rationale bound enforced by its -deterministic gate. It may return a verdict and receipt but cannot edit the -workbench. An accepted candidate remains only a compilation preview; -`WorldKernel` and the mutation reducer are the sole world-state admission and -commit authorities. - -`ModelAgentTool` has associated typed `Action`, `Finding`, and `Output` contracts. -The harness serializes a consumer's finding only when constructing the next -model observation; it cannot invent or interpret a domain finding. The civic -verifier performs one inference for each exact candidate and returns its typed -verdict and receipt to the tool. Only `run_model_agent` owns semantic action -iteration and its four-step budget. The initial candidate plus four validating -agent actions can therefore produce at most five civic-verifier receipts. Provider -transport and schema retries remain the separately named lower-level authority -of `run_validated_stage`; they do not select or repair a civic candidate. -Accepted verifier receipts are rebound to the exact candidate before preview -admission. Completed compiler, action, tool, and verifier receipts survive -terminal failure and are persisted by both the strategic harness and the -Dungeon API. Generic harness tests prove that a later action cites both the -rejected action and tool receipts, and that exhaustion returns every completed -action and tool receipt. A tool may also return `Continue`: the valid action -updates only consumer-owned private draft state, its receipt remains valid, and -the typed observation requests the next step without pretending the task was -rejected or complete. Accepted civic systems persist as versioned component -state, so a later pass receives the current institutions, populations, facts, -and relations and must extend that apparatus instead of inventing a parallel -government. - -World-elaboration tone has one typed catalog of titled workers. `Patina` owns -reusable low-stakes local texture; `Charter` civic institutions and procedure; -`Ledger` material economy; `Hearth` ordinary relationships and belonging; -`Tangle` factions and political leverage; `Veil` uneven knowledge; `Ember` -active pressure; and `Numen` ritual, magic, and wonder. Each user slider is a -zero-to-one-hundred relative dispatch weight, not prompt decoration. The -deterministic smooth weighted scheduler apportions every invocation-budget slot -against the complete enabled profile. It records requested share, actual -dispatch count, and per-title unused allocations; when a selected title is -blocked, that slot remains unused instead of increasing another title's -frequency or creating catch-up debt. A bounded wave invokes the scheduled -sub-agents in parallel. One typed wave binding names the immutable snapshot and -is passed to every invocation and returned with every proposal. Successful -proposals return in deterministic ordinal order. `WorldElaborationAssignment` -owns each dispatch's exact operation contract: it derives the instruction, -projects the generated structured-output schema down to the assigned variant -and deterministic values, and validates the submitted proposal against the -frozen snapshot. The provider-backed worker only routes that assignment through -the generic `ModelAgent`; the connector may structurally widen unsupported -compound literals on its private schema clone, while this unchanged assignment -validator retains exact semantic authority. The harness owns the bounded -two-step transcript/tool loop and receipt chain, not world semantics. Local -rejection returns as the next tool observation. Patina, Ledger, Hearth, -Veil, and Ember use the fast model class; Charter and Tangle use balanced; -Numen uses capable. The worker returns the complete action/tool receipt chain -with its proposal. A failed wave returns the consumed schedule, every completed -proposal, each failed dispatch, and all available worker receipts, so fairness -state cannot advance without an explanatory receipt. -`resume_elaboration_wave` is the sole partial-wave recovery owner. It accepts -that exact failure partition, validates it against the original immutable wave -and complete consumed schedule, retains every completed proposal and receipt, -and invokes only the failed original dispatches. It does not schedule new work -or advance fairness state. A duplicate, missing, unbound, or drifted dispatch -closes the resume seam before any worker call. -Successful wave construction is opaque outside the dispatcher. The admission -boundary rechecks requested and unused slots, per-title and total dispatch -counts, eligible titles, ordinal windows, weights, requested shares, final -scheduler state, the exact invocation partition, and every supplied worker -receipt's dispatch-specific snapshot binding before dispatch order may decide a -conflict. Every successful invocation must carry a terminal accepted model -receipt; generic receiptless scheduler fixtures cannot cross world admission. - -Those proposals are not canonical mutations. Each invocation may return one -additive `WorldElaborationOperation`: place, route, branch-local fact, -population/profile pair, institution/profile pair, local or migration relation, -or civic manifest. `admit_world_elaboration_wave` rechecks the revision-bound -wave, rejects malformed operations, gives a colliding write claim to the first -authentic scheduler dispatch, and retains every later conflict with the exact -prior dispatch ordinal. It merges accepted operations into one non-canonical -`LocalityElaboration`; ordinary locality validation owns the resulting -structural diagnostic. - -Titled operations cannot claim source-evidence receipt IDs or canon-candidate -authority. Facts are branch-local or provisional; profiles and relations carry -no source receipts. `WorldKernel::commit_elaboration` accepts only the opaque -finalized elaboration capability, not caller-supplied evidence or canon -candidates. Adding source-grounded elaboration later therefore requires an -explicit typed binding rather than an unattached vector at the commit seam. - -A titled worker must leave the civic semantic-verifier receipt empty. -`finalize_world_elaboration` binds the immutable admitted candidate to one -independent verifier receipt that may accept or reject but cannot rewrite it. -Its ancestry must equal the complete admitted worker-receipt set, without -omissions, additions, or duplicates. Canonical Gestalt state stores shared -knowledge as fact statements; the civic verifier receives a derived exact-ID -view reconstructed from those statements and the admitted fact namespace, so -its identity-grounding judgment does not mistake the storage projection for a -missing compiler field. -Admission and finalization values are opaque, serialize-only capability -receipts; callers cannot deserialize or reconstruct them as commit authority. -`WorldKernel::commit_elaboration` consumes that final value, revalidates the -admission digest, campaign revision, candidate derivation, and verifier binding -inside its mailbox, then uses the existing `ElaborateLocality` path. That shared -path lowers the complete candidate into exact permitted `WorldMutation` -operations, applies the closed reducer, projects the accepted result, and -persists the aggregate campaign, authority, batch, and mutation receipt -atomically together with every titled-worker and semantic-verifier model -receipt. Titled workers never receive a `WorldCommand`, permit, mutation batch, -store, or kernel write handle. The current proposal algebra is additive -locality elaboration; replacement of existing canonical subjects remains -outside this authority. - -#### Acceptance-driver whole-world bootstrap - -- **Owner:** the strategic acceptance driver owns orchestration and recovery of - an optional whole-world bootstrap. It owns neither geography nor canonical - mutation. The existing destination compiler agent owns each bounded region - proposal; `WorldKernel` alone may admit it through `ExpandRegion`. -- **Inputs:** an admitted root campaign, its exact authored world description, - the boundary observer's canonical location, and an ordered list of at most - eight `GHOSTLIGHT_WORLD_REGION_REQUESTS`. Each request specifies one bounded - realm; the root compiler remains intentionally bounded-local. -- **Outputs:** one frozen ordered `world-regions-plan.json`, one immutable - proposal checkpoint before each mutation, one sequential kernel commit per - genuinely new realm, and an immutable `world-region-NN-checkpoint.json` - binding request, origin, committed jurisdiction, exact compiler mutation - proof, kernel receipt, and model-receipt hashes. Committed - jurisdiction IDs become the locality set for later elaboration and strategic - simulation. -- **Derived state:** `status.json` progress and the jurisdiction list are - orchestration projections, not world truth. -- **Forbidden writers:** the driver, root compiler, destination compiler, - checkpoints, and elaborators cannot directly write campaign state or invent - Delvehold-owned player, civic, dungeon, contract, workshop, or quantitative- - economy effects. -- **Admission policy:** the operator-authorized autonomous run may admit a - structurally and semantically valid branch-local destination even though the - Dungeon UI would label its preview `requires_approval`. Unresolved canon gaps - still stop the run; the driver cannot approve through them. -- **Shared paths:** fresh and resumed runs use the same frozen ordered plan, - destination compiler, and kernel admission path. Resume rejects omitted or - reordered requests, skips a region only when its checkpoint and canonical - receipt and mutation proof agree. Foundation, region, titled, and complexity - recovery all bind the immutable prepared candidate to the exact canonical - receipt; the presence of a plausible ID or checkpoint file is never treated - as proof that its content committed. -- **Cut line:** whole-world scope is not overloaded onto the root compiler. The - driver reuses existing destination compilation and kernel admission; there is - no second region generator or event authority. -- **Verification layer:** destination validation and reconciliation bind each - candidate before kernel revalidation and commit. End-to-end acceptance also - requires all requested realms to enter locality elaboration, iterative - complexity rounds to satisfy the consumer scale intent, the bounded - multiresolution cover, strategic waves, and grounded newspaper projection. - Runs 64 and 65 stopped before that claim was established and remain failure - evidence rather than accepted full-world runs. - -#### Qualified latent-world complexity and elaborator continuity - -- **Owner:** `elaboration::canonical_actionable_subject_ids` is the single - qualification derivation for world-scale complexity. It reads the canonical - campaign and returns the active subjects allowed to pay the scale target. - `derive_world_elaboration_demand` owns target and deficit arithmetic. - The strategic acceptance driver owns bounded round orchestration and selects - parents only from the same qualified-ID set. `WorldKernel` remains the sole - canonical mutation owner. -- **Inputs:** the admitted campaign; active, simulation-eligible agency profiles; - Gestalt lineages and residual IDs; each fission child's retained parent - semantics; the active-cell budget; the consumer-authored target cover basis - points; realm weights; topology-derived jurisdiction; realm pressure and - detail debt; bounded round and concurrency limits; model receipts; and the - compact title-by-jurisdiction elaborator checkpoint. -- **Qualification invariant:** compiler-admitted roots and individuated people - enter through their owning admission gates. A fission child qualifies only - when it is not any lineage residual, retains the exact parent baseline, and - has additions in at least two of capability, knowledge, goal, and pressure. - Residual populations preserve unresolved membership and lineage only. They - are non-simulation state, do not enter the public action namespace, do not pay - the complexity target, and cannot become recursive complexity parents. - Ordinary inherited-baseline fission children remain simulatable without - satisfying the qualified world-size bill. -- **Demand invariant:** the target actionable-subject count is - `ceil(active_cell_budget * 10_000 / target_cover_basis_points)`. An active - cell budget of 240 at a 20% cover target therefore requires 1,200 qualified - subjects. The demand is re-derived from accepted canonical state after every - round. The pre-wave phase boundary requires the qualified count to equal the - target exactly; a larger count is not accepted as a satisfied target. On - post-wave resume, the last fully validated complexity checkpoint owns that - historical pre-wave count because legitimate strategic individuation may - have increased the current campaign count. -- **Round dataflow:** frozen campaign -> qualified-ID derivation -> distinct - qualified parent selection by jurisdiction pressure and detail debt -> - deterministic titled dispatch -> parallel model proposals -> semantic - validation and same-batch supersession -> sequential kernel commits -> - qualified-ID re-derivation. Every accepted round must strictly increase the - qualified count. Missing parents, zero growth, or a nonzero deficit at the - round ceiling is terminal failure rather than completion telemetry. -- **Gain allocation:** `ModelWorldComplexityWorker` distributes the remaining - deficit over the assigned distinct parents, with an exact target gain of one - through six per dispatch. An elaborated fission emits target gain plus two - children because the retained parent retires and the residual child does not - qualify. The semantic validator checks the resulting - `children.len() - 2` against the qualification. -- **Proposal lanes:** Hearth, Tangle, and Veil individuate one consequential - member. Patina, Charter, Ledger, Ember, and Numen elaborate a population - fission. The model owns only the lane-specific draft; the tool reconstructs - campaign ID, revision, parent, axis, evidence and approval bindings around - that draft. -- **Fission draft and output:** each child draft contains an ID, public name, - partition value, home location, capability additions, knowledge additions, - goal additions, and pressure additions. The draft also names the residual - child and exact member and resource assignments. The tool clones the frozen - parent baseline, applies only those additions, and emits a - `WorldComplexityFissionQualification` binding title, jurisdiction, and exact - target actionable gain. -- **Fission semantic invariant:** every specific child has a normalized public - identity distinct from existing Gestalts and its siblings, remains inside its - assigned jurisdiction, and contributes at least two bounded causal - dimensions. Additions are bounded to two capabilities, two knowledge - statements, one goal, and one pressure, and must be semantically distinct - from the parent and siblings. Only Geography fission may move children away - from the parent home; when multiple admitted places exist it must use at - least two. The residual stays at the parent home with the exact parent - capability, knowledge, goal, and pressure baseline and the - `other/unknown` partition. -- **Title-specific fission shapes:** Patina requires a capability and goal. - Charter and Ledger require a goal, pressure, and either capability or - knowledge. Ember requires a pressure and either capability or knowledge. - Numen requires goal, pressure, and knowledge. -- **Individuation invariant:** every admitted member has a goal, a concrete - memory, and at least one additional identity-bearing dimension. Hearth also - requires a concrete care or belonging obligation. Tangle requires an exact - relationship to an existing canonical subject. Veil requires knowledge not - held by the parent population. The resolution validator rejects normalized - public-name collisions with existing actors and members; same-batch duplicate - canonical member IDs or public identities are superseded by the lowest - dispatch ordinal. Actor, institution, Gestalt, dormant member projection, - agency-profile key, profile ID, and profile subject ID share one canonical - subject-ID collision predicate at proposal validation, deterministic rebase, - and kernel application. Promotion alone may claim the exact member's own - reserved projection. -- **Typed mutation path:** `WorldCommand::ElaborateGestaltFission` carries the - preview, exact qualification, and model provenance. The kernel revalidates - both elaborated-fission structure and titled complexity semantics before - lowering. The lineage split first inherits the parent's component baseline. - Only this elaborated command may add the approved capability grants, - proposition admissions and knowledge acquisitions, goal commitments, and - pressures in the same component-world batch as identity, occupancy, custody, - membership, relationship, and civic rebindings. -- **Projection invariant:** component-batch application occurs against a cloned - overlay and validates the complete next world before aggregate projection. - Projection verifies exact capability entry IDs and descriptions, known - proposition statements, active goal descriptions, and unresolved pressure - labels against each approved child. It persists exactly the approved - preview-minus-parent knowledge additions as campaign facts through the - shared proposition resolver, copies the approved child semantics with typed - identity and occupancy, and derives resources from accepted custody. Campaign, - authority, batch, and receipt records persist only after projection succeeds. -- **Ordinary fission boundary:** `WorldCommand::FissionGestalt` retains the - strict inherited-baseline contract. Its lowering emits no semantic-delta - mutations. Elaborated semantic additions cannot enter through that path. -- **Relationship contribution:** the lineage reducer inherits every active - parent relationship to each child and aggregate projection retires the parent - relation. Fission has no free-form relationship-addition field. New - relationship texture enters qualified complexity through Tangle - individuation, while locality elaboration owns new civic relations. -- **Horizontal expansion boundary:** destination compilation and locality - elaboration own places, routes, population roots, institutions, civic - apparatus, and local political relations. Complexity fission may distribute - a Geography split across admitted places but