# Ghostlight Verse: Map

Campaign `ghostlight-verse`, target `ghostlight-verse:target:r2`
(`notes/ghostlight-verse-target.md`). This page holds body facts, the model
page and rationale only. Cut specs, questions, rulings and follow-ups live in
the Eureka mind; query them there, never copy them here.

Phase 1 map: Imagination, session `self-2026-10-09-morning`, 2026-10-09.
Base for every phase-1 anchor: Ghostlight `origin/main` `4fee97f`.
Times are UTC unless marked local (UTC+2).

## Body facts (probed 2026-10-09)

### Does main run on Yggdrasil?

- **The code on `main` is running.** The live unit
  `idunn-ghostlight-dda9de02…` (PID 818485, up since 2026-09-23 20:02:48) runs
  release `sha256-51b014be…`, whose binary embeds commit `454fc33` (grep of
  the binary for the stamped commit: `454fc33` 5 hits, every later commit 0).
  `git diff --stat 454fc33 origin/main` touches only
  `docs/architecture/ghostlight-play-agent-cut.md`,
  `notes/fresh-workspace-handoff.md` and `state/map.yaml`. So `main`'s code is
  live; only its provenance stamp is a week old.
- **Why the 2026-09-30 deploy died.** Unit `idunn-ghostlight-0e4f20f5…`
  (release `sha256-ec17cae9…`, binary stamped `4fee97f`) logged
  `publishing initial Warming runtime presence failed; retrying error=timed
  out connecting runtime-presence publisher to 10.77.0.1:17871` every ~2.5 s
  from 10:58:35, then at 11:00:36 `Error: publishing initial Warming runtime
  presence timed out` and exit 1 (`journalctl -u` on the unit). The bound is
  `WRITE_LEASE_WAIT_TIMEOUT` = 120 s
  (`crates/ghostlight-dungeon/src/runtime.rs:1939`, used at `:1985-1992`).
  `10.77.0.1:17871` is nginx's UDP stream route to Odin's catalog
  (`/etc/nginx/idunn-stream-routes/odin.conf`: listen `10.77.0.1:17871`,
  upstream `127.0.0.1:17973`, the `odin-daemon` socket). Idunn itself could not
  reach it in the same minutes: `Idunn rejected admitted odin route
  continuity: timed out connecting CultMesh RUDP client idunn-route-observer
  to 10.77.0.1:17871` (idunn-yggdrasil journal, 10:57-11:08). Idunn recorded
  the transaction `up-855ddf0c…` as failed and kept the 09-23 generation:
  daemon survival worked as designed.
- **The Odin route outage window.** Idunn's "odin route continuity"
  rejections per hour run from 2026-09-28 01:19 to 2026-09-30 12:xx, peaking
  at 1,326 in 2026-09-29 23:00, and stop after that. The live Ghostlight's
  failed presence republications per day: 3,186 (09-28), 3,793 (09-29),
  2,512 (09-30), then 1-7 per day from 10-01. The peak matches the scar in
  Eureka's `tools/stopgap/ygg-verify.sh` header: at 8 verify slots on
  2026-09-30 01:50 local, `/proc/pressure/io` full avg60 was 41% and Odin's
  fsyncs stalled long enough for Idunn's route challenges to time out. That
  explains the peak; the start on 09-28 is not proven to share the cause.
  Odin's unit failures in the window include `RUDP packet connection id …
  does not match` and `timed out waiting for reliable acknowledgement from
  CultMesh RUDP catalog 127.0.0.1:17973` (journal of `idunn-odin-*`).
- **Consequence for deploys.** Ghostlight cannot start without Odin: the
  Warming presence and the process write lease both go through Odin
  (`runtime.rs:1974-2003`). That coupling is the lease design, not a defect
  in this campaign's scope. A deploy is preflighted on Odin's route health
  and on Yggdrasil's IO pressure.

### Does main build and pass?

Two jobs through `ygg-verify.sh` at `4fee97f`, with `vendor/eve` initialised:

