Ghostlight/notes/ghostlight-current-system-map.md

Ghostlight Current System Map

Status: pre-rebuild as-built body, frozen 2026-09-01. This document is a teardown source, not the adopted target architecture. The live target and deletion line are in docs/architecture/ghostlight-dungeon-mvp.md. Update sections below only as corresponding cuts land; do not use old verifier, reconciliation, checkpoint, or completion claims to steer new work.

GhostlightDungeon is the pre-rebuild hosted runtime. Its replacement authority map is docs/architecture/ghostlight-dungeon-mvp.md. The implemented Rust daemon, CultCache campaign stores, CultMesh/Eve surfaces, browser lowerer, native Yggdrasil systemd body, Idunn continuity target, and Odin discovery crossing are the live machine; the older validated artifact seams remain regression evidence only.

Landed replacement source owner

crates/ghostlight/ (library crate ghostlight) contains the world kernel; ghostlight-dungeon consumes it across a boundary sealed by admission (ruling Q1-9, L0 108b691..ab95d78). Commits 6bb6869 and 13d5136 make that mailbox/kernel path the crate and executable runtime identity, remove the legacy Session Zero/kernel/scheduler/verifier source body, and place app sessions, world journal, and controller custody behind one CultCache implementation. Production remains on the separately recorded legacy release; source cutover is not deployment evidence.

Replacement authority map

• Owner: ghostlight::WorldKernel, private to the library and reached only through WorldMailbox, directly contains one canonical WorldState and one WorldJournal. Its reducer is the sole semantic transition owner. It admits world creation, Draft title changes and approvals, Draft-to-Active activation, and one ExerciseDecision action path. WorldJournal is the persistence actuator: it may atomically append the reducer's exact candidate state and commit, but it may not invent an effect or repair semantic state.
• Inputs: creation receives one CreateWorld seed and separately sealed AuthenticatedCaller evidence for its owner. Later submission receives one CommandEnvelope, the separately sealed caller, the exact world ID, and the expected revision. Active decisions also carry the complete opportunity and invocation. Open receives a .cc path and expected world ID. The current ontology is deliberately closed to decision subjects, one controller per subject scope, and the Speak affordance. Lifecycle state is exactly Draft or Active.
• Outputs: accepted creation yields issued world, subject, controller, and affordance identities plus a genesis receipt. Accepted submissions yield an applied or idempotent commit receipt; semantic no-ops yield the unchanged snapshot. Snapshots expose lifecycle, subjects, controller modes, grants, committed decision events, digests, and current derived opportunities. The store contains one head-state row and one immutable commit row per command. Each commit carries the caller bound to separate authentication at submission plus the admitted effect as its semantic replay inputs; the commit digest covers both.
• Derived state: required Draft approvers derive from the owner and exact human controller assignments. Subject snapshots derive controller and affordance projections from canonical maps. Subject and affordance identity exists in each map key rather than being duplicated inside the keyed value. Active opportunities derive from the current state only and bind world ID, revision, state digest, subject scope, controller, mode, and the complete sorted affordance set. They are not separately persisted, scheduled, repaired, or cached. Any commit changes the revision and state digest, so an earlier opportunity loses authority.
• Forbidden writers: caller claims inside a command, mailbox tasks, controller implementations, model output, snapshots, derived opportunities, replay, and consumers cannot mutate canonical state. The legacy SessionZeroKernel, public kernel::WorldKernel, CampaignStore callers, assessor/reconciliation chains, schedulers, and reload repair paths are absent from the committed replacement source and have no admission path into its journal.
• Shared paths: after create or open constructs the owner, WorldMailbox consumes it and offers only Submit and Snapshot. Human controllers, Narrative Personas, and operational agents all exercise the same ExerciseDecision reducer with an exact current opportunity; there is no controller-specific mutation API. Draft commands use that same submit primitive. Command ID replay is checked before revision so an exact retry can recover a known durable result, while reuse with different content fails. Runtime identity and human, Narrative Persona, and OperationalAgent execution are wired to that mailbox boundary in the committed source.
• Cut line: source subtraction is complete. Production cutover now belongs to Idunn's typed deployment path: admit the replacement release and exclusive world-v3 state without a dual-write or compatibility bridge, prove restart and negative legacy authority, then remove the old hosted body and state.
• Verification layer: the reducer checks exact authentication, world, revision, lifecycle, approver, controller, opportunity, scope, affordance, and action bindings before proposing an effect. apply_effect rechecks the persisted caller/effect pair against the predecessor state. The journal checks state shape, state and commit digests, contiguous semantic replay, event-command identity, path identity, and compare-and-swap ownership before admitting a state row plus commit row atomically. Eighteen focused tests cover the complete Draft-to-Active/player/autonomous path, denied authority, stale and tampered opportunities, exact restart/replay, durable idempotency, one live store owner, uncertain post-commit acknowledgement, path replacement, mailbox serialization, concurrent stale submissions, caller cancellation, and rejection of a forged replay caller even when its hashes are recomputed.

WorldMailbox owns queue order and request-delivery semantics only. A send that never enters the queue is unavailable; loss of a submitted command's reply is reported as outcome-unknown so the caller can retry the same command ID. Caller cancellation does not cancel an enqueued command, and dropping the last sender drains accepted work before releasing the journal. The mailbox does not own authentication, authorization, opportunities, lifecycle, reduction, replay, or persistence semantics.

Controller mode is a canonical assignment, not mutation authority by itself. A human controller supplies its authenticated principal; Narrative Persona and operational-agent controllers supply their exact sealed controller identity. A controller may choose prose or another typed invocation from what it can see. It does not own its scope, grants, opportunity, revision, effect, event, or commit. Narrative Persona projection and total interpretation, plus pure-agent tool execution, remain controller-side organs to wire onto this boundary; no model call exists inside the world owner.

Inference transport

• Owner: RoutedInferencePort (world/sdk_inference.rs), holding both transports every controller lane shares through one Arc<dyn InferencePort>.
• Inputs: the configured model name on each ControllerModels field and GHOSTLIGHT_SDK_MODEL_PREFIX (default claude) decide which transport a lane's request reaches; there is no separate mode flag.
• Outputs: one InferenceOutput per query from either transport, under the same PreparedInference/receipt-digest shape; nothing downstream can tell which transport produced it.
• Derived state: the two transports are CodexConnectorInferencePort (unchanged, a daemon peer over a keyed socket) and SdkInferencePort, a Node sidecar (sidecar/claude-sdk/) run as a plain child process of the runtime — restarted on fault, holding no query state between queries, no daemon, no listening socket, no CultMesh surface. Every tool result the SDK route hands the model is produced by ToolResultOracle, the lane's own evaluator fold lent to the port for one query; the sidecar computes none.
• Forbidden writers: no credential path is read, copied, or logged by Ghostlight or the sidecar; the sidecar inherits the ambient Claude Code login only. ControllerRunner::open takes its ports by injection; there is no #[cfg(test)] constructor that builds them itself.
• Cut line: stopgap by design. SdkInferencePort's two named liabilities (its receipt attests only to its own child process, and a prior round's conversation reaches the model as prose) are retired only by deleting the port for a Messages-API transport once an API budget exists, not by extending it.

Frozen pre-rebuild flow

Campaign creation now has its own pre-world authority:

Heimdall member messages
  -> SessionZeroKernel durable shared/private conversation
  -> Projector -> persistent DM Persona owns exact speech
  -> Interpreter proposes typed draft changes, never rewritten speech
  -> runtime binds both into one revision-bound DM turn proposal
  -> typed contract, private character drafts, boundaries, decisions
  -> roster lock -> approved_campaign_brief.v1 -> Vault compiler
  -> evidence-gap conversation or digest-bound final review
  -> every player approves shared + own private digest
  -> one staging CultCache batch + atomic directory exposure
  -> campaign_membership.v1 binds each member to one exact actor

WorldKernel receives no draft state. The transcript is never replayed into the compiler. Account and invitation hashes remain persistence-only; shared model turns, browser surfaces, schemas, and CultMesh records cannot see them.

Session Zero extraction is one atomic membrane with separated authorship. For an ordinary turn, Ghostlight binds one exact current player message separately from six prior same-channel turns and four shared continuity turns. The Projector receives that bounded channel-permitted state; the Persona receives the current turn verbatim plus its lived narrative and owns the complete natural DM utterance. The Interpreter receives the same current turn, only the typed state for its channel's authority lane, and no speech field. A private Interpreter does not receive the shared contract merely to be forbidden from editing it. Ghostlight binds the exact Persona output to the Interpreter's typed proposals only after every stage validates against the same component epoch. Interpreter failure therefore commits neither prose nor draft state.

Material negotiation has one typed path. Accept applies the exact proposal stored in the decision. Counter preserves that proposal as an inert, visible audit and replacement basis, records the player's counter in its shared or private durable channel, removes the Accept control, and leaves compilation blocked. The DM may replace it only through a same-epoch ApplyDmTurn containing a fresh material decision; the replacement and retirement of the pending counter commit atomically. Stale, empty, malformed, or failed counter responses leave the counter pending and the retired payload uncommittable. Retry is an inference launch against that persisted counter and exact unchanged snapshot. It owns no state transition; a replacement still commits only through ApplyDmTurn at the original component and channel epochs. For a counter replacement, the target decision ID enters the stage binding. A deterministic Ghostlight Projector turns only the target, retired typed payload, exact counter, and aggregate safety policy into the Persona's exact lived stream; it does not spend a model call asking another agent to paraphrase facts Ghostlight already owns. The Interpreter receives the same bounded typed basis. For an exact typed counter lane it emits only the replacement payload. Fresh decision identity, owner, materiality, evidence, prompt, and counter text are bound locally; permission identity, actor binding, and evidence cannot be rewritten by the model. The full decision-union Interpreter remains for ordinary turns and legacy payloadless migration only. Conversation history, party, contract, and unrelated private state are omitted. Legacy counters created by the payload-erasing build receive one bounded current-state basis. The kernel accepts exactly one same-lane decision with stable permission identity and no direct patch, so unrelated output cannot retire the counter.

An acceptance card is also a typed-state claim. New Interpreter decisions must carry a non-empty contract, character, or extraordinary-permission payload; payloadless questions remain speech. Legacy empty decisions project no Accept control and the kernel rejects forged acceptance without changing revision. This prevents polished DM prose such as “materialize the character” from advancing a revision while leaving the character ledger blank.

The player-facing Eve surface projects the exact typed payload on every acceptance card and the complete actor-entitled private character draft. The DM summary is explanatory, never the accepted state. Other members receive only their own private ledger and the deliberately public party projection.

Vault evidence receipts + typed campaign snapshot
  -> permissioned projection
  -> Persona receives private lived narrative only
  -> Interpreter emits typed deltas and action proposals
  -> deterministic gates + expected revision
  -> one WorldCommand enters the campaign mailbox
  -> atomic CultCache commit + receipt
  -> parallel affected-participant appraisal
  -> CultMesh/Eve projection

Ghostlight owns the generalized projection organ. Epiphany and other consumers own their canonical Persona state and consequence commits.

DELVE/HOLD consumer profile

Delvehold is the first proving consumer for Ghostlight's generic API for one canonical world beyond a consumer-owned boundary. Its target contract supplies an authored ontology and fixed seed rather than invoking Session Zero world generation. That bypass ends at generation: publication and every later transition must still enter WorldKernel through typed validation and atomic CultCache commit.

Delvehold owns players, workshops, dungeons, civic state, contracts, and its quantitative economy. Ghostlight owns external actors, institutions, Gestalts, relationships, knowledge, pressures, and strategic decisions. Consumer configurations may bind institution or Gestalt subjects through ExternalSubjectAuthority. Those subjects project committed revisioned snapshots into Ghostlight, receive no Persona or strategic turn, and remain targets of foreign action. Such actions persist as attributed proposals in the same strategic-wave commit and return for consumer admission, not direct mutation. Compiler and consumer producers share one WorldSeed admission transaction.

Clock consequences cannot use an externally controlled subject as their affected or responsible scope. They may still reach that subject through an exact place or public channel, but only the consumer may decide what happens inside its sovereign state. Temporary materialized-member actor projections are also ineligible clock anchors; consequences bind stable simulated people, institutions, or populations.

The Delvehold adapter remains Delvehold-owned. It lowers committed Greathold projections and realized effects into generic Ghostlight operations, then raises attributed Ghostlight intents, news, projections, and receipts into Delvehold's domain contract. It owns no truth on either side.

The current InstitutionState and strategic resource vocabulary use named resource handles. They do not model quantities, prices, recipes, facilities, capacity, inventories, orders, contracts, or conservation. Those remain consumer-owned unless Ghostlight later admits a deliberate economic component and mutation algebra. The complete contract is docs/architecture/delvehold-forced-ontology-integration.md. The active next implementation organ is the Delvehold-owned adapter at this boundary; newsroom cache probing is not on the critical path.

The current checkout admits one to eight campaign members into one shared scene. campaign_membership.v1 maps each authenticated account to one exact actor; HTTP, Eve, assessment confirmation, and CultMesh publication derive from that binding. Human actors are excluded from Persona and strategic control. Sequential public actions are accepted; PvP and split-party movement are rejected. Time, group travel, and pooled cell-budget changes require unanimous revision-bound approval. Post-launch Contract Review reuses the Session Zero kernel against an exact world revision and commits approved amendments in one campaign batch without rewriting location, topology, knowledge, memory, or history. The authority map is docs/architecture/ghostlight-dungeon-session-zero.md; later multiplayer work remains in docs/architecture/ghostlight-dungeon-multiplayer-intention.md.

Solo Wait has two exact meanings. A wait shorter than the campaign horizon is a simple fictional-time command. A wait equal to one horizon enters the same AdvanceStrategicTick compiler, Persona-cell, outcome, and atomic commit path as away-time simulation, with a one-horizon maximum per player command. The bounded co-op time proposal still advances raw time after unanimous approval; routing governed co-op horizons through strategic simulation remains an open implementation gate. Group travel updates controlled actor locations and their canonical agency-profile locations in the same commit, so reload never becomes a repair owner for partition inputs.

Build provenance has one owner: crates/ghostlight-dungeon/build.rs binds the exact source commit into the binary. Its inputs are either the release tool's explicit clean-tree commit or Git HEAD; it watches the actual symbolic ref, HEAD reflog, and packed refs so an ordinary commit invalidates Cargo's cached value. Health derives its commit from that embedded value. Release manifests, launch scripts, and CultCache deployment receipts are verifiers and records, not alternate writers. Local runs and immutable releases use this same binding, and the regression test compares it to the checkout's live git rev-parse HEAD. A mismatch blocks activation rather than being repaired after launch.