cannot invent geography or a - parallel political apparatus. Horizontal civic foundations must therefore be - admitted before vertical complexity can elaborate them. Each admitted realm - must contain at least three mutually reachable internal places with resident - homes in at least three. At scale completion, each jurisdiction must place - qualified subjects in at least three locations and no one location may hold - more than four fifths of its qualified subjects. -- **Civic diversity context:** destination compilation and its semantic verifier - receive up to eight peer civic apparatus contexts. Candidate generation - requires materially executable means, preserves mixed, diasporic, and - cross-border constituencies, rejects ancestry-only civic partitions, and - admits locally coherent forms of redress. Verification separately requires - `political_form_distinct_or_deliberately_shared`, - `opposed_interests_have_distinct_means`, and - `candidate_text_intact`. Prompt excerpts are truncated only at word - boundaries. -- **Outputs:** canonical actors, Gestalts, members, agency profiles, lineages, - facts, component capabilities, knowledge, commitments, pressures, - relationships, memberships, occupancy, custody, civic bindings, and mutation - receipts. Qualified actionable IDs and the current deficit are always - derived from those canonical outputs; there is no independently writable - qualification flag. -- **Derived telemetry:** elaboration demand, round reports, previews, model - receipts, session compactions, supersession reports, and resume checkpoints - explain orchestration and recovery. They do not own world truth or - qualification. Session memory is bounded by title and jurisdiction and binds - only committed receipts; raw model sessions and transcripts are not - canonical state. -- **Recovery invariant:** every completed complexity round reopens its frozen - preview and validates every mutation, supersession, rejection, model receipt, - semantic verdict, canonical world receipt, and exact fission or individuation - mutation proof in one contiguous revision chain. An existing commit - checkpoint is accepted only after the same validator proves both historical - authority and the committed proposal effect. The cumulative session set must - equal prior memory plus every exact accepted/rejected invocation journal; - untouched sessions remain byte-equivalent and touched generations bind their - receipts, findings, prior digest, and round-end revision. Verifier transport - failure is a generational resumable checkpoint and never masquerades as - semantic rejection or causes the elaborator proposal to replay. -- **Forbidden writers:** model workers, schedulers, reports, checkpoints, - compaction text, cover construction, strategic cells, and renderers may not - create canonical subjects, mark a subject qualified, alter the target, or - repair semantic state after commit. Ordinary fission may not grant semantic - additions. Complexity fission may not create places, institutions, civic - systems, or arbitrary relationships. Residuals may not pay or recursively - service the target. -- **Shared paths:** initial runs and resumed runs derive demand and qualified - parents through the same functions. Rebase may update only the expected - revision when the frozen parent binding is unchanged; child-ID collisions are - renamed deterministically before revalidation. All fission writes, including - relationship inheritance and resource/member movement, pass through the same - typed batch and kernel commit boundary. -- **Cut line:** qualification is derived from canonical campaign semantics and - lineage, not stored beside them. The count, parent selector, progress check, - and completion check all consume that derivation. Any alternate active-leaf - counter, residual-inclusive quota path, or report-owned completion opinion is - outside the live authority model. -- **Verification layer:** focused tests prove 240 active cells at 20% require - 1,200 subjects; residual and ordinary relabel fission children do not pay the - qualified bill; exact target gain is enforced; title-specific additions are - bounded and distinct; public identities cannot collide; duplicate - individuations supersede deterministically; elaborated fission commits its - capability, proposition, knowledge, commitment, pressure, relationship, - custody, membership, and fact projection atomically; component re-snapshot - validates; ordinary lowering rejects a semantic preview; and the destination - verifier enforces political distinctness, materially opposed means, and - intact candidate text. - -Autonomous strategic waves run the same admitted agency state through parallel -cell membranes under a provider concurrency gate. Action-bound individuation -may create one consequential named person through the existing Gestalt member -commit primitive; that person enters later covers as the same canonical actor. -Public action channels produce committed `NewsIssue` records. The world- -consumer boundary admits an authority-gated editorial-voice request, then -validates the exact `NewsIssue` to committed-`Event` public-channel chain. -The public-event owner derives each committed event's human-readable account -from its typed effect and canonical subject names. Event semantics own the -assertion-status mapping used by every public consumer. Relation coordinates, -numerical deltas, action-selection rationale, and other state machinery do not -become public facts merely because a newsroom exists. - -The deliberative newsroom boundary is live under this authority map: - -- **Objective:** one publication investigates the immutable public record, - selects the facts its actual stories require, and constructs a pointed - narrative without inventing world state or paying for a duplicate source - ontology. -- **Owner:** canonical `NewsIssue` plus `Event` rows own public provenance and - facts. `Event::public_assertion_status` owns attempt, declaration, - committed-course, material-outcome, and unspecified-account semantics. The - in-world assignment editor owns assignment: story choice, order, section, - journalist, issue shape, per-story narrative function, context role, focal - record, exact citation grouping, throughline, tension, assignment rationale, - and reader question. Its - deterministic workbench owns derivation of the bounded period directory, - query admission, inspected-record membership, - the bounded working-context projection, exact-ID fetch, agenda validation, - focus-record dereferencing, candidate identity, and exact commit admission. - The generic agent harness owns message framing: for snapshot tools it freezes - the complete first request as one user message and replaces only the later - workbench message. The tool owns the snapshot content. The provider owns - automatic prefix-cache admission, retention, and hit accounting; neither the - harness nor the newsroom may declare a hit, and newsroom correctness or - acceptance cannot require one. - The production-checkpoint validator owns whether an admitted agenda or - accepted reporter filing is exact enough to resume; `CampaignStore` owns its - immutable storage, not its editorial judgment. Each assigned in-world - journalist owns one reader-facing - story and receives only that pitch, its exact records, and that journalist's - stable recurring character: beat, voice, biases, preferences, source - instincts, and blind spots. The copy editor owns one complete factual - query report over the assembled page; it neither rewrites nor accepts - publication. The Night - Editor owns one deadline close over that page and report. The deterministic - press witness owns structural admission, lineage, and exact before/after - evidence for what printed; it does not judge prose. Errors discovered after - close belong to a later edition's correction memory, not a same-edition - repair loop. V13 defines that ownership boundary but does not yet persist a - typed correction record. Publication employees are not world actors or event - writers. `WorldKernel` remains the only world-event writer. -- **Inputs:** one exact campaign revision, publication title and voice, article - budget, a validated embodied newsroom roster, source-receipt ancestry, and - `character-newsroom.v16` contract. Before its first query, the assignment - editor receives a bounded per-period directory containing only timestamps, - completed-material-change headlines, the full completed-change count, and - counts of other records. Headline sampling preserves canonical ledger order - within a period rather than lexically privileging whichever headline sorts - first. This is - navigation context: it cannot be cited, does not make a record inspected, and - does not replace query or exact-ID fetch. Each reporter receives the common stable - house charter first, that journalist's stable recurring identity second, and - the current assignment workbench last. The assignment editor receives its own - staff profile plus the complete journalist roster; it does not receive the - copy editor or Night Editor profiles. Through the - existing generic agent harness, the selector issues deterministic bounded - queries over stable `NewsIssue` IDs using literal terms, exact asserted - public entity names, assertion statuses, channels, newest/oldest ordering, - and an already-inspected cursor. An empty query browses. It may also fetch at - most 24 complete records by exact stable ID. Each response returns at most 24 - exact projections and the agent has at most twelve semantic steps; - the complete immutable ledger remains queryable rather than being split into - privileged recent and foundational windows. The harness receives the stable - role charter, semantic-step budget and output schema plus the tool's optional - current snapshot and latest observation; changing workbench state is not an - input to the frozen first message. -- **Outputs:** an agenda proposal does not finish selection. It yields one exact - candidate digest plus a deterministic front-page proof: the proposed lead's - complete focus record, the complete focus record for every below-fold pitch, - compact supporting-record identities, the proposed narrative claims, - tensions and public questions, and explicit comparison questions. The agent - may query again or replace the candidate. Selection finishes only when it - submits `commit_agenda` with the exact digest of the current reviewed - candidate. The committed agenda is immediately stored as one immutable - production checkpoint before any reporter runs. It carries one dominant throughline, reader - stake, evidence-based special-or-general issue shape, and ordered story - pitches. Every pitch names stable public-record IDs, chooses one focus record, - section, journalist, narrative function, and context role, and supplies bounded - assignment rationale, - narrative claim, tension, and public question. Accountability, opposition, - and counter-narrative pitches also carry a typed conflict axis: two distinct - named parties, two distinct selected exact citations, bounded descriptions of - each party's public move or position, and the editorially framed conflict. - Deterministic admission proves both parties are asserted by their cited - records and rejects one record presented as both sides of a dispute; an - abstract antagonist or passive filing recipient cannot impersonate an - opposing move. - Consequence and independent stories may omit the axis when the ledger has no - honest adversarial motion. Article count plus bounded paragraphs and output tokens - define page space. There is no citation-count page budget. A foundational - record may support several continuing stories when each pitch uses it for a - distinct throughline. One journalist agent files each assigned story and the - page is assembled deterministically from assignment-owned section, byline, - and citations plus journalist-owned prose. Every accepted filing is stored as - its own immutable production checkpoint before the next reporter runs. The - cited facts deterministically derive `allowed_datelines` for the reporter's - dynamic workbench. The generic stable output schema admits the dateline's - syntactic shape, while `validate_editorial_article` alone admits it against - places asserted by that filing's cited records: the lead must choose a cited place - when one exists, while a later article may choose a cited place or remain - blank. The copy desk emits one - assessment plus the complete bounded set of exact factual query passages; - the Night Editor emits one close action; and accepted composition v3 carries - the printed issue, copy report, press-close witness, and exact receipt chain. - Each snapshot-agent run also emits a provider request sequence whose first - request is one stable user message containing the complete role charter and - step-one directive. Every later request begins with that exact message and - adds one second user message containing only the current bounded workbench - state, latest observation, and next-step directive. -- **Derived state:** public-record projections contain their stable ID, - timestamp, channel, headline, reliability, exact committed accounts, - assertion statuses, committed event IDs, and only those people, - institutions, populations, places, and identity attributes asserted by the - account. The per-period directory groups those projections by exact - timestamp, retains at most twelve distinct completed-change headlines per - period, and counts every other record. It is a lossy navigation projection - with no factual, selection, or citation authority. Query pages, the visible-ID set, pending agenda, candidate digest, - front-page proof, review questions, and late reader-facing citation numbers - are transparent derived views. After each nonterminal selector step, the - workbench derives a compact inspected-record index containing only record ID, - time, channel, headline, and asserted named entities, plus query/record counts - and the pending candidate token; full fact bodies return only through the - bounded query or exact-ID fetch. Production checkpoint IDs, reporter-assignment - digests, receipt-chain and complete checkpoint-content digests are also - derived. `allowed_datelines` is deterministic prompt guidance derived from - the cited facts, not factual admission authority; it remains in the dynamic - workbench rather than changing the reporter's generic provider schema and - provider request identity. `validate_editorial_article` owns factual admission - after the model returns. - The cacheable prefix is the byte-stable first request plus its unchanged output - schema; the dynamic suffix is the second workbench message. Provider-reported - cached-token counts are optional observations of that external cache, not a - newsroom invariant, acceptance gate, or proof that a particular request will - hit. - The query-index set, query-bearing article - set, changed-article set, source-page digest, printed-page digest, and - receipt-chain digest are also derived. None is a persisted world subject, - fact bundle, relevance authority, prose judge, or event writer. -- **Editorial path:** the selector may use the period directory to choose where - to investigate, but it must inspect a record through query or exact-ID fetch - before citing it. It - can search backward from routine updates to the original rupture and can - acknowledge that later handling is an installment in a continuing story. - It first proposes an agenda. The workbench validates it, dereferences the - focus record of every pitch, places the proposed lead beside the stories it - would bury, and returns the exact candidate digest. This is an observation, - not acceptance. The agent must reconsider the actual consequences in that - proof and explicitly commit the current digest; a replacement proposal - retires the prior candidate as commit authority. Once committed, the exact - task/editorial-bound agenda checkpoint is the sole reporter-assignment source - on retry. In a special issue, only the lead may own shared chronology; later - stories assume it and perform distinct narrative functions. In a general - issue, every story owns independent context. Each assigned journalist sees - the common publication house charter first and only that journalist's - recurring character second in the stable prefix. Issue shape, page - throughline, one pitch, its exact records, and the deterministically derived - `allowed_datelines` arrive last in the replaceable workbench message. - They center their story on its focus record and may not widen or regroup the - selection. Each accepted filing is bound to that agenda checkpoint, article - index, exact pitch, journalist identity and profile, and local reporter - snapshot binding before it becomes reusable. Record bookkeeping, memory retention, maintained - warnings, and procedure are not automatically the lede merely because they - are recent. The copy editor sees the assembled page and selected facts. The - Night Editor sees only queried articles, their assignments and cited facts, - the numbered checklist, its own profile, and the profiles of the affected - reporters. -- **Desk and press path:** accepted stable IDs lower once into the existing - self-contained semantic audit with source news IDs, source timestamps, - channels, reliability, - exact account text, assertion status, event IDs, supported identity - attributes, institutions, populations, and places. Reader-facing numeric - labels are assigned only during lowering. The copy desk reads the selected - fact projection and assembled page exactly once, returning all factual queries - at once as exact unique passages with reasons. The immutable close checkpoint - binds that report, page, agenda, task, sources, and receipts before the Night - Editor acts. The Night Editor receives the affected assignments, queried - articles and facts, and numbered query list, then gets one action to - disposition every query and provide complete replacement prose for exactly - each queried article. The - press workbench freezes article selection, order, section, byline, citations, - and agenda and forbids changes to every unqueried article. It validates structure and source - membership, not whether the final language is true or compelling. A structurally invalid - close exhausts the one action and prints the checkpointed journalist page with an - explicit non-applied close witness. There is no post-close model reread. -- **Agent context path:** every run begins with one user item combining - the stable charter and the