Ghostlight/notes/fresh-workspace-handoff.md

Ghostlight Fresh Workspace Handoff

Do not trust this file for the exact live HEAD. Use git for volatile truth.

Do not continue implementation automatically from a rehydrate-only request.

Immediate Re-entry Instruction

1. Read state/map.yaml.
2. Read notes/ghostlight-current-system-map.md.
3. Read notes/ghostlight-implementation-plan.md.
4. Run npm run state:status.
5. Restate the persisted next action before touching code or docs.

Mission

Ghostlight exists to build socially persistent generative agents for Aetheria: characters and institutions whose actions emerge from personality, culture, memory, perception, incentives, material constraints, ordinary life, tonal mode, and scene pressure.

The live product-facing goal is procedural branching scene generation for games: speech and non-speech actions, NPC responses, consequences, future hooks, and state/memory/social-perception mutation. The wider ambition includes narrated story scaffolding, Elysium branch exploration, psychologically grounded consumer behavior, major faction decision-making, and technology/item manifest generation.

Current Focus

GhostlightDungeon is the active MVP. Read docs/architecture/ghostlight-dungeon-mvp.md before touching its runtime. The per-campaign WorldKernel mailbox is the sole canonical writer. Ghostlight owns the generalized Projector → Persona → Interpreter organ; Epiphany retains her canonical Persona mind and will consume the shared organ through an adapter.

The hosted MVP is implemented and live on Starfire. Ghostlight owns the generalized projection membrane; Epiphany consumes its pinned crate while retaining her own Mind and consequence authority. The Rust daemon now owns VoidBot-grounded compilation and approval, stable topology, campaign mailboxes, fiction-first d20 receipts, parallel Persona waves, automatic gestalt individuation and folding, a multiresolution global agency graph, connected cohesive/arena cell covers, model-driven strategic cell waves, exact-channel news, CultMesh/Eve publication, invite-isolated campaigns, and .cc export. Live acceptance has proved two invite sessions, Vault compilation, three concurrent NPC reactions, a 13.57-second four-actor wave, and material offscreen agency without player puppeting. Re-enter through the authoritative architecture and the latest exact deployment evidence; do not resume the superseded compiler foundation checklist below. Existing Ghostlight fixtures remain regression evidence.

The active immutable release is b76bb5a8936624513fd0cd5e46d4d9ab11c3a517, binary SHA-256 41928dbe73bb3e4a75e3a468d8a2c7ce725254621d17faa8a565ea526b2a3296. Manifest, process, typed health, persisted campaign count, CultMesh store, DeepSeek startup inference, and VoidBot retrieval agree. Periwinkle proved the private-LAN route and unauthenticated 401; Raven and Yggdrasil independently proved WireGuard. Exact firewall and rollback truth remains owned by gamecult-ops/runbooks/ghostlight-dungeon-starfire.md.

The accepted runtime lineage passes the authenticated generated-start and committed player journey: canonical nonliteral player identity, private assessment, confirmed d20 roll, wait, restart, fork, export, original re-selection, and reset. The current 24-subject budget matrix passes at 1, 4, 8, and 32 cells. The strict nested refugee golden now passes without a retry: Mira retains an individual perspective inside a budget-one rival arena, migrates across two depth-two population lineages, survives three further background waves with her exact delta intact, and is automatically promoted as the same person when the player later returns. The remaining human-test gate is rendered browser inspection using a temporary invite, which requires explicit approval to send that credential through the in-app browser; rotate invitations afterward.

The multiresolution authority map is docs/architecture/ghostlight-multiresolution-agency.md. Canonical people and populations never merge; only the derived simulation cover does. Budget/pin changes use resolution_epoch, provider parallelism uses its own configuration epoch, and neither advances fictional time.

The paid-alpha scope remains single-player, but single-player is not a kernel invariant. docs/architecture/ghostlight-dungeon-multiplayer-intention.md records the intended later extension: multiple authenticated humans control distinct actors through the same mailbox, perception gates, initiative, and atomic WorldKernel commit path. It introduces no party prompt, room-state authority, or current implementation work. The forge remains focused on proving that multiresolution Gestalts preserve agency and produce satisfying surprises.

The current acceptance candidate adds a bounded population activity vocabulary for preparation, coordination, investigation, recruitment, obstruction, trade, and communication. Each action is constituent-attributed, graph- and location-scoped, semantically verified, and committed only as an attempt event; pressure markers carry only unresolved pressure. Event participants include exact gestalt IDs for later perception and demand. Presence planning projects only nearby active leaves and exact-location dormant members, while the WorldKernel rejects inactive-leaf or teleported promotions. The refugee-return live-fire harness requires the presence planner, rather than a direct materialization command, to surface the same migrated member.

Live pressure then exposed that dormant named members could migrate but could not take ordinary local action. The candidate now has member_activity, using the same bounded activity vocabulary with exact member, location, target, knowledge, and channel scope. It shares the person's resolution key with migration and emits an attempt event without mutating the member delta or letting a containing arena or destination Gestalt steal the choice.

The next live failure exposed a reciprocal reach gap rather than a Persona problem: South Harbor residents could perceive settled Mira but their typed target list contained only explicit agency relations. Strategic activity reach now includes exact shared location as well as explicit relations. Dormant named people remain exact member:<id> targets, and the scheduler filters every cell slice to its capped salient member exceptions so a crowded location cannot dump its roster into a prompt. Resolver and WorldKernel independently revalidate identity, location, attribution, and attempt-only semantics.

The first run after that repair failed safely for a different reason. The budget-one arena Projector showed the transit camp and South Harbor as parallel views, but the Persona staged a direct conversation across the bay. The Interpreter also widened offers and ongoing loading into successful integration and ensured departure. Arena projection now states and preserves remote scene boundaries, and Interpreter guidance defines the activity vocabulary as narrow attempts with attempt-only intended_effect. No kernel rule or world-state compensator was added.

