Ghostlight/docs/architecture/ghostlight-multiresolution-agency.md

# Ghostlight Multiresolution Agency Graph

Status: teardown evidence. Describes the pre-rebuild resolution cover,
strategic waves, demand/deficit elaboration, and the wave-level outcome
resolver, all on the deletion line. The current vocabulary is
`docs/architecture/ghostlight-world-ontology.md`. It keeps the resumable
per-jurisdiction elaborator session, compact mutation drafts, the complete
deterministic mismatch set, the authored `WorldScaleIntent` and its
deterministically derived deficit, the budgeted connected cover with singleton
detail focus and grouped coarse cells, debt rotation, and deterministic clocks
that advance regardless of attention. Detail first, then the ten-percent choke,
is the operator's design and survives. It drops gestalt as identity:
`GestaltPersonaState`, member deltas, arena knowledge union, fission as a scale
loop, promotion and folding, and cover-completeness targets.

## Objective

Let a campaign contain the whole strategic setting without pretending every
person, faction, institution, and population can receive a separate model turn.
Ghostlight preserves canonical fine state and changes only the resolution at
which that state is simulated during a wave.

This document is the authority map for the implemented multiresolution organ.
The wider runtime map remains `ghostlight-dungeon-mvp.md`.

## Authority map

- **Owner:** `WorldKernel` owns canonical subjects, world revision, resolution
  controls, accepted fission, and atomic strategic-wave commits.
- **Inputs:** canonical actors, institutions, gestalt leaves, typed agency
  profiles and relations, resolution pins, current pressure demand, committed
  clocks/events, and the previous accepted cover.
- **Outputs:** a revision-bound `ResolutionCover`, its plan receipt, one
  appraisal per selected cell, exact constituent-attributed proposals, and one
  atomic strategic transition.
- **Derived state:** simulation cells, merge losses, content-addressed cell IDs,
  detail focus, and the active cover. None owns a person, population, secret,
  relationship, possession, or fictional fact.
- **Forbidden writers:** demand projection, graph construction, the partitioner,
  Projectors, Personas, Interpreters, scheduler, browser, and operator inspector
  cannot mutate canonical world state.
- **Shared paths:** scheduled ticks and return catch-up both compile the same
  `AdvanceStrategicTick` command. Budget and pin changes use the campaign
  mailbox at safe boundaries. Provider parallelism uses a separate
  configuration epoch and does not repartition or advance fiction.
- **Cut line:** the old flat strategic-plan proposer is gone. No active runtime
  path may tick a hand-picked list of factions outside the selected cover or
  union arena knowledge into a synthetic actor.

`ActorState`, `InstitutionState`, `GestaltPersonaState`, and durable gestalt
member deltas remain canonical owners. `AgencyProfile` and `AgencyRelation` are
typed partition inputs. `SimulationCell` is always disposable and rebuildable.

## Latent-world scale and elaboration demand

- **Owner:** consumer-authored `WorldScaleIntent` owns the desired active-cover
  ratio. `ResolutionPolicy` continues to own only the active-cell entitlement.
  A deterministic `WorldElaborationDemand` derivation owns the resulting target
  and deficit; it owns no fictional content.
- **Inputs:** active-cell budget, target active-cover basis points, the current
  count of simulation-eligible canonical subjects, and positive complexity
  weights for admitted realm jurisdictions.
- **Outputs:** target actionable-subject count, exact current deficit, a bounded
  round-effort budget, and deterministic per-realm target shares. At 240 cells
  and 1,000 basis points, the target is 2,400 subjects.
- **Derived state:** demand, deficit, invocation schedule, and realm target
  shares are resumable planning artifacts. They are not subjects, facts,
  Personas, cells, or mutation permits.
- **Forbidden writers:** the elaboration scheduler, titled workers, Gestalt
  compression, Nemesis, and provider concurrency cannot create or count a
  proposed subject as canonical. Only admitted population, institution, or
  actor operations committed through `WorldKernel` reduce the deficit.
- **Shared paths:** initial compilation, destination expansion, resumed
  elaboration, and later consumer-requested scale changes use the same demand
  derivation and canonical actionability count. Each titled worker proposes at
  most one structural operation at a time; deterministic admission and kernel
  commit remain unchanged. The current scale loop raises complexity through
  grounded Gestalt fission or promotion of an individual into an active Actor
  leaf, never through unelaborated census or roster rows. Institution admission
  remains compiler-owned rather than being smuggled into this loop.
- **Cut line:** fixed elaboration-pass count is not a world-scale owner. It may
  bound which jurisdictions are being worked in one run, but it cannot declare
  the latent world sufficiently populated. Provider concurrency controls only
  simultaneous calls and never changes the target or deficit.

Realm complexity weights distribute the target; they do not increase it. Any
integer remainder is assigned deterministically so the realm shares sum exactly
to the world target. A rejected or conflicting proposal leaves the deficit
visible rather than being hidden behind an assumed model-call yield.

The actionable count includes only active simulation-eligible agency leaves.
Dormant member records are useful latent identity, but do not pay down the
complexity deficit until grounded elaboration promotes them. Resolution may
still compress roughly 2,400 such leaves into at most 240 cells.

The mutation budget is not a cold-prompt budget. Each titled elaborator owns a
resumable working session per realm jurisdiction containing its current frontier, unresolved leads,
recent admitted mutations, exact rejection findings, and title mandate. The
canonical world remains long-term memory. Bounded retrieval supplies older
relevant state. After each round, every title that committed work receives one
agentic compaction turn. It emits a typed checkpoint bound to the exact admitted
commit ancestry; raw conversation is never authority, and the next turn appends
from the checkpoint. This round boundary is the current bounded context policy.
Scheduler frequency remains proportional to slider share across sequential
turns.