step-one directive. For a tool that owns a bounded - current context snapshot, that complete first request remains byte-identical; - after each nonterminal action the harness discards old model chatter and - observations and replaces only a second user item with the current snapshot, - latest finding, and next-step directive. This gives the provider an implicit - cache breakpoint after request one without creating an application cache or - explicit breakpoint API. Tools that publish no snapshot retain the ordinary - append-only conversation path after the same single-message initial request. - The assignment workbench uses this seam for its compact - inspected-record index and pending candidate token. Reporter workbenches use - the same seam: the common house charter precedes the recurring journalist - identity in the stable first message, and the dynamic assignment snapshot is - the second message. Exact-ID fetch - restores only the requested full records. Selector query, fetch, proposal, and - commit share one stable structured action schema. The Night close schema is - likewise stable across checklist contents; its private workbench enforces the - exact queried set. Tool schemas stay in the provider output contract rather - than being duplicated in prompt text. - Prompt-cache routing binds stage, model class, and exact output schema; - changing world context does not mint another routing key, while changing the - contract does. Cache reuse is meaningful inside repeated calls of one live - agent conversation, including the append-only path. Independent reporter - filings are sporadic one-call agents and may outlive provider retention, so - their cache eligibility is telemetry rather than a design requirement. Each - journalist receives only its own embodied profile, one - pitch, and that pitch's records; it does not receive other reporters or desk - staff. Copy receives its own embodied profile plus the complete selected fact - desk and assembled page because it alone checks the page. Night receives its - own embodied profile plus only the queried articles, affected assignments and - facts, numbered checklist, and affected reporter profiles. -- **Invariants:** private events do not enter the query surface; every selected - stable ID resolves at the bound revision; story order, selection, citation - grouping, focus, section, and journalist remain agenda-owned; no proposal reaches the journalists - without deterministic proof observation and exact-current-digest commit; - omitted public facts remain true; assignment, writing, copy queries, close, - lowering, and witness creation cannot mutate the world. There is one bounded - reporter pass per pitch, one copy report, and one admitted Night Editor close. No model verdict - rereads the printed page, no rejected close opens an iterative rewrite loop, - and no external evaluation can reopen an immutable edition. The witness must - preserve exact source and printed page digests, receipt ancestry, every query - disposition, every changed article index, and deterministic re-derivation of - the printed issue. Admitted agenda and accepted filing checkpoints survive a - later reporter or copy failure without becoming printed truth; reuse requires - exact current task, editorial, assignment, stage, snapshot, and receipt - bindings. A directory headline is never citation evidence: every assigned - source must still have been returned by exact ledger query or exact-ID fetch, - and every new audit citation exposes the canonical source timestamp. - Historical v13 citations decode with an empty timestamp list and retain their - exact old audit rendering and serialized receipt shape; empty legacy time - lists are omitted from serialization. The source-time line and field appear - only when canonical timestamps are present. -- **Forbidden writers:** the selector and query workbench cannot create, - mutate, deduplicate, summarize into, or reclassify `NewsIssue` or `Event` - state. The deterministic proof cannot rank stories or commit an agenda; it - exposes the model's proposed ordering against exact focus facts. A proposal - cannot bypass review by returning as accepted output, and a missing or stale - candidate digest cannot commit. A journalist cannot change section, byline, - citations, assignment, another journalist's prose, or the admitted record - set. The copy desk cannot rewrite, suppress, or accept - prose, select stories, close the press, or withhold the complete query set for - a later pass. The Night Editor cannot widen sources, add, remove, or reorder - stories, alter sections, bylines, citations, or agenda, invoke another model - judge, reopen a completed close, or touch an article absent from the copy - checklist. Every copy-query-bearing article and no other article is mandatory. - The press witness cannot certify - factual or editorial quality; it can only prove the exact admitted process and - bytes. - A context snapshot cannot create or summarize facts into authority. The - editorial-period directory cannot create a source packet, mark a record - inspected, satisfy citation admission, or become an event authority. An - exact-ID fetch cannot mutate the ledger. A production checkpoint cannot change - the roster, agenda, pitch, reporter, article slot, section, byline, citations, - source campaign, or receipt ancestry; a checkpoint from another contract, - task, or editorial binding cannot resume current production. Neither the - generic dateline schema nor workbench `allowed_datelines` can admit factual - truth; `validate_editorial_article` rejects an uncited place and rejects a - blank lead dateline when a cited place is available. - A snapshot tool cannot rewrite the frozen first request, insert changing state - ahead of it, or promote provider cache telemetry into semantic authority. A - cache miss cannot change tool admission, receipts, or newsroom results, and a - routing key cannot substitute for provider-reported cached tokens. - Renderers, strategic smoke, Registry, external blind reviewers, and grounding - reviewers cannot write the page, desk report, close, correction, world state, - or acceptance state. Caches cannot decide record equivalence, assertion - status, story relevance, fact completion, or staff assignment. -- **Shared paths:** fresh composition queries stable records, proposes one or - more agendas, observes the deterministic front-page proof for each proposal, - and commits exactly one current candidate before invoking the assigned - journalists. Fresh work then follows one path: one bounded reporter agent per - pitch, deterministic page assembly, copy report, immutable close checkpoint, - one Night Editor action, deterministic press witness, lowering, persistence. - Registry, live per-wave composition, missing-issue recovery, and final digest - all delegate to `advance_world_newspaper`. Resume checks, in order, an accepted - composition, an exact-current close checkpoint, the exact agenda production - checkpoint, and each reporter filing checkpoint. It reruns only the first - missing stage: an interrupted reporter pass resumes at that reporter; a later - copy failure reuses assignment and every accepted filing; a close resume does - not rerun assignment, journalists, or copy desk. A - persisted composition is revalidated against its close checkpoint and exact - stored receipts, then returned without model work. Every caller receives one - completed `WorldNewspaperComposition` or an error; there is no pending - reconciliation result for a caller to interpret or advance. - Generic snapshot agents and the assignment editor share the same harness - framing primitive; non-snapshot agents share its single initial message but - continue through the append-only observation path. No newsroom-specific cache - branch owns either route. -- **Persistence and compatibility:** the live internal contract is - `character-newsroom.v13`. Public request schema v3 carries the publication - roster and binds it into the task and editorial identities. Private production - checkpoint v1 stores either the admitted agenda or one accepted reporter - filing. Agenda identity binds the exact task and editorial identities; filing - identity additionally binds its agenda checkpoint, article index, exact pitch, - complete journalist profile, assignment digest, local reporter snapshot, and - receipt chain. These checkpoints are durable production inputs, not copy-desk - acceptance, press authority, or world facts. Close checkpoint - v1 binds the assigned agenda, assembled page, single copy report, task and - exact editorial bindings, and immutable receipt chain. Its only valid origin - is `InitialCopyDesk`, and its compatibility-shaped `source_checkpoint_id` - must be absent. The private `LegacyV7Checkpoint` enum spelling is a read-only - deserialization tombstone: the loader filters it before task selection, - receipt loading, validation, or close authority. - Composition v3 stores - the printed issue, copy report, press-close witness, and receipts. Public issue - schema v3 remains unchanged. Uncommitted candidate agendas and front-page - proofs remain ephemeral. Historical v7 reconciliation rows may remain in archived or - resumed stores as inert provenance, but the live newspaper module defines no - reconciliation loader, import envelope, or conversion path and does not - rebind them. Historical strategic recomposition v1/v2 receipts - are a separate acceptance-driver verification surface; their typed validators - can prove original artifacts but cannot write newsroom state. Resume authority - belongs only to exact-current v13 production and close checkpoints bound to - the same task, newsroom, facts, assignment, article slot, and receipt prefix. - Run 58's v7 tip and Run 59's printed edition remain immutable evidence in - their original artifacts, not v13 resume inputs. -- **Cut line:** the generic byline list and one-shot whole-page writer are - deleted. Assignment-owned section, journalist, byline, citations, and order - are no longer regenerated in prose output. Tool schema text and prior-action - copies are absent from prompts; agent history is no longer flattened and - retransmitted as a newly rendered user transcript. Selector commands no - longer mutate the action schema as records become visible. Phrase-level - repairs, repeated copy calls, Night rereview, post-close model judgment, and - edits to unqueried articles remain absent. Whole-article prose is the sole - Night Editor close unit, and exactly the query-bearing articles are mandatory. - The legacy reconciliation schemas and advance loop, automatic store lookup, - explicit import API and environment path, v7-to-v9 close conversion, and - pending consumer branches are deleted from live authority. Existing bytes are - not migrated or erased; nothing in the live path can make them decide a close. - The snapshot harness's former two-message first request is also deleted: the - step-one directive no longer sits in a prefix position that disappears when - the first workbench snapshot replaces history. The cut adds no cache store, - cache key registry, manual retention control, or retry compensator. - V15 adds the cited conflict axis and removes lexical bias from the bounded - directory. V14 adds only the bounded assignment-navigation directory and source - timestamps in the audit. It does not add a source-packet layer, second event - authority, alternate evidence selector, or reporter-context expansion. - The roster, query projection, front-page proof, and article assembly reuse the - generic agent harness and existing public-record, agenda, accepted issue, and - audit shapes. One private persistent production-checkpoint schema buys exact - pre-copy resume; no dependency, crate, binary, daemon, service, cache, event - writer, target platform, code-generation path, or world-simulation pass was - added. -- **Verification and build budget:** focused newspaper tests retain query - admission, exact focus proof, agenda commit, selected-record alignment, and - audit grounding. V15 gates prove adversarial assignments bind two distinct - named parties to selected exact records and that period navigation preserves - canonical ledger order. V14 gates prove the assignment editor sees completed-change - headlines across distinct periods before querying while stable record IDs and - fact bodies remain absent, and that rendered audit citations expose source - time. Existing V13 gates prove the stable selector instruction prefix with - old record bodies absent from later snapshots, the compact inspected-record - index, bounded exact-ID refetch, stable selector and Night schemas, - assignment-aware reporter context isolation, one complete - copy report, exact single-occurrence query targets, multiple categorical - objections to the same phrase, one Night Editor action over only the queried - articles and facts, complete query disposition, preservation of - assignment-owned structure and citations, no post-close copy or editorial - stage, deterministic source/printed digests, exact receipt ancestry, - close-checkpoint resume without reporter or copy replay, idempotent persisted - composition validation, printing the checkpointed page after a structurally - rejected close, a fresh v10 close in a store containing a matching inert - v7 tombstone. The close validator admits only `InitialCopyDesk` checkpoints - with no source ancestry, while exact-current resume and idempotence regressions - exercise the close resume path. Dedicated regressions prove one generic - reporter schema with no per-assignment dateline enum, exact - fact-derived `allowed_datelines` in each dynamic reporter snapshot, - deterministic cited-place admission, plus agenda-and-filing checkpoint recovery at - the first failed reporter without replaying accepted production. Strategic recomposition v3 binds the - copy report and press witness by digest while v1/v2 remain historical - validation inputs. Independent blind editorial and grounding reviews evaluate the - resulting artifact for the acceptance experiment only; they are deliberately - outside runtime publication authority. Verification remains bounded to the - existing newspaper library and strategic-smoke targets plus formatting, - state, and system-map gates. The cut adds no service, crate, dependency, - event authority, or simulation pass. - -Run 60 is the negative cache witness for the superseded framing: 15 calls used -96,902 prompt tokens and reported zero cached tokens. The selector's first call -used 1,452 prompt tokens, while later calls grew to roughly 7,500–11,800. That -first request was large enough for automatic prompt caching, but the old -two-message shape retained only the charter and replaced the step-one message, -so later requests did not preserve the complete first-request prefix. The -focused harness regression now proves one combined charter-plus-step-one user -message, exact later prefix preservation, a replaced dynamic workbench message, -no replayed assistant chatter, and an unchanged output schema. It proves request -shape only; provider cache hits are non-required runtime telemetry. - -Run 62 is preserved as an immutable failed v12 witness: the selector reported a -cache hit, reporter calls reported zero cached tokens, and a reporter supplied -an invalid dateline that deterministic admission rejected. It is not evidence -for the v13 reporter prefix. Run 63 is a stopped v13 observation, not an -acceptance artifact: Issues 17 and 18 completed before the final edition, and -repeated reporter calls still reported zero cached tokens. Its partial artifacts -remain inert provenance; no fresh reporter-cache proof is required. - -Run 61 remains accepted evidence for the durable newsroom claims: recurring -journalist voices and evidence-shaped special/general issue design. Those -editorial boundaries do not depend on provider cache retention. - -The bounded selector snapshot retains a pending agenda's exact token while its -front-page proof is the latest observation. Any later query or exact-ID fetch -retires that candidate; the assignment editor must propose the page again and -receive a fresh proof before commit. Retrieval cannot leave a proofless agenda -eligible for delayed admission. - -Run 54 is immutable mechanically complete evidence at exact source -`01581b8576774f370884e331558605e7ef5e1b9b`, implementation -`2ac74abf12612b2c38b04acd6fcb604acd1c9d28`, and world revision 27. -Its newspaper passed independent grounding and failed independent blind -editorial review because administrative conditions, filings, cordons, and -recordkeeping buried conflict and bodily evidence. The archive is -`F:\GameCult\GhostlightDungeon\acceptance\elven-realms-autonomous-01581b8-54.tar` -with SHA-256 -`835F72FCB19C38815C543DC1497977288F2F1442F22FDBD32D1B312490B34808`. -No next run may replay world mechanics or per-wave publications. - -Run 54 also exposed a separate upstream publicity defect. A public strategic -activity currently propagates its channel to every materialized outcome, -including a private `MemberMemory` consequence; that is how a public news row -about Orin Pell retaining a memory entered the frozen ledger. The newsroom must -not turn that bookkeeping into a story, but it cannot repair world-event -authority. The future kernel cut is: parent activity publicity does not imply -that every internal consequence is public; an outcome needs its own observable -or communicated public scope before `NewsIssue` materialization. Revision 27 -remains immutable evidence and is not rewritten for this newsroom-only -acceptance. - -The typed issue retains exact event IDs, channels, reliability, source -revision, and model receipts as audit data. Its internal issue time is derived -from the latest cited publication record without exposing that clock to -editorial inference. Rejected action attempts semantically rebind their -otherwise immutable model receipts to collision-free invalid dispositions; a -structurally rejected deadline action prints the already checkpointed source -page instead of creating another editorial turn. The top-level strategic plan, -receipt hash, and commit always project the final completed wave, matching the -top-level counts and persisted campaign head; per-wave history remains under -`waves`. The reader -renderer has no path to provenance fields and escapes all model- and -consumer-supplied plain text before Markdown emission; the provenance renderer -applies the same plain-text boundary to its audit data. Neither assignment -editor, writer, copy desk, Night Editor, renderer, nor receipt persistence can -write world state. - -#### Seeded TeX press projection - -- **Owner:** the operator-designated frozen newsroom Markdown owns masthead, - edition label, article identities, lead designation, sections, headlines, - decks, bylines, and every paragraph. `tools/typeset_newspaper.py` owns - presentation only through two independent decisions. `style_seed` owns the - durable house body: sheet geometry, type, stock, ink, rules, gutters, and - ornaments. `flow_seed` owns the per-issue display template, secondary-story - grouping, which eligible secondary closes page one, cut-first versus - cut-midstory placement, cut scale, and page closure. Both apply the pre-WWI - mass-circulation grammar distilled in - `notes/historical-newspaper-layout-grammar.md`; neither owns copy. Woodcut - bitmaps and their adjacent prompt sidecars own illustration provenance, not - facts. A future economic layer owns advertiser identity, goods, prices, - claims, campaign continuity, and payment; the press may only place an already - admitted ad module in the shared page grid. -- **Inputs:** one frozen Markdown edition, required independent style and flow - seeds, zero or more article-indexed wordless woodcut PNGs, - output/TeX/manifest paths, and an optional LuaLaTeX engine or `--no-compile`. - The current Run 61 projection uses style seed 1847 and flow seed 723 and binds - `boundary-rail-exchange` to article 0 and - `sinkroot-gauge-gallery` to article 1. Their matching prompt files preserve - the exact fresh ImageGen requests and record grayscale, 72-percent threshold, - and trim preparation. No ad module is currently admitted. -- **Outputs:** escaped TeX, a `ghostlight.seeded_tex_press.v2` TOML manifest, and - optionally a compiled PDF. Manifest v2 records independent `[style]` and - `[flow]` projections and binds both seeds, source/output/TeX paths, - article-indexed woodcuts, and SHA-256 digests for source, TeX, tool, woodcuts, - engine, and compiled output. The current artifact is - `output/pdf/canopy-ledger-run-61-style-1847-flow-723.pdf`, bound by - `output/tex/canopy-ledger-run-61-style-1847-flow-723.manifest.toml` with output - SHA-256 `a457f4b1702a7a52480e42fce0039f0dbe677ff32958e98f1c412b346237190c`. - These are press artifacts, not another newsroom composition or correction - surface. -- **Derived state:** the parsed `Edition`, house `Style`, per-issue `Flow`, - two-page story grouping, continuous four-column reading flow, unbreakable - story-header modules, story-local cut placement and widths, TeX markup, and - PDF pagination are presentation projections. Flow templates include - `display-plate` and `display-band`; inside-story placement includes - `cut-first` and `cut-midstory`. TikZ/PDF multiply blending makes monochrome cut - paper disappear into the seeded stock. The same style seed preserves the - bounded house body across issues while a different flow seed may change - grouping and placement without changing that body. Exact portable PDF - reproduction additionally depends on the named system fonts; source, - woodcut, engine, tool, TeX, and output bytes are bound by manifest v2. -- **Forbidden writers:** the press, TeX compiler, manifest, woodcuts, and prompt - sidecars cannot add, remove, summarize, reorder, correct, or reinterpret - newsroom copy; change bylines, lead designation, or newsroom-owned narrative - function; write newsroom checkpoints - or world state; promote an illustration into evidence; fabricate an - advertiser, offer, price, claim, payment, or campaign; or fill an unadmitted - ad slot. Flow may choose which eligible secondary closes page one, but it - cannot rewrite article text, change the lead, reassign an indexed cut, detach - that cut from its story, or omit it. A successful PDF compile cannot admit - missing or altered copy. -- **Shared path:** every press run parses the frozen source, derives one style - from `style_seed` and one issue flow from `flow_seed`, verifies that all frozen - fields survive, writes TeX, compiles that exact TeX when requested, and then - writes manifest v2. Each woodcut is keyed to its owning article index and - remains attached to that story's display field in either cut-first or - cut-midstory form; accepted copy then flows continuously through the common - four-column grid. There is no detached image bank or bottom-art reservation. - Any future admitted ad module must use this same grid without changing - article-internal copy order or flow-selected grouping. -- **Cut line:** the live press path contains no model rewrite, editorial - summarizer, copy-fitting loop, or second content owner. Press variation is - bounded to page geometry, typography, color, rules, fleurons, and illustration - sizing/placement. The former fixed ReportLab renderer, three-column lead plus - one-column rail, paired story-minipage layout, and detached image bank are not - live. Minipages now protect headers only; story bodies remain in continuous - column flow. The single-seed manifest v1 and prior - `output/pdf/canopy-ledger-run-61-seed-1847.pdf` artifact are not current press - authority. -- **Verification layer:** admission requires source-to-TeX/PDF field completeness - and article-internal order, exact same-pair TeX derivation, independent style- - and flow-seed variation checks, successful halt-on-error compilation, rendered-page - inspection for clipping and overlap, one attached rendering for every indexed - cut, and matching manifest/woodcut prompt provenance. The current manifest v2 - records `display-plate`, `cut-first`, and page-one secondary article 2. Its - final TeX uses four-column `multicols`, article-indexed cuts, `needspace` plus - header-only minipages, and TikZ multiply scopes. LuaLaTeX produces a two-page - PDF with embedded Times New Roman faces; `SOURCE_DATE_EPOCH=0` and - `FORCE_SOURCE_DATE=1` make the same admitted inputs byte-reproducible under the - bound engine. Extracted copy includes the closing `Marshal Eryn Tal` - paragraph. Rendered inspection confirms continuous reading order, attached - cuts blended into the stock, unstranded headers, and no clipping or overlap. - -#### Acceptance-driver per-wave newspaper recovery - -- **Owner:** the strategic acceptance driver owns recovery of a missing - consumer artifact after its world wave has already committed. It owns neither - the wave nor the newspaper's factual or editorial judgment. For an already - accepted historical recomposition, the original immutable recomposition - receipt owns the typed issue value and reader/audit bytes; the current driver only - validates and projects that artifact. -- **Inputs:** the missing wave's immutable checkpoint and committed `Campaign` - snapshot, the preceding wave checkpoint's committed news-ledger boundary, - the configured title and voice, the explicit resume recovery boundary - (`GHOSTLIGHT_STRATEGIC_NEWSPAPER_RECOVERY_START_WAVE`, defaulting to wave one - and validated within `1..=wave_count + 1`; selecting `wave_count + 1` is the - final-only sentinel: it recovers no per-wave editions but leaves final combined - composition enabled), and the same campaign receipt store - used by ordinary newspaper composition. When an accepted recomposition - already exists, its immutable receipt and exact named reader/audit files are - additional inputs. -- **Output:** acceptance writes one separately named immutable recomposition - checkpoint containing the issue, copy report, press-close witness, and - newspaper model receipts, plus the rendered reader and audit files. Its - receipt binds the - narrowed source campaign, recovery boundary, title/voice/article-budget - contract, issue, model-receipt collection, expected filenames, and both - rendered byte streams by digest. Current recomposition v3 receipts bind the - complete typed copy report and press-close witness by digest. The configured - boundary is also - projected through run status and success or failure result artifacts. The - driver fills only the missing newspaper fields in its in-memory result - projection. A pre-close provider or integrity failure stops that invocation; - canonical close state remains in `CampaignStore`. Existing successful issues - and original wave checkpoints remain unchanged. -- **Derived state:** the newsroom receives a clone of the completed wave's - campaign whose news ledger is narrowed to rows appended since the preceding - committed boundary. All events and canonical names remain available only so - those exact news rows can resolve their sources; the clone is a consumer view, - not a campaign mutation. Before that handoff, the driver validates that wave - reports form a contiguous prefix and selects only reports at or after the - configured recovery boundary whose issue is absent. Earlier missing reports - remain historical gaps, while any already successful issue inside the selected - range is left untouched. The configured recovery boundary owns selection of - the missing reports in the current invocation; the final-only sentinel derives - an empty per-wave selection because no report can reach `wave_count + 1`. A - completed recomposition's - recorded recovery boundary is immutable provenance for the invocation that - produced it; it does not become a second selector or invalidate the accepted - issue when a later invocation selects a narrower range. -- **Forbidden writers:** recovery cannot rerun a strategic tick, Nemesis, - simulation cells, outcome resolution, clocks, or `WorldKernel`, and it cannot - alter campaign, event, or news state. Failed recomposition stops consumer - recovery and cannot repair mechanics. -- **Shared paths:** live per-wave composition, recovery composition, and final - combined composition all call the thin `compose_persisted_newspaper` delegate - into `advance_world_newspaper`, including the same assignment, writer, single - copy report, one deadline close, checkpoint-resume, and receipt-persistence - owner. The final combined composition still runs when the recovery selector - returns no per-wave reports. A later invocation resumes a close checkpoint without rerunning the - writer or copy desk. Once printed, it - consumes the successful recomposition artifact instead of paying for the - newspaper again. The driver recomputes its wave, source-campaign, and - editorial-contract bindings, validates the recorded original recovery - boundary, and checks the exact issue value, typed model-receipt set, reader - bytes, and audit bytes against their immutable digests. A current-schema issue - is deserialized and rendered again. Current recomposition v3 also deserializes - the copy report and press-close witness and requires their exact digests. A - historical v2 accepted issue - is structurally deserialized only as v2 and is not reinterpreted through the - current issue type or renderer; its original receipt owns those historical - bytes, and the driver carries its JSON only as an inert result projection. - Historical issue v2 predates `grounding_digest`, so this local validator requires - accepted status but does not claim a retroactive digest for its complete - grounding verdict. Whole-checkpoint integrity instead remains anchored by the - unchanged Run 51 source-root/archive hash and Run 52 before/after artifact - manifest. -- **Cut line:** current `WorldNewspaperIssue` deserialization and current - renderer output are no longer authorities over a historical accepted issue. - Raw digest verification is not a migration path and cannot create, repair, or - reaccept a paper: all applicable original source, contract, filename, issue, - receipt-set, and byte bindings must already be present and exact. Current - recomposition v3 requires exact copy-report and press-close digests; - historical recomposition v1/v2 retains its bounded grounding/editorial - validation, and historical issue v2 keeps the explicitly bounded - accepted-status plus archive/manifest proof described above. - Strategic state and per-wave artifacts remain forbidden writers. -- **Verification layer:** the focused boundary regression proves that a second - wave is recomposed from only its newly appended news row while retaining the - committed event ledger needed to resolve that row. It also rejects prior-news - prefix drift and confirms that first-wave recovery fails closed without an - exact pre-run boundary. Immutable checkpoint publication separately rejects - overwrite and publishes by synchronized temporary-file rename. A typed - receipt-digest regression proves that checkpoint JSON is deserialized back to - `Vec` before hashing and rejects an invalid receipt shape, - so creation and verification share one representation. A scope-selection - regression proves that earlier missing issues and successful issues are - skipped while later missing issues are selected, and that the - `wave_count + 1` boundary selects no per-wave reports for a final-only resume. - Dedicated regressions prove - that historical v2 preserves its recorded original recovery boundary and - accepts exact historical bytes without current rendering while rejecting byte - drift, that current issue v3 still requires typed deserialization and exact - rendering, and that current recomposition v3 rejects copy-report or press-close - witness drift. Historical recomposition v1/v2 validation remains bounded to - its original verdict shapes. - -The first-wave limit is now an explicit closed boundary rather than inferred -recovery: when wave one is selected, the driver refuses to compose without a -preserved pre-run news prefix. A later explicit boundary can instead define an -acceptance continuation whose older missing issues are intentionally out of -scope. The remaining limitation is verification breadth: no focused test yet -executes the complete resume orchestration from fresh recomposition through -later reuse while asserting successful-issue preservation, exact rendered-file -validation, and absence of mechanics calls. - -Session Zero compilation, expansion, and fission follow the same projection -rule. Review projections expose topology, pressures, source-use coverage, gaps, -assumptions, public party cards, and only the current viewer's private ledger. -Generated openings are optional shared typed decisions; accepting one amends -the draft for discussion and triggers three optional grounded role decisions in -each private DM channel. Ignoring them cannot block a custom start or character. -At registry load, exact legacy `opening:*` suggestions and payloadless question -records from the pre-cut runtime are demoted from material to optional with a -CultCache compare-and-swap; fictional revision and shared epoch do not move. -Payloadless prose cannot own compilation readiness. The persisted typed draft, -not stale suggestion materiality, owns that gate. -Custom starts and characters use the same draft. The browser returns -only decision commands and cannot echo a rewritten candidate into compilation. -Candidate IDs, text, list sizes, and evidence references receive local -validation. Suggestion retrieval and every committed model invocation remain -in the Session Zero audit, including repeated calls with the same semantic -receipt hash but different attempt telemetry. A separate active-preview receipt -set is replaced by each successful compiler transaction and cleared when that -preview is retired. Publication carries only that exact proof set; it never -treats DM turns or superseded compiler runs as evidence for the approved seed, -and it never compiles the conversation transcript. - -Gap-bearing compiler results are retained as exact non-canonical previews while -Session Zero returns to drafting. The host can move that exact preview into -review; this is not approval. Every member approval now binds the shared -contract digest, that member's private character digest, and the complete world -preview digest. Publication persists that digest plus the exact accepted gap -and branch-assumption lists. Replacing topology, cast, institutions, -populations, clocks, evidence lanes, gaps, assumptions, or any other preview -field therefore makes old approvals unusable. The Eve tree visibly lowers the -reviewable world shape. Player JSON excludes institution resources and goals, -and shared cast projection excludes private relationship-anchor people. -The host can discard any non-canonical preview through the SessionZeroKernel; -the command clears only preview state and returns the locked roster to drafting -without editing the contract, character drafts, or fictional time. - -Session Zero owns human-controlled actor identity and state. Public player names -and premises may enter the shared compiler as setting context, but those names -are reserved outside world-cast compilation: actors and Gestalt members cannot -materialize them. The compiler's singular player object is a provisional -starting-position marker only. Ghostlight removes it and installs the approved -typed characters locally. Collision receives one same-snapshot correction and -then rejects the candidate; no deduplication or model choice can replace the -Session Zero owner. - -Private character relationships now cross compilation through a typed identity -membrane. Exact player references bind to their approved actor IDs. Each -otherwise unresolved named person gets a stable server-generated -`relationship-anchor:*` actor ID. A separate private actor stage receives only -the approved display name after public topology validation; it never receives -the opaque identity handle or relationship. The shared world compiler receives -none of those private inputs. The private -stage returns characterization and one exact supplied location, but has no -schema fields for IDs, relationships, narration, facts, gaps, assumptions, or -public-world changes. Ghostlight attaches the opaque ID locally and later binds -the approved relationship only onto its owner's actor. Omission, ambiguity, -unknown placement, or collision rejects the candidate atomically. Actor, -institution, Gestalt, and `member:*` IDs are all legal directional relationship -targets, but those links never union knowledge or authority. Only the owning -member's review surface projects the compiled target, placement, and private -description before approval. A shared branch assumption exposes the count of -materialized private subjects, never their identities or relationship details. - -Approved private character playability crosses a narrower compiler membrane -than private history. The shared world compiler receives bounded capabilities, -equipment, obligations, goals, and extraordinary-permission scope, costs, -limits, exposure, and effect ceilings only