Retire the revision-bound rule from active steering

The steward found stale-means-discard still asserted as the opportunity rule
in map.yaml live_architecture and plan invariant 11. Both now state
scope-digest binding as the adopted rule and name foundation.v0 as still
revision-bound until plan step 6 pass 2. Handoff and next_action carry the
v2 shape and the live worker witnesses.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

notes/fresh-workspace-handoff.md

@@ -40,8 +40,12 @@ The replacement owner is sealed. Its runtime boundary remains create/open,
 immutable snapshot, submit, and typed receipts. Mutable aggregate state,
 canonical ID issuance, the reducer, and the CultCache journal writer stay
 private to the kernel. Controller assignment and affordance grants are
-canonical; current executability and exact revision-bound decision
-opportunities are derived and revalidated by the kernel.
+canonical; current executability and decision opportunities are derived and
+revalidated by the kernel. The landed `foundation.v0` loop binds opportunities
+to a revision; ontology v2 replaces that with scope-digest binding, so a
+proposal whose scope digest is unchanged commits at a later revision and one
+whose digest changed is rejected. Revision binding is current source, not the
+adopted rule.
 
 Autonomous cognition has two explicit modes under disjoint controller scopes:
 
@@ -196,32 +200,33 @@ and proposals but cannot commit on their behalf.
 
 ## Next gate
 
-Two live operator orders, both ahead of the deployment gate. Commit `9c662bd`
-landed the closed vocabulary at `docs/architecture/ghostlight-world-ontology.md`
-and implementation-plan step 6 (ontology widening, seven passes); the kernel
-source is still Speak-only (`SubjectKind` Person/Institution/Population,
-`AffordanceKind::Speak`, `DecisionAction::Speak` in
-`crates/ghostlight-dungeon/src/world/mod.rs`). Run 115's root cause is recorded
-as vocabulary-shaped in `state/evidence.jsonl`; `12ee9f4` removed the legacy
-elaboration ingresses with no compatibility path and they are not a design input.
+Ontology v2 is the adopted vocabulary: `34ce8c8` rewrote
+`docs/architecture/ghostlight-world-ontology.md` (twelve components, twenty-nine
+operations under one `WorldPatch`, world-authored affordances with
+preconditions, effect slots, and kernel-entropy outcome bands, four derived
+`CausalBoundary` kinds, scope-digest binding, one `AdmitPatch` for seed and
+elaboration, eighteen proofs). `ghostlight-transition-algebra.md` and
+`ghostlight-multiresolution-agency.md` are teardown evidence. Plan step 6 is
+eight implementation passes, none landed; kernel source is still Speak-only
+(`crates/ghostlight-dungeon/src/world/mod.rs`) with revision-bound
+opportunities. Run 115's vocabulary-shaped root cause and the v2 decisions are
+the last two records in `state/evidence.jsonl`.
 
-1. Revise the ontology so deterministic correctness verification covers both
-   world elaboration and character action, general enough for sprawling worlds
-   with layered institutional agency. Eight elaborators are looping agents whose
-   tools are exactly the ontology's permitted mutations; no elaborator gets a
-   tool the reducer cannot validate. Sparse causal sufficiency still governs:
-   counts, cover ratios, and qualitative review are evaluation evidence only.
-2. Fan out four detached Codex CLI workers on the prose plus illustration Ink
-   fixture path, one each against AetheriaLore, Delvehold lore, Kalsa, and
-   Zyphos. Planned layout, not yet present on disk at the time of writing:
-   launcher under `C:\Users\Meta\.claude\worlds\`; Ghostlight worktrees at
-   `F:\Projects\Ghostlight-worlds\<world>` on branches `codex/world-<world>`;
-   lore worktrees at `F:\Projects\<Lore>-worktrees\ghostlight-worlds`. On
-   re-entry, `git worktree list` and `git branch --list 'codex/world-*'` are
-   the witnesses; if they are empty, the fan-out has not launched. Image
-   rendering is deferred: the BFL key at `E:\Projects\gamecult-ops\bfl-api.txt`
-   is gone with drive E:, so workers emit imagegen-ready prompts only and
-   `scripts/generate_bfl_images.py` must not be run against its default key path.
+1. Land plan step 6 pass 1: typed ID namespaces, `Ref<Id>` draft handles,
+   closed-patch resolution, and the complete mismatch set against an otherwise
+   empty ontology, with tests, before pass 2. Eight elaborators are one
+   `OperationalAgent` loop whose tool catalog is a projection of the operation
+   set; no elaborator gets a tool the reducer cannot validate.
+2. Four detached Codex CLI world workers are live on the prose plus
+   illustration Ink fixture path (started 2026-09-04T15:56). PIDs:
+   `C:\Users\Meta\.claude\worlds\logs\pids-worlds.csv`. Poll from
+   `C:\Users\Meta\.claude\worlds\` with `.\Invoke-Worlds.ps1 -Phase Status`.
+   Ledgers: `F:\Projects\Ghostlight-worlds\<world>\examples\ink\<world>\RUN.md`
+   for aetheria, delvehold, kalsa, zyphos. Worktrees branch from `9c662bd` on
+   `codex/world-<world>`; `git worktree list` lists them. Lore worktrees at
+   `F:\Projects\<Lore>-worktrees\ghostlight-worlds`. Image rendering is
+   deferred: the BFL key drive E: is gone, workers emit imagegen-ready prompts
+   only, and `scripts/generate_bfl_images.py` has no working default key path.
 