The scale workbench uses mutation drafts rather than asking a model to restate a
complete kernel command. A fission draft owns only new child identities,
partition values, and exact member/resource assignments. The deterministic tool
attaches campaign revision, parent, axis, approval fields, and inherited
capabilities, knowledge, goals, and pressures before running the ordinary
fission validator. An individuation draft owns only the new member delta; the
tool attaches the exact parent version and location. Unchanged world state is
therefore never paid for in model output and cannot drift while being copied.
The shared fission validator reports the complete deterministic mismatch set in
one observation, so an agent can repair the same compact draft without replaying
inference or guessing which invariant failed first.
The lane-specific action schema requires one entry for every exact frozen
resource and dormant-member ID and rejects extra keys. The elaborator still
chooses child custody; it cannot silently omit a scarce thing the kernel must
conserve.

Round effort is proportional to unresolved pressure rather than presumed model
yield: `ceil(active_cell_budget * deficit / target)`, zero when the target is
satisfied. With 80 admitted leaves against the 2,400 target, the first round
funds 232 one-operation turns. After admission the deterministic owner recounts
active meaningful leaves and derives the next round afresh. A fission may add
several meaningful child leaves; a rejected proposal may add none. Neither case
changes the accounting rule or grants the scheduler fictional authority.

## Canonical population resolution

Known population detail is represented by non-overlapping active gestalt
leaves. A material split uses approval-gated `FissionGestalt`:

1. the compiler retrieves exact Vault evidence and produces a fission preview;
2. every requested enumerated facet gets a child and one `other/unknown`
   remainder is mandatory;
3. children inherit the parent baseline and own only later deltas;
4. every exact scarce resource is assigned to one child rather than copied as
   an inheritable trait;
5. member deltas are assigned to one child without rewriting identity;
6. the parent remains as inactive lineage rather than being destroyed;
7. the kernel validates the preview, evidence, versions, assignments, and
   residual child before one atomic commit.

The commit is a canonical `WorldMutationBatch`: child admission establishes
identity and occupancy, the lineage mutation inherits non-scarce baseline
components, custody transfers partition resources, and membership transfers
move exact named people. Agency profiles, inherited partition facets, and the
discarded cover are resolution projections of that accepted transition; they
cannot create a second result.

Reversible simulation aggregation never invokes fission and never deletes or
reverses this lineage.

## Canonical individual migration

Resolution aggregation and population membership are separate authorities. A
cell may temporarily contain many populations, but that never changes which
population baseline a durable person is composed from. `WorldKernel` owns one
explicit membership transition for that purpose.

- **Owner:** `WorldKernel` owns a durable member's current active-leaf
  `gestalt_id`. The member delta owns their identity, memories, relationships,
  possessions, injuries, obligations, and personal departures from the current
  baseline. `GestaltLineage` owns immutable fission ancestry.
- **Inputs:** one exact member-attributed proposal, the source and destination
  active gestalt leaves, a typed migration relation, a reachable destination,
  and the campaign/resolution snapshot already bound to the strategic wave.
- **Outputs:** the same member identity attached to the destination leaf, with
  capability and knowledge deltas rebased so their effective personal state is
  bit-for-bit unchanged; one attributed migration event is emitted.
- **Derived state:** simulation cells, arena membership, member prompt
  selection, and rematerialized `ActorState` projections do not own population
  membership.
- **Forbidden writers:** a source gestalt, destination gestalt, arena, demand
  model, Projector, Persona prose, or migration relation cannot move a person.
  Only an action attributed to that exact durable member may propose the
  transition, and the kernel validates it.
- **Shared paths:** source and destination may be leaves at any depth under
  unrelated lineage trees. The same rebase primitive handles crisis camps,
  neighborhoods, departments, corporations, species populations, and later
  refinements.
- **Cut line:** changing `GestaltMemberDelta.gestalt_id` directly is forbidden.
  It would reinterpret the old delta against a different baseline and silently
  alter the person's knowledge, capability, or default goals.

A bounded set of salient dematerialized member exceptions may be projected
inside the cell containing their current gestalt. They remain separately
attributed people, not shared gestalt state. Selection favors unresolved
personal conditions, obligations, goals, and relationships to the player and
is capped so a large population does not dump its roster into the prompt. A
member may migrate only along an explicit active `migration` relation to a
reachable destination leaf. At any active leaf, the same member may instead
emit a `member_activity` from their exact location toward their current
population, an explicitly related subject, or another selected named person or
active subject at that exact location. Only the capped salient member
exceptions exposed to the cell may appear as named targets in its prompt;
canonical validation still checks the target's identity and current location.
Migration and ordinary activity share one per-member strategic action slot.
This lets a refugee who mattered during
a crisis choose to travel, offer work after settling, and later rematerialize
as the same person without forcing every refugee to consume an active Persona
cell or giving their agency to the destination Gestalt.

The membrane distinguishes a chosen journey from preparation for one. When a
member commits to board, depart, travel, or join a supplied destination within
the strategic horizon, the Interpreter must emit `member_migration`; approaching
the queue is not allowed to erase that commitment into `member_activity`.
Preparing applies only while departure remains unchosen. The semantic verifier
checks both directions so neither consideration becomes travel nor chosen
travel disappears into local activity.

Presence projection is location- and lineage-bounded. The planner sees only
active gestalt leaves at the player's location, dormant members whose exact
current location is there, and materialized members that might be eligible to
fold. Inactive ancestors and remote dormant rosters do not enter the prompt.
The kernel independently rejects individuation from an inactive leaf,
promotion outside the member's exact location, and automatic reconciliation
outside the player's active location. A direct internal command may preserve a
named offscreen actor, but model-driven presence reconciliation cannot teleport
one into view. Existing member deltas are preferred when their relationship,
memory, obligation, or goal makes an ordinary encounter a meaningful callback.
The player actor's reciprocal relationship to each nearby dormant member is
projected beside that member's exact delta. Presence planning is scene casting,
not roster cleanup: an earned local callback may surface without the player
asking for the person, while an incompatible event or absence of durable
callback evidence may still produce no promotion. The model only proposes the
cast; `WorldKernel` validates exact member, gestalt, location, and versions
before materialization. Live harnesses persist the private presence preflight
even when their acceptance assertion fails.