The next strict run migrated Mira and completed two sustained waves. Its third wave then failed atomically because a camp-only cell voiced Mira from another cell and invented a reachable camp coordinator; the Interpreter repeated an impossible targetless coordination after correction. Projectors now reserve internal perspective for actual cell constituents/member exceptions, Personas cannot conjure absent entities into contact, and empty target errors explicitly tell the correction stage that anonymous targets cannot be encoded.

The following run migrated Mira and completed two sustained waves before a third safe abort. An institution's committed posture had been stored in the generic cell pressures list; its Projector treated that already-made decision as a live dilemma and the Persona repeated it. CellConstituentSlice now has an explicit current_posture; institution pressure is no longer smuggled through pressures[0]. Projector, Interpreter, and local validation share the same unambiguous baseline.

A subsequent strict preflight revealed a lossy Interpreter mapping: Mira chose to board for South Harbor, but the typed effect recorded only local preparation and the semantic verifier accepted it. The migration contract now states both directions explicitly. Chosen travel within the strategic horizon is member_migration; preparation is reserved for a still-unchosen departure.

The next preflight found two structural weaknesses. A learned Projector omitted the relief crews' South Harbor label, allowing a remote supply table to drift into Mira's camp; and the Interpreter copied prefixed subject_id into a second raw member_id field. Ghostlight now prepends deterministic narrative scene boundaries from the permitted slice, and model-facing effects no longer carry duplicate owner IDs. subject_id is bound once into the canonical effect by the runtime, reducing both ambiguity and prompt/output tokens.

The following sustained wave reached a missing typed capability rather than a prompt defect. An entire refugee leaf chose to board, but only named-member migration existed, so the Interpreter could preserve the journey only by lying. gestalt_migration now lets an exact active leaf move along a typed migration relation and reachable route. WorldKernel atomically updates the Gestalt and its agency-profile location while leaving every named member delta untouched. Fission still owns cohort subdivision and remains approval-gated; derived covers still own only simulation resolution. The same wave also exposed an unnamed manifest clerk. Targetless local investigation is now a typed attempt against the current environment, never an invented actor, response, or discovered fact. Interpreter guidance was split into shorter stable clauses while adding these effects, reducing repeated prompt bulk.

Two later pressure specimens exposed an upstream perspective leak. An arena Projector rendered internal Mira and harbor-neighbor sections inside a cell that owned only a transit population and remote institutions. The Persona followed the vivid illegal voice, and the effect verifier could not reliably recover attribution afterward. Cell Projectors now emit schema-bound subject_id → narrative segments. Ghostlight admits only exact cell owners, rejects duplicates and omission of the debt-selected focus, then lowers the segments into stable natural name/location prose. Raw freeform Projector output no longer crosses into the Persona stream.

The next live run reached the action verifier and exposed a split verdict: its global rejected-index list rejected all four arena actions while the rationale called two of them supported. The verifier contract now returns one ordered typed verdict per candidate. Runtime schema and validation own exact count, index range, order, and aggregate rejection; the model owns only each action's semantic recommendation. Correction guidance forbids returning a rejected action unchanged and explicitly drops chosen travel when no grounded destination transition exists. The fresh candidate still needs a strict live rerun before this is considered proven.

That rerun passed the strict budget-one preflight and reached the sustained waves, but a one-action verdict then emitted supported: false alongside a rationale saying the typed effect matched exactly. The boolean and free prose are replaced by a discriminated match, or mismatch plus an enumerated mismatch class. Supported actions carry no explanatory prose. Runtime rejects missing, reordered, or incoherent discriminators before they can authorize a wave.

The next strict attempt exposed a coherent target_substitution: Mira asked an unnamed camp coordinator for permission, the Interpreter first emitted an empty communication target, and duplicated validators rejected that shape; the correction then stole refugees-east as the listener. Empty-target local communication is now a first-class source-attributed attempt at the exact current location. It never creates the ordinary role, a reply, acceptance, or an outcome. One domain method owns which activity kinds allow this shape, and the Interpreter membrane, wave resolver, and kernel all use it.

The following run produced semantically clean Mira and population migrations, but the wave resolver rejected destination references that the scheduler had shown to the Interpreter. resolution::subject_state_references now owns the canonical constituent reference set, including active reachable migration destinations. Scheduler slicing and wave admission consume that same derivation; the scheduler's private migration-destination helper was deleted.

That fix let the next strict run commit its preflight. In a sustained wave the effect verifier then called two faithful local activities reversals because their prose included walking to an embankment or nearby cove. The verifier now receives the missing spatial contract: incidental motion within the supplied canonical location belongs to the activity and creates no topology or arrival; only movement to a different supplied canonical location requires a movement effect.

The next stochastic strict run chose no Mira migration and correctly stopped without mutation. A second run passed preflight, then an institution emitted a genuinely new but over-240-character posture twice. The existing canonical bound is now present in both the compact Interpreter contract and generated JSON Schema, and prompt guidance names it before generation.

gestalt-posture-bea5d6c-2 is the first complete strict golden. One budget-1 rival arena covered 24 subjects; budgets then changed 4 → 8 → 4. The run committed 26 actions across 11 distinct background subjects, preserved Mira's identity through independent member and population journeys, and automatically rematerialized the same person at South Harbor. It completed in 90.345 seconds with 146,509 prompt tokens, a 40.97% cache-hit ratio, and 5,635 prompt tokens per committed action. Projector cache hit was 53.82%. The new stress mode can keep budget 1 for 23 additional waves, require all 24 debt-selected foci across the initial plus sustained ticks, reject inactive lineage parents, and repeat the callback after compression.

The first 24-tick fairness attempt stopped safely after 20 total ticks when a named member selected six valid communication targets although an activity may encode at most four. The rejected wave did not commit. The Interpreter contract and same-snapshot correction now state the cardinality explicitly instead of making the model infer it from JSON Schema. A deterministic diaspora regression also moves two remembered refugees from one depth-two source leaf to different depth-two destination branches in one plan and proves their effective and private state remains distinct.

