Ghostlight/docs/architecture/ghostlight-library-extraction-cut.md

Ghostlight library extraction — cut map (plan step 15, L0)

Status: cut map. Ends are owned by ghostlight-library-extraction.md; this document owns the means. Written 2026-09-15 against d83534c on codex/ghostlight-dungeon-mvp; first version committed at 02bbf62; refreshed 2026-09-16 with the operator's rulings.

Cut 1 landed at Ghostlight 108b691..f859d2c. 108b691 is 13 renames with zero content change; f859d2c builds. Verified by Soul's own runs, not the Hands report: library 419 passed + 1 ignored with test names identical to the base world:: set; 10 compile_fail doc-tests pass, also under --all-features; Dungeon 50 + 1 ignored, all 49 base names present and the +2 exactly the two new soul tests; no [features], cfg(feature, or cfg(any(test in the library; no schema string, _NAMESPACE, derive_id, serde attribute, or Preimage changed; the rewritten tests fail under mutation of what they pin. Windows only; the Linux release remains Idunn's.

Soul found six defects. Triage:

• F1 seal is name-based (high, open): every pub ID derives Deserialize (crates/ghostlight/src/lib.rs:186-200), as do ScopeDigest (:532) and DecisionOpportunity (:559), so an external crate mints IDs, reproduces ScopeDigest::fixture, and forges a DecisionOpportunity into derive_cover from JSON. The reducer still rejects forged opportunities (lib.rs:4192-4201), so kernel integrity holds and the invariant's wording does not. Dungeon's own Eve payloads deserialize these types, so removing the derives is not available. Operator question Q1-9 below.
• F2 single-minter test is bypassable (medium, fix): the count at crates/ghostlight-dungeon/src/app_session.rs:530-555 greps a literal and misses <VerifiedPrincipalEvidence>::new(, an alias, a renamed test module, or a subdirectory.
• F3 surface wider than bought (low, fix): 71 pub identifiers are unreferenced by Dungeon; ScopeDigest, WorkLane, and ScopeComponents compile as pub(crate) and were opened only to quiet private_interfaces.
• F4 "Eve" named in library error strings (low, fix): crates/ghostlight/src/controllers.rs:1494,2576,2582,2584. Pre-existing; invariant 3 is still unmet.
• F5 two Hands claims false as stated (cosmetic, recorded): Cargo.lock did gain a ghostlight package entry (no new external package), and fixture_[a-z] has 8 benign hits in Dungeon.
• F6 recipe schema drift (pre-existing, recorded): deployment/idunn/recipe.toml declares world_state.foundation.v0 and controller_work.v3 against code at consumer.v4 and controller_work.v15. Outside L0; it changes no behavior here.

Cut 2 landed at gamecult-ops 6aba281 (text only; nothing live was run). The library test step is in the runbook, the deploy script, and the wiring test, ordered as recipe.toml orders it. Two spec defects Hands reported rather than redesigned: the assertion this map specified was vacuous (require_text is grep -Fq, and the string given is a substring of the persona-projection line, so it passed with the library step deleted), so Hands used the file's existing exact-line helper and proved it fails under deletion; and the acceptance test path lives in acceptance_test= at scripts/deploy-ghostlight-yggdrasil.sh:34, a fourth site this map did not list, pinned by the wiring test and repeated in the runbook prose. Operator consequence: changing acceptance_test changes the acceptance binding, so sealed witnesses under /srv/ghostlight/acceptance/<binding-sha>/ from before this commit will miss and regenerate.

Soul passed on Cut 2 and found the assertions pin text, not invocations:

• C2-F1 (high, fixing): deleting the two lines above the pinned cargo line in scripts/deploy-ghostlight-yggdrasil.sh leaves it byte-identical as trailing argv on the persona-projection container, so the kernel tests never run and the wiring test still exits 0. Prefixing the docker run line with : does the same.
• C2-F2 (medium, fixing): nothing pins the order of the four cargo steps; the library block moved after the release build and the wiring test passed, which would seal an artifact before the kernel tests ran.
• C2-F3 (medium, fixing): the wiring test never reads the runbook, so only three of the four acceptance sites are enforced to agree.
• C2-F4 (medium, pre-existing, recorded): deploy-…sh:937 takes a reuse branch when the release directory for a commit already exists, so a redeploy of a sealed commit runs no cargo steps at all. This bounds "the deploy runs the kernel tests" to a commit's first build. Operator owns whether that is right.
• C2-F5 (low, recorded): docs/repo-census-2026-09/* still shows src/world/.... Dated census; no deploy effect.

Held: the step sits in the same branch, image and mounts as its neighbours, and set -euo pipefail with trap means a library-test failure does abort the deploy. The acceptance test exists at crates/ghostlight/src/controllers.rs:8980 under -p ghostlight --lib.

C2-F1, C2-F2 and C2-F3 are fixed at gamecult-ops 803f2c7 (wiring test only). A new require_invocation helper pins each of the four cargo steps as a whole contiguous docker invocation and returns its start line; three numeric comparisons assert the recipe order; the runbook became a checked file, tying all four acceptance sites together. All four of Soul's mutations now exit 1 where they previously exited 0, and every pre-existing assertion still passes. require_order was unusable here because its last_line resolves a substring and would have bound the library step to the acceptance invocation.

Soul passed on the fix batch and confirmed it does what it claimed: whole-invocation pinning survives image swaps, line swaps, re-indentation, continuation splits and appended flags; the order checks catch a move into the reuse branch; the runbook is tied in both directions; fail inside a command substitution does abort, because set -e fires on the assignment's status; nothing was weakened. It also found the structural limit, recorded and not fixed:

• C2-F6 (high, recorded): an exact-line pin proves the lines exist, not that they run. Wrapping the block in if false, prefixing the opener with true || \, or swallowing it in a heredoc keeps every pinned line byte-identical and the checker exits 0.
• C2-F7 (medium, recorded): the four steps carry no explicit || exit; abort depends entirely on set -euo pipefail at deploy-…sh:2, which nothing pins. Removing the e leaves the checker green, so a failing kernel suite would be followed by a sealed release.
• C2-F8 (low, recorded): a duplicated block passes, since the helper takes the first match and never asserts a count.

These stay recorded rather than fixed: that script is a legacy actuator under Ghostlight's do-not-invoke warning and is retired at the deployment gate, and the authority that actually runs the tests is Ghostlight's own deployment/idunn/recipe.toml. Closing them means control-flow analysis in a bash checker for a script we intend to delete. Revisit only if the deployment gate keeps the script.