The presence-planner schema enumerates promotion IDs only from the supplied
nearby dormant roster, demotion IDs only from supplied materialized actors, and
gestalt and location IDs only from the exact scene candidates. A structurally
valid plan that mismatches member, gestalt, location, or version receives one
same-snapshot semantic correction. When that correction succeeds, both the
rejected and accepted stage receipts remain durable; the rejected receipt is
marked `semantic_invalid` with the bounded local reason.

## Canonical population migration

Population fission and population movement are separate decisions. Fission
answers which non-overlapping cohort exists. Migration answers where one active
cohort goes. Simulation aggregation answers how much inference attention that
cohort receives after arrival. None of those operations is a canonical merge.

- **Owner:** `WorldKernel` exclusively owns an active gestalt leaf's
  `home_location_id` and the matching agency-profile location set.
- **Inputs:** one exact gestalt-attributed proposal, an active source leaf, an
  explicit migration relation to an active destination population leaf, a
  reachable destination, and the unchanged world and resolution revisions.
- **Outputs:** the source leaf and its agency profile move atomically, their
  versions advance, and one attributed population-migration event records the
  source and destination locations and populations.
- **Derived state:** the resolution cover may later place the migrant cohort
  and destination population in one cohesive or arena cell. That cover does
  not change either population's identity, knowledge, authority, or lineage.
- **Forbidden writers:** an arena, destination population, Projector, Persona,
  Interpreter, scheduler, or relation cannot move a population. A population
  move never carries named member deltas by implication; each named person's
  exact location and membership remain unchanged until that person acts.
- **Shared paths:** every active leaf uses the same transition, whether it is a
  root population or a child many levels below it. Approval-gated fission may
  first create destination, stayer, and `other/unknown` cohorts; each resulting
  leaf can then migrate independently.
- **Cut line:** collective departure is neither `prepare` nor
  `member_migration`. The former loses the chosen journey; the latter gives a
  population authority over a person. Canonical population merging remains
  absent: arrival changes geography, while derived covers provide cheap local
  aggregation.

## Demand projection

A flash-model structured stage converts the committed event or strategic
horizon into weights for geography, ideology, authority, economy role,
species/body, and information. Focal subjects must be chosen from supplied IDs.
Local semantic validation permits one same-snapshot correction. Failure falls
back to the last accepted demand; the initial fallback favors geography and
authority.

Demand is relevance evidence. It cannot create profiles, pins, cells, or facts.

## Agency graph

Vertices are active canonical actors, institutions, and gestalt leaves. Edges
carry containment, command, membership, alliance, rivalry, trade, migration,
communication, coercion, and shared-location meaning. Subjects sharing a
location receive derived adjacency. Disconnected components receive a
resolution-only Steiner chain so the graph remains coarsenable; those bridge
edges assert no lore relation, common authority, proximity, or shared
knowledge.

The compiler must profile every non-player actor, institution, and gestalt
exactly once across all six axes. It compiles a bounded local play region and a
global skeleton of major powers, coarse regions, institutions, information
channels, and strategic pressures. Runtime migration derives profiles for old
flat campaigns without changing their world revision, actors, institutions,
gestalts, or fictional time.

## Budgeted connected cover

The campaign selects an active Persona-cell budget from 1 through 240, default
8, bounded by its pooled entitlement. Provider parallelism is a separate
control capped at 32 concurrent cell pipelines.
The scale fixture covers 1,000 canonical subjects with 200 unique cells, then
dispatches every cell membrane in one wave while a seven-permit semaphore
bounds physical provider work. Wave width and provider pressure are therefore
separate authorities; all terminals still join, sort, validate, and commit as
one atomic resolution wave.
The partitioner:

1. contracts valid `keep_together` pins;
2. forces focal, directly engaged, leased, initiative, targeted, and
   `minimum_individual_detail` subjects into singleton cells;
3. respects `keep_separate` pins and reports mandatory effective-budget
   overage rather than hiding a foreground subject;
4. starts at fine resolution and repeatedly merges the lowest-loss legal
   graph-adjacent pair with deterministic tie-breaking;
5. performs one connected boundary-refinement pass and accepts a move only
   when compression cost improves by at least five percent;
6. preserves a previous cover during its lease, or until a replacement improves
   the weighted objective by at least ten percent, unless a forced split or
   budget change applies;
7. validates complete unique coverage, connectedness, cell identity, mode, and
   epoch before the cover can enter a wave.

Compression cost is merge loss multiplied by the number of collapsed
trajectories. This prevents the objective from favoring one overloaded arena
merely because a singleton has zero local loss.

The normalized merge loss is:

```text
0.25 facet divergence
+ 0.20 hidden causal-boundary mass
+ 0.15 information-scope divergence
+ 0.15 spatial divergence
+ 0.10 clock/obligation divergence
+ 0.10 salience burial
+ 0.05 partition churn
```

Facet divergence is demand-weighted Jaccard distance. Spatial divergence uses
known locations, direct travel time, and the current strategic horizon.
Candidate scoring uses a deterministic mergeable representative sample for
bounded local work; exact authority, hostile relation, coverage, connectivity,
pins, and knowledge validation remain unsampled.

Union-by-size owns constituent-set merges. This is not merely an optimization:
it keeps the 1,000-subject path from degenerating into quadratic copying while
leaving stable merge ordering unchanged. The release property test completes
the 1,000-subject, budget-8 partition in approximately 50 ms on the development
host, under the 100 ms contract. Setting `GHOSTLIGHT_PARTITION_TRACE` enables a
development-only phase timing probe.