- Rust (image `eureka-verify-rust`), the recipe's own steps:
  `ghostlight-persona-projection` 35 passed; `ghostlight` lib 621 passed,
  1 ignored (`real_local_model_cognition_modes_commit_speech`, needs a model);
  `tests/external_admission.rs` 13 passed; doc-tests 10 passed;
  `ghostlight-dungeon --bin` 198 passed, 4 ignored; release build green in
  3 m 08 s. Total 877 passed, 0 failed. Warnings: unused imports
  (`RECORD_GAP_PATCH_TOOL`, `WorldPhase`, `DEFAULT_LOCAL_MODEL_PREFIX`,
  `DateTime`).
- Node (image `eureka-verify-kotlin`, Node 24.21): `sidecar/claude-sdk`
  27 passed, 3 skipped ("run `npm run build` first"); `web` 3 passed;
  `web` build green.
- **The four ignored Dungeon tests are the Eve client-bridge tests**
  (`runtime.rs:3054`, `:3677`, `:3798`, `:3904`), the only tests that drive
  the real vendored browser lowering. They need Node beside cargo. The rust
  verify image has no `node` (probe: `command -v node` exit 127), and the
  recipe runs them in no step, so the release gate never runs them. PA.f214
  is the class of defect they exist to catch.

### The play-session findings against main today

No commit after `454fc33` touches code, so every PA.f211-PA.f216 is open on
`main`. Mechanisms, probed:

- **PA.f211 and the tunnel.** Bonsai's endpoint on Yggdrasil is the reverse
  tunnel `127.0.0.1:18080`. With Bonsai down (as now), `curl` to it returns an
  empty reply (exit 52): sshd accepts, then closes. `local_inference.rs:166-181`
  classifies only `error.is_connect()` as retryable, so a Bonsai restart reaches
  the play loop as `InferenceFault::new` (not retryable) and closes the turn on
  the first call. Even a retryable fault gets
  `backoff_delay` (`play.rs:2970-2973`, base 100 ms, cap 5 s) times
  `ROUND_RETRY_BUDGET` 12 (`play.rs:89`), about 36 s in all, against a reload
  the Raven runbook puts at about 30 s plus load. Raven's
  `/opt/gamecult/bonsai/rss-watchdog.sh` (systemd `bonsai-rss.timer`, every
  2 min) restarts past 4.5 GiB RSS unless `/slots` shows `is_processing`;
  between the calls of a turn nothing is processing. Raven's
  `idle-reaper.sh` (`bonsai-idle.timer`) stops Bonsai and SillyTavern after
  30 minutes with no `launch_slot_` in the container log. Neither script is in
  version control: gamecult-ops has only the runbook describing them.
- **PA.f212.** A closed turn records its fault (`PlayTurn.fault`,
  `play.rs:298`; `close_with_fault`, `play.rs:1753-1765`), but
  `PlayTurnView` (`play.rs:1224-1246`) has no fault field, the card
  (`eve.rs:455-543`) renders narration, question, refusal, running and
  resolving rows and nothing for a fault, and `close_with_fault` logs nothing.
  A local call can also wait `RESPONSE_TIMEOUT` = 900 s
  (`controllers.rs:68`, used by `local_inference.rs:157`) with "Resolving your
  turn" on the card the whole time.
- **PA.f213.** The owner's Draft card always offers "Seed the world"
  (`eve.rs:366-399`); the handler refuses when `GHOSTLIGHT_SEED_VAULT_ROOT` is
  unset (`runtime.rs:1701`, `:1739-1745`). Yggdrasil sets none.
- **PA.f214.** `world.play.text` (`eve.rs:588-594`) carries no authored
  `value`. The vendored lowering captures only `value`, never `placeholder`
  (the PA.f164 comment at `eve.rs:288-296`), so Play clicked on an untouched
  box sends no `text`, and `PlayPayload.text` (`runtime.rs:288-292`) is
  required. The "submit an empty message to continue" hint (`eve.rs:514-520`)
  asks the player for exactly that payload.
- **PA.f215.** The acceptance step runs
  `controllers::tests::real_local_model_cognition_modes_commit_speech`
  (`controllers.rs:11231`): NarrativePersona and OperationalAgent each must
  commit speech in one shot against Bonsai. It exercises the library's
  controller path, not the Dungeon play loop. Failing runs' prose is written to
  `GHOSTLIGHT_ACCEPTANCE_PERSONA_PROSE_LOG`; Idunn's staging dirs on Yggdrasil
  hold `.runner-rust-acceptance` workspaces per transaction.
- **PA.f216.** Creation is one form of eight fields, three of them raw JSON
  (`targets` `{}`, `jurisdictions` `[]`, lens weights; `eve.rs:244-331`), then
  a Draft card with Approve, Seed and Activate as separate buttons
  (`eve.rs:343-415`).