 The deployment gate below is deferred behind both orders, not cancelled:
 

notes/ghostlight-implementation-plan.md

@@ -112,8 +112,10 @@ projection of committed history.
     them.
 11. Controller assignment and affordance grants are canonical aggregate state.
     Current executability and decision opportunities are deterministic
-    revision-bound derivations. A scheduler can order those opportunities but
-    cannot mint their authority.
+    derivations bound to a scope digest over the components they read; a
+    proposal whose scope digest is unchanged commits at a later revision, and
+    one whose scope changed is rejected. A scheduler can order those
+    opportunities but cannot mint their authority.
 
 ## Implementation sequence
 

state/map.yaml

@@ -87,7 +87,7 @@ live_architecture:
     - Every ingress submits one CommandEnvelope. The kernel derives authority from canonical state, lowers through one component mutation algebra, validates one complete candidate, and atomically persists WorldState plus WorldCommit through CultCache CAS.
     - Rejected and no-effect commands do not allocate canonical IDs, advance revision or digests, or append journal rows. Translation gaps, scheduler queues, and DecisionOpportunity values are derived evidence and cannot enter WorldState by recording themselves.
     - The typed ontology owns runtime-issued identities, subjects, decision controllers, components, places, routes, relations, custody, jurisdiction, knowledge, pressure, provenance, and external-owner grants. Aggregate Campaign and legacy component projection are not parallel truth.
-    - NarrativePersona and OperationalAgent are centralized proposal interfaces with disjoint explicit authority scopes. Canonical controller assignments and affordance grants determine authority; current executable affordances and revision-bound opportunities are derived and kernel-revalidated. Controllers have no commit, verifier, repair, scheduler, or recovery authority.
+    - NarrativePersona and OperationalAgent are centralized proposal interfaces with disjoint explicit authority scopes. Canonical controller assignments and affordance grants determine authority; current executable affordances and opportunities are derived and kernel-revalidated; opportunities and proposals bind to a scope digest over the components their verification reads, not to a revision (ontology v2; landed foundation.v0 still binds to revision until plan step 6 pass 2). Controllers have no commit, verifier, repair, scheduler, or recovery authority.
     - Scheduler queues, covers, transcript, news, surfaces, model receipts, compaction, checkpoints, world-size counts, and qualitative judgments are derived only.
     - Expansion occurs at a typed causal boundary and uses the same mutation vocabulary as seed creation, action, import, individuation, and time. A sparse structurally closed horizon is valid.
     - Pre-rebuild stores and acceptance roots remain immutable evidence. They do not enter the new runtime through a live compatibility writer.
@@ -361,5 +361,5 @@ current_status:
   scale_checkpoint: Runs 108 through 115 prove load and failure properties of the pre-rebuild body, not world completeness. The 1,200 and 2,400 actor figures are synthetic evaluation profiles only. Production expansion is sparse and causal; structural admission cannot require interest, diversity, name uniqueness, or an actor count. The committed replacement authority suite passes, but no further scale run is admitted until Yggdrasil serves the exact world-v2 release through the rebuilt Idunn recipe/binding/router seam, the live state root satisfies the complete world-v2 allowed-path contract, restart preserves exact journal and digest identity, and no old service, state path, process grant, or route can regain write authority.
   presentation_checkpoint: The historical press-layout and seed-ownership split are complete. `notes/historical-newspaper-layout-grammar.md` remains the durable grammar. Manifest v2 at `output/tex/canopy-ledger-run-61-style-1847-flow-723.manifest.toml` independently binds `style_seed=1847`, `flow_seed=723`, frozen source SHA-256 `8f195140f52a40ba705d6a66987146a1500ae89668e5d82b01d1792eb3afb882`, and the final artifact `output/pdf/canopy-ledger-run-61-style-1847-flow-723.pdf`, SHA-256 `a457f4b1702a7a52480e42fce0039f0dbe677ff32958e98f1c412b346237190c`. An identical seed pair produces byte-identical TeX and PDF; changing only flow preserves the exact style section while materially changing a plausible layout, and changing only style preserves flow topology. Cut-first and cut-midstory templates pass visual inspection; the failed split-card template is deleted. Frozen copy/assets, actual PDF `/BM /Multiply`, and economic-layer advertising authority remain invariant.