The fairness harness now models scheduler continuation explicitly. Set GHOSTLIGHT_LIVE_FIRE_MAX_REJECTED_PULSES_PER_WAVE from 0 through 8. Each failed pulse retains its exact world and resolution revisions, writes a numbered private failure artifact, and commits nothing; the next pulse starts a new model pipeline against the still-current snapshot. Final results enumerate the failed pulses instead of hiding them. This is acceptance orchestration only and does not add a second retry inside Projector/Interpreter validation.

Do not resample Mira until she performs for the fairness test. Three consecutive bc19c8a Personas validly gave away the berth or waited. The strict callback golden already proves emergent migration. For fairness, set GHOSTLIGHT_LIVE_FIRE_BASELINE_RESULT to the strict golden's result.json, leave strict migration off, and keep GHOSTLIGHT_LIVE_FIRE_FAIRNESS_WAVES=23: the initial provider wave plus 23 sustained waves provide 24 new debt foci. The harness validates the baseline's committed campaign, dormant Mira identity, arena cover, and player state, then records its path and SHA-256 in the result.

gestalt-dynamics-fairness-a4ea28b-1 passed the full budget-one pressure: 24 distinct foci for 24 subjects, 45 committed consequences from 15 background subjects, four rejected-and-recovered scheduler pulses, stable player and Mira state, and the same-person callback after 641.578 seconds. Aggregate prompt use was 572,695 tokens with 47.07% cache hits. Projector reached 75.45% cache hits; Interpreter consumed 247,578 prompt tokens at 34.54% cache hits and is the next efficiency target.

The scale matrix was 1 cell / 2 actions / 18.913s / 11,734.5 prompt tokens per action; 4 / 8 / 15.619s / 4,682.1; 8 / 16 / 26.300s / 3,546.6; and configured 32, effective 24 / 16 / 55.906s / 7,410.5. The first budget-32 attempt aborted atomically on one overlong posture, demonstrating its higher tail risk. Budget 4 is fastest; budget 8 is the best action-per-token point and reaches the global consequence cap.

Those historical scale figures used provider parallelism 4. The scale harness now exposes GHOSTLIGHT_SCALE_PROVIDER_PARALLELISM, defaults it to 8, and records the value separately from active-cell budget. A corrected budget-8 / parallelism-8 run completed in 18.35 seconds with ten material actions, one explicit attributed inaction, zero retries, exact 24-subject coverage, and no player movement. Witness: F:\GameCult\GhostlightDungeon\acceptance\gestalt-scale-shakedown-b8-p8.

The first fairness profile accidentally sent SetResolutionBudget(1) before every tick. The kernel accepted the redundant command, incremented resolution_epoch, and discarded cover leases each time. The runtime now rejects unchanged budget and provider-parallelism controls without persistence; the harness only sends a real change. Use GHOSTLIGHT_LIVE_FIRE_STRESS_BUDGET and GHOSTLIGHT_LIVE_FIRE_PROVIDER_PARALLELISM independently for the next profiles. Rerun the long budget-one case before treating its cache or churn numbers as the lease-preserving baseline; its agency/fairness result remains valid.

The first lease-preserving budget-4 run committed two waves, then deterministically failed every pulse because migration had changed graph adjacency while an old leased cell remained. The old harness's redundant epoch churn had hidden this. preserve_previous_cover now rejects any previous multi-subject cell that is disconnected in the current derived graph and falls back to the fresh candidate. A regression constructs a still-leased formerly connected cover whose groups are disconnected under the current graph. Validation now names the exact cover fault instead of returning one generic invalid-cell message.

The fixed budget-4 run then completed all 24 ticks but the harness falsely reported relief-union missing: that institution was a singleton in every cover, so advance_detail_debt correctly treated it as directly resolved while the harness counted only explicit aggregate focus labels. Acceptance now uses the canonical union of explicit focus plus singleton subjects.

The corrected lease-preserving budget-4 run committed all 23 sustained waves and recovered from 18 rejected pulses without partial world mutation. It failed only after those waves when automatic presence planning returned an empty cast for Mira's South Harbor callback. Mira's dormant identity, destination, relationships, memories, and effective state were intact. dab6aae made the planner's scene-casting objective explicit, projected the player's reciprocal relationship beside the exact member delta, and began persisting presence-preflight.json before assertions.

The first focused callback probe was blocked before casting by the dominant long-run failure: an institution repeatedly emitted its already committed posture as if it were a new action. 6253f9f now projects that field as already_committed_posture and defines continuation as inaction throughout the Projector, Persona, Interpreter, and correction contexts. Validation still rejects the no-op rather than silently repairing it. The same commit adds GHOSTLIGHT_LIVE_FIRE_PRESENCE_ONLY=1 for a baseline-backed focused acceptance run.

gestalt-callback-6253f9f-1 passed in 18.465 seconds. A fresh 24-subject arena wave ran first; then the presence planner selected mira-venn from harbor-neighbors without the player naming her. WorldKernel rematerialized the same private and effective state at South Harbor. The strategic membrane used 18,662 prompt / 1,096 completion tokens; presence used another 2,504 / 78.

gestalt-lease-b8p4-6253f9f-1 then passed 31 sustained budget-8 waves at provider parallelism 4 in 1,211.592 seconds. It covered all 24 subjects, made 199 accepted proposals from 22 subjects, committed 193 sustained consequences plus the initial arena consequence, recovered 15 rejected pulses, preserved the player and Mira, and passed the same-person callback. Strategic prompt use was 1,468,039 with 60.69% cache hits and 7,567 prompt tokens per committed consequence. Interpreter consumed 737,148 prompt tokens at 67.18% cache hits; Projector reached 70.03%.

That run falsified the prompt-only repeated-posture fix. Its trace showed mixed arena turns where one constituent acted while other institutions explicitly held their existing course. The old CellAppraisal could represent actions or one global inaction reason, not attributed inaction beside another subject's action. The Interpreter sometimes restated the holding institution's posture to avoid dropping its choice. The appraisal contract now has exact actions[] and exact inactions[]; the old global field is deleted. Inactions are bounded, non-mutating, permission-checked, unique, and mutually exclusive with an action from the same subject. The next live profile must compare retry rate and token efficiency under this new contract before claiming the waste is cut.