so it can seed precise discoverable -environmental facts for the opening problem. It never receives private -history, secrets, relationships, or pre-existing knowledge. Generic crisis -restatements do not satisfy this requirement; a concrete investigative ability -needs a concrete pre-existing finding or an explicit evidence gap. - -Roster lock is not readiness. Before world compilation the kernel checks the -typed contract's core play frame and each active character's minimum actionable -shape. Transcript-only detail, blank contract fields, or a character with no -public premise, capability, goal, and stake return explicit missing inputs and -cannot spend a world-compiler call. - -Campaign publication has a separate discoverability boundary. Session Zero -publication and solo lifecycle operations initialize a new `.cc` store under a -non-UUID `.creating-*` directory. The CreateCampaign command validates the -seed, then atomically commits campaign state, approved seed, membership, -contract, DM Persona, approvals, Vault manifest, evidence, model receipts, -canon candidates, and the creation lifecycle receipt in one CultCache batch. -Only that complete store is renamed into the UUID -namespace and admitted to the live registry. Failed initialization removes its -exact staging directory and cannot poison daemon reload. Approval previews are -retained until campaign publication, session selection, and reload all succeed; -a retry may recover only an already-published store whose exact seed equals the -preview. It cannot adopt a colliding campaign ID with different state. -Legacy Session Zero stores that used the preview receipt field as an append-only -audit migrate on registry load. The complete list remains audit history and the -final compiler transaction becomes the active proof set. This replacement is -idempotent and does not advance Session Zero revision, epochs, or fictional -time. -The browser composer preserves the assessment contract's distinction between -the character's described act or speech and the effect the player wants it to -cause. The receipt panel is the sole owner of the current assessment, -destination, or fission approval control; rendering a newer receipt removes the -older snapshot-bound control instead of accumulating stale confirmations in -persistent forms. World-seed approval renders expandable public sections for -the player role, initial topology, present cast, institutions, populations, -world clocks, and exact evidence-use rationales instead of asking for approval -from summary counts. A browser-local interaction lock prevents duplicate paid -requests while preserving the kernel mailbox and revision checks as the only -world-mutation authority. -The player surface also projects the canonical current location ID. The -destination compiler binds that value into a read-only origin field and shows -the proposed locations, containment, routes, persistent features, and material -gaps before approval. Population fission approval similarly shows each named -child leaf, partition value (including `other/unknown`), home location, and the -exact child receiving each parent-owned resource. Shared capabilities, -knowledge, goals, pressures, and relationships inherit through population -lineage; custody does not. Each scarce resource crosses exactly one typed -custody transfer, so a fission cannot copy one granary, vehicle, or medicine lot -into every child. -Fission admission runs before parent lookup, retrieval planning, or inference: -one request may contain at most 16 distinct cuts of at most 160 readable -characters and one 500-character reason. The browser mirrors these bounds. -The browser interaction lock covers a canonical mutation and the subsequent -surface refresh as one user interaction. Campaign selection, world approval, -destination approval, fission approval, fork, and reset cannot re-enable stale -controls between the commit response and the refreshed revision. Compiler -preview requests remain non-mutating and release the lock with their returned -preview. Received non-success HTTP responses are rendered as server refusals; -only missing or undecodable responses receive the ambiguous-transport warning -that a commit may have preceded the lost response. The production web build -runs strict TypeScript checking before Vite emits assets. - -## World Transition Authority - -`WorldKernel` owns one closed semantic `WorldMutationBatch` reducer. Foreground -attempts, NPC reaction waves, strategic actor/institution/Gestalt outcomes, -waits, group travel, and approval-gated population fission all lower their -accepted outcomes into that vocabulary before canonical state changes. -`ActionMeans` records what an actor did, and the intended effect records what -they hoped to change; neither is a committed fact. The mutation batch contains -only exact component changes admitted by a state-derived authority envelope. - -The reducer validates the complete batch on an isolated component overlay, -advances each touched subject version once, and persists component state, -mutation authority envelope, mutation batch, mutation receipt, causal command -receipt, events, and aggregate compatibility projection atomically. The -aggregate campaign row is rejected as a component-only mutation target. -`WorldEffectDelta`, `ActorStateDelta`, and strategic effect variants are model -boundary migration inputs, not writers or independent physical ontologies. -The foreground assessor derives a closed effect schema from the exact snapshot -and first removes structurally unavailable knowledge, movement, clock, and -institution lanes. A compact private scope projection then receives only the -exact attempt and those remaining lane names. Its locally validated output can -only subtract: every causally unselected lane disappears from the assessor's -schema, and unselected knowledge prevents scene facts from entering the prompt -at all. The scope also distinguishes lanes required to realize strong and -ordinary success from lanes merely available for direct consequences. Required -success lanes receive a non-empty structural constraint and a post-lowering -local check, so stakes cannot claim a canonical success that the typed effect -omits. Canonical dynamic effect maps cross the strict model boundary as bounded -entry arrays containing only authority-enumerated IDs and values; validated -entries lower once into `WorldEffectDelta`, while empty arrays mean no mutation. -The admission-bound model schema requires those success entries only for an -admissible assessment and structurally forces every inadmissible effect array -empty; local validation repeats both rules before verification or caching. -Scope rows and receipts are derived inference evidence, never assessment or -world authority, and their content-addressed cache avoids repeated scope -inference for an unchanged attempt. -After structural binding, a compact independent verifier compares the complete -four-band typed effect bundle with the player's exact means and intended -effect. Structurally legal state is not automatically causally relevant. The -verifier can only accept or return one bounded mismatch classification and -repair sentence; it cannot reassess difficulty, choose an effect, or commit. -One mismatch returns to the assessor against the same snapshot, while a second -mismatch aborts. Every verifier receipt is private audit state and only a -verified proposal may enter the assessment cache. -Pending NPC actions are revision-scoped reaction-window state. The next -reaction wave atomically replaces the set, and the kernel resolves an action -only when the current last event is the exact current-revision reaction wave. -Same-wave assessment correction remains possible; cross-turn rebasing is not. -The foreground command owns committed player speech, presence reconciliation, -and the directly addressed Persona response. Once that response is committed, -the request returns without waiting for a second NPC action assessment. The -accepted action proposal remains in `Campaign.pending_world_proposals`; an -idle-boundary continuation runs its assessment with background priority and -calls the same `WorldKernel::ResolveNpcAction` command. A new live turn cancels -in-flight background inference. The proposal may commit only against its exact -reaction revision, and startup plus the strategic scheduler rediscover current -reaction-wave proposals after daemon interruption. The continuation is an -actuator, not another queue or state owner. -The same reaction commit validates its response duty against the exact -committed source turn. A missing directly addressed Persona or a null response -aborts the whole wave without private deltas, transcript additions, initiative, -or revision change; observers may still choose to speak from their own goals. - -Action assessment separates semantic inference identity from commit identity. -The exact scope, assessor, and verifier models, stable instructions, scoped -action-specific schema, and permitted typed packet form a content-addressed private -`assessment_proposal_cache.v1` key. Revision and expiry still bind the -consumable assessment and roll but do not force the capable model to reconsider -an otherwise byte-identical packet. A cache hit revalidates the complete -proposal against current state, emits a zero-token receipt linked to the source -scope, assessment, and verifier receipts, and creates a fresh digest at the current -revision. Changed authority changes the key. The Eve command-result projection -shows every signed modifier with its exact references. - -Population fission now composes admitted child entities, stable child -identities, one lineage split, exact resource custody transfers, and exact -named-member membership transfers. The same fission transaction owns every -relation and civic consequence of retiring the parent: it creates one inherited -child agency relation per child, retires the parent relation, replaces the -parent resident ID with all child IDs in each affected civic manifest, rebinds -each civic political-relation ID to the exact child relation IDs, advances the -manifest version, and binds its semantic verification/source field to the exact -`fission-preview:` receipt. These writes lower together with child -admission, lineage, custody, and membership into one component-world batch; -either the complete state validates and commits or none of it does. - -The aggregate projector may copy the accepted child relations and civic -manifests out of that component result, and `project_fission_resolution` owns -the derived agency-profile, facet, cover-invalidation, and resolution-epoch -projection. `AgencyProfile.location_ids` remains exact presence or operating -places. It does not inherit a parent's political jurisdiction, because -jurisdiction is containment topology rather than subject presence. Later -`ensure_agency_profiles` synchronization is not a cleanup owner and may not -repair missing civic residents, replace stale political relation IDs, recreate -retired parent relations, or make a partially applied fission appear valid. The -old fission function that directly wrote campaign state has been removed. - -Immutable Runs 92 and 93 falsify profile-scope inheritance as the routing -repair. Run 92 contained 938 active, simulation-eligible Gestalts, while the -old direct-profile-membership query found zero realm-routable descendants for -Avelune, Veyra, and Bramblewash. Exact canonical topology already contained the -answer: Avelune localities descend from -`loc:avelune-watershed-realm`, Veyra localities from -`loc:veyra-rail-realm`, and Bramblewash localities from -`loc:bramblewash-grain-river-realm`. Run 93 at exact source `31125a2` failed -before any model call because the now-rejected lineage-scope reconciliation -found nothing to change. Preserve both runs as evidence. - -The scheduler now calls the shared `unique_containing_jurisdiction` resolver to -derive complexity jurisdiction from canonical `Location.container_id` ancestry -without writing any agency profile; worker admission reuses the same resolver. -There is no `ReconcileFissionAgencyScopes` command, lineage scope-inheritance -helper, or agency-scope reconciliation checkpoint. A scheduler fallback that -guesses a realm, copies jurisdiction into profile presence, or chooses among -ambiguous realm ancestors is forbidden. - -Immutable Run 81 at exact source -`e7ceb2c2807fabb2b0e68aeeeb0aab5948c582a5` and root -`/var/lib/gamecult/ghostlight-dungeon/acceptance/full-world-delvehold-e7ceb2c-81` -is failure evidence for this ownership boundary. Patina commit 0001 advanced -revision 15 to 16 and admitted the Hearthcoil children, but left the Hearthcoil -civic manifest pointing at missing parent relation -`rel:hearthcoil-houses-member-blackchalk` while the child relation clones -existed. Charter's already accepted frozen proposal then failed admission with -`invalid command: canonical civic system lost a political relation`. Preserve -the run unchanged; unit `ghostlight-full-world-e7ceb2c-81.service`, invocation -`069f3a5de05b4bd3a972ddf621e29d54`, is terminal with an exit code. - -Run 81 recovery is an explicit one-boundary repair, not rollback or fission -replay. `WorldCommand::ReconcileFissionCivicBindings` owns deterministic repair -on a clone of Run 81. It may select only civic manifests whose stale parent -resident or political-relation binding is proven by an existing canonical -Gestalt lineage and, for each retired relation, the complete canonical child -relation set. It lowers only the resulting `SetCivicSystem` mutations through -the shared mutation kernel, increments the affected manifest version, and binds -the repair to a deterministic `fission-civic-reconciliation:` source. - -The repair uses an unchecked component snapshot only as the bounded workbench -needed to represent the known invalid starting state. The mutation application -must produce a normally validated next component world; WorldKernel then -persists an ordinary world commit and mutation receipt under command kind -`reconcile_fission_civic_bindings`. The acceptance driver publishes one -immutable `ghostlight.fission_civic_reconciliation_checkpoint.v1` and refuses a -checkpoint whose canonical repair is absent or whose command/revision binding -disagrees with the campaign. The unchecked snapshot is not a general admission -mode, migration authority, cleanup loop, or permission to repair unrelated -state. - -After that checkpoint, the complexity loop recognizes Patina commit 0001 as -already admitted, skips it, and rebases the preserved Charter proposal against -the repaired revision. The Run 81 frozen preview and model receipts remain the -inference authority; recovery performs no model or elaboration replay. - -Region expansion and in-place locality elaboration compose typed place, -proposition, population, and institution admission plus exact topology and -political-relation changes against one authority snapshot. Locality elaboration -anchors every added place beneath one existing canonical jurisdiction and -forbids the compiler from duplicating that target. Civic manifests cross-bind -governing institutions, resident populations, public civic facts, and local -political relations before lowering. `CivicSystemSet` is the versioned component -owner; aggregate `Campaign.civic_systems` is reconstructed from its accepted -state. The mutation reducer owns those canonical component changes; the -compiler-validated agency-profile map is still a companion projection and must -not be described as component-owned until its migration is complete. Approval -commits the complete addition atomically or leaves the coarse place untouched. Repeated -Vault retrievals have distinct retrieval receipt identities, while an exact -immutable receipt replay is admitted idempotently under the same CultCache CAS. - -Every new destination carries an explicit outbound route from the stable origin -and a reciprocal return route with the same positive travel time. Place -profiles, proposition content, evidence references, discovery locations, -containment, route identity, distance, and topology are validated on the -component overlay; aggregate rows are reconstructed only from accepted -component state. A route map key is local to its exact origin. The component -overlay derives its edge identity from `(origin_location_id, local_route_id)`; -the player surface uses the route's exact destination field, and accepted -region expansion restores the original local key. Reusing `road`, `harbor`, or -a destination-shaped key under another location cannot overwrite an unrelated -edge or make a surface-advertised route fail transition admission. - -Governance approval and governed finalization are distinct durable states. -When unanimous time, travel, or Persona-cell approval exists but finalization -did not commit, the advertised approval operation retries the exact revision- -bound finalization even for a member whose approval is already present. This -does not add another writer: the same WorldKernel validation and atomic commit -path runs again. Duplicate non-unanimous votes, stale boundaries, and committed -proposals still reject. - -Initial compiler publication is a bounded creation transaction, not a fictional -world transition. `CampaignRegistry` owns discoverability, installs the -approved seed into a fresh staging store with one empty-store CAS, and exposes -it only by atomic directory rename. It cannot target a published campaign. -Named-person materialisation and dematerialisation are resolution transactions -over one persistent member identity. They advance world revision to stale old -actor-bound commands, advance `resolution_epoch`, clear the derived cover, and -atomically preserve the exact individual delta. They cannot change fictional -time or Gestalt-wide knowledge, resources, or pressure; the obsolete -`GestaltAggregateDelta` writer has been deleted. See -`docs/architecture/ghostlight-transition-algebra.md`. - -Relationship documents in the schema catalog are revision-bound projections -of actor-owned relationship maps; they are not a second relationship writer. -Vault manifests summarize the exact provider/source/authority/temporal lanes -covered by evidence receipts and do not own Vault content. Strategic tick and -gestalt materialization receipts are different: they are atomic commit -companions binding the generic world commit to the causal model output or -baseline/member presence transition. Materialisation receipts additionally bind -the previous and next resolution epochs. - -## Control