Follow-ups outside this migration, from the fix batch:

• scripts/deploy-ghostlight-yggdrasil.sh:974, the web container, is pinned by substring and survives a : prefix that neuters it.
• The Codex Connector's four cargo steps are bare substring pins with no invocation or order assertion: the connector-side C2-F1 and C2-F2.
• require_command_options searches a fixed 18-line window, so a block that grows past it stops being checked silently.

Cut 1 fix batch landed at Ghostlight 7c1d1e9..2865ea7: a8d3377 external rejection tests (Q1-9), fac90e6 single-minter check by name (F2), 7cbb9e3 Eve removed from library text (F4), 2865ea7 public surface 262 → 258 (F3). Hands' correction to F3 is confirmed by Soul: Dungeon calls bound_scope_digest and fresh_scope_digest, and ScopeDigest, WorkLane and ScopeComponents are held public by KernelError::ScopeChanged, ControllerWorkCustody::Uncertain::lane and NarrativeCheckpoint variant fields; closing them means reshaping public enums, which F3 does not license. fac90e6's commit message describes a replaced brace-counting scanner; the landed code and its doc comment are correct.

Soul held: the rejection tests are a true external crate with no #[path] or include!, driving ControllerPort::submit_controller through the mailbox into reduce with no pre-validation; every commit moves revision and state_digest, so the unchanged-state assertions are sound; the positive test goes red when issued opportunities are refused; counts, the 14 distinct warnings, and both manifests are unchanged.

Soul found:

• S1 (medium, fixing): both forged digests differ in length from a real sha256: + 64 hex, so comparing only lengths at crates/ghostlight/src/lib.rs:4203 leaves all seven tests green. The realistic forgery is a stale same-length digest from an earlier revision.
• S4 (medium, open, Q1-10): the minter scanner at crates/ghostlight-dungeon/src/app_session.rs:523-668 misses a pub type alias, a multi-line alias, a } // tests closing brace, non-rustfmt indentation, and ::new taken as a function value.
• S7 (low, fixing): controllers.rs:122 provider_model closes to pub(crate) with no error and no warning change.
• S8 (cosmetic, fixing): mailbox.rs:580 names AppSessionOwner and controllers.rs:2606 names AppSession.
• S2 (low, recorded): neutering the world_id check at lib.rs:4193 leaves the suite green because ScopePreimage includes world_id, so the scope lookup refuses first. Redundant by construction; not isolable from outside the crate.
• S3 (low, recorded): the decline path (lib.rs:1603) is pub(crate) and unreachable from an integration test.
• S5 (low, recorded, pre-existing): runtime.rs:3584's credential-name test splits on one literal #[cfg(test)] marker and is evadable the same way the minter test was.
• S6 (medium, recorded): stable rustc does not enforce compile_fail error codes; E0603 changed to E0999 still passes. All ten doc-tests prove "does not compile", not privacy, and the three #[cfg(test)] items (SubjectId::issue, ScopeDigest::fixture, the fixture_* fns) prove non-existence. Enforcing codes needs a snapshot tool such as trybuild; recorded, not added.

Q1-10 how the single minter is enforced (defaulted, 2026-09-16). Asked how much it mattered, the operator said not at all. The scanner stays as a tripwire with stated limits: it guards only against the project's own Dungeon code, and what evades it is deliberate. S4 is a recorded follow-up, with Clippy's disallowed-methods for ghostlight::VerifiedPrincipalEvidence::new noted as the fix if a second minter ever becomes plausible.

S1, S7 and S8 landed at Ghostlight bde05de..af9c95a. S1 submits a genuinely issued digest made stale by another controller's speech, plus the current digest with its last digit altered. Soul confirmed the premise check fails when staleness does not happen and that no earlier check intercepts the forgery, then found two surviving comparison mutants (case-insensitive, hex-only after the label). Those, and "player" vocabulary in library tests, landed at b14507c (uppercased-letter, bare-hex and relabelled forgeries, all six comparison mutants killed) and ab95d78 (test-only rename to "human", one test name changed). Soul's final pass found nothing to fix.

L0 closed, 2026-09-16. Postmortem: ghostlight-library-extraction-postmortem.md. Follow-ups are listed there.

Q1-9 what sealing means (ruled, operator, 2026-09-16): option A. The invariant is unforgeable admission, not unconstructible types. External code may hold a syntactically valid ID, digest, or opportunity; the kernel must reject any it did not issue, and that is proven by rejection tests written from outside the crate. The compile_fail set stays for the genuinely private items. The question as first posed: A: restate invariant 1 as unforgeable admission — external code may hold a syntactically valid ID or opportunity, and the kernel must reject any it did not issue — and prove it with rejection tests from an external crate plus the existing compile_fail set. B: make the types unconstructible from outside, which means Dungeon stops deserializing DecisionOpportunity in its Eve payloads and receives an opaque token instead, a design change L0 excludes. Recommended: A, because the kernel already enforces it and B moves work into L0 that the target puts out of scope. Whichever is chosen, F2 and F3 are fixed in the same Hands batch.

Rulings (operator, 2026-09-15):

• Q1-1 crate name: "crate name is ghostlight."
• Q1-2 adapters: "vault.rs and sdk_inference.rs both go in the library."
• Q1-3 principal seam: "option A, library-owned VerifiedPrincipalEvidence with a public new, plus the Dungeon count test pinning the single minter."
• Q1-4 fixtures: "NOT the test-support feature. The operator takes the alternative: the sealed ID issue() constructors and ScopeDigest::fixture stay unreachable from outside the library under every configuration, including feature-enabled builds, and the Dungeon tests that currently need them move into the library instead. Rationale: a sealed constructor exposed behind a feature is still reachable by any crate that turns the feature on, which contradicts invariant 1." (Supersedes the test-support design in the 02bbf62 map; that text is history and is not repeated here. The classification below found that none of the affected tests is a kernel test, which raises Q1-7 and Q1-8.)
• Q1-5 persona projection: "ghostlight-persona-projection stays a separate crate."
• Q1-6 gamecult-ops: "edit the five gamecult-ops cargo lines in Cut 2; do not retire the scripts (retirement belongs to the deployment gate)." Correction to the 02bbf62 map: Ghostlight's handoff does call those helpers unsafe — notes/fresh-workspace-handoff.md:389-391: "Do not invoke the current bounded Connector or Ghostlight redeploy helpers; they fail at the root/Idunn Git boundary and still embody duplicate target deployment authority." The earlier claim that no such doc existed was wrong; the ruling to edit rather than retire stands on the deployment gate owning retirement, not on the scripts being live.