Away-time agency follows a separate proposal/commit seam:

exact campaign revision
  -> flash-model six-axis resolution demand
  -> connected agency graph + budget/pins/leases/detail debt
  -> cohesive or arena simulation-cell cover
  -> scheduler-owned Nemesis agent binds exact committed event, pressure, or clock anchors to eligible decision owners inside that cover
  -> deterministic agenda admission checks anchor visibility, simulation authority, player exclusion, and per-cell decision quota
  -> one private Projector/Persona/Interpreter membrane per cell
  -> Projector receives exact decision-owner dossiers plus a bounded relevant-target viewport, never every inactive constituent dossier
  -> deterministic projection adds bounded relevant targets and exact canonical names mentioned by the lived stream or Persona turn
  -> Interpreter agent submits or incrementally edits one private exact-decision draft without performing target lookup
  -> deterministic draft compiler checks exact ownership, permissions, topology, and bounds
  -> independent per-action effect verifier checks the typed action against the Persona choice
  -> accepted unchanged actions retain their exact verifier binding across local draft repair
  -> runtime selects compatible attempts and content-addresses each activity
  -> parallel per-activity fast outcome candidates choose bounded typed consequences
  -> one local binder plus selective semantic verifier admit or reject each frozen candidate
  -> at most one balanced reconciliation replaces only a rejected outcome bundle
  -> direct and reconciled candidates publish the same terminal outcome-resolver authority
  -> runtime binds complete cell membership + world/resolution revisions
  -> WorldKernel validates cover, stage/outcome receipts, knowledge, scope, custody, topology, and bounds
  -> AdvanceStrategicTick through the campaign mailbox
  -> one atomic campaign/event/news/cover/appraisal commit

Causal follow-through (Nemesis)

• Owner: the strategic scheduler owns which already-committed consequence deserves another decision window. The bounded model agent serving that decision is Nemesis. Resolution owns the complete 240-cell cover and its decision quotas; Nemesis does not own cover construction or what any subject decides.
• Inputs: one frozen campaign revision, its committed public events and active pressures and clock progress, the durable Nemesis attention history, the deterministic resolution cover, exact perception routes, simulation eligibility, Gestalt-member materialization state, player-control boundary, and each cell's action quota. The initial model frame contains only a cover summary, bounded summaries of the 24 most recent eligible public-event anchors, and the first page of 24 current pressure/clock summaries. Agent commands page current anchors 24 at a time, older world or exact-subject history through the existing 24-item views, and eligible responder dossiers for one already-inspected anchor 12 at a time.
• Output: one bounded follow-through agenda binding exact event, pressure, or clock anchors to exact eligible decision owners already represented by the cover, plus the model receipt rebound to the exact campaign snapshot and admitted agenda. The agenda is scheduler state checkpointed with that cover, not canonical world state. An empty agenda is a valid Nemesis judgment.
• Derived state: an assigned owner receives the exact anchor in its permitted cell slice, takes precedence over ordinary rotation for that wave, and supplies that anchor's exact current committed account to the action's private outcome context. The anchor is context, not new mutation authority. CausalAnchorCandidate is private deterministic tool state containing anchor metadata and the exact set of eligible responder IDs. It derives a summary with only the responder count for broad views; it never clones a responder dossier per anchor. Full responder eligibility and dossiers remain one private tool catalog and are projected only for the selected inspected anchor page. Responder-cell routing preserves identity ownership: a materialized member:* subject remains an actor and binds only to its actor cell; a dormant member keeps its exact member identity but routes through its aggregate Gestalt's cell as a selected member exception. Unassigned recent events remain an ambient perception projection.
• Forbidden writers: the follow-through agent cannot emit events, mutate pressures, choose an action or outcome, move a subject, rewrite a cell Persona, change member materialization, collapse a materialized actor into its aggregate Gestalt, or touch newspaper copy. The outcome organ remains the sole assessor of selected attempts; WorldKernel remains the sole world and event writer and the sole writer of durable served-window records. Member materialization changes only through the existing kernel presence transition; bounded legacy identity normalization may canonicalize an already materialized actor ID but does not decide presence. Nemesis cannot infer eligibility from counts or summaries, address an uninspected anchor, obtain the global responder-dossier cross product, exceed page or cell quotas, or commit its agenda. Anchor summaries and dossier pages are observations, not writers.
• Shared paths: first execution and checkpoint resume consume the identical accepted agenda and exact receipt binding. WorldKernel independently requires that exact admitted receipt before it commits a nonempty causal agenda, then records each exact anchor/responder pair atomically with the wave. Local cell verification and final wave admission both check that required owners were considered without requiring them to act rather than choose an attributed inaction. Later discovery excludes an already served exact pair; a clock's new progress value creates a new anchor. Responder discovery, agenda quota/focus admission, validation, and per-cell assignment injection all use the same materialization-aware cell resolver. Initial and paged current-anchor discovery use the same candidate catalog and add exact candidates to the inspected set. World/subject history pages use the existing event discovery path. Anchor-responder inspection joins the chosen inspected candidate's exact eligible-ID set against the single responder catalog; the generated action schema exposes exact currently admissible IDs, and submit admission rechecks anchor-specific eligibility, distinct responders, total slots, per-cell quotas, and mandatory detail focus before binding a receipt.
• Cut line: blind tick rotation no longer decides a slot already occupied by an admitted causal assignee, and the global last-twelve-event truncation cannot hide that assignee's exact anchor. No prompt downstream may compensate for a missing scheduler decision window. response_role and a claimed accepted-receipt ID are not part of the admission: the scheduler admits only the exact anchor/responder assignment, and receipt identity comes from the actual model invocation. The cut retains one cover, one deterministic eligibility computation, one action/admission validator, and one kernel commit path. It adds no per-anchor responder-dossier cache, cloned candidate frame, second Nemesis agent, eligibility store, or pagination-owned truth.
• Verification layer: focused tests prove paged retrieval beyond the initial event viewport, 24-item current-anchor paging without losing candidates, 12-item responder inspection for an exact chosen anchor, valid empty judgment, exact-pair replay suppression, player exclusion, exact owner consideration, materialized-member routing to the actor cell versus dormant-member routing to the Gestalt cell, exact anchor citation, outcome context containing only the assigned anchor and its committed account, and kernel rejection of a forged agenda followed by atomic acceptance and served-window recording for the exact receipted agenda. Deterministic validators reject unknown anchors, ineligible or duplicate responders, over-quota agendas, missing exact receipts, and stale anchor accounts. A 2,400-responder frame regression proves the initial prompt remains a bounded cover/anchor summary rather than multiplying every anchor by every responder dossier. A strategic smoke remains the whole-system verification that named competing decisions produce committed material outcomes before editorial quality is assessed.

The model owns no tick mutation. A provider failure or invalid proposal leaves the campaign revision and world time untouched. Background inference checks live-turn pressure before launch and again before commit; return catch-up uses the same command path with player-turn priority for fictional commands.

The effect and outcome verdict schemas make semantic coherence structural. Each candidate action receives its own parallel effect-verifier call. Its schema and local validator both require one index-zero verdict: match with no findings, or mismatch with one through six findings whose mismatch kinds are distinct and whose concrete repair guidance is nonempty, trimmed, and at most 240 characters. The prompt asks for that complete bounded set and the request's 1,200-token ceiling can carry the full schema maximum. Every returned finding enters one subject-scoped Interpreter repair. Repair prose is ephemeral diagnostic input, not world state; no verifier chooses the replacement or gains commit authority, and private cell choices never reach a player error surface. A rejected wave returns one spoiler-free message while its exact diagnostic remains operator-only.

The Interpreter is a bounded model agent over a private workbench. Every model-agent workbench owns the action schema legal at its current state; the provider-neutral loop asks the tool for that schema before every semantic step and places the same schema in both prompt guidance and the structured response boundary. For an empty Interpreter draft, the only command is one complete exact submit. A rejected draft remains private tool state, and the next schema contains only upsert_decision commands for exact missing or rejected owners. There is no inspection, removal, wholesale resubmit, or unrelated repair branch for the model to spend a step on. The action wire remains one strict root object containing one exact typed command. Local validation returns a typed local_validation finding and the semantic verifier returns exact subject-scoped mismatch findings. Neither validator chooses the replacement or gains commit authority. Verifier matches are cached by the exact snapshot-and-action binding, so repairing one action does not repay inference for unchanged accepted actions. An undecided result returns to the Persona owner instead of letting the Interpreter invent a choice.

The strategic scheduler owns partial-wave recovery. Its typed checkpoint binds the exact campaign revision, resolution epoch, deterministic cover and plan, effective campaign contract and aggregate boundaries, planning receipts, successful cell terminal bundles, and exact failed-cell set. A retry validates that complete partition, policy, and causal receipt chain before dispatching only failed cells. The checkpoint is opaque outside the scheduler. The smoke runner may persist whole checkpoint generations but cannot merge or edit cell output; it durably publishes the complete cell checkpoint before wave commit. Within a cell, the engine projects one exact lived moment. If the Persona supplies no explicit decision, the engine retries only Persona and Interpreter against that same projected stream; Projector does not rerun. The second Persona cites the first Persona and Interpreter attempt as causal ancestry. Provider transport gives both connection failures and attempt timeouts one separately bounded retry of the exact same request and snapshot; a later successful receipt preserves the failed attempt's diagnostic. Interpreter draft repair remains workbench-local. Actor and cell membranes share one causal-source derivation primitive for Projector to Persona to Interpreter, while canonical evidence remains a separate namespace.

World clocks own declared consequence text and exact observable scope. New seeds must supply that scope and begin below threshold. A persisted legacy clock without scope enters one balanced-model binding agent over a frozen campaign revision. The agent proposes the smallest causally sufficient stable, simulation-eligible scope; its accepted action is rebound to the exact batch digest. WorldKernel alone admits the proposal. The common mutation application path detects threshold crossing and derives one stable clock-consequence:<clock-id> event, then the shared event publisher derives the exact rows for every admitted public channel. The event IDs enter mutation and strategic-tick receipts. Binding scope, exact model receipt ancestry, emitted event and news IDs, and the next newspaper boundary commit atomically with the campaign in CultCache. Runner proposal and completion checkpoints are recoverable projections; neither owns the event nor the newspaper slice.

The effect verifier receives the same exact typed permission slice used by the Interpreter. That slice is its sole map of canonical locations, reachable actor destinations, population destinations, and target IDs. A pump, desk, queue, or other place named only in lived prose remains local texture inside the supplied canonical activity location; the verifier cannot manufacture topology and then reject a valid local action for omitting travel through it.

A live request also interrupts an in-flight scheduler wave. Live-turn admission increments pressure and signals cancellation before waiting for an already admitted background commit to finish. The admission guard exists before that wait, so cancellation cannot leak false pressure. Dropping the scheduler wave aborts its parallel cell tasks before they can launch later Persona stages, and a shared/exclusive commit gate makes scheduler commit impossible while any live request is active. Return catch-up is intentionally exempt because it is part of the live request and must finish before the requested fictional action. Private assessment and resolution-policy edits neither advance fiction nor invoke catch-up. Session Zero logs the exact draft revision when a DM response is queued and when its live guard is admitted, making provider latency distinct from scheduler contention without exposing channel contents.

Entering or dropping that guard republishes the canonical typed health record immediately. HTTP health reads the same record, so live_turn_pressure is an actual launch brake during an in-flight player command rather than a delayed status reconstruction.

Resolution-demand focal IDs are salience hints, not partition commands. They cannot create mandatory singleton cells or exceed the configured budget. Cell Projectors receive decision-relevant situation state for the scheduler-selected decision owners, the count of other represented subjects, and at most 24 exact activity targets ranked by explicit relationship, mention in current goals or pressure, co-location, and stable ID. Inactive constituents remain represented by the exact cell cover but their full dossiers do not enter the model frame. Cell Interpreters receive exact permissions for active decision owners and the narrative products. Membership and revision bindings are derived by the runtime, so a model is never asked to copy an invariant that the planner already owns. Stable prompt prefixes are deliberately placed before dynamic state, and provider receipts expose per-attempt token/cache usage plus bounded local validation failures.

ModelPort remains Ghostlight's single inference seam. The Codex-backed implementation is an ordinary typed consumer of the independent CodexConnector daemon: it emits an encrypted, expiring MessagePack request over bounded TCP-framed CultNet and accepts only a correlated ordered text stream plus terminal receipt. A stable cache key is derived from stage, logical model class, and output schema rather than mutable campaign content. CodexConnector owns credential custody, caller admission, bounded provider transport, replay, and transport receipts. Ghostlight owns provider-request derivation, stage projection, schemas, retry between passes, semantic validation, model-stage receipts, and every kernel admission. Epiphany is a separate consumer and owns neither side. Yggdrasil runs CodexConnector as the independent codex-connector.service release f9cfa355051ef91d0e7f095b2df2a69fe79f8a7c. Ghostlight has only a soft systemd ordering edge to that daemon and cannot build, configure, restart, select, or roll it back.

Ghostlight exposes three provider-neutral logical classes. ghostlight.fast.v1 owns high-volume cells and retrieval, ghostlight.balanced.v1 owns bounded reconciliation and routine elaboration, and ghostlight.capable.v1 owns frontier invention and editorial judgment. Only the selected ModelPort maps those classes to physical models or assigns their attempt deadlines; compilers and harnesses never pass physical model IDs as logical stage authority.

Vault availability is typed at the provider boundary. When the configured Vault cannot return evidence, SessionZeroKernel returns the exact draft to drafting, records one stable resolved material blocker, and publishes no preview, branch assumption, world digest, or campaign. Operational causes stay in the private daemon journal. A later retry uses the unchanged approved brief through the same compiler path; neither the model nor client can inject a replacement evidence source.

Canonical actor cell slices include that actor's exact goals, obligations, relationships, and bounded memories. Named Gestalt-member exceptions receive the same continuity fields. The Projector narrativizes them for the Persona; the Interpreter still receives only exact effect permissions. A promise does not become a hard-coded behavior rule, but it cannot disappear merely because the actor entered offscreen simulation.

The Interpreter decision schema is derived from every exact decision-owner ID. Institution, actor, Gestalt, and named-member effect variants cannot cross subjects: complete submits bind decisions by owner-key, while incremental edits are rebound and validated under the selected owner by the workbench. Target IDs, canonical locations, pressure resolutions, movement destinations, state references, and public channels are enumerated from that subject's permitted slice. Activity targets are the exception to eager projection, not to exact authority: the initial schema exposes the bounded relevant viewport, and the same Interpreter workbench may query one active decision owner by a supplied name/ID fragment for at most 12 exact matches. A successful query expands only that workbench's dynamic schema. It cannot add a target to canonical permission, change the cell, or bypass the full deterministic validator. Movement and population-migration variants disappear when the subject has no exact destination; target-requiring activities cannot emit an empty target list. Semantic correction therefore judges meaning rather than repairing type combinations local code already knows are impossible.

Each permitted activity target is one runtime-derived descriptor keyed by its authoritative ID, with the target's exact name and current canonical locations. Reachable actor destinations map exact location IDs to names; population migration destinations carry both population and location identity. The Projector and Interpreter bounded views distinguish a canonical target actually named by the Persona from an unnamed local role, and can prove whether “go to Reed” means movement at all. The effect verifier receives only the exact target descriptors cited by its already structurally valid candidate action; the full permission map remains private to deterministic validation. Opaque permitted IDs are not enough reason to substitute a containing population, related institution, or unrelated destination. Descriptor prose and target queries are disambiguation context, not a new subject, permission writer, or fuzzy-match authority.

Targetless local activity is explicit rather than encoded through a convenient unrelated subject. Preparation, investigation, communication, and obstruction may act on an unnamed role, infrastructure, terrain, traffic, or other local texture only at the exact supplied location. The activity records the source's attempt, never a listener, discovery, damage, disruption, or response. A canonical target is required whenever the attempt actually addresses one.

AgencyProfile.information_channels owns concrete routes through which a subject can publish or receive reports. Actor knowledge and Gestalt shared knowledge remain separate state and may justify an action without manufacturing a news route. Profile maintenance removes legacy overlap and unknown placeholders; the compiler rejects both categories before campaign approval.

Arena projection preserves spatial partitions as well as identity partitions. Each remote view carries its actual location; a relation grants potential reach, not co-presence. Persona turns cannot stage direct sight, speech, or response across locations unless the lived stream establishes a shared place or communication channel. Interpreter activity labels then describe the narrow attempted act, while hoped-for success remains outside the effect. Ghostlight deterministically prepends the exact name/location partition to the learned Projector's narrative, so model omission cannot erase those boundaries. Only supplied cell constituents and selected member exceptions may own a perspective. Event mentions do not transfer a person into another cell, and an unnamed or unsupplied entity cannot become an activity target merely because a Persona found it plausible.

Institution slices carry committed current_posture separately from unresolved pressure. Projectors present the posture as existing state; Interpreters and validators compare any new commitment directly against it. The old overloaded pressures[0] convention is not an authority path.

Model-facing actions contain one owner, subject_id. Nested effect owner IDs are runtime-derived during binding and exist only in the canonical downstream proposal. The model cannot disagree with itself about member:mira-venn versus raw mira-venn, and the prompt/output contract spends fewer tokens copying invariants Ghostlight already owns.

Canonical constituent references have one owner: resolution::subject_state_references. Scheduler slices consume that set directly, including active reachable migration destinations, and wave validation recomputes the same set. Prompt construction cannot append references the resolver does not recognize.

Cell perspective attribution is runtime-bound too. The schema admits only exact constituents and selected member exceptions. Ghostlight rejects duplicates and requires both the debt-selected focus and every selected named member exception to receive their own perspective segment; an actionable individual can no longer disappear inside the aggregate before the Persona turn. The perspective count may exceed the action limit only by the number of mandatory owners; action consequences remain separately capped. Segments are sorted and lowered to natural name/location headings before the Persona sees prose only. An invented Markdown section cannot turn a mentioned outsider into a decision-making perspective.