The first parallelism-8 comparison on 97e05c5 committed nine waves and then failed closed at wave 10 after 11 total rejected pulses. Its first nine waves already showed the missing expressive capacity: 72 cell appraisals contained 63 actions, 93 attributed inactions, and 18 mixed appraisals. The failure was overprojection, not authority leakage: the Interpreter filled in “no action taken” for unvoiced roster members, exceeded the four-perspective limit, and once exceeded the reason-length bound. The prompt now maps only explicit holds or waits from the Persona turn, forbids absence-as-inaction, and requests reasons within 160 characters. Rerun a 23-wave fairness-length budget-8 profile at provider parallelism 8 from the same committed migration baseline.

The next exact-build profile passed the original Mira action/inaction conflict after local validation began returning the exact failed condition instead of a four-way generic error. It then exposed a deeper kernel seam: one camp Gestalt communicated with refugees-east in the same wave that the refugees migrated. The proposal was valid against the shared snapshot, but the apply loop moved the refugees before rechecking the later communication. Strategic application now reads the original snapshot, mutates a private working campaign, and swaps it in only on total success. Regressions cover the simultaneous migration/communication case and prove that an invalid late action cannot partially apply an earlier migration.

gestalt-lease-b8p8-d044951-1 then passed all 23 sustained waves in 742.435 seconds at budget 8 and provider parallelism 8. All 24 subjects received direct resolution attention; 22 background subjects acted and the remainder were explicitly represented by attributed inaction. The run committed 175 consequences, retained 179 inactions across the appraisals, ran 90 arena cells, preserved the cover across 21 of 22 boundaries, kept the player unchanged, and automatically returned the same Mira with effective personal state intact. It recovered 19 rejected pulses with no partial mutation. Observed usage was 1,988,812 prompt / 233,146 completion tokens at 66.64% prompt-cache hits; rejected pulses consumed 807,304 prompt tokens (40.59%). The next efficiency cut is the failed-pulse tail, led by semantic effect-verifier rejection. The dramatic result was still missing: 85 committed population activities were attempts rather than typed material change.

The candidate now contains that separate owner. Priority selection content-addresses each selected population/member activity, one batched Flash stage resolves the exact attempt set, and WorldKernel requires one outcome per digest plus a stage receipt bound to the whole digest set. Outcomes are locally limited to exact resources, population pressures, incident relations, named-member memories/obligations/relationships, discoverable facts, or an explicit no-material-change result. The Interpreter still owns attempts only. Kernel tests prove a wrong outcome binding leaves time and state untouched, a correct binding commits the material result, and a malformed late outcome cannot partially apply an earlier one. CultCache stores outcomes individually and the operator Eve projection exposes them.

The revised live Gestalt harness now passes. Its four provider-backed waves at budgets 1 -> 4 -> 8 -> 4 produced ten durable consequences and seven typed material activity outcomes, with three explicit no-change results and zero rejected pulses. The player remained unchanged, member changes stayed bound to exact outcomes, and the same Mira returned with effective personal state. The run used 126,826 prompt tokens, 14,477 completion tokens, and a 58.34% prompt cache-hit ratio. The harness requires at least one typed material activity outcome, so unrelated direct consequences cannot counterfeit success.

High-risk effects—custody consumption/transfers, agency-relation shifts, and named-member private deltas—now receive an independent same-snapshot semantic verdict before admission. Low-risk preparations and pressures remain locally validated; a verifier on every effect caused disproportionate retries and was cut. The high-risk path has both local regression proof and the forced live provider witness below.

That forced live witness now passes: Dock Labor Guild transferred one exact owned plan to one exact colocated population, a separate Flash verifier accepted the causal match, and the campaign snapshot remained byte-identical. The witness removed an avoidable field-name correction call. The deployed authenticated rehearsal then found and repaired two first-use failures: invite rotation now replaces persisted auth authority with the protected tokens, and semantically duplicate opening sets receive one same-evidence correction. Exact release 0e4b8f4617840d45daec8a6451001192193ca5e0 accepted one invite exactly once, returned three distinct grounded openings, preserved authentication across restart, and was finally rotated back to two unused tester invitations.

The multiresolution body is deployed on Starfire. Typed health matched the immutable release, DeepSeek was ready, and the disposable live strategic-cell smoke committed three offscreen events plus three accessible news items without moving the player. The exact release and rollback witnesses are owned by gamecult-ops/runbooks/ghostlight-dungeon-starfire.md.

Prior research pipeline focus

The active path is a source-grounded branching-scene data loop:

1. Source-ground Aetheria context.
2. Project canonical state into character-local operating context.
3. Build an exact responder packet.
4. Run a sandboxed responder with only allowed packet/context/research scope.
5. Capture raw output, consulted refs, research summary, reviewed output, leakage audit, and coordinator interventions.
6. Apply only reviewed mutations into state, memory, relationships, perceived overlays, and unresolved hooks.
7. Update initiative scheduling from reviewed state: readiness, recovery, current load, status, reaction windows, and next actor eligibility.
8. Run the coordinator as its own sandboxed, promptable organ whenever generating training-shaped scene loops. Capture exact coordinator input, raw coordinator output, parsed artifact, review labels, interventions, and rejected alternatives.
9. Let Codex act as meta-coordinator: scope the organs, launch sandboxed workers, review outputs, repair only with labels, wire structured state, and preserve receipts. Do not silently treat omniscient chat steering as raw coordinator training data.
10. Let the accepted coordinator artifact carry continuity, unresolved hooks, glue prose, and the next scene/beat plan.
11. Let the branch compiler materialize playable Ink plus sidecar and compiler notes from reviewed state and branch decisions.
12. Run IF, narrative, lore, spatial, and visual review before accepting a fixture as training data.