Rulings (2026-09-16), taken by Self under the operator's standing "Go" after Q1-4's classification found no kernel test to move. Either may be reversed by the operator; both are recorded here as the live design:

• Q1-7 port value constructors: option A. PreparedInference::prepare (renamed from prepare_invocation), InferenceOutput::new, and InferenceFault::{retryable, recovery_required, integrity_violation} become the port's public contract; the five fixture_* items are deleted and TracingInferencePort becomes an ungated decorator. A public trait whose return types only the library can construct is not a port, none of these touches a sealed item, and the change is a net deletion.
• Q1-8 cover source: option A. The tick-ordering test derives its cover from a real world through derive_cover and asserts 2 cells, with its ordering and shared-tick assertions unchanged; fixture_controller_opportunities, the only outside caller of a sealed issue()/ScopeDigest::fixture, is deleted.

Together these satisfy Q1-4's intent: the sealed ID issuers and ScopeDigest::fixture stay private #[cfg(test)] items with no feature gate anywhere, unreachable from outside the library under every configuration.

Open: nothing blocking Cut 1. Operator checks remain on the Linux release (Idunn's recipe run), which no Windows probe can prove. Follow-ups outside this migration: see "Findings not assigned to a cut".

Probe names versus real names: probes 1–4 built the crate as ghostlight-world (use ghostlight_world::…); probe 5 rebuilt it as ghostlight (use ghostlight::…). The difference is the package name, the directory crates/ghostlight, and the path prefix; every mechanism finding held in both. This map uses the real name throughout.

What the probes established

All probes ran in scratch worktrees at d83534c (both removed, repo clean) on the Windows workstation with cargo check and cargo test --doc; they prove the crate graph and visibility on Windows only. The Linux proof is Idunn's recipe run on Yggdrasil. Logs are in the session scratchpad (probe1*-check.log, probe3*-visibility.log, probe5.log, base-test-list.log); they are not repo artifacts.

• Base test census (cargo test -p ghostlight-dungeon --bin ghostlight-dungeon -- --list, repo target dir): 469 unit tests in the bin, of which 420 are under world:: (action 34, clock_tests 45, consumer 30, controllers 81, cover 18, custody_tests 17, elaboration 14, journal 24, knowledge_tests 21, mailbox 15, patch 34, sdk_inference 23, soul_knowledge_tests 9, tests 32, vault 6, witness_tests 17) and 49 are Dungeon's own (app_session 7, eve 5, heimdall 5, idunn_health 4, mesh 4, runtime 24). tests/build_provenance.rs has 1. ghostlight-persona- projection has 13 unit, 0 doc. Two tests are #[ignore]: world::controllers::tests::real_codex_connector_cognition_modes_commit_speech and runtime::tests::live_smoke_seeds_then_ticks_a_world_against_the_connector.
• Base warning: mod.rs:28-32 re-exports nine names nobody in the crate uses (ControllerOpenError, NarrativeCapture, NarrativeDecision, NarrativePending, OperationalCapture, OperationalDecision, OperationalPending, SourceRange, TranslationGapSummary). Their deletion is inside Cut 1.
• The move compiles (probe 1d). Moving src/world/* to the new crate (mod.rs → lib.rs), rewriting crate::world:: → crate:: inside it and → ghostlight:: in Dungeon, and moving VerifiedPrincipalEvidence into the library root: cargo check on the library, its tests, the Dungeon bin, and the Dungeon tests all pass. Two mechanical faults: the 94 pub(super) sites in the former mod.rs are illegal at a crate root (become pub(crate)), and consumer.rs:62 needs serde_bytes in the library manifest.
• What Dungeon needs public (probe 3, four compiler rounds from every item pub(crate)): 54 production items, 22 test-only items, 38 fields on 10 structs, 36 methods, the opaque IDs AffordanceId/CommandId/ SubjectId, and FictionalMinutes(u64) (one Dungeon test). Nothing sealed appears: WorldKernel, WorldState, reduce, apply_effect, CommandEnvelope, AuthenticatedCaller, the journal, *::issue() and ScopeDigest::fixture are never named by Dungeon. Under the narrowed library cargo check -p ghostlight emits 646 dead-code warnings — a second enumeration of the same boundary (an item used only by Dungeon is dead inside the library until it is pub).
• The sealed set under the Q1-4 ruling (probe 5, crate ghostlight, no cargo features, fixtures left #[cfg(test)]): ten compile_fail doc-tests on the library root pass under cargo test -p ghostlight --doc and again under cargo test -p ghostlight --all-features --doc (the crate declares no features, so the second run is the same build; it is the command Soul re-runs if a feature is ever added). cargo check -p ghostlight-dungeon --bin ghostlight-dungeon passes: production needs no fixture. cargo check -p ghostlight-dungeon --tests fails on exactly four errors — runtime.rs:3081 (ControllerWork… family, Inference… types, three fixture_inference_*), :3570 (fixture_controller_opportunities), :2582 (TracingInferencePort), :2581 (InferencePort, because the base re-export at mod.rs:66 is cfg(test)). Those four sites are the whole cross-boundary test surface; they are classified under Cut 1.
• Compile-fail mechanism: doc-tests compile as an external crate, which is exactly the boundary; no trybuild, no scratch crate. The ten (use ghostlight::WorldKernel, reduce, WorldState, CommandEnvelope, AuthenticatedCaller, journal::WorldJournal, SubjectId::issue(), ScopeDigest::fixture("x"), fixture_controller_opportunities(&[]), fixture_inference_output(..)) are pinned to E0603, E0599, E0599, E0425, E0425.
• Negative-grep collisions checked in src/world/: axum, tower_http, jsonwebtoken, heimdall, eve::, idunn_health, Session Zero have zero legitimate hits. Dungeon collides with the vault fixture path Spoilers/Dungeons/Provenance.md (vault.rs:489,581): use \bDungeon\b. player collides with tests::player() (consumer.rs:966): do not publish a bare player pattern. app_session has 5 hits, all the principal seam, and must reach 0.
• Line endings: index and working tree are LF (git ls-files --eol reports i/lf w/lf); core.autocrlf=true rewrote every fresh scratch worktree to CRLF. Hands edits in F:\Projects\Ghostlight itself, never in a fresh worktree; if a worktree is unavoidable, run git ls-files --eol crates after the move and refuse any w/crlf. sdk_inference.rs:1831 normalizes \r\n before scanning source.