Gestalt background choices use three distinct typed paths. Pressure transitions change exact unresolved markers. gestalt_activity records an attributed preparation, coordination, investigation, recruitment, obstruction, trade, or communication attempt against subjects connected by an explicit agency relation or exact shared location without claiming the outcome. After selection, the outcome organ launches one logical-fast candidate per selected activity under the configured provider parallelism. Each candidate receives only that attempt and its precomputed legal consequence handles. It must return one digest-bound strategic_activity_outcome.v1 per activity; missing, duplicate, stale, player-mutating, or invented effects reject the entire wave. Accepted outcomes may change exact resources, population pressures, incident agency relations, named-member deltas, or discoverable canonical knowledge, or explicitly record that no durable material change occurred. A selected dormant member can be addressed by their durable ID; this does not union them into the source population. The kernel derives the event text and exact participant IDs; the arena and model prose own neither.

The outcome organ does not repair or reinterpret Persona intent. The Interpreter owns the attempt; the terminal outcome resolver owns opposition and result; WorldKernel alone owns mutation. Local binding failures and independent semantic-verifier mismatches are findings from the same admission boundary. Either finding may invoke one logical-balanced reconciliation that can replace only the frozen outcome bundle. Cell appraisals, selected attempts, action digests, campaign snapshot, and admissible handles are immutable inputs. A failed reconciliation closes the wave; it cannot call the logical-fast candidate again or return to Persona appraisal.

Direct and reconciled outcomes publish the same terminal strategic_outcome_resolver stage authority at the exact activity binding. A reconciled receipt remains distinguishable by its logical-balanced model and causal source chain; the rejected logical-fast receipt remains semantic_invalid evidence and cannot satisfy kernel admission. The terminal verifier cites the admitted candidate receipt, and every material outcome must carry that exact outcome-bound valid verifier receipt through WorldKernel admission. Scheduler sequences the boundary, checks cancellation, and aggregates typed terminal failures and completed receipts for persistence; it owns no repair prompt or replacement decision. Every outcome is stored independently in CultCache and projected on the operator Eve surface. All effects apply to the same private campaign copy as the rest of the strategic wave, so a late invalid outcome cannot leave an earlier action, clock, detail debt, or event committed.

Deterministic admissible-effect handles constrain every resolver decision. Actor possessions, member equipment, institution resources, and Gestalt resources use one resource:* reference ontology. When a model cites another action's handle or invents a reference, the local owner returns the exact action digest, offending values, and admissible set to the private same-snapshot correction. The player receives only a spoiler-free refusal if correction also fails.

The resolver's JSON Schema is derived from exact action authority. Each action digest admits only its available effect kinds; unavailable lanes are absent, not represented by empty placeholder choices. The chosen effect kind makes its own owner, recipient, resource, relation, member, fact, pressure, and evidence fields structurally required while forbidding fields owned by another kind. Exact IDs and existing values come from that action's bounded slice. New resource or pressure text remains model-proposed but locally bounded and still requires kernel validation. This keeps deterministic impossibility out of the semantic retry loop without letting the schema decide narrative causality.

Pressure authority is state-relative. The outcome stage receives each exact Gestalt owner together with its current unresolved pressure strings. A resolution must copy one of those strings; an addition must be new and cannot overlap a resolution or repeat current state. The runtime rejects the whole wave on a no-op, duplicate, or invented resolution before commit. These state-transition checks belong to the outcome semantic validator, not the generic JSON-shape retry. A well-shaped repeated pressure reaches the shared balanced reconciliation boundary with the exact rejected bundle; the replacement may propose a genuinely new pressure or no_material_change, while the kernel guard still makes the repeated transition uncommittable.

Named-member private effects are action-relative too. An obligation is available only for social activity—communication, coordination, recruitment, or trade—where the attempt can actually create a promise or debt. Physical preparation, investigation, or obstruction cannot mint an unrelated social obligation merely because the member is present in the outcome slice.

Structured-stage failures name the exact stage, instance JSON pointer, and schema pointer. Receipts retain the bounded private diagnostic; player-facing strategic refusal remains spoiler-free. A model failure can therefore be located without logging chain-of-thought or dumping the private prompt. For the one same-snapshot correction, the validator also projects only the nearest rejected containing object rather than replaying the whole output. This gives the model the exact failed activity or effect beside the schema pointer, preserves the stable cacheable prompt prefix, and avoids paying again for unrelated valid output. Parallel cell failures retain the exact cell ID, constituent IDs, and bounded anyhow cause chain in operator-only logs.

Ordinary bounded preparation, pressure, and knowledge effects stop at local validation. Resource consumption/transfers, agency-relation shifts, and named member private deltas additionally receive an independent same-snapshot semantic verdict because those effects can be structurally valid while charging the wrong inventory or person. The verifier proposes no state and cannot commit. The latest provider-backed four-wave golden produced seven typed material activity outcomes, ten durable consequences, and zero rejected pulses while leaving the player unchanged and returning the same Mira.

The service-owned CultMesh store remains the canonical projection body when Odin rendezvous is temporarily unavailable. RUDP publication is outbound replication, not daemon-liveness authority: a failed publish is logged with its key and target while the complete local snapshot persists and HTTP serves that same typed health and Eve state.

advance_one_strategic_tick owns post-commit mesh publication for scheduler, return catch-up, and explicit player-horizon waits. Callers no longer decide whether a strategic commit deserves a projection. A publication error is an operator-visible derived-state failure; it cannot roll back, rewrite, or report the already committed world transition as failed. This closes the former path where return catch-up advanced canonical state, the subsequent player command correctly failed stale, and an early return left the operator surface on the previous revision.

The RUDP session owns reliable-send pressure. It admits at most 32 packets—the cumulative-ACK horizon—queues the rest, promotes queued packets only as ACKs retire admitted packets, and emits an exact ACK when an older retransmit has fallen behind that horizon. Its explicit flush succeeds only after every reliable packet is acknowledged. Large CultMesh documents no longer depend on blasting every fragment and sleeping for a fixed interval. The wire contract is unchanged, and model, campaign, and application authorities remain outside the transport.

Ghostlight stages discovery-critical health and provider advertisement before bulk projections. Its Odin schema catalog contains only the Ghostlight-owned boundary state types advertised to consumers: ghostlight.campaign.v1 and ghostlight.session_zero.v1. Internal compiler, Persona, transition, Gestalt, receipt, and operator documents remain available through their owning private projection; they are not dumped into rendezvous merely because Ghostlight has Rust types for them.

Odin registers only the ghostlight.schema_catalog.v1 public envelope, not those private contracts. Its provider-document adapter returns and awaits the single durable node.put promise, preserving per-peer write order instead of launching concurrent CultCache mutations behind transport acknowledgement. The live typed snapshot returns Ghostlight source 7522ea8405212b344441f83f502993f525276521 and exactly the two boundary schema keys above.

Opening retrieval deliberately covers early, transitional, and late historical frames. These pure retrieval/compiler functions now serve the Session Zero DM; they are not browser-owned creation routes or transient preview maps. Generated suggestions enter the typed draft for discussion and use the same final brief as custom premises. Both rejected and accepted receipts remain private. Invite rotation is owned by the deployment boundary: it replaces the protected token set and clears the persisted auth authority together while the daemon is stopped. Campaign stores survive; old sessions deliberately do not.

Away time does not require invented agency. When a campaign has no active, simulation-eligible agency profiles, the scheduler enters the same AdvanceStrategicTick kernel command with no model plan or resolution wave. World time, clocks, pending-tick accounting, and deterministic obligations advance atomically while the player remains untouched. The scheduler does not call the partitioner merely to discover an empty graph, and it retains the same live-turn commit exclusion as model-backed waves.

Compiler approval is a player decision surface, not an operator spoiler surface. It exposes topology, public cast, institutions, populations, clocks, player-role capabilities, evidence coverage, gaps, and branch assumptions. It does not project branch-local or provisional fact statements—even when they are discoverable later. Those facts remain canonical inputs to knowledge-gated play and operator inspection; the browser cannot reveal them before discovery.

Legacy acceptance body (pre-rebuild; Yggdrasil still serves it)

Yggdrasil serves one native immutable Ghostlight release under ghostlight-dungeon.service. The fresh-workspace handoff and state/map.yaml carry the exact current source, Eve source, executable hash, provider, store counts, and replay witness. This map describes the acceptance body without duplicating a volatile release identity in several sections.

The hosted adversarial campaign now pressures the complete eight-cell strategic path against real provider output. Every failed Projector, Persona, Interpreter, effect-verifier, outcome, or kernel boundary has left campaign revision and fictional time unchanged. Human separate-account co-op privacy and unanimity remain unproven; the expected D&D cohort dispersed before this pass, so no fixture or solo browser run may be presented as that acceptance.

Campaign e99e8794-281f-4a82-8b2c-5e6954bd6b16 is the current live Kalsa witness. At revision 21 and resolution epoch 3 it runs with a configured one-cell budget. Startup migration repaired Cal Rusk's malformed doubled legacy identity to exact canonical member:cal_rusk without advancing fictional time or revision. Cal retained his learned bypass and warning-mark knowledge across materialisation, folding during travel to Veyr Run, and rematerialisation when Asha returned to Raincross gate. A budget-1 strategic wait advanced Ilya's investigation and Oren's movement without puppeting Asha.

The earlier campaign 34929b8d-7b04-49af-9936-1c798fd79760 remains the eight-cell strategic receipt witness. Its revision-12-to-13 catch-up preserved five exact actor/institution cells, two Gestalt cells, and one arena containing three distinct remote institutions. The arena acquired no actor ID. Zhestokost's repeated posture became attributed inaction; two named members made their own decisions; Reed kept the twelve-patient commitment; and the player plus Reed remained byte-identical. Five selected actions produced five bounded outcomes. Fourteen channel-aware reports remained absent because the player had no route to them.

That tick used 34 stage receipts and 35 provider attempts: 83,838 prompt tokens, 64,000 cache-hit tokens, 6,192 completion tokens, and 90,030 total tokens. The extra Interpreter receipt records the rejected repeated institution posture. The outcome path records an undersized bundle retry and a rejected repeated pressure before the corrected complete bundle. All diagnostics remained private; the campaign committed once.

The public /ghostlight/ path terminates on Yggdrasil nginx and proxies the native loopback listener at 127.0.0.1:8831. Anonymous access returns the actor-free ghostlight.play Eve gate with 200; actor and campaign state stay unavailable without an app session and canonical membership. The previous Starfire writer is stopped; its process and tunnel are no longer live authority. The migration copied campaign and Session Zero stores while preserving Yggdrasil's native mesh and provider-health identities.

The pre-rebuild hosted body published local CultMesh and HTTP readiness without waiting for Odin; that legacy health admission is teardown evidence, not the new runtime contract. Under the landed contracts, an activation becomes current only after Idunn's workload driver observes the exact native process and artifact. Present requires that activation plus service-signed presence health; Odin alone correlates Ready. CultNet through CultLib 85f7024 carries the generation-bound activation, lifecycle-brake, write-lease, observed-capability, and disagreement contracts plus routed RUDP incarnation admission. Odin through pushed 65cf2b2 carries exact source actuation, the narrow driver body, and the durable three-record deployment transaction. Remaining Odin work is Idunn projection, bounded RUDP transport, and stable-route integration. VoidBot's canonical MCP service remains separately owned and is not a deployment authority.

Idunn starts and recovers from its own durable admitted state. Odin is the first managed semantic daemon, never an Idunn bootstrap dependency; its initial admission is the sole graph-bootstrap exception and begins from a root-admitted local binding. During an Odin outage, Idunn may preserve already-admitted continuity and routes, but it may not start a graph-changing transaction or promote without the exact frozen Odin Ready receipt for that runtime instance and presence digest. Idunn never manufactures Ready locally.

Deployment, discovery, and adjacent capacity

Idunn is the only deployment and daemon-survival authority; Odin is the discovery/rendezvous authority. Their health or availability never grants either organ a campaign write path. Current release identity for Idunn, Odin, Heimdall, Bifrost, and Epiphany is operational truth in gamecult-ops; do not copy it here and let it fossilize again.

The landed deterministic foundation retains the exact selected commit, source tree, recipe blob, and Gitlink facts. Shape validation is not proof of Git ancestry, signatures, or object custody. Those proofs belong to the narrow Idunn-owned source driver, which must read the canonical ref and exact objects as the Idunn identity before compiling a consequential plan. Odin through pushed 65cf2b2 lands that source driver and the crash-resumable transaction owner that replaced the command-owner loop.

Heimdall publishes four redacted typed discovery records to Odin under globally unique catalog keys: the provider, private command boundary, Eve access plugin, and transport profile. Ghostlight resolves heimdall:command-boundary from Odin only for begin, complete, refresh, and logout; valid local app sessions do not depend on an Odin round trip. No direct Heimdall endpoint remains in the Ghostlight unit.

Epiphany is adjacent capacity, not part of Ghostlight's campaign authority and not required by the current provider-backed runtime. Rehydrate her live state from her own workspace and gamecult-ops. Her deployment remains one Idunn-owned transaction; passive watcher tasks and cross-task exclusivity messages are not an operational control plane.

The deployed Session Zero canary survived two exact-build restarts with its private store intact. Heimdall completed a real KLTST Discord round trip and adopted one HttpOnly Ghostlight session. Aetheria retrieval produced three grounded opening decisions. Live DM inference initially exposed that JSON mode had not been given the Interpreter's application schema; the repaired release places exact stable schemas before dynamic context, emits only new deltas, and produced a coherent Mars/Zhestokost follow-up without borrowing First Exodus state. A forced malformed-output path displayed a local retry notice while the typed contract remained unchanged.

Authenticated acceptance against the exact release has proved generated opening/role/approval compilation, a nonliteral canonical player actor ID, private assessment, confirmed server roll, wait, daemon restart continuity, fork isolation, original re-selection, reset, and a MessagePack-backed .cc export. The multiresolution matrix covered 24 factions exactly once at budgets 1, 4, 8, and 32. The strict nested refugee golden placed all 24 subjects in one rival arena, preserved Mira Venn as a named decision owner, migrated her into a different depth-two population lineage, produced material activity across six other background subjects, preserved her delta and the player, and later promoted the same Mira for a return encounter. Witnesses live under F:\GameCult\GhostlightDungeon\acceptance\player-journey-a92fb7a-20260818, gestalt-scale-a92fb7a-b{1,4,8,32}, and gestalt-dynamics-7916ab0-strict.

Cell budget and physical provider parallelism are independent controls. The scale executable accepts GHOSTLIGHT_SCALE_PROVIDER_PARALLELISM, defaults it to the runtime default of eight, and records it in every witness. The corrected 24-subject budget-8 / parallelism-8 wave completed in 18.35 seconds, covered all subjects exactly once, committed ten material actions plus one attributed inaction, did not move the player, and required no model retry. Its witness is F:\GameCult\GhostlightDungeon\acceptance\gestalt-scale-shakedown-b8-p8. The earlier 25.64-second budget-8 witness used four provider slots and must not be cited as an eight-concurrency performance result.

gestalt_migration records a collective decision by one exact active leaf to move along an explicit migration relation and reachable route. WorldKernel changes the leaf's home location and agency-profile location together. The destination population remains a separate canonical subject, and named member deltas are not carried by implication. Approval-gated fission creates destination/stayer cohorts; the same migration primitive moves any resulting leaf regardless of lineage depth. A local investigate activity may omit a target when it examines the exact current environment. A local communicate may likewise omit a target when its exact source speaks, offers, requests permission, or notifies an unnamed ordinary role. Both admit ordinary texture without inventing a listener, response, acceptance, discovered fact, or target agency.

Activity effects operate at canonical-location granularity. Incidental motion around unnamed local features remains part of the source-attributed attempt and does not create topology or assert arrival. A different supplied canonical location or population destination still requires the exact movement path.