Live Seams

• Canonical map: state/map.yaml
• CultCache-backed state spine: state/ghostlight-state.cultcache.jsonl
• CultCache-Py submodule: vendor/cultcache-py
• Ghostlight state cache seam: tools/ghostlight_state_store.py
• Readable state exports during migration: state/branches.json, state/evidence.jsonl
• Current system map: notes/ghostlight-current-system-map.md
• Implementation plan: notes/ghostlight-implementation-plan.md
• Documentation inventory: notes/documentation-inventory.md
• Agent-state schema: schemas/agent-state.schema.json
• Shared CultNet state-contract note: docs/architecture/cultnet-shared-agent-state-contract.md
• Projected local context schema: schemas/projected-local-context.schema.json
• Coordinator artifact schema: schemas/coordinator-artifact.schema.json
• Responder packet schema: schemas/responder-packet.schema.json
• Responder output schema: schemas/responder-output.schema.json
• Event record schema: schemas/event-record.schema.json
• Participant appraisal schema: schemas/participant-appraisal.schema.json
• Reviewed mutation schema: schemas/reviewed-mutation.schema.json
• Scene-loop bundle schema: schemas/scene-loop-bundle.schema.json
• Initiative schedule schema: schemas/initiative-schedule.schema.json
• Training-loop validator: npm run training-loop:validate
• Initiative schedule validator: npm run initiative:validate
• Prompt folder: prompts/
• Corpus coverage ledger: state/corpus-coverage.json
• Corpus coverage command: npm run coverage:status
• Sandboxed responder prompt template: prompts/sandboxed-responder-packet.md
• Research sanity responder prompt template: prompts/research-sanity-responder.md
• Narrative quality reviewer prompt: prompts/narrative-quality-reviewer.md
• Lore grounding reviewer prompt: prompts/lore-grounding-reviewer.md
• Spatial/geometric reviewer prompt: prompts/spatial-geometric-cohesion-reviewer.md
• Visual scene continuity reviewer prompt: prompts/visual-scene-continuity-reviewer.md
• Interactive Fiction Weaver prompt: prompts/interactive-fiction-weaver.md
• Illustrated IF visual pipeline: docs/architecture/illustrated-if-visual-pipeline.md
• Branch compiler and IF reviewer contract: docs/architecture/ink-branching-scenes.md

Live Fixtures

Pallas Species Strikes is the current reference-only interactive-fiction story fixture:

• examples/lore-grounding/pallas-species-strikes.awakened-labor.v0.json
• examples/agent-state.pallas-species-strikes.v0.json
• examples/coordinator/pallas-species-strikes.branch-and-fold.v0.json
• examples/ink/pallas-species-strikes.branch-and-fold.v0.ink
• examples/ink/pallas-species-strikes.branch-and-fold.v0.training.json
• examples/visual/pallas-species-strikes.branch-and-fold.v0.visual.json
• experiments/pallas-species-strikes/pallas-species-strikes.branch-and-fold-clean-run.v0.md
• experiments/pallas-species-strikes/pallas-species-strikes.visual-scene-review.v1.json

It starts in ordinary AU Bloom cavity-shell maintenance texture, introduces the major participants before branch-only deepening, then escalates through Nara-7's coordinated hazard refusal, baseline rigger solidarity pressure, supplier liability framing, AU dry-operation cephalopod shell-artery leverage, and a folded recognition/safety climax. Treat it as a reference for well-shaped, source-grounded story and illustrated IF presentation. It is not training-ready data for the responder, projector, appraiser, mutator, relationship updater, coordinator, branch compiler, or reviewer organs because it lacks exact stage-shaped input/output receipts.

The first separate training-shaped derivative is pallas-training-loop-v0. It rebuilds only the Kappa refusal / Ilya arrival threshold segment as a receipt-chain pilot, leaving the reference fixture untouched:

• examples/training-loops/pallas-training-loop-v0/pallas-training-loop-v0.scene-digest.json
• examples/training-loops/pallas-training-loop-v0/pallas-training-loop-v0.initial-state.json
• examples/projected-contexts/pallas-training-loop-v0.turn-01.nara-7.projected-context.json
• examples/projected-contexts/pallas-training-loop-v0.turn-02.ilya-marne.projected-context.json
• examples/projected-contexts/pallas-training-loop-v0.turn-03.lio-vale.projected-context.json
• examples/responder-packets/pallas-training-loop-v0.turn-01.nara-7.packet.json
• examples/responder-packets/pallas-training-loop-v0.turn-02.ilya-marne.packet.json
• examples/responder-packets/pallas-training-loop-v0.turn-03.lio-vale.packet.json
• experiments/responder-packets/pallas-training-loop-v0.turn-01.nara-7.packet.capture.json
• experiments/responder-packets/pallas-training-loop-v0.turn-02.ilya-marne.packet.capture.json
• experiments/responder-packets/pallas-training-loop-v0.turn-03.lio-vale.packet.capture.json
• examples/training-loops/pallas-training-loop-v0/pallas-training-loop-v0.bundle.json
• experiments/pallas-training-loop-v0/pallas-training-loop-v0.clean-run.md

The derivative has exact packet prompts, raw no-fork subagent outputs, event records, participant-local appraisals from current character state refs, reviewed mutation receipts, coordinator continuity receipts, and a coverage row. It is training-shaped for projector, responder, event resolver, appraiser, mutator, relationship/perception updater, and coordinator/story-runtime seams. It is not branch compiler, IF reviewer, or visual training data.

lucent-hostage-feed-v0 is the current open-ended training-loop draft. It moves the pipeline away from Pallas overfitting into a darkly comic Lucent Media hostage-feed negotiation set in a tethered counterweight station: a giant media-headquarters eye staring down the tether at a metropolis bubble.