### A live defect not yet in the findings

The live process has logged `Heimdall refresh transport unavailable
error=Heimdall denied the private command: Idempotency key was reused with
different command content.` once a minute since 2026-09-23 21:04 (1,440 a
day from 10-01). Sequence: 21:02:03 discovery timed out; 21:03:00 `local app
session rejected Heimdall refresh error=local session changed during refresh`;
from 21:04 the denial forever. Mechanism:

- Ghostlight's refresh key is `refresh:{heimdall_session_id}:{access_revision}`
  (`runtime.rs:1877-1880`), stable until the local session advances.
- Every attempt is resealed with a fresh nonce, IV and issue time
  (`heimdall.rs:880-895`).
- Heimdall fingerprints the sealed request bytes, not the command
  (`Heimdall/src/private-command-plane.ts:88`,
  `createHash("sha256").update(request.payload)`), and refuses a known key with
  a different fingerprint (`:93`).
- So once Heimdall has executed one refresh (it rotated the token at 21:03)
  and the local commit refused it (`app_session.rs:293-300`), no retry under
  that key can ever succeed, and `sessions_due_for_refresh`
  (`app_session.rs:247-268`) keeps offering the same candidate while
  `refresh_expires_at > now`. Which clause of `app_session.rs:293-299` fired at
  21:03 is not logged.

### The host

- `ghostlight-dungeon.service` (the v1 body) is **enabled**, inactive since
  2026-09-23 14:31. It binds `127.0.0.1:8831`, runs `/srv/ghostlight/current`,
  targets CodexConnector, and would start at the next boot beside Idunn's
  generation. `/srv/ghostlight` holds 46 GiB (226 releases, acceptance
  build scripts), `/var/lib/gamecult/ghostlight-dungeon` 17 GiB of v1 world
  state (the v2 kernel refuses earlier schemas; nothing migrates it),
  `ghostlight-dungeon-quarantine` 44 KiB, `ghostlight-import-20260821T1858Z`
  8 KiB. Disk `/` is 20% of 2 TB used.
- The v1 actuator and its tests live in gamecult-ops:
  `scripts/deploy-ghostlight-yggdrasil.sh`,
  `scripts/test-ghostlight-yggdrasil-wiring.sh`; the runbook's "One-time state
  cut" section (`runbooks/ghostlight-dungeon-yggdrasil.md:456-499`) describes
  that path.
- Idunn's leftovers: 12 failed `idunn-ghostlight-*` transient units (11 from
  the 09-23 bring-up, 1 from 09-30), 15 release dirs under
  `/srv/ghostlight-idunn/releases` (403 MiB), per-transaction staging dirs
  under `/var/lib/gamecult/idunn/staging`. These are Idunn's: it launches the
  units and owns release retention. Phase 1 does not hand-clean them.
- Hostname is `yggdrasil-candidate`. Heimdall still runs as the legacy
  `heimdall.service`; every Idunn v2 deploy of it has failed (`idunn status`).

### The repo

- The pre-rebuild research machine is still on `main`: `tools/` (17 files,
  4,146 lines, including the Python state store), `schemas/` (14, 4,057),
  `examples/` (194, 37,421), `experiments/` (172, 12,325), `acceptance/`,
  `prompts/`, `scripts/`, `output/`, `assets/newspaper/`, `state/` (map.yaml,
  evidence ledger and archive, a CultCache JSONL, corpus coverage, branches),
  `docs/aetheria/`, root `package.json` scripts pointing at a Codex Python
  runtime, and about 30 pre-rebuild architecture and note pages. No file
  outside Ghostlight references `Ghostlight/schemas`,
  `ghostlight_state_store` or `ghostlight.agent_state` (grep over
  `F:\Projects`, excluding build output).
- `AGENTS.md` (234 lines) instructs agents to treat `state/` and the Python
  store as canonical state and the implementation plan as current.
- Live docs that cite the old `world/*.rs` paths:
  `ghostlight-world-consumer-api.md:19,31,33,38,70`;
  `ghostlight-world-ontology.md:53,74,167,202,203,215,232,277`;
  `notes/fresh-workspace-handoff.md:253`; `notes/local-live-smoke.md:56`. The
  code is flat under `crates/ghostlight/src/`. Dated cut documents and
  postmortems keep their paths: they are history.