Canonical non-player actors have an actor_activity path for ordinary preparation, coordination, investigation, recruitment, obstruction, trade, and communication. The Interpreter binds the actor's exact ID locally; WorldKernel validates current location, graph targets, state references, channels, and human-control exclusion. Actor movement and actor activity share one action key, while successful consequences remain a separately resolved, digest-bound outcome.

Salient dormant members have their own member_activity path for ordinary local attempts. It uses the same bounded verbs, the member's exact location, their current leaf plus explicitly related or exactly co-located targets, and their own state/channel permissions. Only the capped salient member exceptions selected for the cell enter any prompt or can be named there. Migration and activity conflict on one member key. A destination population cannot inherit the person's offer, speech, or decision merely because the cover placed them in the same arena.

A named member's explicit commitment to board, depart, travel, or join a supplied destination maps to member_migration, even when the first narrated motion is only entering a queue. member_activity: prepare is valid only while departure remains unchosen. The Interpreter and semantic verifier share this distinction.

The semantic verifier emits one ordered verdict per candidate action. Ghostlight owns exact verdict coverage and derives the aggregate rejected set; the model cannot reject one arena constituent merely because another constituent's mapping failed, omit a candidate, duplicate an index, or publish a global decision that contradicts its per-action rationale. Rejected actions return to the same private Interpreter draft as exact subject-scoped findings; unchanged accepted actions retain their verifier binding.

Population scale uses reversible individuation:

gestalt baseline + existing member delta, or an admitted foreground or system-owned identity proposal
  -> WorldKernel validates gestalt/member/revision/location
  -> atomic durable member delta + temporary ActorState
  -> ordinary Persona appraisal and world commands
  -> expired relevance lease outside player perception
  -> atomic fold into the member delta; active slot removed
  -> gestalt receives strategic ticks without erasing the individual

The temporary actor slot is derived. It never owns identity, relationship, memory, equipment, injury, or obligation state.

Automatic presence planning projects only active leaves at the player's location, dormant members whose exact location matches, and materialized members eligible for folding. The kernel rejects inactive hierarchy nodes and location mismatches. Nested fission and migration therefore change which baseline a durable delta composes with, never who the person is. The projection also names the player actor's reciprocal relationship to each nearby dormant member. The planner owns reversible scene casting and may surface an earned callback without a player prompt; it cannot move a remote person or commit the cast. Failed live casts retain a private presence-preflight artifact.

Automatic presence has two different authorities. Recasting an existing exact member is reversible and may follow any relevant foreground event. Admitting a first-relevance member is canonical entity creation and is available only when the planner reason exactly matches the immediately committed player-speech turn. The generated schema closes the individuation lane for resolved attempts, and WorldKernel independently rejects any such plan. Outcome prose and narration are not entity-admission inputs.

A separate strategic selector may propose one first-relevance identity only for an exact selected Gestalt-owned action in the current resolution wave. Its receipt binds the eligible Gestalt action digest set, exact locally admitted proposal digest, and world revision. resolution::validate_strategic_individuation_proposals is the single owner of exact strategic-individuation semantics: one-person budget, selected-action binding, Gestalt action authority, location, version, lineage, bounded identity payload, relationships, and uniqueness. The scheduler calls that shared owner immediately after proposal production. An invalid optional person marks the selector receipt semantic_invalid, records the exact local finding, and is dropped before wave assembly; the otherwise valid strategic wave may continue. WorldKernel calls the same validator again against the admitted wave snapshot, then invokes the same apply_individuation primitive used by the system-only direct command. Early validation is proposal hygiene, not mutation authority or a substitute for kernel revalidation. The proposal and strategic plan commit atomically; the selector cannot own entity creation, location, revision, materialization, or commit.

Institution already_committed_posture is projected as durable state, distinct from unresolved pressure and fresh choice. Maintaining it is inaction. A model may propose only a materially different posture; repeated posture remains a locally rejected no-op and cannot enter an atomic wave.

Cell appraisals carry exact actions[] and exact inactions[]. Inactions name the constituent or selected dormant member who holds and a bounded reason. They cannot duplicate, cross cell authority, or coexist with an action from the same subject. They are non-mutating audit/fairness evidence. The former global inaction string is no longer an owner or runtime path.

Strategic plan application reads authority and permissions from one immutable command snapshot. All writes land in a private working campaign which replaces the command-local campaign only after every action validates. Sequential loop order is no longer a fictional owner: a migration earlier in the apply loop cannot invalidate another subject's same-snapshot communication, and a late invalid action cannot leave earlier in-memory mutations behind.

The active cell budget, operator-owned pins, and provider concurrency limit are separate controls. Budget and pins increment resolution_epoch without advancing world revision or fictional time. Provider concurrency increments only provider_configuration_epoch; it batches the same cover and cannot repartition the world. See docs/architecture/ghostlight-multiresolution-agency.md.

The public application boundary is one stable Eve provider surface: GET /api/eve/provider, GET /api/eve/surfaces/ghostlight.play, POST /api/eve/commands, and revision-only GET /api/eve/events. Anonymous surface requests return an Eve Heimdall access gate without campaign, membership, actor, account, boundary, or Session Zero state. Authenticated surface requests derive account, selected campaign, membership, and exact actor from Ghostlight-owned app-session and campaign records before projection.

Native and browser clients share that logical surface and command authority. The native path is ghostlight.native.player over loopback RUDP 127.0.0.1:4102; it exposes only Heimdall begin/completion, actor-filtered surface retrieval, and canonical Eve invocation. Heimdall persists the OAuth attempt and single-use completion. Ghostlight redeems the completion into the same app-session record used by HTTP, then derives every actor and campaign binding server-side. The installed native client stores only the opaque Ghostlight bearer in a mode-0600 CultCache file. It never receives a Heimdall access or refresh claim and cannot submit actor, member, account, or authority identifiers. While a model-backed Eve invocation is pending, the client sends a bounded transport keepalive every five seconds; the operation and its result remain owned by the server-side idempotency reservation and kernel path.

Odin advertises the redacted native route and operation names in the provider document. It does not proxy native commands or persist session tokens, attempt handles, claims, account state, membership, or player surfaces. The boundary is loopback-only; remote native use requires a trusted host crossing and still passes Heimdall admission. A malformed or forged native request returns a typed denial before product projection and cannot enter either kernel mailbox.

Command ingress accepts only gamecult.eve.command_invocation.v1. It validates provider, logical surface, command boundary, operation schema, source version, and idempotency before resolving the caller's authority server-side. Browser payloads containing account, member, or actor authority fields are rejected. Every admitted operation then uses the existing SessionZeroKernel or WorldKernel mailbox and returns a persisted Eve command receipt. Strategic ticks, region commits, NPC initiative, and raw kernel commands remain outside the browser capability surface.

The browser is EveBrowserProviderHost, Ghostlight transport, Heimdall access adapter, status mount, and SSE invalidation. Eve owns editable bindings and operation capture: renderer-local drafts survive authoritative refreshes and stale refusals, and only an accepted result may request named draft clearance. HTML forms may appear as an accessibility lowering detail but are absent from Eve documents and command payload semantics. Session Zero, campaign, governance, receipt, and login DOM renderers are not product authorities.

Heimdall owns OAuth attempts, Discord callbacks, entitlement evaluation, claim issuance, and single-use completion. Anonymous Eve operations cross Heimdall's authenticated CultNet operation boundary on Yggdrasil loopback. Sensitive completion and refresh fields are message-wrapped and never enter the public CultMesh catalog, Odin records, Eve surfaces, logs, or browser responses. Ghostlight validates the exact issuer, audience, app, profile, access revision, session identity, expiry, and app_access before creating a local app session.

ghostlight.app_session.v1 stores a hash of the random cookie, stable Heimdall subject hash, exact Heimdall session and access revision, verified capabilities, expiries, and a locally wrapped refresh claim. Routine requests verify that state locally. Claim refresh and logout revalidate exact Heimdall session custody through the private boundary; a stale refresh cannot resurrect a logged-out session. Heimdall outages leave valid local sessions usable only until their verified expiry. Campaign access always comes from campaign_membership.v1; account preferences remember only selection. The old auth store is frozen rollback evidence and does not participate in admission.

That boundary also projects less state outward than the kernel returns inward. Player command responses contain only assessment and public commit/roll receipts. Canonical campaign state and spoiler-bearing actor or institution state are operator-only. Informational rolls add only their exact previewed finding to the acting character and a provisional branch fact. The assessor deterministically binds typed findings into visible stakes before validation, so formatting is not delegated to a correction attempt. The compiler classifies each retrieved source as direct seed, setting background, or excluded before generation. Only direct-seed source text enters causal world compilation; background and excluded sources remain coverage provenance and cannot donate story incidents or cast.

The player-facing story is the chronological lowering of exact committed NarrativeTurn rows. Player speech, Persona speech, and resolved outcome prose already enter the transcript through the kernel transaction that owns their revision. The surface does not run a second narrator or verifier model, replace world turns, or read historical narration_projection.v1 rows. This removes two calls per live turn and makes display-layer invention of names, dialogue, injuries, participants, or actions structurally impossible.

Player speech address is also typed before it can steer a reaction. A compact Flash projection receives only the exact co-present simulation-eligible actor IDs and names, bounded recent public turns, prior conversational focus, and the new utterance. It returns the exact Persona actors from whom the utterance asks for a response. WorldKernel revalidates those IDs and commits them with the speech NarrativeTurn; neither Eve nor the native client may submit them. Every present actor continues to appraise the turn, but the private actor slice now distinguishes direct_response_expected from present_observer. A direct addressee must speak or select typed deliberate silence. The kernel lowers silence to a deterministic visible refusal, so no free-text gesture lane can claim an unassessed world effect.

ghostlight-campaign-inspect is a read-only typed-store witness retained in the immutable hosted release. Campaign-store ACLs keep it operator-only. It reports the latest strategic cover, attributed appraisals and inactions, activity outcomes, events, news, subject continuity, and model receipt/token metadata without dumping provider reasoning or raw private narrative streams.

ghostlight-mesh-inspect provides the same read-only operator projection from a copied derived mesh.cc snapshot. It never opens or copies the live campaign store. Operators may extract one private JSON witness from that copy, then delete the temporary mesh file; JSON is diagnostic export, not state authority.

The actor-filtered Eve surface follows the same membrane. It renders the player-owned ledger—including that actor's own relationships—and already filtered news, but does not enumerate canonical institution postures or raw world clocks. Those remain operator state until narration or an exact information channel makes a development available to the character. A negative regression plants a remote coup posture and sealed investigation clock, proves all three secret strings absent from the player surface, and proves an admitted public headline remains. It likewise exposes only the number of operator pins and local active population leaves eligible for a fission preview. Pin bodies, remote population names, and ReplaceResolutionPins remain outside the player boundary.

Exact private per-member and operator projections remain CultMesh documents for authorized Verse consumers. The public provider advertisement exposes only the subject-scoped logical surface and Heimdall plugin requirement. Hermodr may materialize that provider for inspection when its plugin is installed; it is not a Ghostlight runtime dependency and owns no application state.

Global strategic context has a separate non-causal lane. Two stable broad Vault queries run alongside local retrieval, and a Flash extraction stage proposes a bounded pool of remote institution names with one to three exact supporting claims each. Local code binds every retained claim to an institution-specific witness. Only the grounded candidates, capped at 32, enter a separate Flash synthesis stage. It preserves those canon anchors while generating the smallest useful campaign-local doctrine needed for strategic action. An independent verifier checks compatibility rather than textual entailment: source silence is allowed, while contradiction, canon erasure, identity conflation, story-specific borrowing, current branch events, and unanchored setting-breaking power are not. Verification must still cover every grounded institution exactly once; a malformed or incomplete verdict retries once and then aborts. After one faithful synthesis correction, a still-incompatible doctrine aborts compilation rather than deleting an anchored power. Compatible doctrine becomes campaign state and an approval-visible branch assumption. Exact receipts anchor the institution and its canon constraints; they do not falsely certify the generated policy as Vault text. Admitted remote institutions receive deterministic coarse profiles with distinct authority and explicit unknown facets. The Pro agency stage profiles only local actors, populations, and institutions where semantic subdivision is useful. The model schema permits a bounded pool of 64 candidates so provider overage and ungrounded index fragments can reach local judgment. Exact grounding runs before the 32-institution simulation capacity is applied; excess grounded candidates become an approval-visible on-demand-compilation gap. Raw proposal count therefore cannot consume canonical capacity or abort an otherwise valid world compile. A supporting claim is institution-specific only when its quotation names exactly that candidate or comes from the candidate's dedicated source document; shared index headings, category descriptions, cross-faction lists, and orphaned sentence fragments are rejected. Exact claims and receipts remain evidence; synthesized strategic doctrine becomes branch-local coarse simulation goals.

The Aetheria Vault adapter derives document authority from the exact source path before any model sees a witness. Worldbuilding is reusable canon; published Fiction and legacy Stories are historical reference; static interactive output is a fixture artifact; Brainstorming is working draft; and Game Design is design reference. Only reusable canon may enter a new branch's direct_seed lane or the global-agency compiler. The classifier may further narrow canon by relevance, but it cannot promote a lower-authority document. Direct-seed projection and receipt selection repeat this local guard, so a malformed or stale classifier output cannot smuggle a story cast into the world seed. The live AetheriaLore retrieval archive is correspondingly bounded to Aetheria/Worldbuilding/; durable facts discovered through fiction must be promoted into Worldbuilding before they become reusable campaign canon.

Strict provider schemas do not carry canonical dynamic maps directly. Compiler routes and relationships cross the model boundary as explicit ID-bearing records, then local validation rejects empty or duplicate IDs and lowers them once into canonical maps. The same cut applies to fixed six-axis agency facets, destination-expansion routes, population-fission assignments, and strategic resolution-demand weights. This preserves semantic keys under providers whose strict object dialect forbids open-ended additionalProperties; an empty closed object is never accepted as a substitute for route, relationship, assignment, or facet authority. Canonical campaign and resolution documents retain their map-shaped storage contracts.

The Codex/OpenAI connector owns one further provider-only projection for exact compound literals. Scalar const values survive. Array and object const values lower recursively to the supported strict Responses subset: fixed array lengths with bounded item literals, or closed objects with every exact key required. Array ordering and multiplicity are necessarily wider at this transport layer. The native request schema remains unchanged, and its consumer validator still owns exact equality before any proposal can reach admission. No compiler, elaborator title, or generic agent loop carries a provider-specific repair for this dialect boundary.

F:\Projects\Kalsa is the first bundled fantasy Vault canary. Its typed manifest makes the Public tree player-safe world knowledge and the Spoilers tree GM-only canon; workshop material is non-canonical. Selection, Git/Obsidian provenance, retrieval, exact receipts, and player projection preserve those lanes without copying Kalsa into the read-only Aetheria recovery index or creating a Ghostlight-owned semantic index.

Destination compilation treats Vault evidence as canon constraints rather than an exhaustive game map. Identity resolution sends a genuinely new place to bounded region expansion and an exact reachable canonical place to locality elaboration. Locality elaboration preserves the existing place identity while adding only contained places and locally scoped subjects, public facts, and relations. A player's question can select the missing domain but cannot dictate the office, procedure, or answer. Inhabited proposals must expose current authority, selection or succession, public resources, and redress through a typed civic manifest whose exact fact references are shared by each resident population. A separate model stage verifies their semantic legibility; it may reject but cannot rewrite or commit the proposal.

Destination repair is the first consumer of the generic model-agent harness. The harness owner is run_model_agent, operating only over ModelPort, a ModelAgentSpec, and a consumer-owned ModelAgentTool. The spec supplies the stage, logical model class, frozen snapshot binding, instructions, causal receipt IDs, per-call settings, and semantic step limit. Before every step, the tool publishes the action schema legal at its current private state. Static tools may route a contract from their actual domain owner; world elaboration, for example, delegates schema derivation to WorldElaborationAssignment. The harness outputs one accepted consumer-owned value plus the complete receipt chain, or one terminal failure plus the receipts completed before failure. Step transcript, tool observations, causal source-ID accumulation, and semantic_invalid marking are derived run state. The harness has no campaign, fact, institution, civic, kernel, or persistence type and cannot validate or mutate world state. Patina or another consumer may supply a different action and tool without moving that consumer's state authority into the harness.