Cut 0. Captures

• Repo/branch: Ghostlight codex/ghostlight-dungeon-mvp at 02bbf62 (source identical to d83534c). No commit; output lives in the session scratchpad.
• First:
  • Test census: cargo test -p ghostlight-dungeon --bin ghostlight-dungeon -- --list > base-tests.txt (PowerShell > writes UTF-8 BOM + CRLF; compare post-cut with the same redirection and Compare-Object on trimmed lines after stripping the world:: prefix). Expected 469.
  • A world.cc written at base. No store exists on disk (F:\Projects\Ghostlight-smoke\ghostlight holds no world.cc), so produce one: in a scratch copy at d83534c, add an ignored test beside mailbox.rs:966 fixture() that opens WorldMailbox::open(<capture>/world.cc), creates through create_fixture, approves, activates, and ticks three times through submit_clock; record snapshot().revision, the state_digest, and the last commit_digest from operator_log to capture.txt. Copy world.cc and capture.txt to the scratchpad. After Cut 1 the same test body, in the library's mailbox tests, reopens that file and asserts the three values are equal. The controller-work.cc layout is pinned by the untouched CONTROLLER_WORK_SCHEMA/CONTROLLER_WORK_ROW constants (controllers.rs:75-76) and the existing v7/v8 refusal tests (controllers.rs:6487,10654); no separate capture.
  • Get-ChildItem target -Recurse | Measure-Object Length -Sum: 7.5 GiB at the start of this pass.

Cut 1. Extract the library crate

• Repo/branch: Ghostlight codex/ghostlight-dungeon-mvp from 02bbf62. One commit; the crate graph does not build half-moved. Depends on Cut 0 and rulings Q1-7, Q1-8.

• First: Cut 0 captures in hand; git status clean; working in the main checkout (LF).

• Deletes first:

  • crates/ghostlight-dungeon/src/world/mod.rs:28-32 — the nine unused re-exported names above (leave CellRun, ConnectorBinding, ControllerError, ControllerModels, ControllerPendingReason, ControllerRunner, ControllerWorkCustody, NarrativeRun, OperationalRun, SubmissionDisposition, open_controller_work, open_inference).
  • crates/ghostlight-dungeon/src/world/mod.rs:61-72 — the #[cfg(test)] re-export block (12 lines). The port traits and their value types in it return as ungated production pub use under Adds; the three fixture_inference_* names do not return.
  • crates/ghostlight-dungeon/src/world/mod.rs:483-508 — fixture_controller_opportunities (26 lines), per Q1-8 A; and controllers.rs:372-382,409-432 — fixture_prepared_inference, fixture_inference_output, fixture_inference_events (about 40 lines) and controllers.rs:221-237 — InferenceFault::fixture_* (17 lines), per Q1-7 A. Under Q1-7 B / Q1-8 B these stay #[cfg(test)] inside the library and the Dungeon tests that used them are deleted instead (see the classification).
  • crates/ghostlight-dungeon/src/app_session.rs:54-91 — the VerifiedPrincipalEvidence struct, accessors, and fixture (38 lines).
  • crates/ghostlight-dungeon/src/main.rs:7 — mod world;.
  • crates/ghostlight-dungeon/Cargo.toml:27 — the direct ghostlight-persona-projection dependency (controllers.rs:35 is the only importer and it moves).

• Keeps and moves:

  • git mv crates/ghostlight-dungeon/src/world/{action,clock,consumer, controllers,cover,elaboration,journal,mailbox,patch,sdk_inference, tool_schema,vault}.rs crates/ghostlight/src/ and git mv .../world/mod.rs crates/ghostlight/src/lib.rs. Verify with git diff --cached -M --stat that all 13 show as renames.
  • Inside the moved files: crate::world:: → crate:: (199 sites; super::super:: paths need no change); pub(super) → pub(crate) in lib.rs only (94 sites; submodules keep theirs); crate::app_session::VerifiedPrincipalEvidence → crate::VerifiedPrincipalEvidence (mailbox.rs:10, controllers.rs:10714,10790,10988,11473).
  • vault.rs and sdk_inference.rs move with the rest (Q1-2). Their fixture writes (sdk_inference.rs:1900,1983) resolve from crates/ghostlight at the same depth.
  • build.rs, tests/build_provenance.rs, runtime.rs:375 (web/dist) stay in Dungeon; CARGO_MANIFEST_DIR/../.. still resolves.
  • No test moves between crates. Every test under world:: was already a library test and moves with its file (420); every Dungeon test stays in Dungeon (49). See the classification.

• Adds:

  • Cargo.toml (workspace): member crates/ghostlight.
  • crates/ghostlight/Cargo.toml: package ghostlight; no [features]; dependencies async-trait, chrono, codex-connector, cultcache-rs, ghostlight-persona-projection = { path = "../ghostlight-persona-projection" }, rmp-serde, serde, serde_bytes = "0.11", serde_json, sha2, thiserror, tokio, tracing, uuid, zeroize (all .workspace = true except serde_bytes, which the workspace does not declare); dev tempfile = "3". Every one is already in Cargo.lock; no new package.
  • crates/ghostlight-dungeon/Cargo.toml: ghostlight = { path = "../ghostlight" } in [dependencies]; nothing in dev-dependencies.
  • Cargo.lock: the new [[package]] name = "ghostlight" entry. Commit it; Idunn builds --locked.
  • crates/ghostlight/src/lib.rs, root: pub struct VerifiedPrincipalEvidence { account_subject_hash: String, valid_until: DateTime<Utc> } with pub fn new, pub fn account_subject_hash, pub fn valid_until, and #[cfg(test)] fn fixture delegating to new (Q1-3). Doc comment: the consumer verifies; the library bounds by valid_until at mailbox.rs:231.
  • crates/ghostlight/src/lib.rs, the public boundary, one ungated list. pub use clock::{FictionalMinutes, TickMinutes}; consumer::{CONSUMER_BODY_LIMIT, CONSUMER_CREDENTIALS_ENVIRONMENT, CONSUMER_PATCH_SCHEMA, CONSUMER_RECEIPT_SCHEMA, ConsumerRegistry, admit_document, encode_receipt}; controllers::{CellRun, ConnectorBinding, ControllerError, ControllerModels, ControllerPendingReason, ControllerRunner, ControllerWork, ControllerWorkCustody, ControllerWorkLookup, ControllerWorkStore, ControllerWorkStoreError, ControllerWorkWrite, InferenceEvent, InferenceFault, InferenceOutput, InferencePort, InferencePurpose, InferenceRequest, NarrativeRun, OperationalRun, PreparedInference, SubmissionDisposition, ToolResultOracle, open_controller_work, open_inference} (plus TracingInferencePort under Q1-7 A); cover::{AgencyGraph, Cell, Cover, CoverBudget, TickIndex, derive_cover}; elaboration::{SeedOutcome, select_row}; mailbox::{ConsumerPort, ControllerPort, MailboxError, SeedPort, WorldMailbox}; patch::{JurisdictionKey, Statement}; sdk_inference::{DEFAULT_SDK_MODEL_PREFIX, SdkBinding}; vault::VaultEvidenceSource. Root items made pub: STATE_SCHEMA, state_schema_compatibility_tag, AffordanceId, CommandId, SubjectId (the opaque_uuid! macro at mod.rs:98-106 emits pub(crate) struct; give it a visibility parameter and emit pub for these three only — the issue() impls stay private and #[cfg(test)]), PrincipalId, WorldPhase, SubjectKind, ControllerMode, CreateWorldIntent, CreateJurisdictionIntent, DecisionOpportunity, DecisionInvocation, PrincipalCommandIntent, CommandBody, WorldSnapshot, OperatorEvent, CommitReceipt, SubmitReceipt, KernelError, ScaleDeficitRow, and the snapshot row types Dungeon reads through WorldSnapshot fields (SubjectSnapshot, PlaceSnapshot, AffordanceSnapshot, and whichever others the compiler names; probe 3 stopped at the WorldSnapshot field layer). GroupedRun (controllers.rs) is reached through ControllerRunner return values and needs pub with its five fields.
  • How the ports stay public without the fixture constructors becoming reachable: InferencePort (controllers.rs:259) and ControllerWorkStore (:1541) are traits whose method signatures name InferenceRequest, PreparedInference, InferenceOutput, InferenceFault, ToolResultOracle, ControllerWork, ControllerWorkLookup, ControllerWorkWrite, ControllerWorkCustody, ControllerWorkStoreError. Those types become pub; their fields stay private except where listed below. Nothing about them reaches an ID issue() or ScopeDigest::fixture, which are private free functions and #[cfg(test)] impls (mod.rs:200-226,448) with no pub path of any kind and no cargo feature — reachable only from inside the library's own test build. The fixture_* functions are deleted (Q1-7 A / Q1-8 A) or stay #[cfg(test)] (B), and the ten doc-tests pin both outcomes.
  • Fields that become pub (38, from probe 3): CommitReceipt.{command_id, commit_digest, resulting_revision, resulting_state_digest}, Constituent.subject, Cover.{cells, oversubscribed, tick}, CoverBudget.{cells, constituent_cap, urgency_slots}, DecisionOpportunity.{controller_mode, world_id}, GroupedRun.{cell, needs, pending, resolution, submissions}, OperatorEvent.{revision, speech}, PreparedInference.purpose, ScaleDeficitRow.{deficit, jurisdiction, kind, target}, WorldSnapshot.{affordances, draft_approvals, now, opportunities, owner, phase, places, required_approvers, revision, scale_deficit, subjects, title, world_id}. FictionalMinutes.0 stays pub(crate): under Q1-8 A the one Dungeon use (runtime.rs:3579) is replaced by snapshot.now. Fields of the row structs reached through WorldSnapshot follow in the next compiler round.
  • Methods that become pub (36, from probe 3, by definition site): WorldMailbox::{open, create, submit_principal, submit_clock, agency_graph, operator_log, snapshot} (mailbox.rs:93,105,226,355,448, 461,474), ConsumerPort::new (:552), SeedPort::new (:594), ElaborationPort::new (:660), ControllerPort::{new, snapshot, submit_controller} (:692,696,721), ControllerRunner::{open, elaborator, seeder, custody_probe, run_narrative, run_operational, run_cell} (controllers.rs:2691,2712,2728,2744,2748,2838,3057), the receipt/pending accessors at controllers.rs:2397,2413,2421,2453, 2457,2461,2465,2469,2515,2519,2523,2543,2591,2595 (persona_turn, re_lowering, into_parts, subject, bound_scope_digest, fresh_scope_digest, gap, mode, reason, persona_prose), sweep (elaboration.rs:607,1746), name (elaboration.rs:1511), Cover::{singletons, groups, validated} (cover.rs:163,170,198), ConsumerRegistry::{empty, from_secret_file} (consumer.rs:168,176), TickMinutes::{new, minutes} (clock.rs:45,51), CommandId::new (mod.rs:122), PrincipalId::new (mod.rs:239), Statement::new (patch.rs:281). Under Q1-7 A add PreparedInference::prepare (renamed from prepare_invocation, controllers.rs:388), InferenceOutput::new, InferenceFault::{retryable, recovery_required, integrity_violation}, InferenceRequest::provider_model (:120), and TracingInferencePort::new (:285).
  • crates/ghostlight/src/lib.rs crate docs: the ten compile_fail doc-tests from probe 5, each pinned to its error code.
  • crates/ghostlight-dungeon/src/runtime.rs (tests): a ~25-line copy of soul_no_credential_name_appears_in_the_ports_own_source scanning runtime.rs only, because the library test cannot read another crate's source (see per-file sdk_inference.rs:1824-1828).
  • crates/ghostlight-dungeon/src/app_session.rs (tests): one test asserting VerifiedPrincipalEvidence::new( occurs exactly once in the crate's production source, at account_for_cookie (same shape as the from_secret_file count at sdk_inference.rs:1860). This is the single-minter rule the deleted private fields used to enforce (Q1-3).

• Cross-boundary test classification (Q1-4). Every Dungeon test that reaches an item which is #[cfg(test)] in the library today. Method: probe 5's four compile errors plus a read of each test body.

  #	File:line	Test	Exercises	Reaches	Class
  1	runtime.rs:3270	the_tick_driver_never_exceeds_its_controller_permit_pool	run_cover_tick and state.controller_permits: two singleton cells, pool of one, no overlapping infer	fixture_prepared_inference, fixture_inference_output (via CountingInferencePort, :3241); AlwaysFreshWorkStore (:3194) uses only pub enum variants	Dungeon runtime
  2	runtime.rs:3337	quarantine_raised_mid_tick_stops_the_sibling_cell_and_every_later_tick	the driver's controller_quarantined flag across sibling cell and next tick	fixture_prepared_inference, InferenceFault::fixture_integrity_violation (QuarantiningInferencePort, :3308)	Dungeon runtime
  3	runtime.rs:3500	a_second_mid_turn_change_reaches_the_drivers_interrupted_arm	the driver's Interrupted arm reached through run_cover_tick, commits through ControllerPort::submit_controller (production)	fixture_prepared_inference, fixture_inference_output, fixture_inference_events, InferenceFault::fixture_recovery_required, InferenceEvent::ToolCall (pub variant), PreparedInference.purpose (InterruptingCoverPort, :3432)	Dungeon runtime
  4	runtime.rs:3567	drive_one_tick_runs_every_cell_before_the_clock_and_all_share_one_tick	drive_one_tick ordering: every cell before the clock, all cells carry the cover's tick	fixture_controller_opportunities (the only caller of the sealed WorldId/SubjectId/ControllerId::issue() and ScopeDigest::fixture from outside world/), FictionalMinutes(u64), AgencyGraph::default, Cell, TickIndex, CommitReceipt literal (controller_commit, :2492)	Dungeon runtime
  5	runtime.rs:3697 (ignored)	live_smoke_seeds_then_ticks_a_world_against_the_connector	the road test: seed from a real Vault, activate, tick against a real connector; GHOSTLIGHT_SMOKE_TRACE writes the whole membrane (notes/local-live-smoke.md:214-246)	TracingInferencePort (fixture_with, :2581-2582)	Dungeon runtime

  Counts: 5 tests reach test-only library items; 0 are kernel tests; 5 are Dungeon runtime tests. Two other Dungeon tests touch the boundary but need nothing test-only: runtime.rs:2502 no_proposal_projection_carries_the_canonical_world_commit builds a CommitReceipt literal (four pub fields, in the boundary list) and runtime.rs:4293 soul_verified_evidence_outlives_the_session_that_minted_it uses VerifiedPrincipalEvidence::fixture → ::new (Q1-3). Every other Dungeon test (42) uses production ingress only.