## Cell modes

- **Cohesive:** all constituents share one actual collective authority, contain
  no active hostile edge, and remain within information and behavioral
  divergence thresholds. The cell may speak and act plurally.
- **Arena:** constituents remain distinct or opposed. The cell receives an
  attributed polyphonic situation and may simulate interaction, but it has no
  actor ID and cannot speak, know, decide, or act as a collective.

Cross-faction aggregation is therefore an arena. Arena interpreters may emit at
most `min(4, 1 + ceil(log2(constituent_count)))` actions, each attributed to an
exact constituent. The kernel validates that subject's knowledge, information
channel, resources, authority, relationships, location, and reachable
destinations. Secrets are never unioned.

## Strategic outcome authority

A valid attributed attempt is not yet a world consequence. The Interpreter
owns the narrow claim that a constituent chose an admissible attempt; it does
not decide whether the attempt worked, what opposition did, or which durable
state changed. Treating the attempt event as a sufficient result made the
world busy in prose while its resources, relationships, knowledge, and
pressures mostly stood still.

One wave-level strategic outcome resolver owns that missing decision. It runs
after priority and incompatibility selection but before the command enters the
kernel:

1. Ghostlight content-addresses every selected `gestalt_activity`,
   `actor_activity`, and `member_activity` proposal. The digest binds exact
   source, intent, intended effect, targets, locations, state references,
   channels, and typed activity.
2. A local context compiler supplies only those selected attempts and their
   legal consequence handles: source capabilities and holdings, exact target
   state, active incident relations, current pressures, eligible named-member
   deltas, and source-discoverable canonical facts.
3. One cheap structured model call resolves the batch. It returns exactly one
   success, mixed, or failure result for every digest and chooses one bounded
   typed effect, including an explicit `no_material_change` when the attempt
   cannot honestly alter canonical state.
4. Local validation recomputes every permission from the unchanged campaign
   snapshot. It rejects invented owners, resources, relations, facts, pressure
   resolutions, player mutation, missing outcomes, duplicate outcomes, and
   conflicting effect targets. One same-snapshot correction is permitted.
5. `WorldKernel` requires the outcome-stage receipt bound to the complete
   ordered digest set, then applies the plan and all outcomes to one private
   campaign copy. A late invalid effect aborts the wave; no clock, activity,
   outcome, detail debt, or world state reaches the committed campaign.

The public `strategic_activity_outcome.v1` contract is a typed sum. Its MVP
effects are deliberately small:

- create, spend, or give away a resource owned by the acting population or
  named member;
- add or resolve pressure on the acting population or an exact targeted
  population;
- shift one exact active agency relation incident to the source and a supplied
  target by a bounded amount;
- add one memory, obligation, or relationship description to an exact named
  member who owns that perspective;
- learn one exact canonical fact that was discoverable at the attempt location
  or already known by an exact communication target;
- or record an explicit reason why no durable material change occurred.

The provider boundary uses a flat JSON proposal rather than asking the model to
emit the public tagged sum directly. The private flat shape avoids fragile
`oneOf` generation; a local interpreter is the only component allowed to turn
it into the typed public effect. JSON remains a model-provider boundary. The
accepted outcome, its binding, and its receipt are persisted through the
campaign's CultCache path.

Outcome resolution does not grant an arena collective authority. Every result
remains bound to the exact constituent proposal digest. A rival can suffer a
pressure or relation consequence, but cannot be made to speak, spend a
resource, reveal knowledge, or acquire a private relationship as though the
arena had chosen for it. Effects on the player are forbidden; accessible news
may later reveal a committed consequence, but the absent player is never
puppeted or directly harmed.

The resolver is batched once per strategic wave rather than once per cell or
attempt. This keeps the stable rules and schema in one cacheable prompt prefix,
lets it compare simultaneous opposition, and spends completion tokens only on
the handful of attempts that survived selection. Provider concurrency still
controls the preceding Persona-cell wave and does not alter outcome authority.

## Fairness and quiet-world agency

Every active profile carries persistent non-fictional `detail_debt`. Aggregate
representation increases debt; singleton or explicit detail focus clears it.
Each strategic wave reserves focus for the highest-debt subject. At budget 1,
the root arena retains the global situation while explicitly appraising that
subject. Deterministic clocks and obligations advance regardless of focus, and
every cell must emit explicit action or inaction.

With N subjects, deterministic debt rotation gives every subject direct
resolution attention within at most N strategic waves, absent a mandatory
foreground override.

## Persona-cell wave

Each selected cell runs one Ghostlight-owned
Projector → Persona → Interpreter membrane:

- cohesive Projectors expose genuinely shared lived state plus attributed
  exceptions;
- arena Projectors expose attributed constituent slices and no synthetic actor;
- Personas receive only the private lived narrative stream;
- Interpreters emit a typed appraisal and exact constituent effects;
- malformed or semantically invalid output gets one same-snapshot correction.

An appraisal has two attributed lanes: `actions[]` for proposed transitions and
`inactions[]` for exact subjects that deliberately hold, wait, or continue an
already committed course. The old cell-wide inaction string is gone. This
matters in a mixed arena: one institution can act while two rivals hold without
the Interpreter manufacturing repeated posture transitions merely to preserve
their separately voiced decisions. Inaction IDs use the same constituent or
selected-member permission set, carry a bounded reason, cannot duplicate, and
cannot also appear in the action lane. They are audit/fairness evidence and
never mutate the world. A cell with no actions must still contain at least one
attributed inaction.

An arena may contain simultaneous views from distant locations. The Projector
names each subject's actual location and keeps those views as separate scenes;
a graph relation or activity target grants permission to attempt contact, not
fictional co-presence. The Persona preserves those spatial boundaries unless
the lived stream explicitly establishes an exact shared location or
communication channel. Compression therefore cannot turn a regional arena
into one impossible meeting room.