Once the destination compiler has produced a repairable frozen civic candidate, that exact seed initializes one private workbench owned by DestinationReconciliationAgentTool. The balanced-model agent may take at most four small typed actions: validate_current, or revise_and_validate with a bounded transactional edit batch. The edit algebra replaces one stable fact slot, one resident fact-ID set, one frozen institution's operational fields, individual local relations, or the civic-manifest membership and fact lanes. The action wire is one root object with a typed tool discriminant and nullable edit batch; the connector refuses root-union schemas locally before provider submission. The action schema contains no complete-candidate type. A failed edit batch changes nothing. An admitted edit persists only in the private workbench and returns Continue when the resulting draft still fails validation; its digest, changed slots, and exact typed finding become the next observation without reprojecting the whole draft.

Sol's seed remains the immutable owner of geography, routes, migration, population identity and ordinary state, institution identity/name/goals and locations, civic jurisdiction, branch assumptions, and gaps. The initial compiler finding and every later tool finding use the same typed DestinationReconciliationFinding; civic verdict booleans are not collapsed into rationale-only text. destination_fact_findings remains the sole candidate-fact namespace owner. Every current or edited draft traverses that checker, apply_civic_reconciliation, ordinary lowering and structural validation, and a fresh independent civic verdict. The verifier's structured schema declares the same one-to-1,000-character rationale bound enforced by its deterministic gate. It may return a verdict and receipt but cannot edit the workbench. An accepted candidate remains only a compilation preview; WorldKernel and the mutation reducer are the sole world-state admission and commit authorities.

ModelAgentTool has associated typed Action, Finding, and Output contracts. The harness serializes a consumer's finding only when constructing the next model observation; it cannot invent or interpret a domain finding. The civic verifier performs one inference for each exact candidate and returns its typed verdict and receipt to the tool. Only run_model_agent owns semantic action iteration and its four-step budget. The initial candidate plus four validating agent actions can therefore produce at most five civic-verifier receipts. Provider transport and schema retries remain the separately named lower-level authority of run_validated_stage; they do not select or repair a civic candidate. Accepted verifier receipts are rebound to the exact candidate before preview admission. Completed compiler, action, tool, and verifier receipts survive terminal failure and are persisted by both the strategic harness and the Dungeon API. Generic harness tests prove that a later action cites both the rejected action and tool receipts, and that exhaustion returns every completed action and tool receipt. A tool may also return Continue: the valid action updates only consumer-owned private draft state, its receipt remains valid, and the typed observation requests the next step without pretending the task was rejected or complete. Accepted civic systems persist as versioned component state, so a later pass receives the current institutions, populations, facts, and relations and must extend that apparatus instead of inventing a parallel government.

World-elaboration tone has one typed catalog of titled workers. Patina owns reusable low-stakes local texture; Charter civic institutions and procedure; Ledger material economy; Hearth ordinary relationships and belonging; Tangle factions and political leverage; Veil uneven knowledge; Ember active pressure; and Numen ritual, magic, and wonder. Each user slider is a zero-to-one-hundred relative dispatch weight, not prompt decoration. The deterministic smooth weighted scheduler apportions every invocation-budget slot against the complete enabled profile. It records requested share, actual dispatch count, and per-title unused allocations; when a selected title is blocked, that slot remains unused instead of increasing another title's frequency or creating catch-up debt. A bounded wave invokes the scheduled sub-agents in parallel. One typed wave binding names the immutable snapshot and is passed to every invocation and returned with every proposal. Successful proposals return in deterministic ordinal order. WorldElaborationAssignment owns each dispatch's exact operation contract: it derives the instruction, projects the generated structured-output schema down to the assigned variant and deterministic values, and validates the submitted proposal against the frozen snapshot. The provider-backed worker only routes that assignment through the generic ModelAgent; the connector may structurally widen unsupported compound literals on its private schema clone, while this unchanged assignment validator retains exact semantic authority. The harness owns the bounded two-step transcript/tool loop and receipt chain, not world semantics. Local rejection returns as the next tool observation. Patina, Ledger, Hearth, Veil, and Ember use the fast model class; Charter and Tangle use balanced; Numen uses capable. The worker returns the complete action/tool receipt chain with its proposal. A failed wave returns the consumed schedule, every completed proposal, each failed dispatch, and all available worker receipts, so fairness state cannot advance without an explanatory receipt. resume_elaboration_wave is the sole partial-wave recovery owner. It accepts that exact failure partition, validates it against the original immutable wave and complete consumed schedule, retains every completed proposal and receipt, and invokes only the failed original dispatches. It does not schedule new work or advance fairness state. A duplicate, missing, unbound, or drifted dispatch closes the resume seam before any worker call. Successful wave construction is opaque outside the dispatcher. The admission boundary rechecks requested and unused slots, per-title and total dispatch counts, eligible titles, ordinal windows, weights, requested shares, final scheduler state, the exact invocation partition, and every supplied worker receipt's dispatch-specific snapshot binding before dispatch order may decide a conflict. Every successful invocation must carry a terminal accepted model receipt; generic receiptless scheduler fixtures cannot cross world admission.

Those proposals are not canonical mutations. Each invocation may return one additive WorldElaborationOperation: place, route, branch-local fact, population/profile pair, institution/profile pair, local or migration relation, or civic manifest. admit_world_elaboration_wave rechecks the revision-bound wave, rejects malformed operations, gives a colliding write claim to the first authentic scheduler dispatch, and retains every later conflict with the exact prior dispatch ordinal. It merges accepted operations into one non-canonical LocalityElaboration; ordinary locality validation owns the resulting structural diagnostic.

Titled operations cannot claim source-evidence receipt IDs or canon-candidate authority. Facts are branch-local or provisional; profiles and relations carry no source receipts. WorldKernel::commit_elaboration accepts only the opaque finalized elaboration capability, not caller-supplied evidence or canon candidates. Adding source-grounded elaboration later therefore requires an explicit typed binding rather than an unattached vector at the commit seam.

A titled worker must leave the civic semantic-verifier receipt empty. finalize_world_elaboration binds the immutable admitted candidate to one independent verifier receipt that may accept or reject but cannot rewrite it. Its ancestry must equal the complete admitted worker-receipt set, without omissions, additions, or duplicates. Canonical Gestalt state stores shared knowledge as fact statements; the civic verifier receives a derived exact-ID view reconstructed from those statements and the admitted fact namespace, so its identity-grounding judgment does not mistake the storage projection for a missing compiler field. Admission and finalization values are opaque, serialize-only capability receipts; callers cannot deserialize or reconstruct them as commit authority. WorldKernel::commit_elaboration consumes that final value, revalidates the admission digest, campaign revision, candidate derivation, and verifier binding inside its mailbox, then uses the existing ElaborateLocality path. That shared path lowers the complete candidate into exact permitted WorldMutation operations, applies the closed reducer, projects the accepted result, and persists the aggregate campaign, authority, batch, and mutation receipt atomically together with every titled-worker and semantic-verifier model receipt. Titled workers never receive a WorldCommand, permit, mutation batch, store, or kernel write handle. The current proposal algebra is additive locality elaboration; replacement of existing canonical subjects remains outside this authority.

Acceptance-driver whole-world bootstrap

• Owner: the strategic acceptance driver owns orchestration and recovery of an optional whole-world bootstrap. It owns neither geography nor canonical mutation. The existing destination compiler agent owns each bounded region proposal; WorldKernel alone may admit it through ExpandRegion.
• Inputs: an admitted root campaign, its exact authored world description, the boundary observer's canonical location, and an ordered list of at most eight GHOSTLIGHT_WORLD_REGION_REQUESTS. Each request specifies one bounded realm; the root compiler remains intentionally bounded-local.
• Outputs: one frozen ordered world-regions-plan.json, one immutable proposal checkpoint before each mutation, one sequential kernel commit per genuinely new realm, and an immutable world-region-NN-checkpoint.json binding request, origin, committed jurisdiction, exact compiler mutation proof, kernel receipt, and model-receipt hashes. Committed jurisdiction IDs become the locality set for later elaboration and strategic simulation.
• Derived state: status.json progress and the jurisdiction list are orchestration projections, not world truth.
• Forbidden writers: the driver, root compiler, destination compiler, checkpoints, and elaborators cannot directly write campaign state or invent Delvehold-owned player, civic, dungeon, contract, workshop, or quantitative- economy effects.
• Admission policy: the operator-authorized autonomous run may admit a structurally and semantically valid branch-local destination even though the Dungeon UI would label its preview requires_approval. Unresolved canon gaps still stop the run; the driver cannot approve through them.
• Shared paths: fresh and resumed runs use the same frozen ordered plan, destination compiler, and kernel admission path. Resume rejects omitted or reordered requests, skips a region only when its checkpoint and canonical receipt and mutation proof agree. Foundation, region, titled, and complexity recovery all bind the immutable prepared candidate to the exact canonical receipt; the presence of a plausible ID or checkpoint file is never treated as proof that its content committed.
• Cut line: whole-world scope is not overloaded onto the root compiler. The driver reuses existing destination compilation and kernel admission; there is no second region generator or event authority.
• Verification layer: destination validation and reconciliation bind each candidate before kernel revalidation and commit. End-to-end acceptance also requires all requested realms to enter locality elaboration, iterative complexity rounds to satisfy the consumer scale intent, the bounded multiresolution cover, strategic waves, and grounded newspaper projection. Runs 64 and 65 stopped before that claim was established and remain failure evidence rather than accepted full-world runs.

Qualified latent-world complexity and elaborator continuity

• Owner: elaboration::canonical_actionable_subject_ids is the single qualification derivation for world-scale complexity. It reads the canonical campaign and returns the active subjects allowed to pay the scale target. derive_world_elaboration_demand owns target and deficit arithmetic. The strategic acceptance driver owns bounded round orchestration and selects parents only from the same qualified-ID set. WorldKernel remains the sole canonical mutation owner.
• Inputs: the admitted campaign; active, simulation-eligible agency profiles; Gestalt lineages and residual IDs; each fission child's retained parent semantics; the active-cell budget; the consumer-authored target cover basis points; realm weights; topology-derived jurisdiction; realm pressure and detail debt; bounded round and concurrency limits; model receipts; and the compact title-by-jurisdiction elaborator checkpoint.
• Qualification invariant: compiler-admitted roots and individuated people enter through their owning admission gates. A fission child qualifies only when it is not any lineage residual, retains the exact parent baseline, and has additions in at least two of capability, knowledge, goal, and pressure. Residual populations preserve unresolved membership and lineage only. They are non-simulation state, do not enter the public action namespace, do not pay the complexity target, and cannot become recursive complexity parents. Ordinary inherited-baseline fission children remain simulatable without satisfying the qualified world-size bill.
• Demand invariant: the target actionable-subject count is ceil(active_cell_budget * 10_000 / target_cover_basis_points). An active cell budget of 240 at a 20% cover target therefore requires 1,200 qualified subjects. The demand is re-derived from accepted canonical state after every round. The pre-wave phase boundary requires the qualified count to equal the target exactly; a larger count is not accepted as a satisfied target. On post-wave resume, the last fully validated complexity checkpoint owns that historical pre-wave count because legitimate strategic individuation may have increased the current campaign count.
• Round dataflow: frozen campaign -> qualified-ID derivation -> distinct qualified parent selection by jurisdiction pressure and detail debt -> deterministic titled dispatch -> parallel model proposals -> semantic validation and same-batch supersession -> sequential kernel commits -> qualified-ID re-derivation. Every accepted round must strictly increase the qualified count. Missing parents, zero growth, or a nonzero deficit at the round ceiling is terminal failure rather than completion telemetry.
• Gain allocation: ModelWorldComplexityWorker distributes the remaining deficit over the assigned distinct parents, with an exact target gain of one through six per dispatch. An elaborated fission emits target gain plus two children because the retained parent retires and the residual child does not qualify. The semantic validator checks the resulting children.len() - 2 against the qualification.
• Proposal lanes: Hearth, Tangle, and Veil individuate one consequential member. Patina, Charter, Ledger, Ember, and Numen elaborate a population fission. The model owns only the lane-specific draft; the tool reconstructs campaign ID, revision, parent, axis, evidence and approval bindings around that draft.
• Fission draft and output: each child draft contains an ID, public name, partition value, home location, capability additions, knowledge additions, goal additions, and pressure additions. The draft also names the residual child and exact member and resource assignments. The tool clones the frozen parent baseline, applies only those additions, and emits a WorldComplexityFissionQualification binding title, jurisdiction, and exact target actionable gain.
• Fission semantic invariant: every specific child has a normalized public identity distinct from existing Gestalts and its siblings, remains inside its assigned jurisdiction, and contributes at least two bounded causal dimensions. Additions are bounded to two capabilities, two knowledge statements, one goal, and one pressure, and must be semantically distinct from the parent and siblings. Only Geography fission may move children away from the parent home; when multiple admitted places exist it must use at least two. The residual stays at the parent home with the exact parent capability, knowledge, goal, and pressure baseline and the other/unknown partition.
• Title-specific fission shapes: Patina requires a capability and goal. Charter and Ledger require a goal, pressure, and either capability or knowledge. Ember requires a pressure and either capability or knowledge. Numen requires goal, pressure, and knowledge.
• Individuation invariant: every admitted member has a goal, a concrete memory, and at least one additional identity-bearing dimension. Hearth also requires a concrete care or belonging obligation. Tangle requires an exact relationship to an existing canonical subject. Veil requires knowledge not held by the parent population. The resolution validator rejects normalized public-name collisions with existing actors and members; same-batch duplicate canonical member IDs or public identities are superseded by the lowest dispatch ordinal. Actor, institution, Gestalt, dormant member projection, agency-profile key, profile ID, and profile subject ID share one canonical subject-ID collision predicate at proposal validation, deterministic rebase, and kernel application. Promotion alone may claim the exact member's own reserved projection.
• Typed mutation path: WorldCommand::ElaborateGestaltFission carries the preview, exact qualification, and model provenance. The kernel revalidates both elaborated-fission structure and titled complexity semantics before lowering. The lineage split first inherits the parent's component baseline. Only this elaborated command may add the approved capability grants, proposition admissions and knowledge acquisitions, goal commitments, and pressures in the same component-world batch as identity, occupancy, custody, membership, relationship, and civic rebindings.
• Projection invariant: component-batch application occurs against a cloned overlay and validates the complete next world before aggregate projection. Projection verifies exact capability entry IDs and descriptions, known proposition statements, active goal descriptions, and unresolved pressure labels against each approved child. It persists exactly the approved preview-minus-parent knowledge additions as campaign facts through the shared proposition resolver, copies the approved child semantics with typed identity and occupancy, and derives resources from accepted custody. Campaign, authority, batch, and receipt records persist only after projection succeeds.
• Ordinary fission boundary: WorldCommand::FissionGestalt retains the strict inherited-baseline contract. Its lowering emits no semantic-delta mutations. Elaborated semantic additions cannot enter through that path.
• Relationship contribution: the lineage reducer inherits every active parent relationship to each child and aggregate projection retires the parent relation. Fission has no free-form relationship-addition field. New relationship texture enters qualified complexity through Tangle individuation, while locality elaboration owns new civic relations.
• Horizontal expansion boundary: destination compilation and locality elaboration own places, routes, population roots, institutions, civic apparatus, and local political relations. Complexity fission may distribute a Geography split across admitted places but cannot invent geography or a parallel political apparatus. Horizontal civic foundations must therefore be admitted before vertical complexity can elaborate them. Each admitted realm must contain at least three mutually reachable internal places with resident homes in at least three. At scale completion, each jurisdiction must place qualified subjects in at least three locations and no one location may hold more than four fifths of its qualified subjects.
• Civic diversity context: destination compilation and its semantic verifier receive up to eight peer civic apparatus contexts. Candidate generation requires materially executable means, preserves mixed, diasporic, and cross-border constituencies, rejects ancestry-only civic partitions, and admits locally coherent forms of redress. Verification separately requires political_form_distinct_or_deliberately_shared, opposed_interests_have_distinct_means, and candidate_text_intact. Prompt excerpts are truncated only at word boundaries.
• Outputs: canonical actors, Gestalts, members, agency profiles, lineages, facts, component capabilities, knowledge, commitments, pressures, relationships, memberships, occupancy, custody, civic bindings, and mutation receipts. Qualified actionable IDs and the current deficit are always derived from those canonical outputs; there is no independently writable qualification flag.
• Derived telemetry: elaboration demand, round reports, previews, model receipts, session compactions, supersession reports, and resume checkpoints explain orchestration and recovery. They do not own world truth or qualification. Session memory is bounded by title and jurisdiction and binds only committed receipts; raw model sessions and transcripts are not canonical state.
• Recovery invariant: every completed complexity round reopens its frozen preview and validates every mutation, supersession, rejection, model receipt, semantic verdict, canonical world receipt, and exact fission or individuation mutation proof in one contiguous revision chain. An existing commit checkpoint is accepted only after the same validator proves both historical authority and the committed proposal effect. The cumulative session set must equal prior memory plus every exact accepted/rejected invocation journal; untouched sessions remain byte-equivalent and touched generations bind their receipts, findings, prior digest, and round-end revision. Verifier transport failure is a generational resumable checkpoint and never masquerades as semantic rejection or causes the elaborator proposal to replay.
• Forbidden writers: model workers, schedulers, reports, checkpoints, compaction text, cover construction, strategic cells, and renderers may not create canonical subjects, mark a subject qualified, alter the target, or repair semantic state after commit. Ordinary fission may not grant semantic additions. Complexity fission may not create places, institutions, civic systems, or arbitrary relationships. Residuals may not pay or recursively service the target.
• Shared paths: initial runs and resumed runs derive demand and qualified parents through the same functions. Rebase may update only the expected revision when the frozen parent binding is unchanged; child-ID collisions are renamed deterministically before revalidation. All fission writes, including relationship inheritance and resource/member movement, pass through the same typed batch and kernel commit boundary.
• Cut line: qualification is derived from canonical campaign semantics and lineage, not stored beside them. The count, parent selector, progress check, and completion check all consume that derivation. Any alternate active-leaf counter, residual-inclusive quota path, or report-owned completion opinion is outside the live authority model.
• Verification layer: focused tests prove 240 active cells at 20% require 1,200 subjects; residual and ordinary relabel fission children do not pay the qualified bill; exact target gain is enforced; title-specific additions are bounded and distinct; public identities cannot collide; duplicate individuations supersede deterministically; elaborated fission commits its capability, proposition, knowledge, commitment, pressure, relationship, custody, membership, and fact projection atomically; component re-snapshot validates; ordinary lowering rejects a semantic preview; and the destination verifier enforces political distinctness, materially opposed means, and intact candidate text.