  Consequence: the ruling's "move the tests into the library" has no test to move. Tests 1–4 exercise run_cover_tick, drive_one_tick, the permit pool, and quarantine — Dungeon's tick driver — and test 5 is Dungeon's road test; moving any of them would move the driver. What they need divides into two kinds, and each is an operator question below rather than a mechanism this map invents:

  • tests 1, 2, 3, 5 need to construct port values (PreparedInference, InferenceOutput, InferenceFault) and a port decorator; none of these is a sealed item under invariant 1 (mutable state, ID allocator, reducer, journal, authenticated-caller constructor) — Q1-7;
  • test 4 needs a Cover to walk, and today gets it from fabricated opportunities minted with sealed IDs — Q1-8.

  Expected post-move counts, under Q1-7 A and Q1-8 A: library 420 unit (the base world:: list, prefix stripped) + 10 doc; Dungeon bin 49 (the same 49 names; tests 1–4 rewritten in place, test 5 unchanged); build_provenance 1; persona-projection 13; ignored 1 + 1. Under Q1-7 B tests 1–3 and the trace half of test 5 are deleted (Dungeon 46, or 45 if test 4 goes under Q1-8 B); the library count is unchanged either way.

• Per-file changes (against d83534c = 02bbf62 source):

  • Cargo.toml:3-5: add member.
  • crates/ghostlight-dungeon/Cargo.toml:27: replace with the library path dep.
  • crates/ghostlight-dungeon/src/main.rs:7: delete.
  • crates/ghostlight-dungeon/src/runtime.rs:3-22: split the use crate::{} block; world::{…} becomes use ghostlight::{…} (probe edit); :4: import VerifiedPrincipalEvidence from ghostlight, not app_session. :518,519,535,1084,1088,1092,1201,1325,1621,2492,2493,2581,2582,3081, 3501,3568,3658,3666,3675,3677,3777,3782,4267: crate::world:: → ghostlight::. :4313: ::fixture( → ::new(. :3081-3086: drop the three fixture_inference_* names. :3243,3310,3434: PreparedInference::prepare("ghostlight-controller-test", 4_102_444_800_000, request) (Q1-7 A; the two literals are the ones fixture_prepared_inference hard-codes at controllers.rs:381). :3255,3442,3447: InferenceOutput::new(vec![InferenceEvent::Text(..)], "sha256:<receipt>"); :3457: InferenceOutput::new(events, ..); :3318: InferenceFault::integrity_violation(..); :3479: InferenceFault::recovery_required(..). :3567-3644 (Q1-8 A): replace fixture_controller_opportunities + FictionalMinutes(..) with fixture().await, active_two_cell_world, snapshot(), and agency_graph(), then derive_cover(snapshot.world_id, snapshot.now, CLOCK_TICK_MINUTES, &snapshot.opportunities, &graph, budget); the cell count assertion becomes 2 (a genesis world has two controller-bearing subjects — :3089-3095 already says this is the most world.create can produce); the ordering and shared-tick assertions are unchanged. :504,2673 doc comments name world::consumer; reword to the crate.
  • crates/ghostlight-dungeon/src/eve.rs:3-6 and :182,335,338,354,386, 405,449,494: same rewrite.
  • crates/ghostlight-dungeon/src/mesh.rs:6-9: same.
  • crates/ghostlight-dungeon/src/idunn_health.rs:8: same.
  • crates/ghostlight-dungeon/src/app_session.rs:54-91: delete; :6: add use ghostlight::VerifiedPrincipalEvidence;; :232-235: struct literal → VerifiedPrincipalEvidence::new(session.account_subject_hash.clone(), session.access_expires_at).
  • crates/ghostlight/src/controllers.rs:221-237,372-382,409-432 (Q1-7 A): delete the fixtures; :388 prepare_invocation → pub fn PreparedInference::prepare (keep the body; the two in-library callers at the connector and SDK ports follow); :150 add pub fn new(events, receipt_digest); :192,206 new → pub fn retryable, integrity_violation → pub, add pub fn recovery_required(detail) (the RecoveryRequired disposition has a private new today; make it the named constructor); :277-370 drop #[cfg(test)] from TracingInferencePort and make it and new pub.
  • crates/ghostlight/src/sdk_inference.rs:1824-1828: the scanned file list becomes ["sdk_inference.rs", "controllers.rs"] (paths are now crate-root relative); :1860 sources[1] still indexes controllers.rs. The runtime.rs half moves to Dungeon (Adds).
  • deployment/idunn/recipe.toml:14-17: test-world-owner becomes two steps — test-world-library: ["cargo","test","--locked","-p","ghostlight"] (runs the 420 unit tests and the 10 doc-tests) and test-dungeon: the existing -p ghostlight-dungeon --bin ghostlight-dungeon line. :51-53: acceptance argv becomes -p ghostlight --lib controllers::tests::real_codex_connector_cognition_modes_commit_speech (the world:: prefix is gone; --exact still matches).
  • package.json:9 (dungeon:run): unchanged; :7-8 use --workspace and pick the crate up.
  • notes/local-live-smoke.md:64: unchanged; the ignored smoke stays in runtime.rs:3697.
  • Docs that name the old path (owner in brackets): README.md:165-166 [Hands] add the library line; docs/public-architecture/index.md:46 [Hands]; docs/architecture/ghostlight-session-zero.md:21-23 [Hands] rewrite "Source does not yet match" as the current rule; docs/architecture/ghostlight-world-ontology.md:939-941 [Hands] the build-budget sentence now names crates/ghostlight; notes/ghostlight-current-system-map.md:18,28,289 [Mind steward]; notes/fresh-workspace-handoff.md:284-286 [steward]; state/map.yaml:57,389-390 [steward].

