Refresh transition authority and deployed state

notes/fresh-workspace-handoff.md

@@ -37,9 +37,11 @@ d20 resolution, persistent locations and institutions, multiresolution Gestalt
 agency, offscreen strategic activity, knowledge-filtered news, and actor-filtered
 Eve/CultMesh surfaces.
 
-The immediate product gate is continued adversarial play against the hosted
-compiler and multiresolution agency loop. Separate-account multiplayer privacy
-and unanimity proof remains required, but the previously expected D&D test
+The immediate engineering gate is completion of the principled world-transition
+migration before adversarial hosted play resumes. Region expansion remains a
+named direct writer, and the 36-case agency corpus is only a candidate seed
+against a 300-reviewed-case target. Separate-account multiplayer privacy and
+unanimity proof also remains required, but the previously expected D&D test
 group is no longer available; record that gate as unproven rather than silently
 lowering it.
 
@@ -52,6 +54,11 @@ lowering it.
 - Each campaign `WorldKernel` mailbox is the sole owner of canonical world state
   and revision. Player commands, NPC proposals, ticks, travel, waits, imports,
   reloads, and contract amendments share its validated atomic commit path.
+- Accepted foreground, reaction, strategic, time, travel, and population-fission
+  outcomes lower into one closed `WorldMutationBatch` vocabulary. Means and
+  intended effects remain proposals; only the kernel reducer can alter typed
+  canonical components. Legacy effect enums are model-boundary migration input,
+  not alternate physical laws.
 - Ghostlight owns the generalized Projector → Persona → Interpreter membrane.
   Projectors, Personas, Interpreters, retrieval, narration, dice previews, and
   browsers may propose or project; none may commit canonical state.
@@ -82,12 +89,12 @@ Yggdrasil is production. The Starfire writer and its old tunnel are stopped.
 Do not start both writers.
 
 - Executable release:
-  `a10a0125fc87a1262c50c85a0f1bf52133989feb`
+  `c7463c050620c69342c0cb84973beaefb09295cb`
 - Executable SHA-256:
-  `87ae68139375f507c54456907c687c397f18d7591a6a93d814ba7f4bc0ef3513`
+  `7b1aed52797f0845d896e9a1de2aa0b973a837353e8a76087845a50d9a429b06`
 - Artifact SHA-256:
-  `sha256-c0d1ab58fe711ff98502d4fad495c7a4d90e2aa079f08ac43e7981e26056cf92`
-- Eve release: `e5a81185bb790906bea5eeba40507673b0d9b5bb`
+  `sha256-d5aa68cc1162f7bf145a5b96b10284842638a8751810cd532a6d7f17ed93610d`
+- Eve release: `19c3dcf9173dce848a6253e975324ea239a02d24`
 - Service: `ghostlight-dungeon.service`, running as `ghostlight:ghostlight`
 - Listener: Yggdrasil loopback `127.0.0.1:8831`
 - Public route: `https://yggdrasil.gamecult.org/ghostlight/`
@@ -104,8 +111,9 @@ Do not start both writers.
   and rotates the locally wrapped claim without returning the browser to the
   access gate.
 
-Manifest, embedded commit, executable hash, typed health, persistent stores,
-restart recovery, public crossing, and anonymous rejection agree.
+Manifest, embedded commit, executable hash, typed health, `current` symlink,
+zero-restart service state, fresh signed Idunn health, fresh Odin catalog
+publication, public crossing, and anonymous rejection agree.
 
 ## Deployment and discovery truth
 
@@ -139,11 +147,25 @@ messages.
 