   public_reference_checkpoint: The published public architecture is immutable pre-rebuild history, not current rebuild authority. Canonical Ghostlight commit `15ea0f0` owns five archived pages covering the former overview, authority, pipelines, 43 named production stages, and eight titled elaborators. Site commit `2035e799c2cf7470b2bfc70d5a878d5d3be5e90f` publishes a shared mobile Home/Blog/Docs masthead, visibly marks every Docs page as a teardown archive, and publishes the postmortem `The World Counter Lied` at `https://ghostlight.gamecult.org/Blog/the-world-counter-lied`; live HTTP inspection returned 200 for the postmortem and Docs index and found the masthead and archive banner. Do not use the archived pages to steer the whole-machine rebuild. `docs/architecture/ghostlight-dungeon-mvp.md` owns the adopted target; publish replacement architecture only after the replacement body is implemented and verified. The site repository owns public composition and deployment.
-  next_action: Two operator orders ahead of the deployment gate. (1) Revise the ontology at `docs/architecture/ghostlight-world-ontology.md` (landed `9c662bd`, plan step 6) so deterministic correctness verification covers both world elaboration and character action across sprawling worlds with layered institutional agency; eight elaborators are looping agents whose tools are exactly the ontology's permitted mutations. Kernel source remains Speak-only in `crates/ghostlight-dungeon/src/world/mod.rs`; `ghostlight-transition-algebra.md` is teardown evidence and `ghostlight-world-consumer-api.md` is drift pending rewrite. (2) Fan out four detached Codex CLI workers on the prose+illustration Ink fixture path against AetheriaLore, Delvehold lore, Kalsa, and Zyphos: launcher `C:\Users\Meta\.claude\worlds\`, Ghostlight worktrees `F:\Projects\Ghostlight-worlds\<world>` on `codex/world-<world>`, lore worktrees `F:\Projects\<Lore>-worktrees\ghostlight-worlds`; `git worktree list` is the witness. Image rendering deferred, BFL key path on drive E: is gone, workers emit imagegen-ready prompts only. Deferred behind both orders, not cancelled: review and subtract the uncommitted Idunn projection and bounded RUDP transport, add UDP route actuation plus an independently persisted post-reload data-plane observation, and verify that focused pass on Yggdrasil. Then implement the directly managed Rust Odin observation/correlation daemon and exact transaction-frozen capability dependency closure. Install rebuilt Idunn, admit Odin first, then CodexConnector and Ghostlight; prove same-generation continuity, fencing, signed health, route cutover, Odin-outage freeze, and negative legacy authority before purging old units, releases, state roots, and the remote acceptance debris. `GameCult/cultcache-rs` and `GameCult/cultnet-rs` now have no readers anywhere: Epiphany `68939b2c` and CodexConnector `6519289` consume CultLib and carry no submodules at all, and Odin `27cc815` does the same. Both repos are retirable now: that work landed on CultLib main by fast-forward at `8cb3b72`, so every pinned revision -- Ghostlight `85f7024`, Epiphany and CodexConnector `e171eca`, Odin `cbde940` -- is an ancestor of main and resolves from a fresh clone. Still vendored are `VoidBot/vendor/cultcache-ts`, `Ghostlight/vendor/cultcache-py` and `Odin/vendor/cultmesh-rs`. The first two vendored because npm and pip cannot take a package from a subdirectory of a git repo the way cargo can, so there was nothing to depend on. CultLib `8cb3b72` adds a publish workflow: tagging `cultcache-ts-v*` or `cultcache-py-v*` ships `@gamecult/cultcache-ts` to npm and `cultcache-py` to PyPI, refusing any tag whose version disagrees with the manifest. Both repoints wait on the first publish, which needs an `NPM_TOKEN` secret and a PyPI trusted publisher. Ghostlight's is not a bare dependency swap: `tools/ghostlight_state_store.py` puts `vendor/cultcache-py/src` on `sys.path` so the state tooling works from a clone with no install step, and session bootstrap depends on that. Detail on the Odin repoint: Odin's vendored CultNet submodule and CultCache copy are gone from its worktree and both come from CultLib, with only `vendor/cultmesh-rs` still vendored and itself consuming CultLib. Odin's commit had to carry the in-flight CultMesh RUDP document server with it: the previously committed CultMesh calls `assume_connected()`, a CultNet method the fork had and CultLib does not, so the old code cannot build against CultLib at all. It depends on CultLib branch `claude/cultnet-reliable-expiry` at `cbde940`, which must reach main by merge rather than squash or the pinned rev is orphaned. Live citations name CultLib `85f7024`, a permanent ancestor of main; evidence records keep their pre-consolidation SHAs as dated history. Local run scaffolding, downloaded acceptance copies, and redundant Git bundles are already purged, and `.gitignore` now refuses them.