Autonomous strategic waves run the same admitted agency state through parallel cell membranes under a provider concurrency gate. Action-bound individuation may create one consequential named person through the existing Gestalt member commit primitive; that person enters later covers as the same canonical actor. Public action channels produce committed NewsIssue records. The world- consumer boundary admits an authority-gated editorial-voice request, then validates the exact NewsIssue to committed-Event public-channel chain. The public-event owner derives each committed event's human-readable account from its typed effect and canonical subject names. Event semantics own the assertion-status mapping used by every public consumer. Relation coordinates, numerical deltas, action-selection rationale, and other state machinery do not become public facts merely because a newsroom exists.

The deliberative newsroom boundary is live under this authority map:

• Objective: one publication investigates the immutable public record, selects the facts its actual stories require, and constructs a pointed narrative without inventing world state or paying for a duplicate source ontology.
• Owner: canonical NewsIssue plus Event rows own public provenance and facts. Event::public_assertion_status owns attempt, declaration, committed-course, material-outcome, and unspecified-account semantics. The in-world assignment editor owns assignment: story choice, order, section, journalist, issue shape, per-story narrative function, context role, focal record, exact citation grouping, throughline, tension, assignment rationale, and reader question. Its deterministic workbench owns derivation of the bounded period directory, query admission, inspected-record membership, the bounded working-context projection, exact-ID fetch, agenda validation, focus-record dereferencing, candidate identity, and exact commit admission. The generic agent harness owns message framing: for snapshot tools it freezes the complete first request as one user message and replaces only the later workbench message. The tool owns the snapshot content. The provider owns automatic prefix-cache admission, retention, and hit accounting; neither the harness nor the newsroom may declare a hit, and newsroom correctness or acceptance cannot require one. The production-checkpoint validator owns whether an admitted agenda or accepted reporter filing is exact enough to resume; CampaignStore owns its immutable storage, not its editorial judgment. Each assigned in-world journalist owns one reader-facing story and receives only that pitch, its exact records, and that journalist's stable recurring character: beat, voice, biases, preferences, source instincts, and blind spots. The copy editor owns one complete factual query report over the assembled page; it neither rewrites nor accepts publication. The Night Editor owns one deadline close over that page and report. The deterministic press witness owns structural admission, lineage, and exact before/after evidence for what printed; it does not judge prose. Errors discovered after close belong to a later edition's correction memory, not a same-edition repair loop. V13 defines that ownership boundary but does not yet persist a typed correction record. Publication employees are not world actors or event writers. WorldKernel remains the only world-event writer.
• Inputs: one exact campaign revision, publication title and voice, article budget, a validated embodied newsroom roster, source-receipt ancestry, and character-newsroom.v16 contract. Before its first query, the assignment editor receives a bounded per-period directory containing only timestamps, completed-material-change headlines, the full completed-change count, and counts of other records. Headline sampling preserves canonical ledger order within a period rather than lexically privileging whichever headline sorts first. This is navigation context: it cannot be cited, does not make a record inspected, and does not replace query or exact-ID fetch. Each reporter receives the common stable house charter first, that journalist's stable recurring identity second, and the current assignment workbench last. The assignment editor receives its own staff profile plus the complete journalist roster; it does not receive the copy editor or Night Editor profiles. Through the existing generic agent harness, the selector issues deterministic bounded queries over stable NewsIssue IDs using literal terms, exact asserted public entity names, assertion statuses, channels, newest/oldest ordering, and an already-inspected cursor. An empty query browses. It may also fetch at most 24 complete records by exact stable ID. Each response returns at most 24 exact projections and the agent has at most twelve semantic steps; the complete immutable ledger remains queryable rather than being split into privileged recent and foundational windows. The harness receives the stable role charter, semantic-step budget and output schema plus the tool's optional current snapshot and latest observation; changing workbench state is not an input to the frozen first message.
• Outputs: an agenda proposal does not finish selection. It yields one exact candidate digest plus a deterministic front-page proof: the proposed lead's complete focus record, the complete focus record for every below-fold pitch, compact supporting-record identities, the proposed narrative claims, tensions and public questions, and explicit comparison questions. The agent may query again or replace the candidate. Selection finishes only when it submits commit_agenda with the exact digest of the current reviewed candidate. The committed agenda is immediately stored as one immutable production checkpoint before any reporter runs. It carries one dominant throughline, reader stake, evidence-based special-or-general issue shape, and ordered story pitches. Every pitch names stable public-record IDs, chooses one focus record, section, journalist, narrative function, and context role, and supplies bounded assignment rationale, narrative claim, tension, and public question. Accountability, opposition, and counter-narrative pitches also carry a typed conflict axis: two distinct named parties, two distinct selected exact citations, bounded descriptions of each party's public move or position, and the editorially framed conflict. Deterministic admission proves both parties are asserted by their cited records and rejects one record presented as both sides of a dispute; an abstract antagonist or passive filing recipient cannot impersonate an opposing move. Consequence and independent stories may omit the axis when the ledger has no honest adversarial motion. Article count plus bounded paragraphs and output tokens define page space. There is no citation-count page budget. A foundational record may support several continuing stories when each pitch uses it for a distinct throughline. One journalist agent files each assigned story and the page is assembled deterministically from assignment-owned section, byline, and citations plus journalist-owned prose. Every accepted filing is stored as its own immutable production checkpoint before the next reporter runs. The cited facts deterministically derive allowed_datelines for the reporter's dynamic workbench. The generic stable output schema admits the dateline's syntactic shape, while validate_editorial_article alone admits it against places asserted by that filing's cited records: the lead must choose a cited place when one exists, while a later article may choose a cited place or remain blank. The copy desk emits one assessment plus the complete bounded set of exact factual query passages; the Night Editor emits one close action; and accepted composition v3 carries the printed issue, copy report, press-close witness, and exact receipt chain. Each snapshot-agent run also emits a provider request sequence whose first request is one stable user message containing the complete role charter and step-one directive. Every later request begins with that exact message and adds one second user message containing only the current bounded workbench state, latest observation, and next-step directive.
• Derived state: public-record projections contain their stable ID, timestamp, channel, headline, reliability, exact committed accounts, assertion statuses, committed event IDs, and only those people, institutions, populations, places, and identity attributes asserted by the account. The per-period directory groups those projections by exact timestamp, retains at most twelve distinct completed-change headlines per period, and counts every other record. It is a lossy navigation projection with no factual, selection, or citation authority. Query pages, the visible-ID set, pending agenda, candidate digest, front-page proof, review questions, and late reader-facing citation numbers are transparent derived views. After each nonterminal selector step, the workbench derives a compact inspected-record index containing only record ID, time, channel, headline, and asserted named entities, plus query/record counts and the pending candidate token; full fact bodies return only through the bounded query or exact-ID fetch. Production checkpoint IDs, reporter-assignment digests, receipt-chain and complete checkpoint-content digests are also derived. allowed_datelines is deterministic prompt guidance derived from the cited facts, not factual admission authority; it remains in the dynamic workbench rather than changing the reporter's generic provider schema and provider request identity. validate_editorial_article owns factual admission after the model returns. The cacheable prefix is the byte-stable first request plus its unchanged output schema; the dynamic suffix is the second workbench message. Provider-reported cached-token counts are optional observations of that external cache, not a newsroom invariant, acceptance gate, or proof that a particular request will hit. The query-index set, query-bearing article set, changed-article set, source-page digest, printed-page digest, and receipt-chain digest are also derived. None is a persisted world subject, fact bundle, relevance authority, prose judge, or event writer.
• Editorial path: the selector may use the period directory to choose where to investigate, but it must inspect a record through query or exact-ID fetch before citing it. It can search backward from routine updates to the original rupture and can acknowledge that later handling is an installment in a continuing story. It first proposes an agenda. The workbench validates it, dereferences the focus record of every pitch, places the proposed lead beside the stories it would bury, and returns the exact candidate digest. This is an observation, not acceptance. The agent must reconsider the actual consequences in that proof and explicitly commit the current digest; a replacement proposal retires the prior candidate as commit authority. Once committed, the exact task/editorial-bound agenda checkpoint is the sole reporter-assignment source on retry. In a special issue, only the lead may own shared chronology; later stories assume it and perform distinct narrative functions. In a general issue, every story owns independent context. Each assigned journalist sees the common publication house charter first and only that journalist's recurring character second in the stable prefix. Issue shape, page throughline, one pitch, its exact records, and the deterministically derived allowed_datelines arrive last in the replaceable workbench message. They center their story on its focus record and may not widen or regroup the selection. Each accepted filing is bound to that agenda checkpoint, article index, exact pitch, journalist identity and profile, and local reporter snapshot binding before it becomes reusable. Record bookkeeping, memory retention, maintained warnings, and procedure are not automatically the lede merely because they are recent. The copy editor sees the assembled page and selected facts. The Night Editor sees only queried articles, their assignments and cited facts, the numbered checklist, its own profile, and the profiles of the affected reporters.
• Desk and press path: accepted stable IDs lower once into the existing self-contained semantic audit with source news IDs, source timestamps, channels, reliability, exact account text, assertion status, event IDs, supported identity attributes, institutions, populations, and places. Reader-facing numeric labels are assigned only during lowering. The copy desk reads the selected fact projection and assembled page exactly once, returning all factual queries at once as exact unique passages with reasons. The immutable close checkpoint binds that report, page, agenda, task, sources, and receipts before the Night Editor acts. The Night Editor receives the affected assignments, queried articles and facts, and numbered query list, then gets one action to disposition every query and provide complete replacement prose for exactly each queried article. The press workbench freezes article selection, order, section, byline, citations, and agenda and forbids changes to every unqueried article. It validates structure and source membership, not whether the final language is true or compelling. A structurally invalid close exhausts the one action and prints the checkpointed journalist page with an explicit non-applied close witness. There is no post-close model reread.
• Agent context path: every run begins with one user item combining the stable charter and the step-one directive. For a tool that owns a bounded current context snapshot, that complete first request remains byte-identical; after each nonterminal action the harness discards old model chatter and observations and replaces only a second user item with the current snapshot, latest finding, and next-step directive. This gives the provider an implicit cache breakpoint after request one without creating an application cache or explicit breakpoint API. Tools that publish no snapshot retain the ordinary append-only conversation path after the same single-message initial request. The assignment workbench uses this seam for its compact inspected-record index and pending candidate token. Reporter workbenches use the same seam: the common house charter precedes the recurring journalist identity in the stable first message, and the dynamic assignment snapshot is the second message. Exact-ID fetch restores only the requested full records. Selector query, fetch, proposal, and commit share one stable structured action schema. The Night close schema is likewise stable across checklist contents; its private workbench enforces the exact queried set. Tool schemas stay in the provider output contract rather than being duplicated in prompt text. Prompt-cache routing binds stage, model class, and exact output schema; changing world context does not mint another routing key, while changing the contract does. Cache reuse is meaningful inside repeated calls of one live agent conversation, including the append-only path. Independent reporter filings are sporadic one-call agents and may outlive provider retention, so their cache eligibility is telemetry rather than a design requirement. Each journalist receives only its own embodied profile, one pitch, and that pitch's records; it does not receive other reporters or desk staff. Copy receives its own embodied profile plus the complete selected fact desk and assembled page because it alone checks the page. Night receives its own embodied profile plus only the queried articles, affected assignments and facts, numbered checklist, and affected reporter profiles.
• Invariants: private events do not enter the query surface; every selected stable ID resolves at the bound revision; story order, selection, citation grouping, focus, section, and journalist remain agenda-owned; no proposal reaches the journalists without deterministic proof observation and exact-current-digest commit; omitted public facts remain true; assignment, writing, copy queries, close, lowering, and witness creation cannot mutate the world. There is one bounded reporter pass per pitch, one copy report, and one admitted Night Editor close. No model verdict rereads the printed page, no rejected close opens an iterative rewrite loop, and no external evaluation can reopen an immutable edition. The witness must preserve exact source and printed page digests, receipt ancestry, every query disposition, every changed article index, and deterministic re-derivation of the printed issue. Admitted agenda and accepted filing checkpoints survive a later reporter or copy failure without becoming printed truth; reuse requires exact current task, editorial, assignment, stage, snapshot, and receipt bindings. A directory headline is never citation evidence: every assigned source must still have been returned by exact ledger query or exact-ID fetch, and every new audit citation exposes the canonical source timestamp. Historical v13 citations decode with an empty timestamp list and retain their exact old audit rendering and serialized receipt shape; empty legacy time lists are omitted from serialization. The source-time line and field appear only when canonical timestamps are present.
• Forbidden writers: the selector and query workbench cannot create, mutate, deduplicate, summarize into, or reclassify NewsIssue or Event state. The deterministic proof cannot rank stories or commit an agenda; it exposes the model's proposed ordering against exact focus facts. A proposal cannot bypass review by returning as accepted output, and a missing or stale candidate digest cannot commit. A journalist cannot change section, byline, citations, assignment, another journalist's prose, or the admitted record set. The copy desk cannot rewrite, suppress, or accept prose, select stories, close the press, or withhold the complete query set for a later pass. The Night Editor cannot widen sources, add, remove, or reorder stories, alter sections, bylines, citations, or agenda, invoke another model judge, reopen a completed close, or touch an article absent from the copy checklist. Every copy-query-bearing article and no other article is mandatory. The press witness cannot certify factual or editorial quality; it can only prove the exact admitted process and bytes. A context snapshot cannot create or summarize facts into authority. The editorial-period directory cannot create a source packet, mark a record inspected, satisfy citation admission, or become an event authority. An exact-ID fetch cannot mutate the ledger. A production checkpoint cannot change the roster, agenda, pitch, reporter, article slot, section, byline, citations, source campaign, or receipt ancestry; a checkpoint from another contract, task, or editorial binding cannot resume current production. Neither the generic dateline schema nor workbench allowed_datelines can admit factual truth; validate_editorial_article rejects an uncited place and rejects a blank lead dateline when a cited place is available. A snapshot tool cannot rewrite the frozen first request, insert changing state ahead of it, or promote provider cache telemetry into semantic authority. A cache miss cannot change tool admission, receipts, or newsroom results, and a routing key cannot substitute for provider-reported cached tokens. Renderers, strategic smoke, Registry, external blind reviewers, and grounding reviewers cannot write the page, desk report, close, correction, world state, or acceptance state. Caches cannot decide record equivalence, assertion status, story relevance, fact completion, or staff assignment.
• Shared paths: fresh composition queries stable records, proposes one or more agendas, observes the deterministic front-page proof for each proposal, and commits exactly one current candidate before invoking the assigned journalists. Fresh work then follows one path: one bounded reporter agent per pitch, deterministic page assembly, copy report, immutable close checkpoint, one Night Editor action, deterministic press witness, lowering, persistence. Registry, live per-wave composition, missing-issue recovery, and final digest all delegate to advance_world_newspaper. Resume checks, in order, an accepted composition, an exact-current close checkpoint, the exact agenda production checkpoint, and each reporter filing checkpoint. It reruns only the first missing stage: an interrupted reporter pass resumes at that reporter; a later copy failure reuses assignment and every accepted filing; a close resume does not rerun assignment, journalists, or copy desk. A persisted composition is revalidated against its close checkpoint and exact stored receipts, then returned without model work. Every caller receives one completed WorldNewspaperComposition or an error; there is no pending reconciliation result for a caller to interpret or advance. Generic snapshot agents and the assignment editor share the same harness framing primitive; non-snapshot agents share its single initial message but continue through the append-only observation path. No newsroom-specific cache branch owns either route.
• Persistence and compatibility: the live internal contract is character-newsroom.v13. Public request schema v3 carries the publication roster and binds it into the task and editorial identities. Private production checkpoint v1 stores either the admitted agenda or one accepted reporter filing. Agenda identity binds the exact task and editorial identities; filing identity additionally binds its agenda checkpoint, article index, exact pitch, complete journalist profile, assignment digest, local reporter snapshot, and receipt chain. These checkpoints are durable production inputs, not copy-desk acceptance, press authority, or world facts. Close checkpoint v1 binds the assigned agenda, assembled page, single copy report, task and exact editorial bindings, and immutable receipt chain. Its only valid origin is InitialCopyDesk, and its compatibility-shaped source_checkpoint_id must be absent. The private LegacyV7Checkpoint enum spelling is a read-only deserialization tombstone: the loader filters it before task selection, receipt loading, validation, or close authority. Composition v3 stores the printed issue, copy report, press-close witness, and receipts. Public issue schema v3 remains unchanged. Uncommitted candidate agendas and front-page proofs remain ephemeral. Historical v7 reconciliation rows may remain in archived or resumed stores as inert provenance, but the live newspaper module defines no reconciliation loader, import envelope, or conversion path and does not rebind them. Historical strategic recomposition v1/v2 receipts are a separate acceptance-driver verification surface; their typed validators can prove original artifacts but cannot write newsroom state. Resume authority belongs only to exact-current v13 production and close checkpoints bound to the same task, newsroom, facts, assignment, article slot, and receipt prefix. Run 58's v7 tip and Run 59's printed edition remain immutable evidence in their original artifacts, not v13 resume inputs.
• Cut line: the generic byline list and one-shot whole-page writer are deleted. Assignment-owned section, journalist, byline, citations, and order are no longer regenerated in prose output. Tool schema text and prior-action copies are absent from prompts; agent history is no longer flattened and retransmitted as a newly rendered user transcript. Selector commands no longer mutate the action schema as records become visible. Phrase-level repairs, repeated copy calls, Night rereview, post-close model judgment, and edits to unqueried articles remain absent. Whole-article prose is the sole Night Editor close unit, and exactly the query-bearing articles are mandatory. The legacy reconciliation schemas and advance loop, automatic store lookup, explicit import API and environment path, v7-to-v9 close conversion, and pending consumer branches are deleted from live authority. Existing bytes are not migrated or erased; nothing in the live path can make them decide a close. The snapshot harness's former two-message first request is also deleted: the step-one directive no longer sits in a prefix position that disappears when the first workbench snapshot replaces history. The cut adds no cache store, cache key registry, manual retention control, or retry compensator. V15 adds the cited conflict axis and removes lexical bias from the bounded directory. V14 adds only the bounded assignment-navigation directory and source timestamps in the audit. It does not add a source-packet layer, second event authority, alternate evidence selector, or reporter-context expansion. The roster, query projection, front-page proof, and article assembly reuse the generic agent harness and existing public-record, agenda, accepted issue, and audit shapes. One private persistent production-checkpoint schema buys exact pre-copy resume; no dependency, crate, binary, daemon, service, cache, event writer, target platform, code-generation path, or world-simulation pass was added.
• Verification and build budget: focused newspaper tests retain query admission, exact focus proof, agenda commit, selected-record alignment, and audit grounding. V15 gates prove adversarial assignments bind two distinct named parties to selected exact records and that period navigation preserves canonical ledger order. V14 gates prove the assignment editor sees completed-change headlines across distinct periods before querying while stable record IDs and fact bodies remain absent, and that rendered audit citations expose source time. Existing V13 gates prove the stable selector instruction prefix with old record bodies absent from later snapshots, the compact inspected-record index, bounded exact-ID refetch, stable selector and Night schemas, assignment-aware reporter context isolation, one complete copy report, exact single-occurrence query targets, multiple categorical objections to the same phrase, one Night Editor action over only the queried articles and facts, complete query disposition, preservation of assignment-owned structure and citations, no post-close copy or editorial stage, deterministic source/printed digests, exact receipt ancestry, close-checkpoint resume without reporter or copy replay, idempotent persisted composition validation, printing the checkpointed page after a structurally rejected close, a fresh v10 close in a store containing a matching inert v7 tombstone. The close validator admits only InitialCopyDesk checkpoints with no source ancestry, while exact-current resume and idempotence regressions exercise the close resume path. Dedicated regressions prove one generic reporter schema with no per-assignment dateline enum, exact fact-derived allowed_datelines in each dynamic reporter snapshot, deterministic cited-place admission, plus agenda-and-filing checkpoint recovery at the first failed reporter without replaying accepted production. Strategic recomposition v3 binds the copy report and press witness by digest while v1/v2 remain historical validation inputs. Independent blind editorial and grounding reviews evaluate the resulting artifact for the acceptance experiment only; they are deliberately outside runtime publication authority. Verification remains bounded to the existing newspaper library and strategic-smoke targets plus formatting, state, and system-map gates. The cut adds no service, crate, dependency, event authority, or simulation pass.