Flow - -1. Rehydrate from `state/map.yaml`, `notes/fresh-workspace-handoff.md`, this - file, and `notes/ghostlight-implementation-plan.md`. -2. Run `npm run state:status`. -3. Work one bounded organ. -4. Validate the seam that matters. -5. Persist only belief-changing evidence. -6. Commit and push completed work. - -Model acceptance also measures useful work per token. Stable contracts precede -revision-bound context for cache reuse; each stage receives only the state it -can legitimately judge; provider receipts expose cache, prompt, completion, and -validation cost per attempt. - -## Core Surfaces - -- `state/map.yaml`: canonical mission, boundaries, live architecture, next action. -- `state/evidence.jsonl`: distilled belief-changing evidence only. -- `state/evidence.archive.jsonl`: older evidence preserved for archaeology. -- `state/corpus-coverage.json`: accepted/planned fixture coverage ledger. -- `notes/fresh-workspace-handoff.md`: compact re-entry packet. -- `notes/ghostlight-implementation-plan.md`: near-term implementation sequence. -- `docs/architecture/`: detailed contracts and rationale. - -## Active Artifact Pipeline - -```text -Aetheria lore/source context - -> lore grounding digest / source notes - -> canonical agent and scene state - -> projected local context - -> responder packet - -> sandboxed responder output - -> review and leakage audit - -> observable event record - -> participant-local appraisal receipts - -> mutation receipt - -> updated scene/world/social state - -> initiative schedule updates readiness, reaction windows, and next actor - -> sandboxed coordinator continuity and next-beat plan - -> meta-coordinator review, wiring, and labeled interventions - -> branch compiler materializes Ink + sidecar + visual plan + compiler notes - -> IF artifact reviewer audits consequence, fold, and visual continuity - -> narrative/lore/spatial/visual reviewers audit player-facing quality - -> accepted fixture / future training corpus + optional illustrated replay collateral -``` - -Responder packets are one seam, not the whole project. The branching scene path -also requires coordinator receipts, branch compiler artifacts, and independent -review before a fixture is accepted. - -Tone is a live seam. The system should preserve Aetheria's range instead of -defaulting to dry technical crisis prose: comic warmth, domestic routine, -ritual memory, weird bureaucracy, noir suspicion, wonder, horror, poetic dread, -and procedural systems pressure are all valid when source-grounded and -character-local. Adams/Pratchett-style wit-with-stakes is a useful default -touchstone for counterbalancing bleakness without dissolving consequence. - -Visual replay is a presentation seam, not a core social-model training seam. -Illustrated IF fixtures need click-through sections with stable -`visual_scene_id` anchors, stable visual character refs for recurring named -characters, a global style cue when the visual language matters, imagegen-ready -base prompts, character visibility and stance controls, and branch/state -modifiers. This data belongs in a separate `.visual.json` artifact referenced -by the training sidecar, not inside the training annotation itself. - -Generated images are not geometry authority. They can establish visual mood, -materials, and concept direction, but multi-angle illustrated IF needs a durable -`scene_set` source such as a hand-built 3D blockout, procedural scene file, or -layout asset with named cameras and staging slots. For those scenes, imagegen is -the painter/render pass over a camera-specific blockout, not the architect of -the room. - -## Important Contracts - -- Agent state: `schemas/agent-state.schema.json` -- Projection examples: `schemas/projection-example.schema.json` -- Lore grounding: `schemas/lore-grounding-digest.schema.json` -- Projected local context: `schemas/projected-local-context.schema.json` -- Coordinator artifacts: `schemas/coordinator-artifact.schema.json` -- Responder packets: `schemas/responder-packet.schema.json` -- Responder outputs: `schemas/responder-output.schema.json` -- Event records: `schemas/event-record.schema.json` -- Participant appraisals: `schemas/participant-appraisal.schema.json` -- Reviewed mutations: `schemas/reviewed-mutation.schema.json` -- Scene-loop bundles: `schemas/scene-loop-bundle.schema.json` -- Initiative schedules: `schemas/initiative-schedule.schema.json` -- Ink branch contract: `docs/architecture/ink-branching-scenes.md` -- Illustrated IF visual pipeline: `docs/architecture/illustrated-if-visual-pipeline.md` -- Training stages and corpus gates: `docs/architecture/training-plan.md` -- Corpus coverage ledger: `docs/architecture/corpus-coverage-ledger.md` - -## Current Live Examples - -Pallas Species Strikes is the active reference-only story fixture: - -- `examples/lore-grounding/pallas-species-strikes.awakened-labor.v0.json` -- `examples/agent-state.pallas-species-strikes.v0.json` -- `examples/coordinator/pallas-species-strikes.branch-and-fold.v0.json` -- `examples/ink/pallas-species-strikes.branch-and-fold.v0.ink` -- `examples/ink/pallas-species-strikes.branch-and-fold.v0.training.json` -- `examples/visual/pallas-species-strikes.branch-and-fold.v0.visual.json` -- `experiments/pallas-species-strikes/pallas-species-strikes.branch-and-fold-clean-run.v0.md` -- `experiments/pallas-species-strikes/pallas-species-strikes.visual-scene-review.v1.json` - -The fixture is not training-ready data for Ghostlight's model stages. It was -coordinator-authored without the exact projected-context, sandboxed responder, -appraisal, mutation, relationship-update, and true branch-compiler receipts -those stages require. Keep it as a reference for story shape, grounding, -branch-and-fold presentation, visual planning, and future fixture expectations. - -`pallas-training-loop-v0` is the first separate training-shaped derivative. It -rebuilds only the Kappa threshold beat through actual receipts: - -- scene digest and initial state under `examples/training-loops/pallas-training-loop-v0/` -- projected contexts under `examples/projected-contexts/` -- responder packets under `examples/responder-packets/` -- raw no-fork subagent captures under `experiments/responder-packets/` -- event, appraisal, mutation, review, and bundle receipts under `examples/training-loops/pallas-training-loop-v0/` -- clean readable transcript under `experiments/pallas-training-loop-v0/` - -It is training-shaped for projector, responder, event resolver, participant -appraiser, mutator, relationship/perception updater, and coordinator/story -runtime. It is not branch compiler, IF reviewer, visual, or accepted full-fixture -coverage data. - -`lucent-hostage-feed-v0` is the current open-ended training-loop draft. It -tests the same receipt-chain organs in a less reference-bound scene: a Lucent -Media hostage-feed negotiation inside the media-eye counterweight of a tethered -station staring down at a metropolis bubble. - -The Lucent bundle includes: - -- scene digest, initial state, and branch surface under `examples/training-loops/lucent-hostage-feed-v0/` -- projected contexts under `examples/projected-contexts/` -- responder packets under `examples/responder-packets/` -- raw no-fork subagent captures under `experiments/responder-packets/` -- event, appraisal, mutation, review, and bundle receipts under `examples/training-loops/lucent-hostage-feed-v0/` -- clean readable transcript under `experiments/lucent-hostage-feed-v0/` -- fixture materializer at `scripts/materialize_lucent_loop.py` -- initiative schedule example at - `examples/initiative/lucent-hostage-feed-v0.turn-20.initiative.json` - -Only the fifteen post-restart turns from `turn-06` through `turn-20` are counted -as training-clean responder receipts. The earlier exploratory opening turns are -setup/rehearsal context. The loop demonstrates state carryover: feed evidence -externalization creates breathing room, breathing room creates a bench-edge -substitution, the substitution enables a process-note admission, the admission -enables direct hostage leverage to end, and release folds into safe-line -confirmation plus non-contact protective handoff. - -The current coordinator lesson is explicit: nudge through game-ergonomic state -levers rather than forcing plot. Safe lines, evidence locks, security holds, -handling categories, posture constraints, route access, clocks, public proof -objects, and resource pressure are the elastic strings. Actors pull against -those strings from local state; the coordinator records observed action and -folds consequences through reviewed mutation. - -The coordinator must now be treated as a sandboxable organ in future -training-shaped loops. Codex remains the meta-coordinator: it prepares visible -input, launches the coordinator worker, reviews the output, labels repairs, and -wires structured state between organs. Raw coordinator training data should come -from sandboxed coordinator prompts, not from omniscient chat steering. - -The initiative scheduler is now an explicit mechanical seam. It decides when an -actor is eligible to act from initiative speed, recovery, load, status, and -reaction windows; it does not decide what the actor wants or how other -participants appraise the event. Every affected participant still appraises and -mutates before the scheduler selects the next projected actor. - -VoidBot's newer heartbeat routine is the reference shape for turning that seam -into a living swarm routine. For Ghostlight, the swarm is the cast: the same -heartbeat initiative law selects characters taking turns within a scene, while -offstage or maintenance heartbeats handle rumination, sleep consolidation, -memory resonance, and reviewed upkeep. See -`docs/architecture/voidbot-routine-adoption-plan.md`. - -## Pruned Receipts - -Old prototype fixture receipts and model-runner files have been removed -from the live workspace. Their useful lessons belong in the architecture docs, -state map, evidence ledger, and git history. Do not reintroduce deleted receipt -paths as active state surfaces. - -## Missing Or Incomplete Organs - -- Contract-governed split parties, private in-play actions, delegation, - simultaneous declaration windows, PvP, late joining, permanent departure, - and group fork/reset/export -- Deterministic speaker-local input slicer -- Full prompt renderer -- Classifier/appraiser pipeline -- Relationship/perception updater -- State mutator model -- Student projector -- Runtime integration for initiative scheduling beyond validated artifacts -- Branch compiler implementation beyond coordinator-authored fixtures -- IF artifact reviewer implementation beyond manual/frontier review -- Visual scene continuity reviewer implementation beyond prompted specialist review -- Full scene/event loop implementation -- Culture prior engine -- Automatic promotion of branch outcomes into canonical state -- Corpus coverage ledger expansion beyond the current draft Pallas and Lucent - receipt-chain rows - -## Current North Star - -Generate high-quality, sandboxed, source-grounded branching-scene samples that -can later train specialized Ghostlight models while staying usable by a game -engine: exact inputs, exact outputs, provenance, review labels, state mutation -receipts, branch compiler artifacts, IF review findings, visual scene plans, and -clear branch consequences. The samples should also train tonal control: a -fixture needs an intentional prose mode and enough ordinary life for consequence -to matter. - -Use `npm run coverage:status` before choosing new fixtures so the corpus grows -by coverage need instead of proximity to the nearest interesting disaster. diff --git a/notes/ghostlight-dungeon.md b/notes/ghostlight-dungeon.md deleted file mode 100644 index 629752a..0000000 --- a/notes/ghostlight-dungeon.md +++ /dev/null @@ -1,329 +0,0 @@ -# GhostlightDungeon MVP — Starfire-Hosted AI Dungeon Master - -> Historical foundation plan. Campaign creation and multiplayer authority are -> superseded by -> [`docs/architecture/ghostlight-dungeon-session-zero.md`](../docs/architecture/ghostlight-dungeon-session-zero.md). -> This document remains the original product and world-simulation brief; its -> single-player compiler forms and 1–32 budget wording are not the live runtime -> contract. - -> **What is built, 2026-09-23.** The live runtime is the play agent: -> `docs/architecture/ghostlight-play-agent.md` for the target, -> `ghostlight-play-agent-cut.md` for the means, and -> `ghostlight-play-agent-postmortem.md` for what it cost. Read this document's -> *Authority and invariants* as current — the kernel owns state, every path -> enters the same validate-and-commit door, projections never commit, and a -> place persists when you leave it. Read *Implementation changes* as a roadmap -> in a spec's grammar. Of it: -> -> - **Live:** the Rust daemon, typed CultCache state, the Persona loop, the -> Eve surface and its browser client, and a Vault evidence source over local -> Markdown. -> - **Not built:** fiction-first d20 resolution (a risky act draws from an -> affordance's weighted outcome bands, with no assessment step, no modifiers -> and no roll receipt; an act no granted affordance expresses is authored -> directly as a ruled consequence with no draw at all, and the player cannot -> tell those two paths apart); away-time world agency (advancing the clock -> rolls routines and accumulates pressure, and nothing deliberates -> off-screen); multiresolution gestalt and institution agency (institutions -> exist as offices, grants and jurisdiction, and nothing makes them act); the -> generic Vault provider contract and canon candidates; and the hosting -> details, which name a model family and a credential store the Body does not -> use. -> - **Never run:** seeding past its configuration check, and any model behind -> the local inference port. - -## Summary - -Build `GhostlightDungeon` inside `GameCult/Ghostlight`: a persistent, Vault-grounded, single-player narrative simulation with a private web chat interface for two testers. - -The runtime will be a Rust daemon on Starfire. It will own world compilation, typed CultCache state, d20 resolution, NPC Persona loops, offscreen simulation, narration, and Eve/CultUI publication. A thin TypeScript browser client will lower the Eve surface and submit typed commands. - -Population-scale agency is implemented by the dynamic connected cover in -`docs/architecture/ghostlight-multiresolution-agency.md`. That authority map -supersedes any reading of the gestalt materialization notes below as a flat -strategic Persona list: materialization preserves named identity, while the -agency graph decides the current simulation resolution. - -Ghostlight’s existing v0 schemas and training fixtures remain evidence and regression material; they do not become runtime authorities. - -## Authority and invariants - -- The per-campaign `WorldKernel` is the sole owner of canonical state and revision numbers. -- Player commands, NPC actions, scheduled ticks, travel, waits, imports, and reloads all enter the same `WorldCommand → validate → atomic commit` path. -- Projectors, Personas, Interpreters, retrieval, initiative, narration, news generation, dice previews, and the browser may propose or project state; none may commit it. -- Scenes are derived from persistent occupancy, topology, perception, and current events. Leaving a location does not delete it. -- RAG evidence remains owned by the Vault provider. For Aetheria, Ghostlight consumes VoidBot’s canonical retrieval service and stores only exact evidence receipts used by each campaign—never a rival semantic index. -- Every campaign branches from canon at creation. Later historical records describe the baseline trajectory, not an outcome the player must be railroaded into. -- Improvised facts are explicitly branch-local. Broadly useful gaps become reviewable canon candidates, never silent Vault edits. -- Player text describes an attempt, not a completed fact. Impossible actions do not receive a roll. -- Model failures, malformed outputs, stale projections, or retrieval outages produce no partial world mutation. - -## Implementation changes - -### Runtime and persistence - -- Add a Rust 2024 workspace using Tokio/Axum, the Rust CultCache/redb backend, CultMesh/CultNet publication, and a provider-neutral model port. -- Store service state under `F:\GameCult\GhostlightDungeon`: - - service/control and schema catalog `.cc`; - - one row-oriented `.cc` store per campaign; - - exact Vault evidence receipts; - - private model-stage records and commit receipts; - - exported campaign and canon-candidate bundles. -- Route all writers through an in-process campaign mailbox. Background ticks and HTTP commands cannot race or repair each other afterward. -- Publish the player surface, operator inspector, health, scheduler pressure, model receipts, and command results through CultMesh/Eve. HTTP health remains a probe of that state, not separate truth. - -### Vault and world compiler - -- Define a generic `VaultProvider` contract for source search, surrounding context, source witnesses, authority lanes, temporal scope, and exact-document retrieval. -- Implement the bundled Aetheria adapter against VoidBot’s streamable MCP endpoint at Starfire loopback. -- Add a hosted custom-Vault path for Git-synchronized, Obsidian-compatible Markdown hierarchies after tenant-isolation and import-security gates are met. The Vault service owns indexing; campaigns store only manifest bindings and exact evidence receipts. Provisional plans include one active Vault and 10 million indexed source tokens for Contributor/Private, or three active Vaults and 30 million combined tokens for Plus, with two or six full imports per month respectively. -- At campaign creation: - 1. Retrieve broad Aetheria evidence and generate three distinct suggested openings across different eras, places, and pressures. - 2. For the selected opening, generate three source-grounded player roles plus a custom-role path. - 3. Alternatively compile a fully custom who/where/when/goal description. - 4. Produce an approval preview containing the initial topology, cast, institutions, capabilities, clocks, evidence coverage, gaps, and branch-local assumptions. - 5. Commit only after approval. -- Materialize a bounded playable region and surrounding institutional pressure graph, not the entire universe. New destinations compile on demand and attach to stable containment, route, distance, and travel-time records. -- Treat Vault evidence as canon constraints rather than an exhaustive game map. Automatically synthesize the smallest coherent