• Authority map:

  • Owner: the library crate ghostlight owns the world kernel, its ontology, reducer, journal, mailbox, controllers, elaboration, cover, clock, consumer admission, inference ports (connector, SDK sidecar, and the tracing decorator), and the markdown evidence source. Its public surface is the list under Adds and nothing else.
  • Inputs: VerifiedPrincipalEvidence values Dungeon constructs from AppSessionOwner::account_for_cookie; CreateWorldIntent, PrincipalCommandIntent, DecisionInvocation; consumer patch bytes via admit_document; store paths via WorldMailbox::open and open_controller_work; connector and SDK bindings via open_inference; a consumer-implemented InferencePort/ControllerWorkStore when the consumer supplies its own (Dungeon's tests do; production uses the library's).
  • Outputs: immutable WorldSnapshot, OperatorEvent, AgencyGraph, typed receipts (SubmitReceipt, CommitReceipt, CreationReceipt through MailboxError/KernelError), controller runs, cover partitions, encoded consumer receipts.
  • Derived state: Dungeon's Eve projection, mesh documents, Idunn health (which reads STATE_SCHEMA and state_schema_compatibility_tag and derives, never restates), HTTP responses.
  • Forbidden writers: any path in Dungeon naming WorldKernel, WorldState, reduce, apply_effect, CommandEnvelope, AuthenticatedCaller, the journal, an issue(), or ScopeDigest::fixture — enforced by visibility with no feature that can lift it, proven by the doc-tests under --all-features. Any second minter of VerifiedPrincipalEvidence — enforced by the Dungeon count test. Any fixture-shaped DecisionOpportunity — there is no constructor for one outside the reducer.
  • Shared paths: Dungeon production and Dungeon tests reach the kernel through the same pub items; a Dungeon test port constructs port values through the same constructors the library's own ports use (Q1-7 A). Library-internal tests keep pub(crate)/super:: access as today. Consumers other than Dungeon: none yet; Epiphany consumes only ghostlight-persona-projection, which is unchanged (Q1-5).
  • Deletion line: mod world;, the nine unused re-exports, the #[cfg(test)] re-export block, the fixture_* functions (A) and Dungeon's private principal struct are gone before the first pub is written.

• Verification (Windows workstation; proves Windows only):

  • builds: cargo check -p ghostlight (no new warnings; the 646 dead-code warnings of an under-opened boundary must be 0), cargo check -p ghostlight-dungeon --bin ghostlight-dungeon, cargo check -p ghostlight-dungeon --tests, cargo build --locked -p ghostlight-dungeon --bin ghostlight-dungeon (proves Cargo.lock). Expected target-dir delta: one extra lib crate in debug; the scratch probe's check-only target was 2.3 GiB from empty, so expect well under 1 GiB incremental on the repo's 7.5 GiB.
  • tests: cargo test -p ghostlight = 420 unit + 10 doc (the 420 names equal the base world:: list with the prefix stripped); cargo test -p ghostlight-dungeon --bin ghostlight-dungeon = 49 (same names as base); cargo test -p ghostlight-dungeon --test build_provenance = 1; cargo test -p ghostlight-persona-projection = 13. Ignored counts unchanged (1 + 1). The reopen test from Cut 0 pins invariant 2 (world.cc written at base reopens with equal revision and digests). The doc-tests pin invariant 1. The VerifiedPrincipalEvidence::new count pins the single minter. The split credential-name test pins "no credential name in the port's source" on both sides. Tests 1–4 keep their names and assertions (test 4's cell count is 2).
  • negative: cargo test -p ghostlight --all-features --doc = 10 passed (same as without; the command is the standing check that no later feature reopens the seal); rg -n '\[features\]' crates/ghostlight/Cargo.toml = 0; rg -n 'cfg\(any\(test' crates/ghostlight/src = 0 (no feature-gated test path exists); rg -n 'fixture_' crates/ghostlight-dungeon/src = 0 outside the Heimdall ::fixture( sites (app_session.rs:560, runtime.rs:2552, 2611,4126 — use rg -n 'fixture_[a-z]' … which they do not match); rg -n 'crate::world::' crates = 0; rg -n '^mod world;' crates = 0; rg -n 'app_session|heimdall|eve::|idunn_health|axum|tower_http|jsonwebtoken|\bDungeon\b|Session Zero' crates/ghostlight/src = 0 (collisions checked: Dungeons in vault.rs is excluded by \b; do not add player); rg -n 'pub\(super\)' crates/ghostlight/src/lib.rs = 0; rg -n 'VerifiedPrincipalEvidence::new\(' crates/ghostlight-dungeon/src = 1 outside #[cfg(test)]; cargo tree -p ghostlight names no axum, tower-http, jsonwebtoken, cultnet-rs, cultmesh-rs, reqwest, aes-gcm, hmac, rand, base64, libc; git diff -M --stat 02bbf62..HEAD -- crates shows 13 renames.
  • operator: Idunn recipe run on Yggdrasil (Linux proof): the test-world-library, test-dungeon, build-daemon steps and the acceptance step resolve; /srv/…/ghostlight-dungeon --state-root reopens the live world.cc; health reports consumer-v4. One GHOSTLIGHT_SMOKE_TRACE road run after the cut shows the membrane trace still writes (test 5).

• Operator questions:

  • Q1-7 Port value constructors for consumer-implemented ports. Tests 1, 2, 3 and 5 implement InferencePort outside the library and must return PreparedInference, InferenceOutput, InferenceFault; today they do it through #[cfg(test)] fixture_* wrappers that exist only because those types have private constructors. A: make the constructors the port contract — PreparedInference::prepare(caller_ runtime_id, expires_at_unix_ms, request) (rename of the existing prepare_invocation, "the one place a PreparedInference is built", which every in-library port already calls), InferenceOutput::new(events, receipt_digest), InferenceFault::{retryable, recovery_required, integrity_violation}, InferenceRequest::provider_model; delete the five fixture_* items; make TracingInferencePort an ungated pub decorator (it wraps any port and constructs nothing sealed; "production never constructs it" becomes a Dungeon rule, which is where it was enforced anyway — only the ignored smoke names it). B: keep every fixture #[cfg(test)] in the library and delete tests 1–3 and the trace field of LiveController (runtime.rs:2538,3726) from Dungeon; the permit-pool, quarantine, and interrupted-arm invariants of the tick driver lose their proofs and the road test loses its membrane trace. Recommended: A. A public trait whose methods must return a type nobody outside the crate can construct is not a port; it is a trait only the library can implement. Invariant 1 seals the kernel, not the inference transport, and none of these constructors mints an ID, mutates state, reduces, or writes the journal. A is a net deletion (about 85 fixture lines out, about 25 constructor lines in, of which prepare is a rename).
  • Q1-8 The cover for drive_one_tick_runs_every_cell_before_the_clock_and_all_share_one_tick. A: derive it from a real world through production ingress — the module's own fixture()/active_two_cell_world, then snapshot() and agency_graph() into derive_cover; delete fixture_controller_opportunities and the FictionalMinutes(u64) construction; the test asserts two cells instead of three, and the ordering and shared-tick assertions are unchanged. B: delete the test. C: keep fixture_controller_opportunities #[cfg(test)] in the library and move the test there — not available, drive_one_tick is Dungeon. Recommended: A. It removes the last caller of the sealed constructors from outside world/, uses only what tests 1–3 already use, and the test's own doc (:3558-3565) is about ordering, not about three.