Run 60 is the negative cache witness for the superseded framing: 15 calls used 96,902 prompt tokens and reported zero cached tokens. The selector's first call used 1,452 prompt tokens, while later calls grew to roughly 7,500–11,800. That first request was large enough for automatic prompt caching, but the old two-message shape retained only the charter and replaced the step-one message, so later requests did not preserve the complete first-request prefix. The focused harness regression now proves one combined charter-plus-step-one user message, exact later prefix preservation, a replaced dynamic workbench message, no replayed assistant chatter, and an unchanged output schema. It proves request shape only; provider cache hits are non-required runtime telemetry.

Run 62 is preserved as an immutable failed v12 witness: the selector reported a cache hit, reporter calls reported zero cached tokens, and a reporter supplied an invalid dateline that deterministic admission rejected. It is not evidence for the v13 reporter prefix. Run 63 is a stopped v13 observation, not an acceptance artifact: Issues 17 and 18 completed before the final edition, and repeated reporter calls still reported zero cached tokens. Its partial artifacts remain inert provenance; no fresh reporter-cache proof is required.

Run 61 remains accepted evidence for the durable newsroom claims: recurring journalist voices and evidence-shaped special/general issue design. Those editorial boundaries do not depend on provider cache retention.

The bounded selector snapshot retains a pending agenda's exact token while its front-page proof is the latest observation. Any later query or exact-ID fetch retires that candidate; the assignment editor must propose the page again and receive a fresh proof before commit. Retrieval cannot leave a proofless agenda eligible for delayed admission.

Run 54 is immutable mechanically complete evidence at exact source 01581b8576774f370884e331558605e7ef5e1b9b, implementation 2ac74abf12612b2c38b04acd6fcb604acd1c9d28, and world revision 27. Its newspaper passed independent grounding and failed independent blind editorial review because administrative conditions, filings, cordons, and recordkeeping buried conflict and bodily evidence. The archive is F:\GameCult\GhostlightDungeon\acceptance\elven-realms-autonomous-01581b8-54.tar with SHA-256 835F72FCB19C38815C543DC1497977288F2F1442F22FDBD32D1B312490B34808. No next run may replay world mechanics or per-wave publications.

Run 54 also exposed a separate upstream publicity defect. A public strategic activity currently propagates its channel to every materialized outcome, including a private MemberMemory consequence; that is how a public news row about Orin Pell retaining a memory entered the frozen ledger. The newsroom must not turn that bookkeeping into a story, but it cannot repair world-event authority. The future kernel cut is: parent activity publicity does not imply that every internal consequence is public; an outcome needs its own observable or communicated public scope before NewsIssue materialization. Revision 27 remains immutable evidence and is not rewritten for this newsroom-only acceptance.

The typed issue retains exact event IDs, channels, reliability, source revision, and model receipts as audit data. Its internal issue time is derived from the latest cited publication record without exposing that clock to editorial inference. Rejected action attempts semantically rebind their otherwise immutable model receipts to collision-free invalid dispositions; a structurally rejected deadline action prints the already checkpointed source page instead of creating another editorial turn. The top-level strategic plan, receipt hash, and commit always project the final completed wave, matching the top-level counts and persisted campaign head; per-wave history remains under waves. The reader renderer has no path to provenance fields and escapes all model- and consumer-supplied plain text before Markdown emission; the provenance renderer applies the same plain-text boundary to its audit data. Neither assignment editor, writer, copy desk, Night Editor, renderer, nor receipt persistence can write world state.

Seeded TeX press projection

• Owner: the operator-designated frozen newsroom Markdown owns masthead, edition label, article identities, lead designation, sections, headlines, decks, bylines, and every paragraph. tools/typeset_newspaper.py owns presentation only through two independent decisions. style_seed owns the durable house body: sheet geometry, type, stock, ink, rules, gutters, and ornaments. flow_seed owns the per-issue display template, secondary-story grouping, which eligible secondary closes page one, cut-first versus cut-midstory placement, cut scale, and page closure. Both apply the pre-WWI mass-circulation grammar distilled in notes/historical-newspaper-layout-grammar.md; neither owns copy. Woodcut bitmaps and their adjacent prompt sidecars own illustration provenance, not facts. A future economic layer owns advertiser identity, goods, prices, claims, campaign continuity, and payment; the press may only place an already admitted ad module in the shared page grid.
• Inputs: one frozen Markdown edition, required independent style and flow seeds, zero or more article-indexed wordless woodcut PNGs, output/TeX/manifest paths, and an optional LuaLaTeX engine or --no-compile. The current Run 61 projection uses style seed 1847 and flow seed 723 and binds boundary-rail-exchange to article 0 and sinkroot-gauge-gallery to article 1. Their matching prompt files preserve the exact fresh ImageGen requests and record grayscale, 72-percent threshold, and trim preparation. No ad module is currently admitted.
• Outputs: escaped TeX, a ghostlight.seeded_tex_press.v2 TOML manifest, and optionally a compiled PDF. Manifest v2 records independent [style] and [flow] projections and binds both seeds, source/output/TeX paths, article-indexed woodcuts, and SHA-256 digests for source, TeX, tool, woodcuts, engine, and compiled output. The current artifact is output/pdf/canopy-ledger-run-61-style-1847-flow-723.pdf, bound by output/tex/canopy-ledger-run-61-style-1847-flow-723.manifest.toml with output SHA-256 a457f4b1702a7a52480e42fce0039f0dbe677ff32958e98f1c412b346237190c. These are press artifacts, not another newsroom composition or correction surface.
• Derived state: the parsed Edition, house Style, per-issue Flow, two-page story grouping, continuous four-column reading flow, unbreakable story-header modules, story-local cut placement and widths, TeX markup, and PDF pagination are presentation projections. Flow templates include display-plate and display-band; inside-story placement includes cut-first and cut-midstory. TikZ/PDF multiply blending makes monochrome cut paper disappear into the seeded stock. The same style seed preserves the bounded house body across issues while a different flow seed may change grouping and placement without changing that body. Exact portable PDF reproduction additionally depends on the named system fonts; source, woodcut, engine, tool, TeX, and output bytes are bound by manifest v2.
• Forbidden writers: the press, TeX compiler, manifest, woodcuts, and prompt sidecars cannot add, remove, summarize, reorder, correct, or reinterpret newsroom copy; change bylines, lead designation, or newsroom-owned narrative function; write newsroom checkpoints or world state; promote an illustration into evidence; fabricate an advertiser, offer, price, claim, payment, or campaign; or fill an unadmitted ad slot. Flow may choose which eligible secondary closes page one, but it cannot rewrite article text, change the lead, reassign an indexed cut, detach that cut from its story, or omit it. A successful PDF compile cannot admit missing or altered copy.
• Shared path: every press run parses the frozen source, derives one style from style_seed and one issue flow from flow_seed, verifies that all frozen fields survive, writes TeX, compiles that exact TeX when requested, and then writes manifest v2. Each woodcut is keyed to its owning article index and remains attached to that story's display field in either cut-first or cut-midstory form; accepted copy then flows continuously through the common four-column grid. There is no detached image bank or bottom-art reservation. Any future admitted ad module must use this same grid without changing article-internal copy order or flow-selected grouping.
• Cut line: the live press path contains no model rewrite, editorial summarizer, copy-fitting loop, or second content owner. Press variation is bounded to page geometry, typography, color, rules, fleurons, and illustration sizing/placement. The former fixed ReportLab renderer, three-column lead plus one-column rail, paired story-minipage layout, and detached image bank are not live. Minipages now protect headers only; story bodies remain in continuous column flow. The single-seed manifest v1 and prior output/pdf/canopy-ledger-run-61-seed-1847.pdf artifact are not current press authority.
• Verification layer: admission requires source-to-TeX/PDF field completeness and article-internal order, exact same-pair TeX derivation, independent style- and flow-seed variation checks, successful halt-on-error compilation, rendered-page inspection for clipping and overlap, one attached rendering for every indexed cut, and matching manifest/woodcut prompt provenance. The current manifest v2 records display-plate, cut-first, and page-one secondary article 2. Its final TeX uses four-column multicols, article-indexed cuts, needspace plus header-only minipages, and TikZ multiply scopes. LuaLaTeX produces a two-page PDF with embedded Times New Roman faces; SOURCE_DATE_EPOCH=0 and FORCE_SOURCE_DATE=1 make the same admitted inputs byte-reproducible under the bound engine. Extracted copy includes the closing Marshal Eryn Tal paragraph. Rendered inspection confirms continuous reading order, attached cuts blended into the stock, unstranded headers, and no clipping or overlap.