Perspective attribution is runtime-owned. The learned Projector emits bounded
`subject_id → narrative` segments, where the subject ID must be one exact
constituent or selected member exception from the permitted slice. Ghostlight
then lowers those private structured segments into one natural lived stream,
adding exact names and locations plus a deterministic scene-boundary block. The
Persona receives only that lowered prose. It never sees IDs or schemas.

- **Owner:** the permitted cell slice owns which subjects may have an internal
  perspective; the Projector owns only the lived language inside one bound
  segment.
- **Inputs:** exact cell constituents, selected member exceptions, perceived
  events, locations, private state slices, and the shared snapshot binding.
- **Outputs:** one to the cell action limit unique, non-empty narrative
  segments, lowered in stable order with runtime-owned perspective labels.
- **Derived state:** headings, scene labels, and the combined lived stream are
  disposable projections and own no canonical fact or decision.
- **Forbidden writers:** Projector prose cannot add a perspective owner by
  inventing a heading, voicing a mentioned outsider, or speaking as an arena.
- **Shared paths:** cohesive and arena cells use the same segment binding;
  their mode changes narration guidance, never perspective authority.
- **Cut line:** raw freeform cell Projector output is no longer appended
  directly to the Persona stream. Only runtime-bound segments cross the
  membrane.

The deterministic block contains names and locations, not schemas or state
fields. A poetic omission therefore cannot erase geometry, and an invented
Markdown section cannot grant a subject agency before the Persona turn.

Perspective ownership is equally strict. Only the cell's supplied constituents
and selected member exceptions may receive an internal viewpoint or make a
choice. A named person mentioned by a perceived event but owned by another cell
remains an external observation. Personas may seek an unknown role or office,
but cannot conjure it into available contact; target-requiring effects need one
of the exact supplied subject IDs.

Physical provider concurrency batches these pipelines behind a separate
operator limit, default 8. Changing that limit increments only
`provider_configuration_epoch`; it preserves the selected cover, resolution
epoch, world revision, clocks, and fictional time.

All cell results must bind the same campaign revision and resolution epoch.
The kernel requires a Projector, Persona, and Interpreter receipt for every
cell, validates every proposal, resolves incompatibilities deterministically,
caps committed consequences at `min(16, 2 × effective_budget)`, and commits the
entire wave once. One missing appraisal, stale receipt, malformed stage,
invalid cover, or invalid effect aborts the wave without partial mutation.

Interpreter `intent` and `intended_effect` prose is proposal rationale only. It
never becomes canonical event narration. The kernel derives each committed
event summary from the exact admitted posture, pressure markers, route, or
membership transition after applying it. Strategic plans therefore carry no
model-authored summary field that can assert a consequence outside the typed
effect.

Recent events are projected per constituent. A cell receives an event only for
subjects that participated in it, occupy one of its locations, or possess one
of its public channels; arena streams retain those viewer attributions. There
is no global recent-event recap that can quietly teach every population the
same fact.

Interpreter prompts use a compact stable output contract plus an exact
per-subject permission table. The table names the only allowed effect kind,
state references, public channels, and destinations for each constituent or
member exception. Local validation repeats every slice-expressible constraint
before accepting the terminal appraisal, so a malformed pressure marker or
wrong subject/effect pairing receives the same-snapshot correction while the
kernel still performs the authoritative canonical check. Named-member
knowledge is never treated as an information channel; while dematerialized,
the member can publish only through channels owned by their current leaf
gestalt's agency profile.

`subject_state_references` is the single derivation path for canonical
constituent references used by both prompt slicing and wave admission. For a
Gestalt it includes reachable destinations produced by active migration
relations, along with the destination population and location references. The
scheduler does not append a second opinion after the fact, so a reference
shown to the Interpreter cannot become invalid merely by reaching the wave
resolver.

`subject_id` is the sole model-facing owner attribution. Nested effect owner
IDs are absent from the model contract: Ghostlight derives `institution_id`,
`gestalt_id`, `actor_id`, or the raw member ID during binding. The canonical
`CellActionProposal` still carries those IDs for downstream validation and
receipts, but a model cannot make two copies disagree. This also removes
repeated tokens and one class of correction calls from every actionful cell.

Institution rows distinguish `current_posture` from unresolved `pressures`.
The committed posture is projected as already true and is the exact baseline
against which a new institutional commitment is validated. It is never hidden
in a generic pressure list, where a Projector could mistake a completed choice
for a dilemma still awaiting action.
Institution posture proposals are bounded to 240 characters in both the stable
Interpreter contract and local JSON Schema, matching the canonical validator.
The model sees the limit before generation instead of spending a semantic retry
on an otherwise valid but overlong commitment.

A committed strategic effect must produce an exact canonical consequence.
Institutions cannot re-adopt their current posture. Population pressure effects
carry an explicit lifecycle: `pressure_resolutions` must name exact current
pressure markers, and `pressure_additions` must introduce genuinely new
unresolved constraints, threats, obligations, or conditions. Completed action
prose is not a pressure.

Populations may instead propose a bounded `gestalt_activity`: prepare,
coordinate, investigate, recruit, obstruct, trade, or communicate. Its source
is an exact active gestalt leaf; its targets must be adjacent canonical agency
subjects through an explicit active relation or exact shared location. A
dormant named person is addressable as `member:<id>` without becoming gestalt
state. Its locations and channels must belong to the source's permitted slice.
The effect commits only an attributed attempted-activity event. It does
not claim successful discovery, recruitment, persuasion, delivery, exchange,
obstruction, preparation, or target response. Event records carry exact
gestalt participant IDs so later demand and perception can attribute the
attempt without treating an arena as an actor. A later resolved outcome needs
its own admitted effect.