Live Lucent surfaces:

• examples/training-loops/lucent-hostage-feed-v0/lucent-hostage-feed-v0.scene-digest.json
• examples/training-loops/lucent-hostage-feed-v0/lucent-hostage-feed-v0.initial-state.json
• examples/training-loops/lucent-hostage-feed-v0/lucent-hostage-feed-v0.branch-surface.json
• examples/training-loops/lucent-hostage-feed-v0/lucent-hostage-feed-v0.bundle.json
• examples/training-loops/lucent-hostage-feed-v0/lucent-hostage-feed-v0.review.json
• examples/initiative/lucent-hostage-feed-v0.turn-20.initiative.json
• experiments/lucent-hostage-feed-v0/lucent-hostage-feed-v0.clean-run.md
• experiments/lucent-hostage-feed-v0/lucent-hostage-feed-v0.staging-sketch.md
• scripts/materialize_lucent_loop.py
• scripts/materialize_lucent_loop_continuation.py
• examples/ink/lucent-hostage-feed.branch-and-fold.v0.ink
• examples/ink/lucent-hostage-feed.branch-and-fold.v0.training.json
• examples/ink/lucent-hostage-feed.negotiator-branch.v1.ink
• examples/ink/lucent-hostage-feed.negotiator-branch.v1.training.json
• experiments/lucent-hostage-feed-v0/sandbox-packets/lucent-hostage-feed.negotiator-branch.v1.coordinator-packet.md
• experiments/lucent-hostage-feed-v0/sandbox-captures/lucent-hostage-feed.negotiator-branch.v1.coordinator.capture.json
• experiments/lucent-hostage-feed-v0/sandbox-packets/lucent-hostage-feed.negotiator-branch.v1.weaver-packet.md
• experiments/lucent-hostage-feed-v0/reviews/lucent-hostage-feed.negotiator-branch.v1.narrative-review.final.json
• experiments/lucent-hostage-feed-v0/reviews/lucent-hostage-feed.negotiator-branch.v1.lore-review.final.json
• experiments/lucent-hostage-feed-v0/reviews/lucent-hostage-feed.negotiator-branch.v1.spatial-review.final.json

The Lucent bundle counts fifteen post-compaction restart turns from turn-06 through turn-20 as training-clean responder receipts. Earlier opening turns established the situation and proof-object but crossed a compaction seam, so they are treated as setup/rehearsal context rather than gold responder data. The accepted loop starts after feed ops externalizes the proof-object into EDIT TRAIL HOLD and resolves when Juno reaches the marked safe line, security stays behind the collars, Sol is categorized for non-contact protective handoff, and evidence export remains the live aftermath hook.

Lucent is training-shaped for projector, responder, event resolver, appraiser, mutator, relationship/perception updater, and coordinator/story-runtime seams. It is not branch compiler, IF reviewer, or visual training data yet.

Lucent's strongest machine lesson: the coordinator should not shove the actors toward a desired plot. It should make the strings fun to play with. Supply game-ergonomic affordances, visible gates, clocks, evidence objects, posture constraints, route access, public categories, and resource pressure; let actors choose from local state; then fold the observed action into reviewed state. Elastic strings, not rails. Little puppet theater, but with receipts.

Character-intelligence lesson: keep the machinery as smart as possible, but do not make every character inherit frontier-model metacognition. Characters should reason, manipulate, misread, explain themselves, and regulate stress only to the level supported by their stat sheet, culture, role, experience, and current state. The coordinator/narrator may translate high-context maneuvers for the reader, especially in Lucent-style reputation warfare, but that explanation is not automatically character knowledge.

Coordinator seam correction: the Lucent character responders were sandboxed no-fork agents, but the coordinator was Codex-authored and then captured as artifacts. Future training-shaped loops should sandbox coordinator turns too. Codex is the meta-coordinator herding Ghostlight pieces into shape, not the raw coordinator organ being trained.

Initiative seam: Ghostlight now has a documented and validated initiative schedule artifact. The scheduler is mechanical: it selects eligible actors from initiative speed, next-ready time, load, status, action recovery, and reaction windows. It does not replace participant appraisal. Everyone affected by an event still updates before the scheduler chooses the next projected actor.

Branch compiler seam correction: lucent-hostage-feed.branch-and-fold.v0.ink is the first meta-coordinator authored branch-and-fold draft for exploring the Lucent state space. The newer lucent-hostage-feed.negotiator-branch.v1.ink was produced through a sandboxed coordinator packet and a no-fork sandboxed Interactive Fiction Weaver. Codex then acted as meta-coordinator and applied labeled repairs: Ink syntax, validator-supported action labels, sidecar shape, and post-review spatial cleanup. Treat this as draft branch-compiler training shape with labeled repairs, not pure Weaver gold.

Lucent v1 reviewer result: narrative, lore, and spatial sandboxed reviewers all returned B-level or better after iteration. Visual review was intentionally not run because this pass has no visual plan. The lore reviewer identified reusable backfill candidates: Lucent crisis feed protocols, junior Reality Architect operational roles, Lucent creator debt/arbitration machinery, and media-eye tether stations if that station type recurs.

corvid-collective-founding-v0 is the newest founding-era draft fixture. It uses a sandboxed coordinator and sandboxed Interactive Fiction Weaver to stage the 2470 First Exodus seed from the perspective of Kesh-of-Three-Clicks, an uplifted raven using beak, talon, short flight, mimicry, cached objects, optical sightlines, contact pads, route memory, and fallible human leverage to open a path for the flock without letting humans become the founders.