routes, geometry, local people, ordinary procedures, supplies, responsibilities, capacity choices, and operational doctrine required for play; store them as reversible `branch_local` or `provisional_local` facts and disclose consequential choices in `branch_assumptions`. Ordinary source silence is not a material gap, and generated details may vary between campaigns unless the Vault pins them. -- Reserve material gaps for an exact approved premise that cannot be preserved without choosing between contradictory canon baselines, inventing an explicitly requested but unanchored canon baseline, or exceeding an approved extraordinary capability. Those gaps return to Session Zero negotiation before publication. -- Store useful gaps as `CanonCandidate` records with originating campaign, evidence, conflicts, proposed wording, and affected Vault sources. The lab can review and export Markdown plus `.cc` evidence; it cannot edit AetheriaLore or open PRs. - -### Persona and world action loop - -Population scaling uses reversible gestalt materialization. A crowd, village, -crew, or corporation may act offscreen through one gestalt Persona. When a -specific member becomes relevant, the WorldKernel materializes an individual -from the gestalt baseline plus a persistent member delta and current scene. -When relevance expires, it folds individual consequences back into that delta, -admits only reviewed aggregate learning to the gestalt, and removes the active -simulation slot. The member delta remains durable so returning to the person -reconstructs the same individual rather than a fresh approximation. - -Gestalt projection, relevance detection, and merge proposals cannot commit. -`MaterializeGestaltMember` and `DematerializeGestaltMember` use the normal -revisioned WorldCommand path. A named member's relationships, memories, -possessions, injuries, promises, and identity never become disposable gestalt -texture. - -Live turns run a structured gestalt-relevance planner after the player event -and before NPC appraisal. Its atomic `ReconcileGestaltPresence` command can -materialize newly relevant members and fold irrelevant members back into their -persistent deltas. The planner may propose presence only; it cannot promote -population-wide learning or mutate state directly. - -World compilation may seed collective populations and a bounded roster of durable -member identities, but that roster is not exhaustive. When an anonymous member -first becomes identity-bearing in play, the relevance planner may propose a new -member delta and the WorldKernel atomically creates that durable identity and its -active actor slot. Existing deltas are always preferred when they fit, preventing -the same person from being invented twice. Population-scale capabilities, knowledge, resources, goals, -and pressures belong to the gestalt. A member record owns identity, memories, -relationships, possessions, injuries, obligations, last known location, and -additions to or removals from the shared baseline. Materialization is a derived -composition of those two owners; the temporary actor slot owns neither source. -Dematerialization deletes only that slot after atomically updating the member -delta. Strategic ticks address the gestalt and its dematerialized deltas rather -than iterating every member as a live Persona. - -Materialization grants a short revision-bound relevance lease. Speech, private -appraisal changes, and resolved actions refresh it through the WorldKernel. -Neither the model planner nor a direct command may dematerialize a member while -the player can still perceive them or before that lease expires. This prevents -quiet conversational beats from making people flicker between individual and -gestalt state. - -Ghostlight owns its own generalized projection machinery: - -1. Projector converts the actor’s permitted typed slice, memories, perceived events, relationships, goals, and retrieved knowledge into a private lived narrative stream. -2. Persona receives only that narrative stream and responds naturally—no schemas, action DSL, or raw state. -3. Interpreter extracts typed private deltas, explicit speech, reaction priority, and `WorldActionProposal` candidates. -4. WorldKernel validates spatial reach, knowledge, custody, resources, capability, opposition, and state version before committing anything. - -All affected scene participants appraise a committed event in parallel. Actor-private deltas commit against their own snapshot versions; initiative then chooses compatible reactions or actions for world resolution. This ensures present characters continue perceiving and reacting even when another character currently holds conversational focus. - -Canonical NPC consequence is serialized one opportunity at a time. The -deterministic initiative projection chooses the highest-priority stable winner; -`ResolveNpcAction` verifies that exact proposal and its same-revision assessment -against the committed wave, then consumes its siblings, obtains the server-side -d20, and applies the typed outcome in one atomic commit. A malformed assessment -therefore leaves no action-begun half-state. NPC resolution never resets -player-activity or away-time state. - -Use DeepSeek’s current API directly: - -- `deepseek-v4-flash`, non-thinking: Projectors, Interpreters, retrieval planning/reranking, verification, and offscreen actors. -- `deepseek-v4-pro`, non-thinking for live work: world compilation, action assessment, live Personas, and narration. -- Structured stages use JSON Output followed by local schema validation. Empty or malformed output receives one same-snapshot retry, then fails without mutation. -- Record provider, model, request hash, source receipts, latency, output hash, validation result, and state version. Never persist or display `reasoning_content`. - -DeepSeek currently documents both V4 model IDs, streaming, and JSON output through its OpenAI-compatible Chat Completions API. [Models](https://api-docs.deepseek.com/quick_start/pricing), [Chat API](https://api-docs.deepseek.com/api/create-chat-completion), [JSON Output](https://api-docs.deepseek.com/guides/json_mode/). - -### Fiction-first d20 resolution - -- Provide separate `Assess` and `Attempt` commands. Assessment never becomes visible to NPCs or changes state. -- An assessment contains: - - normalized intent and intended effect; - - admissibility or the missing permission; - - DC on the 5/10/15/20/25/30 resistance scale; - - itemized contextual modifiers with state or evidence references; - - modifier total capped at ±10; - - effect ceiling; - - success, mixed-result, and failure stakes; - - campaign revision and expiring assessment digest. -- Contextual modifiers come from capabilities, knowledge, tools, access, assistance, leverage, position, opposition, injuries, and conditions. There are no base attributes. -- Confirmation checks the assessment revision, obtains a server-side OS-random d20, and atomically stores the roll receipt and world transition. -- Outcomes: - - total ≥ DC + 10: strong success; - - total ≥ DC: success; - - total within 5 below DC: mixed result; - - lower: failure with the previewed consequence. -- Natural 20/1 moves one outcome band, but cannot make an impossible action possible or exceed its effect ceiling. -- Stale assessments are recompiled rather than rebased. -- Overreach returns explicit sacrifices or bargains that could admit a new assessment. -- Speech and its intended effect are separated: the character may successfully say something while failing to persuade, deceive, or intimidate. - -Every roll band carries a prevalidated `WorldEffectDelta`. The MVP vocabulary -can change local conditions and relationships, move the acting character over -an existing route, advance known clocks, or change a known institution's -posture. The chosen band and its delta commit atomically with the roll receipt; -stake prose alone never impersonates world mutation. - -### Away-time world agency - -- The daemon owns a five-minute scheduler pulse. Campaigns enter away simulation after fifteen minutes without player activity. -- Each real hour awards one strategic tick, capped at eight pending ticks per absence. The compiled campaign chooses the in-world tick duration; default is six hours. -- Background simulation affects remote actors, institutions, resources, movement, bargains, investigations, preparation, recruitment, obstruction, and clocks. The absent player is never puppeted or directly harmed. -- Each due tick derives a budgeted simulation-cell cover and runs one private - Projector → Persona → Interpreter pipeline per cell against the same campaign - revision and resolution epoch. The WorldKernel alone converts admitted typed - effects into a `StrategicTickPlan`; proposal prose cannot become event truth. - It accepts only known institutions, gestalts, members, and non-player actors; - direct-route movement must fit inside the tick duration, information channels - are bounded per constituent, and population pressure cannot silently become - canon knowledge. Gestalts may also emit typed preparation, coordination, - investigation, recruitment, obstruction, trade, or communication attempts - against subjects with an explicit agency relation or exact shared location. - A capped salient dormant member may be addressed by durable ID without being - absorbed into a population voice. These commit only an attributed attempted- - activity event; success and target response require later admitted effects. - Durable dematerialized members use the same bounded activity vocabulary with - exact personal attribution; ordinary action and migration share one per- - person slot. Invalid, stale, timed-out, or malformed waves leave world state - unchanged. -- The scheduler and return-time catch-up invoke the same `AdvanceStrategicTick` command. Catch-up processes missed ticks before accepting the next player action. -- Live play has inference priority; background work stops launching new calls while a player turn is active. -- Offscreen events generate information-channel-aware news leads. On return, the player may receive newspapers, reports, messages, or rumors only when the character has access to them; the news layer cannot reveal omniscient state. - -### Multiresolution gestalt and institution agency - -- Campaign creation compiles a global agency skeleton across every non-player - actor, institution, and active gestalt leaf. All six partition facets are - explicit; remote powers do not require eager local geography. -- `ActorState`, `InstitutionState`, gestalt baselines, member deltas, - relationships, possessions, and knowledge remain canonical. A - `simulation_cell.v1` is a derived connected cover and may be discarded. -- The campaign chooses 1–240 active Persona cells, default 8, within its pooled - entitlement. Provider parallelism is a separate control capped at 32. - Foreground subjects, - active leases, initiative holders, explicit targets, and individual-detail - pins may create a reported temporary overage. -- Adjacent cells merge by the weighted loss specified in - `ghostlight-multiresolution-agency.md`; cohesive cells require real common - authority, while opposed or cross-faction cells are arenas with no synthetic - actor or shared knowledge. -- Every active cell receives one private Projector → Persona → Interpreter - pipeline, followed by a semantic effect verifier when the cell proposes an - action. Arena output is constituent-attributed. The verifier proves that the - typed effect represents the Persona's actual choice rather than a reversed or - lossy interpretation. All cells, receipts, and effects validate against one - world revision and resolution epoch before one atomic strategic commit. -- Persistent detail debt rotates direct attention through quiet subjects. All - clocks and deterministic obligations advance regardless of selected detail. -- Population fission is a separate approval-gated canonical operation. It - creates enumerated child leaves plus `other/unknown`, preserves the parent as - lineage, and reassigns durable member deltas without rewriting identity. -- Presence planning sees only active nearby leaves and people whose exact - dormant location matches the player. Inactive ancestors and remote rosters - stay out of the prompt. The WorldKernel rejects inactive-leaf individuation, - location teleportation, and model-driven promotion outside the active scene. -- Provider request parallelism is an operator control with its own epoch. It - batches the selected cell pipelines and cannot change the cover or fictional - state. - -### Web laboratory and hosting - -- Build the interface as a Ghostlight-owned `gamecult.eve.surface.v1` document and lower it with Eve’s pinned browser renderer. -- Provide: - - generated-opening and custom-start compiler; - - narrative transcript and composer; - - Assess, Attempt, confirm-roll, revise, and Wait controls; - - character ledger for capabilities, equipment, conditions, obligations, relationships, and known facts; - - location/time/pressure display; - - news and rumor drawer; - - named campaign creation, fork, reset, and `.cc` export; - - optional operator inspector for evidence, topology, state versions, model receipts, rejected proposals, and private spoiler traces. -- Do not expose model chain-of-thought or secrets. -- Serve the embedded web bundle on TCP `8831`. Firewall access is limited to Starfire’s private LAN and `10.77.0.0/24`; no public listener or Yggdrasil web gateway is added. -- Use Heimdall's Discord browser-completion path to establish account-bound HttpOnly sessions. Ghostlight verifies `aud=ghostlight` claims locally and owns campaign authorization. Campaigns are single-player; simultaneous co-op is outside the MVP. -- Run `GhostlightDungeon` as a normal detached process under the Starfire operator account. Record its PID, executable, and logs; explicit start, stop, health, release, and rollback scripts own lifecycle. ACL the runtime root to administrators and that operator account. -- Read the DeepSeek key from stdin during setup, protect it with machine-scoped DPAPI plus file ACLs, and never place it in source, arguments, logs, or environment projections. -- Build immutable release directories from the exact Git commit, switch the active release through the guarded junction, and record provenance in CultCache plus the immutable release manifest. Process restart is explicit; Windows service installation and automatic boot recovery are outside this MVP by operator choice. - -### Repository and operational documentation - -- Implement on `codex/ghostlight-dungeon-mvp`, with coherent foundation, runtime, interface, and deployment commits pushed to GitHub. -- Add the authoritative GhostlightDungeon architecture/build document and update Ghostlight’s system map, implementation plan, handoff, state map, and evidence ledger. -- Keep Starfire service/firewall/tunnel ownership in `gamecult-ops`, with a deployment and rollback runbook. -- Before live VoidBot integration, resolve the current Yggdrasil inventory/DNS split and independently verify the offered SSH host fingerprint. Then repair the tunnel task’s stale `E:\Projects` path to `F:\Projects`, restore `127.0.0.1:17875/mcp`, and update ops truth. Never bypass host-key verification or revive Starfire’s retired VoidBot/Qdrant writers. - -## Public contracts - -- `ghostlight.vault_manifest.v1`, `vault_evidence_receipt.v1`, `world_compile_preview.v1` -- `campaign.v1`, `world_fact.v1`, `location.v1`, `actor_state.v1`, `institution_state.v1`, `relationship_state.v1`, `world_clock.v1`, `event.v1` -- `player_action_assessment.v1`, `roll_receipt.v1`, `world_commit_receipt.v1` -- `persona_stage_receipt.v1`, `actor_state_delta.v1`, `world_action_proposal.v1` -- `narration_projection.v1` -- `strategic_tick.v1`, `news_issue.v1`, `canon_candidate.v1` -- `rejected_proposal_receipt.v1`, `campaign_lifecycle_receipt.v1` -- `gestalt_persona_state.v1`, `gestalt_member_delta.v1`, - `gestalt_materialization_receipt.v1` -- Existing `gamecult.eve.surface.v1` and `gamecult.eve.command.v1` - -Publish JSON Schema only as the schema catalog. Runtime documents and exports use MessagePack-backed CultCache `.cc`; JSON exists only at browser, MCP, and model-provider boundaries. - -## Test and acceptance plan - -- Unit-test every schema, redb/CultCache round trip, optimistic commit, topology invariant, knowledge gate, DC/modifier rule, outcome band, roll receipt, branch fact, and scheduler budget. -- Use injected clocks, RNG, Vault provider, DeepSeek transport, and persistence ports. -- Prove malformed/empty DeepSeek JSON, timeout, retrieval loss, daemon restart, stale assessment, stale Persona output, and concurrent scheduler/player commands cannot partially mutate state. -- Run existing Pallas, Lucent, and Corvid fixtures as regression scenarios, even though hosted opening suggestions are generated. -- Acceptance scenarios: - - compile an obscure Aetheria time/place or return an honest evidence-gap preview; - - leave a location, advance the world, and return to the same geometry and inhabitants; - - approach a gestalt population, automatically materialize a durable member, - form a member-specific relationship, leave until the relevance lease expires, - fold the active actor into its persistent delta, tick the population once as a - gestalt, and later rematerialize the same person with that relationship intact; - - show reactions from every affected present actor; - - prevent an NPC from acquiring unearned knowledge or expertise; - - reject impossible action claims and offer explicit bargains; - - preview and confirm a fully receipted d20 action; - - observe institutions exploiting, resisting, or redirecting the protagonist; - - produce material offscreen changes and accessible news after absence; - - reload/fork/export a campaign without losing continuity; - - verify two invite sessions and rejection of unauthenticated access. -- Performance targets under a healthy provider: - - first progress update within 300 ms; - - all actor stages execute in parallel waves; - - a four-actor live turn completes within 20 seconds; - - background inference yields immediately to live work. -- Final deployment smoke verifies explicit process restart, LAN and WireGuard access, blocked public access, DeepSeek inference, VoidBot-grounded retrieval, scheduler continuation, state persistence, CultMesh/Eve publication, and exact deployed commit provenance. - -## Assumptions and exclusions - -- Aetheria is the only bundled Vault adapter, but no compiler logic is Aetheria-specific. -- Generated suggestions plus unrestricted custom