Two local attempts may omit a canonical target while retaining the source's
exact current location. Targetless `investigate` seeks facts from the
environment or an unnamed ordinary role. Targetless `communicate` records the
source speaking, offering, requesting permission, or notifying such a role.
Neither form creates a listener, reply, acceptance, discovery, or target
agency. All other target-bearing activity uses exact canonical subject IDs.
Activities may include incidental motion around unnamed local features while
remaining inside the source's canonical location. This does not create
topology or establish arrival. Only a clear commitment to a different supplied
canonical location or population destination requires a movement effect.

The shared validators run in the Interpreter membrane, wave resolver, and
kernel. One gestalt can contribute at most one selected pressure transition or
activity per tick; deterministic priority resolution cannot let two effect
forms bypass that limit.

Named member exceptions use the same activity vocabulary through
`member_activity`. The event is attributed to `member:<id>` and the current
leaf; the member's delta, the source Gestalt, and any target remain unchanged.
An arena cannot translate the person's attempt into a collective action, and
the destination population cannot claim the person's voice. `member_activity`
and `member_migration` resolve under one exact member key, so only the
higher-priority compatible choice can commit in a wave.

Canonical non-player actors use `actor_activity` for preparation,
coordination, investigation, recruitment, obstruction, trade, and
communication. The action is bound to the actor's exact current location,
state references, information channels, and graph-adjacent or co-located
targets. `actor_move` and `actor_activity` share one actor action key, so a
cell cannot make the same person travel and act again in the same wave.
Human-controlled actors are inadmissible in both paths. An arena may carry the
actor's attributed proposal but cannot translate it into population speech,
member activity, or collective authority.

The Interpreter maps natural attempts narrowly: speech, offers, requests, and
notices are communication; coordination requires an actual attempt to arrange
joint work; preparation is the source's own concrete work; investigation seeks
information; recruitment invites participation; trade offers exchange; and
obstruction attempts interference. `intended_effect` repeats the attempted act,
not the hoped-for outcome. This keeps the semantic verifier focused on agency
and consequence rather than guessing what a broad activity label meant.

Semantic correction feedback names the exact failed boundary and current
value. A repeated institution posture receives its present posture; an invalid
population transition receives its exact current pressure set and the failed
transition reason. The correction model is not expected to reconstruct a
validator from a generic rejection.

The WorldKernel resolves every strategic batch against one immutable campaign
snapshot. It applies validated transitions to a private working copy and swaps
that copy into the campaign only after the whole batch succeeds. Earlier
actions in the batch therefore cannot rewrite the spatial, relationship, or
knowledge permissions used by later actions. This matters when, for example, a
camp population signals refugees during the same strategic horizon in which
those refugees depart: both choices are judged from the shared starting world,
while the committed result still contains the migration. A late invalid action
discards the working copy and leaves the campaign untouched.

An actionful cell has a fourth private stage after the Interpreter: the
`cell_effect_verifier`. This cheap structured reader compares the natural
Persona decision with each attributed typed effect. It rejects reversals,
subject swaps, omissions, wishful outcomes, or lossy mappings—for example,
mapping “Mira gives her berth to somebody else” into a migration of Mira
herself. The rejected appraisal and concise rationale return to one
same-snapshot Interpreter correction. Inaction cells skip the call. The kernel
requires a valid verifier receipt for every actionful cell; an invalid or
missing verifier cannot satisfy the wave receipt gate. The verifier receipt's
snapshot binding includes a MessagePack content hash of the ordered action
bundle. The kernel recomputes it, so a verdict for another proposal at the same
world revision and cell cannot be replayed as authority.

Verification is per action, not a batch opinion. The model returns exactly one
ordered `action_index` and discriminated result for every candidate: `match`,
or `mismatch` with one enumerated mismatch class.
Ghostlight constrains the verdict count and index range in the stage schema,
rejects omissions, duplicates, reordering, and incoherent discriminators, and derives
the rejected set locally. This keeps one bad arena action from contaminating
independent constituents and prevents a global pass/fail field from
contradicting its own rejected-index list.

## Public state and controls

The schema catalog and CultCache stores publish:

- `agency_profile.v1`, `agency_relation.v1`, `gestalt_lineage.v1`;
- `resolution_policy.v1`, `resolution_pin.v1`, `resolution_demand.v1`;
- `simulation_cell.v1`, `resolution_cover.v1`,
  `resolution_plan_receipt.v1`, and `resolution_control_receipt.v1`;
- `cell_appraisal.v1`, `cell_action_proposal.v1`, and the internal atomic
  `resolution_wave_commit.v1` bundle;
- `strategic_activity_outcome.v1`, persisted individually for inspection and
  also bound inside the atomic resolution wave;
- `gestalt_migration.v1` and `member_migration.v1` as distinct collective and
  individual movement contracts inside strategic plans;
- `gestalt_fission_preview.v1` and approval-gated `FissionGestalt`.

The authenticated campaign laboratory exposes budget, effective overage, pins,
fission preview/approval, and a separate operator provider-parallelism control.
The Eve operator projection carries the agency graph, active cover, cell modes,
loss components, debt focus, pins, plan receipts, cell appraisals, and control
receipts. Browser and Eve surfaces use a composite interface version so
resolution-only and provider-only changes refresh without impersonating a world
revision.

## Verification

Property and golden tests cover budgets 1/4/8/32, complete unique connected
coverage, deterministic ties, mandatory overage, contradictory pins, fairness,
arena isolation, fission identity preservation, stale epochs, atomic waves, and
the 1,000-subject target. Pressure goldens preserve geography under blockade,
ideology under schism, workplace/economic role under strike, species/body and
transport under epidemic, and information boundaries under espionage.