+  next_action: Ontology v2 is adopted at `34ce8c8` (`docs/architecture/ghostlight-world-ontology.md`: twelve components, twenty-nine operations under one `WorldPatch`, world-authored affordances, four derived `CausalBoundary` kinds, scope-digest binding, one `AdmitPatch`, eighteen proofs); `ghostlight-transition-algebra.md` and `ghostlight-multiresolution-agency.md` are teardown evidence. (1) Land plan step 6 pass 1 of eight: typed ID namespaces, `Ref<Id>` draft handles, closed-patch resolution, and the complete mismatch set with tests; kernel source is still Speak-only with revision-bound opportunities in `crates/ghostlight-dungeon/src/world/mod.rs`. (2) Four detached Codex CLI world workers are live on the prose+illustration Ink fixture path: PIDs `C:\Users\Meta\.claude\worlds\logs\pids-worlds.csv`, poll with `.\Invoke-Worlds.ps1 -Phase Status` from `C:\Users\Meta\.claude\worlds\`, ledgers `F:\Projects\Ghostlight-worlds\<world>\examples\ink\<world>\RUN.md` for aetheria, delvehold, kalsa, zyphos on branches `codex/world-<world>` from `9c662bd`; image rendering deferred, prompts only. Deferred behind both orders, not cancelled: review and subtract the uncommitted Idunn projection and bounded RUDP transport, add UDP route actuation plus an independently persisted post-reload data-plane observation, and verify that focused pass on Yggdrasil. Then implement the directly managed Rust Odin observation/correlation daemon and exact transaction-frozen capability dependency closure. Install rebuilt Idunn, admit Odin first, then CodexConnector and Ghostlight; prove same-generation continuity, fencing, signed health, route cutover, Odin-outage freeze, and negative legacy authority before purging old units, releases, state roots, and the remote acceptance debris. `GameCult/cultcache-rs` and `GameCult/cultnet-rs` now have no readers anywhere: Epiphany `68939b2c` and CodexConnector `6519289` consume CultLib and carry no submodules at all, and Odin `27cc815` does the same. Both repos are retirable now: that work landed on CultLib main by fast-forward at `8cb3b72`, so every pinned revision -- Ghostlight `85f7024`, Epiphany and CodexConnector `e171eca`, Odin `cbde940` -- is an ancestor of main and resolves from a fresh clone. Still vendored are `VoidBot/vendor/cultcache-ts`, `Ghostlight/vendor/cultcache-py` and `Odin/vendor/cultmesh-rs`. The first two vendored because npm and pip cannot take a package from a subdirectory of a git repo the way cargo can, so there was nothing to depend on. CultLib `8cb3b72` adds a publish workflow: tagging `cultcache-ts-v*` or `cultcache-py-v*` ships `@gamecult/cultcache-ts` to npm and `cultcache-py` to PyPI, refusing any tag whose version disagrees with the manifest. Both repoints wait on the first publish, which needs an `NPM_TOKEN` secret and a PyPI trusted publisher. Ghostlight's is not a bare dependency swap: `tools/ghostlight_state_store.py` puts `vendor/cultcache-py/src` on `sys.path` so the state tooling works from a clone with no install step, and session bootstrap depends on that. Detail on the Odin repoint: Odin's vendored CultNet submodule and CultCache copy are gone from its worktree and both come from CultLib, with only `vendor/cultmesh-rs` still vendored and itself consuming CultLib. Odin's commit had to carry the in-flight CultMesh RUDP document server with it: the previously committed CultMesh calls `assume_connected()`, a CultNet method the fork had and CultLib does not, so the old code cannot build against CultLib at all. It depends on CultLib branch `claude/cultnet-reliable-expiry` at `cbde940`, which must reach main by merge rather than squash or the pinned rev is orphaned. Live citations name CultLib `85f7024`, a permanent ancestor of main; evidence records keep their pre-consolidation SHAs as dated history. Local run scaffolding, downloaded acceptance copies, and redundant Git bundles are already purged, and `.gitignore` now refuses them.
   gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Materialisation/folding changes only representation and the exact member delta, advances resolution epoch, and retires the old cover; it has no Gestalt-wide effect authority. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only.