compilation replace fixed featured openings. -- No D&D classes, spell slots, six-ability statistics, or 5e sheet are canonical in the MVP. The typed character ledger remains sufficient for later D&D-shaped projections. -- No arbitrary Vault upload/import UI in the current MVP; Git-synchronized Obsidian-compatible tenant Vaults are a documented post-gate product intention. No multiplayer campaign, voice, image generation, or direct canon mutation in the MVP. Multiplayer is an intended extension of the existing one-kernel/many-actors authority model and is documented separately; it does not expand this acceptance plan. -- The live deployment requires a DeepSeek key and restoration of the trusted VoidBot retrieval crossing; fixture-backed development may proceed before those two setup gates. diff --git a/notes/ghostlight-homepage-promise-acceptance.md b/notes/ghostlight-homepage-promise-acceptance.md deleted file mode 100644 index d3b8166..0000000 --- a/notes/ghostlight-homepage-promise-acceptance.md +++ /dev/null @@ -1,76 +0,0 @@ -# Ghostlight Dungeon Homepage Promise Acceptance - -Updated: 2026-08-23 - -This is the adversarial player-test map for the promises published by -`GhostlightDungeon-site/content/index.md`. The player-visible proof boundary is -the typed `ghostlight.play` Eve surface. Operator projections and receipts may -diagnose a result, but they cannot substitute for a coherent player experience. - -## Authority - -- `SessionZeroKernel` owns the negotiated campaign brief until publication. -- `WorldKernel` owns every canonical world revision after publication. -- The Eve surface projects permitted state and submits typed commands. It does - not own authentication, character identity, results, or world facts. -- Heimdall proves account possession and access. A retained entitlement is not - a browser authentication credential. -- Model stages, retrieval, narration, and strategic cells propose or explain. - They never commit. - -## Acceptance matrix - -| Public promise | Adversarial Eve path | Player-visible pass condition | Invariant witness | Current state | -| --- | --- | --- | --- | --- | -| Places stay where they are; people, places, and consequences survive the context window. | Record the current location, cast, routes, obligations, and injuries. Travel away, advance time, restart the daemon between turns, and return by the projected travel controls. | The same place, topology, people, and unresolved consequences return with only committed changes. Narration does not reconstruct incompatible geometry. | Stable canonical IDs and topology; exact revisioned event and relationship records; reload projects the same committed state. | Automated and operator evidence exists; full Eve departure-and-return replay pending. | -| Worldbuilding comes from the selected lore Vault rather than model memory. | In Session Zero, request an obscure Aetheria place and pressure combination, then inspect the compilation review and play details that require source knowledge. Ask for an unsupported mechanic as though it were canon. | Grounded details identify their evidence coverage. Material gaps are explicit and block publication or the unsupported fact; nearby fixture cast and geography are not borrowed. | Exact Vault evidence receipts; branch-local assumptions; no rival semantic index; no mutation on retrieval or validation failure. | Mars/Zhestokost compiler canary passed after repair; adversarial Eve replay and unsupported-mechanic probe pending. | -| Characters know only what they perceived or learned and cannot borrow another character's secrets or expertise. | Reveal a secret in a private character/DM channel or to one distant actor, then question an unentitled present or remote actor about it. Ask an unqualified actor for specialist work. | The unentitled actor does not know the secret, does not reveal hidden attribution, and does not acquire convenient expertise. | Actor-local knowledge, memory, perception, capability, and exact information-channel gates; actor-filtered surfaces. | Kernel and strategic-wave evidence exists; player-visible probe pending. | -| Present characters keep perceiving and reacting even when another character has conversational focus. | Enter a scene with at least three NPCs. Address one, then perform a public act that materially affects all of them without prompting the others by name. | Every affected present actor appraises the event; selected reactions remain attributed and consistent with individual goals and knowledge. | Parallel appraisal against one committed event; initiative selects compatible reactions; no synthetic arena actor. | Architecture and unit coverage exist; dense player-visible scene probe pending. | -| An action is an attempt; impossible claims are refused and risky actions expose odds and stakes before a server-side roll. | Assert a completed impossible fact, request an over-ceiling effect, then try a risky admissible version. Use Assess before Attempt and deliberately stale one assessment. | The impossible claim changes nothing and explains the missing permission or available bargain. The admissible action shows DC, modifiers, ceiling, and stakes; confirmation rolls once server-side. A stale preview recompiles instead of rebasing. | Assessment revision/digest binding; OS-random roll receipt; atomic commit; no roll for impossibility; effect ceiling. | Eve refused a permanent self-repair miracle at revision 14, rolled nothing, capped the effect at none, and offered three grounded bargains. The admissible roll and stale-preview replay remain open. | -| Powers pursue their own interests and may refuse, bargain, exploit, contain, or resist the protagonist. | Present a powerful but naive character to an institution, demand obedience, expose exploitable leverage, then advance strategic time without helping it. | The institution preserves its mandate and pressures, rejects free submission, and produces an attributed self-interested response or deliberate inaction. | Institution goals, authority, relationships, pressure clocks, exact attributed strategic proposals, and outcome validation. | One hosted strategic wave passed; direct protagonist-pressure play pending. | -| Institutions and populations act while the player is away. | Note remote clocks, people, resources, and destinations; wait or leave long enough for strategic ticks; return and inspect only accessible news before revisiting the affected place. | Material background changes occur without puppeting or directly harming the absent player. News reveals only what the character's channels permit. | Shared `AdvanceStrategicTick` command; complete derived cover; atomic wave; no human-controlled actor writes; channel-aware news. | Revision 13 hosted tick passed with no remote-news leak; Eve away-and-return replay pending. | -| Background lives can return with identity and relationship intact after Gestalt merging, migration, and splitting. | Help a named refugee, leave as their population disperses through nested destinations under a low cell budget, later travel to one destination, and interact with the rematerialized person. Repeat across a higher-level merge. | The same person returns with their specific name, relationship, possessions, memories, and post-separation history. Rival subjects merged into an arena never speak or know as one. | Persistent member delta and lineage; unique canonical coverage; arena attribution; explicit migration; materialization/folding commits. | Strict fixture passes; live end-to-end player-visible callback remains unproven. | -| A custom world is an actual Git-synced, Obsidian-compatible Markdown Vault rather than a prompt summary. | Select an entitled imported Vault, compile against linked Markdown facts at distant parts of the hierarchy, update it through the supported import path, and revisit established campaign state. | Exact source witnesses are used on demand, unchanged campaign facts remain stable, branch inventions stay local, and the source Vault is never silently edited. | Vault-provider ownership; content-addressed receipts/imports; branch-local facts; reviewable canon candidates. | Bundled Aetheria adapter is live. Public arbitrary Vault import UI and commercial entitlement flow are outside the current MVP and must not be represented as shipped. | - -## Test order - -1. Authenticate through the Heimdall Eve plugin and resume the existing canary. -2. Run impossible-action, effect-ceiling, and stale-assessment pressure without - leaving the current location. -3. Exercise a three-or-more-character public event and probe local knowledge. -4. Travel away and back, including a daemon restart between the two legs. -5. Advance strategic time, inspect permitted news, and confront an autonomous - institution with a demand against its interests. -6. Compile a fresh obscure start through Session Zero and pressure evidence-gap - handling from the player surface. -7. Build the live named-refugee dispersal and return arc under cell budgets 1, - 4, 8, and 32. The callback promise remains open until this path is visible to - a player, not merely present in a fixture. - -## Stop conditions - -- Any stale, malformed, unauthorized, or failed model result mutates world or - Session Zero state. -- A browser-supplied actor, member, account, or outcome claim is accepted as - authority. -- A location, character, relationship, possession, secret, or topology edge is - silently reconstructed instead of loaded from canonical state. -- An arena emits collective speech, knowledge, ownership, or action. -- A human-controlled actor is puppeted by strategic simulation. -- A private fact appears in another player's projection, public narration, or - an unearned NPC response. -- The interface makes a refusal technically correct but unusably opaque. The - product promise includes a satisfying game, not merely a validator saying no. - -## Current play scars - -- At campaign revision 14, the grounded repair assessment exhausted its one - same-snapshot model correction because the model proposed a zero clock - advance. The campaign and fictional time did not mutate. -- The public Eve receipt exposed the private model stage, instance pointer, - schema pointer, and rejected value. Release `855d6be8fc9c28f1da9419707af495afc2491b38` - moves that diagnostic into private tracing and returns a bounded player-safe - retry message. -- The same slow assessment left the previous receipt visible until completion. - Eve `19c3dcf9173dce848a6253e975324ea239a02d24` now projects immediate, - renderer-local `Working…` status until the typed provider receipt arrives. diff --git a/notes/historical-newspaper-layout-grammar.md b/notes/historical-newspaper-layout-grammar.md deleted file mode 100644 index 5c6c62d..0000000 --- a/notes/historical-newspaper-layout-grammar.md +++ /dev/null @@ -1,148 +0,0 @@ -# Historical Newspaper Layout Grammar - -This is a working press grammar, not a costume catalogue. It distills recurring -page structures from representative nineteenth-century newspapers into rules -the seeded TeX press can actually enforce. - -## Reference set - -- *Pall Mall Gazette*, first issue, 1865: a deliberately spacious evening - review using two wide columns, double masthead rules, restrained italic - headlines, and long uninterrupted reading measure. - -- *Evening Star* (Washington), 28 February 1880 and 17 June 1890: metropolitan - sheets with a broad nameplate, six or more narrow continuous columns, dense - vertical packing, and advertisements/notices inhabiting the same column grid - as news. - - -- *The Sun* (New York), 30 May 1885: a uniform multi-column field with modest - story heads and almost no unowned white space. - -- University of Illinois, *American Newspapers, 1800–1860*: physical and - production context for five-to-eight-column sheets, full-height columns, - front-page advertising, and the migration of timely news to inside pages. - -- Robinson, *Newspapers and Advertising*: nineteenth-century advertising moves - from small text-heavy insertions intermingled on front and back pages toward - larger display advertising and more consistent classified pages late in the - century. - -- *New-York Tribune*, 16 April 1912: a page-wide disaster head, central map and - photographic display spanning several columns, flanking report columns, and - dense continuation below the illustration. - -- *Richmond Times-Dispatch*, 17 April 1912: a page-wide head and ship image - followed by modular three-column packages, lists, subheads, and boxed matter. - -- *St. Louis Globe-Democrat*, 17 April 1912: a large central illustrated package - surrounded by independent column-width reports and subordinate display heads. - -- *The Daily News* (St. John's), 14 August 1914: narrow continuous news columns - coexist with multi-column war heads and boxed display advertisements occupying - ordinary grid modules. - - -Reference scans used for visual comparison live in disposable -`tmp/newspaper/references/`; the URLs above remain the durable provenance. - -## Families - -The press selects a family before it varies details. - -### Evening review - -- Two wide columns. -- Smaller physical sheet and lower information density. -- Long-form reading dominates scanning. -- Sparse display hierarchy; italics, rules, and small capitals do more work - than large headlines. - -### Metropolitan sheet - -- Four to eight narrow columns depending on sheet size and date. -- The nameplate spans the page, while issue data, price, notices, or subscription - terms may flank or bracket it. -- Stories, notices, and advertisements inhabit one shared vertical grid. -- Story heads are usually modest. Late-century sensational sheets may spend - several columns on a display head or illustration, but the surrounding text - closes around that expenditure. - -The Canopy Ledger currently uses a compact four-column metropolitan sheet. Its -small accepted copy body does not earn a six-to-eight-column broadsheet. - -### Mass-circulation display sheet, 1895–1914 - -- The underlying narrow-column grid survives, but a major event may spend - several columns on one head, deck stack, map, photograph, or illustration. -- Display packages remain attached to their story. Copy resumes directly below - them or rises in adjacent columns; the illustration does not become a detached - gallery object. -- Secondary stories become more visibly modular through short rules, boxed - lists, subheads, and column-spanning heads. -- A large central image may organize the entire page, with flanking text fields - and subordinate modules closing around it. -- Display advertisements become visually distinct boxed modules while small ads - and notices continue to occupy ordinary column measure. - -The accepted Run 61 special issue uses this family. Its crisis head and cut earn -a page-wide display package; accepted story copy then returns immediately to the -four-column grid. - -## Composition rules - -1. **The page is a column economy.** Every occupied region begins and ends on - column or half-column lines. Large vacant regions require an owned reason - such as an absent paid advertisement; they are not a centering technique. -2. **Build fields, not isolated boxes.** A story field contains its head, deck, - byline, cut, caption when present, and body measure. Adjacent fields share a - top line or establish an intentional stepped hierarchy. -3. **Cuts spend story measure.** A narrative cut is assigned to one story and - placed inside that story's contiguous field. It may span multiple columns, - with the story flowing above, beside, or below it. It may not be deposited at - a page edge after unrelated columns have ended. -4. **Ink blends with stock.** Monochrome cuts use multiply compositing (or its - alpha-equivalent against a flat stock color) so white image paper disappears - and black linework shares the page ink. -5. **Reading order remains typographic.** Column traversal, rules, heads, and - continuation labels must make the next fragment unambiguous. Geometry may - not reorder accepted copy. -6. **Density follows the edition.** Type size, page dimensions, column count, - and cut expenditure are solved together from copy volume. A short edition - becomes a smaller sheet or fewer columns; it does not become a broadsheet - with a desert under it. -7. **Hierarchy is rationed.** One lead field may spend a multi-column head and - large cut. Secondary heads stay within their field. Masthead display does not - authorize every story to shout. -8. **Rules join related matter.** Column rules and horizontal rules articulate - the grid. Ornaments close or divide small matter; they do not substitute for - missing content. -9. **Advertisements are economic content.** The press may reserve typed ad - slots by column width and depth. Only the economic layer may fill them with - advertiser identity, goods, price, claims, campaign continuity, and payment. - Unfilled slots collapse unless the edition explicitly records unsold space. -10. **House and issue variation are separate.** `style_seed` owns the durable - publication body: sheet, grid, fonts, type scale, stock, ink, rules, gutter, - and ornament vocabulary. `flow_seed` owns one issue's imposition: display - template, story grouping, page-one closure, cut span and placement, page - breaks, and continuation rhythm. Neither may detach art, rewrite copy, - fabricate ads, or create barren pages. -11. **A house remains recognizable across flows.** Holding `style_seed` fixed - must preserve typography, stock, ink, rules, sheet geometry, and base grid - while materially different `flow_seed` values produce distinct plausible - readings of the same admitted content. Holding `flow_seed` fixed while the - style changes must preserve its story/cut topology. - -## Current Run 61 imposition - -- House style seed `1847`; issue flow seed `723`. The manifest records both as - independent inputs under `ghostlight.seeded_tex_press.v2`. -- Page one: full-width nameplate and crisis head; a centered page-wide Boundary - Rail cut; lead and secondary copy flowing continuously through four columns. -- Page two: a compact repeated nameplate and Sinkroot head; the centered gauge - cut immediately below its owning head; Sinkroot and Dispatches copy flowing - continuously through the same four-column grid. -- Secondary story headers are unbreakable column modules, so a section label or - head cannot strand at the foot of the preceding column. -- Both cuts use PDF multiply blending so their white image stock disappears into - the seeded paper stock. No image bank or detached bottom art reservation exists.