The live Gestalt-dynamics harness has two modes. Its golden mode traverses
budgets 1 → 4 → 8 → 4 and proves independent population/member migration plus
automatic rematerialization of the same durable person. Its fairness mode keeps
the whole 24-subject setting in one arena for 24 total strategic ticks. It
requires every runtime-selected detail focus within the bound, rejects inactive
lineage parents as simulation subjects, and repeats the identity/callback check
after sustained compression. Both migration endpoints must be active leaves at
lineage depth two or greater.

Both modes distinguish selected attempts from resolved material consequences.
The harness counts direct typed transitions and non-`no_material_change`
activity outcomes separately, rejects a sustained run that never changes the
background world materially, and records every outcome in the private
preflight. A named member's dormant delta may now evolve offscreen, but any
change to memory, obligation, relationship, equipment, or knowledge must be
accounted for by an exact member-bound outcome before the return callback is
accepted.

Fairness acceptance treats a rejected provider wave the same way the daemon's
scheduler does: the failed pulse records its private trace and commits nothing;
a later pulse may try the same still-current revision again. The harness permits
a bounded, operator-selected number of these fresh pulses per desired committed
tick and reports every rejection in the final result. This does not expand the
single stage's one-correction rule or rebase stale output.

The exact-build `d044951` budget-8/provider-8 profile is the first complete live
proof of the attributed-inaction and immutable-batch machinery together. It ran
23 sustained waves over 24 active subjects in 742.435 seconds. Every subject
received direct resolution attention; 22 background subjects acted, while the
two without a committed action were represented by exact attributed inaction.
The wave plans selected 175 strategic effects: 85 population activities, 66
institution postures, 22 named-member activities, one population migration,
and one population-pressure transition. The appraisals also retained 179
attributed inactions, including 31 cells where some constituents acted while
others held. Ninety arena cells ran without an arena acquiring an actor ID or
collective voice. The eight-cell cover used only two partitions and preserved
the same boundaries across 21 of 22 wave transitions; its largest arena held
13 rivals.

The same run preserved Mira Venn's effective capabilities, knowledge,
equipment, conditions, obligations, memories, and relationship after her
durable delta crossed the hierarchy. The presence planner later selected her
from `harbor-neighbors` without the player naming her, and the kernel
materialized the same person beside the player. The player remained unchanged.
The private witness is
`F:\GameCult\GhostlightDungeon\acceptance\gestalt-lease-b8p8-d044951-1`.

The profile also names the next pressure point instead of laundering it into a
victory lap. Observed traffic used 1,988,812 prompt and 233,146 completion
tokens at a 66.64% prompt-cache hit rate. Nineteen rejected pulses consumed
807,304 prompt tokens—40.59% of observed prompt work. Eleven were caught by the
action-bound semantic verifier, three by Interpreter semantic validation, two
by JSON Schema, and three by transport failure. In that build, most population
effects were still attributed attempts recorded in event history rather than
resolved changes to resources, obligations, relationships, knowledge, or
pressures. The current candidate adds the separate strategic outcome resolver
described above without promoting the Interpreter into asserting success. A
revised live result is still required; the `d044951` profile is evidence for
cover, fairness, attribution, and atomic batch behavior, not evidence for
material activity outcomes.

The callback and fairness claims are independently falsifiable. Strict live
mode requires Mira's Persona to choose resettlement and proves the later
callback without forcing that choice. Fairness mode may instead branch from the
exact committed campaign inside that strict golden's result, then spend all 24
new provider-driven ticks on budget-one debt rotation. The baseline path and
SHA-256 are recorded in the result; no migration command or Persona decision is
fabricated during fairness setup.

A deterministic diaspora test drives two durable people from the same
depth-two refugee leaf to two different depth-two destination branches in one
strategic plan. It proves exact effective capabilities, knowledge, goals,
memories, relationships, possessions, conditions, and obligations survive the
rebases; destination populations receive none of that private state. Only the
source and destination population version counters change. Each person can then
materialize from their new local baseline with the same name and private delta.

### Live pressure results

The 24-tick budget-one fairness run `gestalt-dynamics-fairness-a4ea28b-1`
covered all 24 canonical subjects with 24 distinct debt-selected foci. Its
accepted appraisals contained 77 attributed proposals: one population
migration, nine institution posture changes, 15 named-member activities, and 52
Gestalt activities. Consequence capping committed 45 actions from 15 background
subjects. Four
bad scheduler pulses were rejected without revision movement; fresh pulses at
the same current state recovered. Mira retained her exact private and effective
state and was automatically rematerialized at the end. The run took 641.578
seconds. Its committed baseline is bound by SHA-256 in the result.

The 24-faction scale matrix produced:

| Configured cells | Effective cells | Arenas | Committed actions | Seconds | Prompt tokens/action |
| ---: | ---: | ---: | ---: | ---: | ---: |
| 1 | 1 | 1 | 2 | 18.913 | 11,734.5 |
| 4 | 4 | 3 | 8 | 15.619 | 4,682.1 |
| 8 | 8 | 7 | 16 | 26.300 | 3,546.6 |
| 32 | 24 | 0 | 16 | 55.906 | 7,410.5 |

Budget 4 is the latency sweet spot in this fixture. Budget 8 reaches the global
16-consequence cap with the best cognitive efficiency. Resolving every faction
individually doubles prompt cost and wall time relative to budget 8, adds no
committed consequences under the cap, and increases whole-wave tail-failure
risk. Budget 1 remains a valid emergency compression mode, not an efficient
default.

Repeated fairness prompts reached a 47.07% aggregate provider cache-hit ratio;
Projector reached 75.45% and Persona 61.57%. Interpreter remained the dominant
cost at 247,578 prompt tokens and only 34.54% cache hits. Prompt/context work
should therefore target Interpreter permissions and stable-prefix layout before
shrinking the Persona stream.