Cut 2. Build and deploy references in gamecult-ops

• Repo/branch: gamecult-ops, current default branch; one commit after Cut 1 is pushed.
• First: git -C F:\Projects\gamecult-ops status clean; bash scripts/test-ghostlight-yggdrasil-wiring.sh passes at base.
• Deletes first: none (Q1-6: retirement belongs to the deployment gate).
• Keeps and moves: none.
• Adds: none.
• Per-file changes:
  • runbooks/ghostlight-dungeon-yggdrasil.md:249-251: insert cargo test --locked -p ghostlight before the Dungeon test line; :257 "one explicit Rust binary" stays true.
  • scripts/deploy-ghostlight-yggdrasil.sh:964-970: add the library test invocation in the same container run; :1308: acceptance becomes -p ghostlight --lib controllers::tests::real_codex_connector_cognition_modes_commit_speech.
  • scripts/test-ghostlight-yggdrasil-wiring.sh:276-278: add require_text "${deploy}" 'cargo test --locked -p ghostlight'.
  • idunn/yggdrasil/bindings/ghostlight.toml.in: unchanged; it names the recipe path, and the recipe carries the commands.
  • The scripts remain, per the Ghostlight handoff (:389-391), helpers not to invoke: they fail at the root/Idunn Git boundary and hold duplicate deployment authority. Editing them keeps their command list from lying about the crate graph until the deployment gate retires them; it is not an endorsement to run them.
• Authority map:
  • Owner: deployment/idunn/recipe.toml in Ghostlight owns the build and test commands (binding :11 recipe_path). The runbook describes; the scripts are a second, dormant list pinned to the recipe's strings by the wiring test until the deployment gate removes them.
  • Inputs: the admitted ref and the recipe.
  • Outputs: the same one binary plus web/.
  • Derived state: runbook text, wiring-test assertions.
  • Forbidden writers: no second list of cargo commands that drifts from the recipe; the wiring test's require_text lines are that check.
  • Shared paths: n/a.
  • Deletion line: none in this cut.
• Verification:
  • builds: none (shell and Markdown).
  • tests: bash scripts/test-ghostlight-yggdrasil-wiring.sh passes with the new require_text.
  • negative: rg -n 'ghostlight-dungeon --bin ghostlight-dungeon' F:\Projects\gamecult-ops --glob '!docs/**' lists only lines that also sit beside a -p ghostlight line.
  • operator: the next Idunn deploy of a post-Cut-1 commit runs the library step.
• Operator questions: none; Q2-1 was Q1-6 and is ruled.

Subtraction ledger (estimate)

Cut	Removed	Added	Deps / formats / targets
0	—	—	scratch captures only
1	mod world; (1), 9 unused re-exports (~3 lines), cfg(test) re-export block (12), Dungeon principal struct (38), Dungeon's direct persona-projection dep (1), fixture_controller_opportunities (26, Q1-8 A), inference fixtures (~60, Q1-7 A); ~140 lines	lib manifest (~28), workspace member (1), Dungeon dep (1), lock entry (~20), principal type in lib (~30), pub use boundary (~25), doc-tests (~30), runtime credential test (~25), minter count test (~15), port constructors (~25, Q1-7 A), recipe step (~6); ~205 lines. Visibility edits: 94 pub(super)→pub(crate), ~150 pub(crate)→pub (items, fields, methods), 199 crate::world::→crate::, 32 crate::world::→ghostlight::; test 4 rewritten in place (~20 lines)	+1 lib crate, 0 features, 0 binaries, 0 new packages in Cargo.lock; 13 files renamed (~52k lines)
2	—	~5 lines	0

Net for L0: about +65 source lines, one crate, no feature. The growth is boundary declaration (an implicit pub(crate) becomes an explicit pub list plus its compile-fail proofs); the liability it retires is the convention "Dungeon does not touch kernel internals", which becomes a compile error with no feature that can lift it, and five fixture wrappers that existed only to work around private port constructors.

Actual, reconciled 2026-09-16 against 6ddabca (Ghostlight) and 647e57e (gamecult-ops):

Area	Estimate	Actual
Crate sources incl. in-module tests	about +65 net	+1202 / −992 (+210 net)
Integration tests	not planned	+479
Manifests and lock	about +50	+50 / −2
Ghostlight recipe	about +6	+10 / −5
gamecult-ops	about +5	+61 / −9

The miss is explained, not hidden. The single-minter scanner grew about 110 lines chasing Soul's evasions and remains evadable (S4). The boundary needed roughly 90 more public items than this map enumerated, each forced by a compile error or a private_interfaces warning. The integration tests buy ruling Q1-9, which postdates the estimate. Features and binaries added: none, as estimated.

Findings not assigned to a cut

• deployment/idunn/recipe.toml:142-146,169-171 declare the world slot and provided capability as ghostlight.world_state.foundation.v0 / foundation-v0, and :150-154 the controller-work slot as ghostlight.controller_work.v3; source is consumer.v4 (mod.rs:84-85, tag consumer-v4) and controller_work.v15 (controllers.rs:75-76). Pre-existing drift; L0 changes no schema string, so it stays.
• tests/build_provenance.rs is never run by the recipe or the scripts: --bin ghostlight-dungeon selects the bin's unit tests only. A cargo test --locked -p ghostlight-dungeon --test build_provenance step would be a recipe change with its own reason.
• notes/ghostlight-current-system-map.md:18-19 still names the state owner as ghostlight.world_state.foundation.v0; :28 says "the private world::WorldKernel". Both are stale before this cut; the steward owns the rewrite.
• runtime.rs:2492 is a CommitReceipt literal in Dungeon tests; it is why CommitReceipt's four fields are in the boundary at all. Under Q1-8 A the same literal serves drive_one_tick's fake clock submitter.
• PreparedInference.invocation (controllers.rs:131, CodexTransportInvocation from codex-connector) stays pub(crate). A consumer port that talks to a real transport would need it; no such consumer exists in L0, and opening it is a port-contract decision for the pass that brings one.
• web/ references nothing in crates/; sidecar/claude-sdk/test/* is written by library tests under GHOSTLIGHT_WRITE_SIDECAR_FIXTURES and read otherwise — path depth unchanged, nothing to do.