## Model page

One row per persistent kind phase 1 touches. No cell may be empty.

| Kind | Named by | Life over time | Who decides |
|---|---|---|---|
| World state and commit journal (`.cc`, redb) | `WorldId`; `revision`; digest chain | created Draft, approved, activated; one commit row per admitted command; earlier schemas refused, never migrated | the kernel, through `WorldMailbox`'s closed operation set; untouched in phase 1 |
| Play turn row (play-turn store `.cc`) | `turn_id` (UUID); per-turn `question_token` | `Running` → `AwaitingPlayer` ↔ `Running` → `Closed` (narration or `fault`); an unreadable row is retired to a sidecar and play starts fresh | `PlayTable` (`play.rs`); the card is a projection of `PlayTurnView`, which phase 1 extends with the fault |
| App session (`app-sessions-v2.cc`) | cookie hash; `heimdall_session_id` + `access_revision` | issued at sign-in; refreshed when access is near expiry; revoked on logout, custody change, invalid receipt, and (phase 1) on a refresh that can no longer succeed | `AppSessionOwner`; Heimdall decides the upstream session and rotates refresh tokens |
| Heimdall private command receipt (Heimdall Postgres) | `(app_slug, idempotency_key)` + request fingerprint | written once per executed command; replayed for an identical request; a different request under the key is refused | Heimdall; its fingerprint rule is a Heimdall follow-up, not a phase-1 cut |
| Idunn generation (transient unit, release dir) | `sha256-<release>` | staged → started → Warming → lease → Active → superseded or failed; the previous Active stays until a new one is Ready | Idunn; retention and failed-unit collection are Idunn's follow-up |
| v1 body (`ghostlight-dungeon.service`, `/srv/ghostlight`, v1 state) | unit name; paths | retired in fact 2026-09-23; unit still enabled | nobody today; phase 1 assigns its removal to a gamecult-ops cut, data by operator ruling |
| Bonsai lifecycle (Raven containers) | container `bonsai`; scripts under `/opt/gamecult/bonsai` | started by hand ("Start AI Chat"); restarted by the RSS watchdog; stopped by the idle reaper | gamecult-ops/Raven; Dungeon only reads the endpoint; availability policy is an operator question |
| Repository docs (README, AGENTS, live architecture pages, handoff) | path on `main` | rewritten to the live machine; pre-rebuild material leaves `main` by operator ruling | the Ghostlight repo; history in git, dated cut documents and postmortems |

### Where phase 2's verb sets plug in

Ruling `verse-verbs-two-render-paths` and invariant `every-event-renderable`
bound what the kernel may admit to two render paths. Today:

- The thirty operations (`ghostlight-world-ontology.md:451-478`) are
  state transitions, not verbs. They stay the closed substrate.
- What an actor *does* is an affordance: a world-authored catalog entry whose
  kind is `AffordanceKindName` (`patch.rs:247-254`), free canonical text that
  "the kernel carries and branches on nowhere", plus the kernel-built `speak`
  (`controllers.rs:94`). Admitted acts surface as `DecisionEvents` on the
  commit.

So phase 2's two verb sets plug in at the affordance kind: a closed
vocabulary of kinds, each tagged with its one render path, with effects that
still compile to the thirty operations. Today the Play authority can declare
any affordance kind, so nothing on `main` enforces the invariant yet. Phase 1
neither widens nor narrows that, and its docs must not describe open-ended
verbs as the target.

## Rationale

- **"main dies" was a misreading.** The deploy that died carried no code
  change, and it died on Odin's route, not on Ghostlight. So phase 1's deploy
  work is mostly preflight and proof: redeploy `main` after the play fixes,
  with Odin's route and IO pressure checked first. The Odin outage is
  recorded against its owner.
- **Subtraction goes first and alone.** The pre-rebuild tree is about 60,000
  lines that the live machine never reads. It is cut before the docs are
  rewritten, so the rewrite describes only what is left. Parking it at a tag
  rather than deleting it outright is the operator's call (question).
- **Faults belong to the card, not the log alone.** PA.f212 is an authority
  gap: the turn store knew the fault and the projection dropped it. The fix
  extends the projection; it adds no second record.
- **Retrying inference is safe.** A model call is a proposal the kernel
  admits or refuses, so a transport fault before any reply is retryable. That
  is the Ghostlight half of PA.f211. The Raven half (the watchdog's quiet
  window) belongs to gamecult-ops, which also takes the scripts into version
  control.
- **The refresh loop is a contract split.** Ghostlight assumes a stable key
  makes a retry safe; Heimdall's fingerprint makes every retry new. Ghostlight
  stops looping (a refresh that can no longer succeed revokes the local
  session). Heimdall's fingerprint rule goes to Heimdall as a follow-up.
- **The bridge tests are the gate's blind spot.** They are the only
  Dungeon tests that drive the real client, and nothing runs them. Fixing the
  gate means a runner with both Rust and Node, which is Idunn's recipe and
  runner surface: a follow-up, with each phase-1 Hands run doing them by hand.