 ## Current proof
 
-- Idunn admitted exact release `a10a012…`; its locked package test and immutable
-  build completed before atomic activation. The same source passes 239 library,
-  32 daemon, and one build-provenance test locally. Typed health, manifest,
+- Idunn admitted exact release `c7463c0…`; its locked Linux package test and
+  immutable build completed before atomic activation. The same source passes
+  263 library, 33 daemon, and one build-provenance test in the local Windows
+  witness; Idunn's Linux journal reports 262 library tests before the remaining
+  package targets in its truncated success receipt. Typed health, manifest,
   embedded source, executable hash, provider readiness, nine campaigns, two
   Session Zero drafts, and zero daemon restarts agree.
+- Foreground, reaction, strategic, wait, travel, and population-fission writes
+  now use the typed mutation reducer. Each successful batch advances a touched
+  subject version once and persists its authority, mutations, receipt, causal
+  receipt, and aggregate projection atomically. Component-only mutation ingress
+  rejects aggregate campaign rows.
+- Population fission cannot copy scarce custody into every child. Approved
+  fission assigns every parent resource to exactly one child, transfers each
+  named member exactly once, preserves the shared non-scarce baseline through
+  lineage, removes the old direct campaign writer, and leaves only derived
+  agency-profile/cover projection outside the reducer. The nested regression
+  moves one granary through two successive fissions without duplication while
+  preserving John's exact identity and delta.
 - Live refresh pressure reproduced and removed two contract faults: reuse of a
   private-command idempotency key across separately sealed attempts, and
   validation of a refresh receipt as if it carried the initial-login account
@@ -204,14 +226,20 @@ Operational release and rollback truth remains in `gamecult-ops`.
 
 ## Next action
 
-1. Fork or compile a denser 20-plus-power Aetheria agency skeleton and pressure
-   budgets 1, 4, 8, and 32 with real provider output, including nested refugee
-   dispersal and later rematerialization.
-2. Run a two-person Yggdrasil Session Zero and bounded shared-scene canary using
+1. Route bounded region expansion through the admitted mutation batch and prove
+   that no production direct writer can bypass the reducer. Classify initial
+   compiler publication and materialisation/dematerialisation explicitly rather
+   than quietly treating their current aggregate writes as equivalent.
+2. Expand and review the agency corpus from its current 36 candidate cases
+   toward 300 behaviorally distinct cases; do not inflate it with reskins.
+3. Resume adversarial Eve play, then fork or compile a denser 20-plus-power
+   Aetheria skeleton and pressure budgets 1, 4, 8, and 32 with real provider
+   output, including nested refugee dispersal and later rematerialization.
+4. Run a two-person Yggdrasil Session Zero and bounded shared-scene canary using
    separate Heimdall accounts.
-3. Then run the eight-account roster, privacy, actor-binding, pooled-budget,
+5. Then run the eight-account roster, privacy, actor-binding, pooled-budget,
    unanimous-approval, unanimous-time/travel, stale-command, and restart smoke.
-4. Continue human pressure on multiresolution Gestalt agency: meaningful
+6. Continue human pressure on multiresolution Gestalt agency: meaningful
    background surprises, exact attributed rival activity inside arenas,
    information boundaries, nested fission/folding, migration, and return
    encounters.
@@ -226,6 +254,7 @@ capacity.
 - MVP authority: `docs/architecture/ghostlight-dungeon-mvp.md`
 - Interface authority: `docs/architecture/ghostlight-eve-native-interface.md`
 - Gestalt authority: `docs/architecture/ghostlight-multiresolution-agency.md`
+- Transition authority: `docs/architecture/ghostlight-transition-algebra.md`
 - Live system map: `notes/ghostlight-current-system-map.md`
 - Implementation program: `notes/ghostlight-implementation-plan.md`
 - Human-readable state: `state/map.yaml`

notes/ghostlight-current-system-map.md

@@ -853,7 +853,12 @@ The player surface also projects the canonical current location ID. The
 destination compiler binds that value into a read-only origin field and shows
 the proposed locations, containment, routes, persistent features, and material
 gaps before approval. Population fission approval similarly shows each named
-child leaf, partition value (including `other/unknown`), and home location.
+child leaf, partition value (including `other/unknown`), home location, and the
+exact child receiving each parent-owned resource. Shared capabilities,
+knowledge, goals, pressures, and relationships inherit through population
+lineage; custody does not. Each scarce resource crosses exactly one typed
+custody transfer, so a fission cannot copy one granary, vehicle, or medicine lot
+into every child.
 Fission admission runs before parent lookup, retrieval planning, or inference:
 one request may contain at most 16 distinct cuts of at most 160 readable
 characters and one 500-character reason. The browser mirrors these bounds.
@@ -867,6 +872,39 @@ only missing or undecodable responses receive the ambiguous-transport warning
 that a commit may have preceded the lost response. The production web build
 runs strict TypeScript checking before Vite emits assets.
 