Live Corvid surfaces:

• examples/lore-grounding/corvid-collective-founding.v0.json
• examples/training-loops/corvid-collective-founding-v0/corvid-collective-founding-v0.initial-state.json
• examples/ink/corvid-collective-founding.branch-and-fold.v0.ink
• examples/ink/corvid-collective-founding.branch-and-fold.v0.training.json
• examples/visual/corvid-collective-founding.branch-and-fold.v0.visual.json
• experiments/corvid-collective-founding-v0/sandbox-packets/corvid-collective-founding-v0.coordinator-packet.md
• experiments/corvid-collective-founding-v0/sandbox-captures/corvid-collective-founding-v0.coordinator.capture.json
• experiments/corvid-collective-founding-v0/reviews/corvid-collective-founding-v0.narrative-review.final.json
• experiments/corvid-collective-founding-v0/reviews/corvid-collective-founding-v0.lore-review.final.json
• experiments/corvid-collective-founding-v0/reviews/corvid-collective-founding-v0.narrative-review.visual-enabled.json
• experiments/corvid-collective-founding-v0/reviews/corvid-collective-founding-v0.lore-review.visual-enabled.json
• experiments/corvid-collective-founding-v0/reviews/corvid-collective-founding-v0.spatial-review.final.json
• experiments/corvid-collective-founding-v0/reviews/corvid-collective-founding-v0.visual-review.final.json

Corvid result: the Ink compiles, lore grounding validates, and the full-artifact narrative reviewer accepted it with minor revisions that were applied. Visual replay is now enabled through a separate .visual.json plan with click-through scene anchors, stable visual character refs, branch/state image modifiers, ending modifiers, explicit hatch 3C states, and a draft Blackbox Aviary 3C scene-set map. Visual-enabled narrative and lore reviewers accepted the fixture; spatial and visual reviewers accepted it as draft after fixes. The draft scene-set is enough for replay planning, not high-consistency website art; build a hand-made blockout before expecting multi-angle image generation to behave like it went to engineering school. A limited-input narrative warning is preserved as a reviewer-packet lesson because that reviewer received a shortened climax excerpt and correctly complained about missing endings that did exist in the real file. Do not count that as a true failure of the Ink.

Corvid usability: this is draft branch-and-fold/reference material for nonhuman embodiment, concrete leverage, Corvid separatist founding texture, and future Chaos Weaver outside-interface boundaries. It is not responder, appraiser, mutator, relationship-updater, projector, or coordinator gold because it lacks per-turn projected contexts, exact character packets, raw character outputs, event/appraisal/mutation receipts, and a complete scene-loop bundle.

Corvid backfill candidates: NeuroSyn Corvid Recon room-scale containment/audit geometry, exact raven-to-telemetry physical interface affordances, Rossum & Douglas high-risk handoff/audit practice, and the Corvid/Chaos Weaver outside-interface origin note.

Kappa geometry to preserve: Service Ring Kappa names this specific standardized industrial spoke manifold service ring, a bounded local access loop around a dense seal-air-thermal equipment cluster. The loop-inner side exposes manifold faces and Kappa access ports on the machinery cluster. The loop-outer side holds worker staging, the baseline anchor rail, lockers, carts, break ledge, and access back toward yard systems. Kappa-7 False-Seam Artery, worker slang Rell's Cut, is the specific dangerous passage. The Kappa operations gallery sees the primary manifold/access-port segment, not the whole loop.

Visual pipeline lesson: generated concept images are useful as vibe/material reference, but they do not preserve room layout. Durable illustrated replay needs a camera-specific blockout or scene-set source; imagegen handles the painterly pass.

Aetheria Doctrine

• Call of the Void remains a consumer target for content generation and dialogue scaffolding.
• Elysium futures are branch-local canon indexed by lineage.
• Aetheria writing should support tonal range: warmth, absurdity, humane observation, institutional comedy, domestic texture, noir, horror, wonder, romance, dour poetry, procedural investigation, and dry systems prose.
• Before writing conflict, establish the life being interrupted when the fixture calls for it: routines, work texture, relationships, private jokes, rituals, status games, habits, small desires, and ordinary accommodations.
• Before generating Aetheria scenes, check lore for factions, movements, institutions, species/body affordances, location, time period, infrastructure, and material constraints.
• If a blocking lore gap appears, patch AetheriaLore narrowly before treating the detail as available to Ghostlight.
• Technology exploration should emit database-shaped item/assembly/component/ supply-chain candidates mapped toward Aetheria-Economy's CultCache item model.
• Corpus completeness requires broad Aetheria coverage. Generate stories for every major faction, minor faction, movement, and major flashpoint. Major factions need both founding-era and day-in-the-life stories. All coverage stories should involve cultural collision.
• Current rough corpus counts from AetheriaLore: 12 major powers, 21 minor powers, 23 movements, 24 Pre-Elysium flashpoints, and 5 defunct/absorbed powers. Baseline coverage is 92 story fixtures, or 97 with defunct powers; the practical first broad target is 100-150 reviewed fixtures.

Cleanup Note

The old prototype fixture receipts and model-runner files were removed from the live workspace after their useful lessons were distilled into the architecture docs, state map, and git history. Do not resurrect them as active steering surfaces unless the user explicitly asks for archaeology.

Current Next Action

The Persona extraction and Epiphany handback are complete. The current local candidate is an acceptance-hardening pass, not the older deployed release. It adds per-attempt DeepSeek usage/cache/error receipts, splits world and agency compilation, minimizes Projector/Persona/Interpreter context by authority, makes cell identity/membership/revisions runtime-derived, and prevents demand-model focal hints from overruling the Persona-cell budget. Live proof under F:\GameCult\GhostlightDungeon\acceptance includes grounded compilation, four-actor appraisal, impossible/rolled actions, grounded narration, strategic cells, and a 24-faction budget-4 wave.

The authenticated browser rehearsal exposed three authority failures in the candidate: a player command response serialized the canonical campaign, a successful diagnostic promised a finding without committing specific knowledge, and a custom Huygens seed borrowed the Lucent fixture's cast and incident from merely adjacent retrieval evidence. The repaired candidate now projects spoiler-safe player responses, requires exact visible informational findings that become player knowledge plus branch fact, classifies retrieval evidence into direct/background/excluded lanes before compilation, admits only direct source text to the causal world seed, and narrows narration to the latest causal turn. Browser strings use text nodes and the laboratory inputs have programmatic labels.

The first clean-seed diagnostic then spent its correction attempt on a verbatim stake/knowledge mismatch. The assessor now deterministically appends each bounded typed finding to the corresponding visible stake before validation and digesting. Semantic or authority errors may retry; punctuation no longer gets a second provider call.