Resolution control is edge-triggered. `active_cell_budget` owns
`resolution_epoch`; provider parallelism owns only
`provider_configuration_epoch`. An unchanged control value is rejected without
persistence, epoch movement, or cover invalidation. Acceptance harnesses issue
either control only when its value actually differs, so repeated strategic
ticks preserve the previous cover, leases, and churn history. Stress runs may
select cell budget and provider parallelism independently.

A lease preserves a cut, not invalid topology. Before reusing a previous cover,
the partitioner revalidates every multi-subject cell against the current agency
graph. Migration, relation changes, fission, or activation can therefore break
a leased cell and force replanning immediately. Cover validation reports empty,
duplicate, disconnected, content-ID, and false-cohesion failures separately.

Fairness accounting uses the same definition as canonical detail debt: an
explicit aggregate `detail_focus_subject_id` and every singleton cell both
receive direct resolution attention. A named focus is not required for a
subject already receiving its own complete Persona pipeline.

The lease-preserving budget-4 profile committed all 23 requested sustained
waves and recovered from 18 rejected provider pulses without partial mutation.
It then failed its separate callback assertion because the presence planner
returned an empty cast. This isolated a player-experience fault from the agency
invariants: Mira remained the same dormant person in the correct destination,
but continuity was not surfaced. The focused `gestalt-callback-6253f9f-1` run
then passed: after one fresh 24-subject arena wave, the planner promoted
`mira-venn` from `harbor-neighbors` without the player naming her, and the
kernel rematerialized the same private and effective state. The full run took
18.465 seconds. Its strategic membrane used 18,662 prompt and 1,096 completion
tokens; the additional presence decision used 2,504 prompt and 78 completion
tokens.

Institution posture is projected as `already_committed_posture`. It is durable
state already in force, not a new pressure or decision. Projector, Persona, and
Interpreter contracts all treat continuing or restating it as explicit
inaction; only a materially different commitment may emit an institution
posture transition. Local validation remains strict rather than silently
dropping a no-op.

The 31-wave budget-8 / provider-parallelism-4 profile
`gestalt-lease-b8p4-6253f9f-1` passed after 1,211.592 seconds. All 24 subjects
received direct attention. Its sustained appraisals made 199 accepted proposals
from 22 distinct subjects; consequence resolution committed 51 institution
postures, 110 Gestalt activities, one population migration, and 31 named-member
activities, plus the initial arena consequence. Fifteen rejected pulses left
the world unchanged and later recovered. The same Mira callback passed after
the full run.

The profile used 1,468,039 strategic prompt tokens and 165,725 completion
tokens, reached a 60.69% cache-hit ratio, and spent 7,567 prompt tokens per
committed consequence. Interpreter remained the largest stage at 737,148
prompt tokens but reached 67.18% cache hits; Projector reached 70.03%. The
presence decision added 2,606 prompt and 78 completion tokens. Live traces
showed that the remaining repeated-posture failures occurred when several
constituents in one arena held while others acted, motivating the attributed
inaction lane rather than another prompt-only prohibition.

The first attributed-inaction/provider-parallelism-8 comparison committed nine
waves, then exhausted its bounded retries at wave 10. It proved the new lane in
mixed appraisals—across the first nine waves, 72 cells emitted 63 actions and 93
attributed inactions, including 18 action-plus-inaction appraisals—but also
exposed an overprojection failure. The Interpreter invented roster-completion
inactions for subjects absent from the Persona turn, overflowing the
four-perspective limit, and once wrote a reason beyond the 240-character schema
bound. The contract now admits inaction only for a subject that explicitly
holds or waits in the Persona turn, forbids absence-as-inaction, and asks for a
reason of at most 160 characters while retaining the 240-character hard bound.

The strategic outcome resolver closes the attempt/result authority gap.
Institution postures, population migration, clocks, and history remain kernel
state; selected Gestalt activities are digest-bound attempts. One batched
resolver receives only those attempts and deterministic admissible consequence
handles, then returns one typed result per attempt. The Interpreter cannot
declare its own hoped-for outcome.

Local validation owns ordinary bounded preparations, pressure changes, and
discoverable knowledge. Effects with easy-to-hide private authority mistakes—
resource consumption or transfer, agency-relation shifts, and named-member
memory, obligation, or relationship deltas—also pass through an independent
same-snapshot semantic verifier. Its verdict is advisory to the resolver retry,
never a writer. Applying that verifier to every harmless preparation was both
expensive and over-strict, so the risk boundary is deliberately selective.

The current provider-backed golden completed four waves across budgets
`1 -> 4 -> 8 -> 4` in 81.28 seconds in a debug build. It produced ten durable
consequences and seven typed material activity outcomes, with three explicit
no-material-change results, zero rejected pulses, exact member attribution,
the player unchanged, and the same Mira returning with her persistent delta.
It used 126,826 prompt tokens, 14,477 completion tokens, and a 58.34% prompt
cache-hit ratio. This proves the ordinary material-outcome path live. The
selective high-risk verifier was first covered locally, then forced through the
provider boundary below.

That witness now exists at
`F:\GameCult\GhostlightDungeon\acceptance\forced-high-risk-outcome-contract-fixed-20260818`.
Dock Labor Guild explicitly transferred its exact `west winch rerouting plan`
to the colocated Harbor Neighbors. The Flash resolver emitted the exact custody
transition, the independent verifier accepted it against the same snapshot,
and the canonical input remained byte-identical. The first witness also caught
a prompt/schema naming mismatch: prose said `resource_recipient_id` while the
schema requires `other_subject_id`. Naming the input-to-output mapping directly
removed the correction call; the accepted rerun used exactly two first-attempt-
valid provider calls in 2.95 seconds.

The Starfire deployment smoke ran a live provider-backed wave over three
eligible singleton cells, committed three offscreen events and three
channel-accessible news items in 19.55 seconds, and preserved the absent player.
That fixture proves deployed cell isolation and atomic admission. The
20-plus-faction budget matrix, not the singleton smoke, proves aggregation.