+## World Transition Authority
+
+`WorldKernel` owns one closed semantic `WorldMutationBatch` reducer. Foreground
+attempts, NPC reaction waves, strategic actor/institution/Gestalt outcomes,
+waits, group travel, and approval-gated population fission all lower their
+accepted outcomes into that vocabulary before canonical state changes.
+`ActionMeans` records what an actor did, and the intended effect records what
+they hoped to change; neither is a committed fact. The mutation batch contains
+only exact component changes admitted by a state-derived authority envelope.
+
+The reducer validates the complete batch on an isolated component overlay,
+advances each touched subject version once, and persists component state,
+mutation authority envelope, mutation batch, mutation receipt, causal command
+receipt, events, and aggregate compatibility projection atomically. The
+aggregate campaign row is rejected as a component-only mutation target.
+`WorldEffectDelta`, `ActorStateDelta`, and strategic effect variants are model
+boundary migration inputs, not writers or independent physical ontologies.
+
+Population fission now composes admitted child entities, stable child
+identities, one lineage split, exact resource custody transfers, and exact
+named-member membership transfers. The old fission function that directly
+wrote campaign state has been removed. Its surviving projector updates only
+agency profiles, facets, cover invalidation, and `resolution_epoch` after the
+canonical mutation batch succeeds.
+
+The runtime migration is not yet complete. Bounded region expansion still
+inserts compiled locations and facts directly, and initial compiler publication
+remains a separate seed authority. Materialisation and dematerialisation are
+resolution changes over one persistent person and require an explicit review
+of why they currently advance aggregate world revision. These are named writer
+frontiers, not silently equivalent paths. See
+`docs/architecture/ghostlight-transition-algebra.md`.
+
 Relationship documents in the schema catalog are revision-bound projections
 of actor-owned relationship maps; they are not a second relationship writer.
 Vault manifests summarize the exact provider/source/authority/temporal lanes

notes/ghostlight-implementation-plan.md

@@ -122,6 +122,14 @@ Region expansion, initial compiler publication, removal of legacy model effect
 schemas, and the 300-case reviewed agency corpus remain the explicit migration
 frontier. See `docs/architecture/ghostlight-transition-algebra.md`.
 
+Idunn's locked Linux test/build gate admitted this cut as immutable Yggdrasil
+release `c7463c050620c69342c0cb84973beaefb09295cb` with Eve
+`19c3dcf9173dce848a6253e975324ea239a02d24`. Live health, the release symlink,
+deployment witness, binary hash, zero-restart service state, signed Idunn
+health, and fresh Odin catalog publication agree. The local Windows witness is
+263 library, 33 daemon, and one provenance test; the Idunn Linux success receipt
+reports 262 library tests before its truncated remaining package-target output.
+
 Live local evidence now covers grounded VoidBot compilation, a four-actor wave,
 impossible and receipted d20 actions, grounded narration, strategic cells, and a
 24-faction budget-4 wave. The first scale baseline used 37,327 prompt tokens and
@@ -156,11 +164,15 @@ leak. It used 90,030 tokens at a 76.3% prompt-cache-hit ratio; the retained
 invalid receipts expose one repeated institution posture and one repeated
 pressure without letting either mutate the world.
 
-The next simulation gate is a 20-plus-power live Aetheria skeleton across
-budgets `1`, `4`, `8`, and `32`, including nested refugee dispersal and later
-rematerialization. Separate-account two-player and eight-player Session Zero
-and shared-scene pressure remains an independent unproven gate; no human cohort
-is currently waiting. The browser never
+The next engineering gate is lowering bounded region expansion through the
+mutation reducer, explicitly classifying seed publication and
+materialisation/dematerialisation, and growing the agency corpus beyond its 36
+candidate cases without cosmetic reskins. After that cut, resume the
+20-plus-power live Aetheria skeleton across budgets `1`, `4`, `8`, and `32`,
+including nested refugee dispersal and later rematerialization.
+Separate-account two-player and eight-player Session Zero and shared-scene
+pressure remains an independent unproven gate; no human cohort is currently
+waiting. The browser never
 receives the Heimdall access token; it adopts a server-verified login attempt
 into an HttpOnly Ghostlight session. Treat player confusion, dramatic flatness, composite consequences,
 and token-heavy low-consequence stages as evidence about missing context or