The next replay exposed that an unannotated string set invited an ID-shaped finding (fact_distress_relay_antenna_damaged). The schema now describes knowledge additions as player-readable declarative statements, and the local boundary rejects unambiguous fact-ID/key syntax before it can become memory.

A route audit then found that approval, destination/fission approval, fork, and reset still serialized internal campaign-bearing values even though the browser ignored them. Every player route now returns a purpose-built public projection. Compiler approval retains topology/cast/pressure/player-role/coverage/gap data, while raw campaign state, evidence, model receipts, private goals, memories, and relationships remain operator-only.

Scheduler priority is now structural rather than a pair of atomic checks. Live requests notify and cancel an in-flight background wave, which drops its cell tasks/provider futures; they also hold the shared side of a commit gate that a scheduler tick must acquire exclusively. A test proves both cancellation and commit exclusion. Return catch-up remains on the live path and may commit its required ticks before the player's next action.

The compiler no longer confuses a local roster with a global agency skeleton. Local and remote retrieval run concurrently. Only direct evidence enters the local seed; a separate Flash lane proposes coarse remote institutions with one short mandate string each. Deterministic code binds that mandate to a witness which also names the institution, omits unsupported candidates into approval coverage gaps, and builds explicit-unknown six-axis remote profiles. The Pro agency compiler sees only locally materialized subjects. Live witness F:\GameCult\GhostlightDungeon\acceptance\compiler-20260817-165127\result.json completed in 43.35 seconds with five first-attempt-valid stages, admitted one local and 17 source-bound remote institutions, and omitted ten unsupported remote candidates into an approval-visible non-canonical coverage gap.

Authenticated HTTP/browser, session isolation, lifecycle, export, persistence, restart, strategic agency, and live/background exclusion have isolated-runtime evidence. The strategic outcome resolver now has a clean provider-backed four-wave golden: ten durable consequences, seven typed material activity outcomes, zero rejected pulses, exact member binding, no player mutation, and Mira's persistent identity across consolidation. High-risk custody, relation, and named-member effects receive an independent same-snapshot semantic verdict; ordinary preparations remain deterministically bounded without paying that model tax. The next action is to commit this exact candidate, deploy its optimized immutable build, and repeat authenticated browser/restart/persistence checks against the served commit before the two-tester playtest.

The pre-human surface audit found that snapshot-bound assessment, destination, and fission approvals were appended to long-lived forms. Recompilation could therefore leave several stale controls visible even though the kernel rejected them safely. The receipt panel now owns exactly the current approval action. The same audit restored separate composer fields for the visible act or speech and its intended effect; the browser no longer duplicates one sentence into both assessment fields. The approval preview now exposes its full public decision surface in expandable sections, and a browser-local request lock prevents double-clicks from launching duplicate inference without claiming any world-state authority. Destination compilation no longer asks the player to transcribe an internal location ID: the canonical current ID is projected by the server and bound read-only, while destination and fission receipts expose the topology or child leaves being approved.

The next surface audit found canonical institution postures and every raw world clock concatenated into the player location card. That bypassed the otherwise channel-aware news path. The omniscient aggregation is deleted: world time and location remain public, developments arrive through player-local narration or admitted news, and raw pressures remain in the operator surface. The character ledger now includes the player actor's own relationships, which it had promised but omitted.

The adjacent pin/fission surface had the same authority smell. Player HTTP now owns only active-cell budget, not resolution pins. The browser pin editor is deleted, the surface publishes only pin_count, and the command boundary rejects ReplaceResolutionPins. Fission candidates are restricted to active population leaves at the player's canonical current location; remote population names remain in the operator surface.

The operator surface now has a real HTTP boundary. Axum carries the direct TCP peer address into the operator inspector and provider-parallelism handlers; only loopback plus a valid campaign session is admitted. LAN/WireGuard tester peers receive 403, and the browser hides the operator panel away from loopback. Do not replace this with trusted forwarded headers unless a named reverse proxy becomes the actual connection owner.

The subsequent perimeter audit found that protected handler JSON extractors ran before their handler-local session checks. All /api routes now share one authentication middleware which rejects invalid sessions before reading or deserializing the body. Handler checks remain as the session-identity and revocation guard, not the perimeter owner. Release f905376a2278c48bf474ab3b665fe12a241d69de proves malformed and three-megabyte anonymous command bodies receive 401; authenticated malformed JSON still reaches the normal 400 extractor path. The full workspace passed 137 core tests and 13 daemon tests. Invitations were neither rotated nor consumed.

Release ca9c1ccbfaac8026bee9554d7244ed75931b5104 hardens the browser handoff. The release build now runs strict TypeScript checking before Vite. Definite HTTP refusals no longer fall into the ambiguous lost-response warning, and campaign selection, approvals, fork, and reset retain the browser interaction lock until the canonical surface refresh completes. Starfire serves assets/index-CA3oKXnL.js; source commit, manifest, and executable SHA-256 b17dcfad6d4cbd442153f1e5b3c834c795614fdd08253cb7e8f0ca2527af65b4 agree. Invitations remain untouched.

Warnings

• Keep persistent state small. Git history and artifacts own chronology.
• Treat ghostlight.agent_state.v0 as the first shared cross-runtime payload contract. If another runtime needs to move agent state over a wire, it should carry the Ghostlight payload unchanged inside a typed CultNet document envelope instead of quietly forking the ontology.
• Do not let notes, map, handoff, and evidence become four versions of the same brain.
• Do not train on coordinator-repaired responder prose unless the repair is labeled.
• Do not accept branch fixtures without branch compiler notes and IF artifact review.
• Do not let tracked variables, relationship bands, or visual modifiers remain decorative.
• Do not let Elysium branch futures overwrite Sol single-history facts.
• Do not let state-grounded prose become one crisis-procedure voice.
• Treat subagent research as self-reported unless the worker returns explicit research notes or a future runner captures calls.