Acceptance-driver per-wave newspaper recovery

• Owner: the strategic acceptance driver owns recovery of a missing consumer artifact after its world wave has already committed. It owns neither the wave nor the newspaper's factual or editorial judgment. For an already accepted historical recomposition, the original immutable recomposition receipt owns the typed issue value and reader/audit bytes; the current driver only validates and projects that artifact.
• Inputs: the missing wave's immutable checkpoint and committed Campaign snapshot, the preceding wave checkpoint's committed news-ledger boundary, the configured title and voice, the explicit resume recovery boundary (GHOSTLIGHT_STRATEGIC_NEWSPAPER_RECOVERY_START_WAVE, defaulting to wave one and validated within 1..=wave_count + 1; selecting wave_count + 1 is the final-only sentinel: it recovers no per-wave editions but leaves final combined composition enabled), and the same campaign receipt store used by ordinary newspaper composition. When an accepted recomposition already exists, its immutable receipt and exact named reader/audit files are additional inputs.
• Output: acceptance writes one separately named immutable recomposition checkpoint containing the issue, copy report, press-close witness, and newspaper model receipts, plus the rendered reader and audit files. Its receipt binds the narrowed source campaign, recovery boundary, title/voice/article-budget contract, issue, model-receipt collection, expected filenames, and both rendered byte streams by digest. Current recomposition v3 receipts bind the complete typed copy report and press-close witness by digest. The configured boundary is also projected through run status and success or failure result artifacts. The driver fills only the missing newspaper fields in its in-memory result projection. A pre-close provider or integrity failure stops that invocation; canonical close state remains in CampaignStore. Existing successful issues and original wave checkpoints remain unchanged.
• Derived state: the newsroom receives a clone of the completed wave's campaign whose news ledger is narrowed to rows appended since the preceding committed boundary. All events and canonical names remain available only so those exact news rows can resolve their sources; the clone is a consumer view, not a campaign mutation. Before that handoff, the driver validates that wave reports form a contiguous prefix and selects only reports at or after the configured recovery boundary whose issue is absent. Earlier missing reports remain historical gaps, while any already successful issue inside the selected range is left untouched. The configured recovery boundary owns selection of the missing reports in the current invocation; the final-only sentinel derives an empty per-wave selection because no report can reach wave_count + 1. A completed recomposition's recorded recovery boundary is immutable provenance for the invocation that produced it; it does not become a second selector or invalidate the accepted issue when a later invocation selects a narrower range.
• Forbidden writers: recovery cannot rerun a strategic tick, Nemesis, simulation cells, outcome resolution, clocks, or WorldKernel, and it cannot alter campaign, event, or news state. Failed recomposition stops consumer recovery and cannot repair mechanics.
• Shared paths: live per-wave composition, recovery composition, and final combined composition all call the thin compose_persisted_newspaper delegate into advance_world_newspaper, including the same assignment, writer, single copy report, one deadline close, checkpoint-resume, and receipt-persistence owner. The final combined composition still runs when the recovery selector returns no per-wave reports. A later invocation resumes a close checkpoint without rerunning the writer or copy desk. Once printed, it consumes the successful recomposition artifact instead of paying for the newspaper again. The driver recomputes its wave, source-campaign, and editorial-contract bindings, validates the recorded original recovery boundary, and checks the exact issue value, typed model-receipt set, reader bytes, and audit bytes against their immutable digests. A current-schema issue is deserialized and rendered again. Current recomposition v3 also deserializes the copy report and press-close witness and requires their exact digests. A historical v2 accepted issue is structurally deserialized only as v2 and is not reinterpreted through the current issue type or renderer; its original receipt owns those historical bytes, and the driver carries its JSON only as an inert result projection. Historical issue v2 predates grounding_digest, so this local validator requires accepted status but does not claim a retroactive digest for its complete grounding verdict. Whole-checkpoint integrity instead remains anchored by the unchanged Run 51 source-root/archive hash and Run 52 before/after artifact manifest.
• Cut line: current WorldNewspaperIssue deserialization and current renderer output are no longer authorities over a historical accepted issue. Raw digest verification is not a migration path and cannot create, repair, or reaccept a paper: all applicable original source, contract, filename, issue, receipt-set, and byte bindings must already be present and exact. Current recomposition v3 requires exact copy-report and press-close digests; historical recomposition v1/v2 retains its bounded grounding/editorial validation, and historical issue v2 keeps the explicitly bounded accepted-status plus archive/manifest proof described above. Strategic state and per-wave artifacts remain forbidden writers.
• Verification layer: the focused boundary regression proves that a second wave is recomposed from only its newly appended news row while retaining the committed event ledger needed to resolve that row. It also rejects prior-news prefix drift and confirms that first-wave recovery fails closed without an exact pre-run boundary. Immutable checkpoint publication separately rejects overwrite and publishes by synchronized temporary-file rename. A typed receipt-digest regression proves that checkpoint JSON is deserialized back to Vec<ModelStageReceipt> before hashing and rejects an invalid receipt shape, so creation and verification share one representation. A scope-selection regression proves that earlier missing issues and successful issues are skipped while later missing issues are selected, and that the wave_count + 1 boundary selects no per-wave reports for a final-only resume. Dedicated regressions prove that historical v2 preserves its recorded original recovery boundary and accepts exact historical bytes without current rendering while rejecting byte drift, that current issue v3 still requires typed deserialization and exact rendering, and that current recomposition v3 rejects copy-report or press-close witness drift. Historical recomposition v1/v2 validation remains bounded to its original verdict shapes.

The first-wave limit is now an explicit closed boundary rather than inferred recovery: when wave one is selected, the driver refuses to compose without a preserved pre-run news prefix. A later explicit boundary can instead define an acceptance continuation whose older missing issues are intentionally out of scope. The remaining limitation is verification breadth: no focused test yet executes the complete resume orchestration from fresh recomposition through later reuse while asserting successful-issue preservation, exact rendered-file validation, and absence of mechanics calls.

Session Zero compilation, expansion, and fission follow the same projection rule. Review projections expose topology, pressures, source-use coverage, gaps, assumptions, public party cards, and only the current viewer's private ledger. Generated openings are optional shared typed decisions; accepting one amends the draft for discussion and triggers three optional grounded role decisions in each private DM channel. Ignoring them cannot block a custom start or character. At registry load, exact legacy opening:* suggestions and payloadless question records from the pre-cut runtime are demoted from material to optional with a CultCache compare-and-swap; fictional revision and shared epoch do not move. Payloadless prose cannot own compilation readiness. The persisted typed draft, not stale suggestion materiality, owns that gate. Custom starts and characters use the same draft. The browser returns only decision commands and cannot echo a rewritten candidate into compilation. Candidate IDs, text, list sizes, and evidence references receive local validation. Suggestion retrieval and every committed model invocation remain in the Session Zero audit, including repeated calls with the same semantic receipt hash but different attempt telemetry. A separate active-preview receipt set is replaced by each successful compiler transaction and cleared when that preview is retired. Publication carries only that exact proof set; it never treats DM turns or superseded compiler runs as evidence for the approved seed, and it never compiles the conversation transcript.

Gap-bearing compiler results are retained as exact non-canonical previews while Session Zero returns to drafting. The host can move that exact preview into review; this is not approval. Every member approval now binds the shared contract digest, that member's private character digest, and the complete world preview digest. Publication persists that digest plus the exact accepted gap and branch-assumption lists. Replacing topology, cast, institutions, populations, clocks, evidence lanes, gaps, assumptions, or any other preview field therefore makes old approvals unusable. The Eve tree visibly lowers the reviewable world shape. Player JSON excludes institution resources and goals, and shared cast projection excludes private relationship-anchor people. The host can discard any non-canonical preview through the SessionZeroKernel; the command clears only preview state and returns the locked roster to drafting without editing the contract, character drafts, or fictional time.

Session Zero owns human-controlled actor identity and state. Public player names and premises may enter the shared compiler as setting context, but those names are reserved outside world-cast compilation: actors and Gestalt members cannot materialize them. The compiler's singular player object is a provisional starting-position marker only. Ghostlight removes it and installs the approved typed characters locally. Collision receives one same-snapshot correction and then rejects the candidate; no deduplication or model choice can replace the Session Zero owner.

Private character relationships now cross compilation through a typed identity membrane. Exact player references bind to their approved actor IDs. Each otherwise unresolved named person gets a stable server-generated relationship-anchor:* actor ID. A separate private actor stage receives only the approved display name after public topology validation; it never receives the opaque identity handle or relationship. The shared world compiler receives none of those private inputs. The private stage returns characterization and one exact supplied location, but has no schema fields for IDs, relationships, narration, facts, gaps, assumptions, or public-world changes. Ghostlight attaches the opaque ID locally and later binds the approved relationship only onto its owner's actor. Omission, ambiguity, unknown placement, or collision rejects the candidate atomically. Actor, institution, Gestalt, and member:* IDs are all legal directional relationship targets, but those links never union knowledge or authority. Only the owning member's review surface projects the compiled target, placement, and private description before approval. A shared branch assumption exposes the count of materialized private subjects, never their identities or relationship details.

Approved private character playability crosses a narrower compiler membrane than private history. The shared world compiler receives bounded capabilities, equipment, obligations, goals, and extraordinary-permission scope, costs, limits, exposure, and effect ceilings only so it can seed precise discoverable environmental facts for the opening problem. It never receives private history, secrets, relationships, or pre-existing knowledge. Generic crisis restatements do not satisfy this requirement; a concrete investigative ability needs a concrete pre-existing finding or an explicit evidence gap.

Roster lock is not readiness. Before world compilation the kernel checks the typed contract's core play frame and each active character's minimum actionable shape. Transcript-only detail, blank contract fields, or a character with no public premise, capability, goal, and stake return explicit missing inputs and cannot spend a world-compiler call.

Campaign publication has a separate discoverability boundary. Session Zero publication and solo lifecycle operations initialize a new .cc store under a non-UUID .creating-* directory. The CreateCampaign command validates the seed, then atomically commits campaign state, approved seed, membership, contract, DM Persona, approvals, Vault manifest, evidence, model receipts, canon candidates, and the creation lifecycle receipt in one CultCache batch. Only that complete store is renamed into the UUID namespace and admitted to the live registry. Failed initialization removes its exact staging directory and cannot poison daemon reload. Approval previews are retained until campaign publication, session selection, and reload all succeed; a retry may recover only an already-published store whose exact seed equals the preview. It cannot adopt a colliding campaign ID with different state. Legacy Session Zero stores that used the preview receipt field as an append-only audit migrate on registry load. The complete list remains audit history and the final compiler transaction becomes the active proof set. This replacement is idempotent and does not advance Session Zero revision, epochs, or fictional time. The browser composer preserves the assessment contract's distinction between the character's described act or speech and the effect the player wants it to cause. The receipt panel is the sole owner of the current assessment, destination, or fission approval control; rendering a newer receipt removes the older snapshot-bound control instead of accumulating stale confirmations in persistent forms. World-seed approval renders expandable public sections for the player role, initial topology, present cast, institutions, populations, world clocks, and exact evidence-use rationales instead of asking for approval from summary counts. A browser-local interaction lock prevents duplicate paid requests while preserving the kernel mailbox and revision checks as the only world-mutation authority. The player surface also projects the canonical current location ID. The destination compiler binds that value into a read-only origin field and shows the proposed locations, containment, routes, persistent features, and material gaps before approval. Population fission approval similarly shows each named child leaf, partition value (including other/unknown), home location, and the exact child receiving each parent-owned resource. Shared capabilities, knowledge, goals, pressures, and relationships inherit through population lineage; custody does not. Each scarce resource crosses exactly one typed custody transfer, so a fission cannot copy one granary, vehicle, or medicine lot into every child. Fission admission runs before parent lookup, retrieval planning, or inference: one request may contain at most 16 distinct cuts of at most 160 readable characters and one 500-character reason. The browser mirrors these bounds. The browser interaction lock covers a canonical mutation and the subsequent surface refresh as one user interaction. Campaign selection, world approval, destination approval, fission approval, fork, and reset cannot re-enable stale controls between the commit response and the refreshed revision. Compiler preview requests remain non-mutating and release the lock with their returned preview. Received non-success HTTP responses are rendered as server refusals; only missing or undecodable responses receive the ambiguous-transport warning that a commit may have preceded the lost response. The production web build runs strict TypeScript checking before Vite emits assets.

World Transition Authority

WorldKernel owns one closed semantic WorldMutationBatch reducer. Foreground attempts, NPC reaction waves, strategic actor/institution/Gestalt outcomes, waits, group travel, and approval-gated population fission all lower their accepted outcomes into that vocabulary before canonical state changes. ActionMeans records what an actor did, and the intended effect records what they hoped to change; neither is a committed fact. The mutation batch contains only exact component changes admitted by a state-derived authority envelope.

The reducer validates the complete batch on an isolated component overlay, advances each touched subject version once, and persists component state, mutation authority envelope, mutation batch, mutation receipt, causal command receipt, events, and aggregate compatibility projection atomically. The aggregate campaign row is rejected as a component-only mutation target. WorldEffectDelta, ActorStateDelta, and strategic effect variants are model boundary migration inputs, not writers or independent physical ontologies. The foreground assessor derives a closed effect schema from the exact snapshot and first removes structurally unavailable knowledge, movement, clock, and institution lanes. A compact private scope projection then receives only the exact attempt and those remaining lane names. Its locally validated output can only subtract: every causally unselected lane disappears from the assessor's schema, and unselected knowledge prevents scene facts from entering the prompt at all. The scope also distinguishes lanes required to realize strong and ordinary success from lanes merely available for direct consequences. Required success lanes receive a non-empty structural constraint and a post-lowering local check, so stakes cannot claim a canonical success that the typed effect omits. Canonical dynamic effect maps cross the strict model boundary as bounded entry arrays containing only authority-enumerated IDs and values; validated entries lower once into WorldEffectDelta, while empty arrays mean no mutation. The admission-bound model schema requires those success entries only for an admissible assessment and structurally forces every inadmissible effect array empty; local validation repeats both rules before verification or caching. Scope rows and receipts are derived inference evidence, never assessment or world authority, and their content-addressed cache avoids repeated scope inference for an unchanged attempt. After structural binding, a compact independent verifier compares the complete four-band typed effect bundle with the player's exact means and intended effect. Structurally legal state is not automatically causally relevant. The verifier can only accept or return one bounded mismatch classification and repair sentence; it cannot reassess difficulty, choose an effect, or commit. One mismatch returns to the assessor against the same snapshot, while a second mismatch aborts. Every verifier receipt is private audit state and only a verified proposal may enter the assessment cache. Pending NPC actions are revision-scoped reaction-window state. The next reaction wave atomically replaces the set, and the kernel resolves an action only when the current last event is the exact current-revision reaction wave. Same-wave assessment correction remains possible; cross-turn rebasing is not. The foreground command owns committed player speech, presence reconciliation, and the directly addressed Persona response. Once that response is committed, the request returns without waiting for a second NPC action assessment. The accepted action proposal remains in Campaign.pending_world_proposals; an idle-boundary continuation runs its assessment with background priority and calls the same WorldKernel::ResolveNpcAction command. A new live turn cancels in-flight background inference. The proposal may commit only against its exact reaction revision, and startup plus the strategic scheduler rediscover current reaction-wave proposals after daemon interruption. The continuation is an actuator, not another queue or state owner. The same reaction commit validates its response duty against the exact committed source turn. A missing directly addressed Persona or a null response aborts the whole wave without private deltas, transcript additions, initiative, or revision change; observers may still choose to speak from their own goals.

Action assessment separates semantic inference identity from commit identity. The exact scope, assessor, and verifier models, stable instructions, scoped action-specific schema, and permitted typed packet form a content-addressed private assessment_proposal_cache.v1 key. Revision and expiry still bind the consumable assessment and roll but do not force the capable model to reconsider an otherwise byte-identical packet. A cache hit revalidates the complete proposal against current state, emits a zero-token receipt linked to the source scope, assessment, and verifier receipts, and creates a fresh digest at the current revision. Changed authority changes the key. The Eve command-result projection shows every signed modifier with its exact references.

Population fission now composes admitted child entities, stable child identities, one lineage split, exact resource custody transfers, and exact named-member membership transfers. The same fission transaction owns every relation and civic consequence of retiring the parent: it creates one inherited child agency relation per child, retires the parent relation, replaces the parent resident ID with all child IDs in each affected civic manifest, rebinds each civic political-relation ID to the exact child relation IDs, advances the manifest version, and binds its semantic verification/source field to the exact fission-preview:<digest> receipt. These writes lower together with child admission, lineage, custody, and membership into one component-world batch; either the complete state validates and commits or none of it does.

The aggregate projector may copy the accepted child relations and civic manifests out of that component result, and project_fission_resolution owns the derived agency-profile, facet, cover-invalidation, and resolution-epoch projection. AgencyProfile.location_ids remains exact presence or operating places. It does not inherit a parent's political jurisdiction, because jurisdiction is containment topology rather than subject presence. Later ensure_agency_profiles synchronization is not a cleanup owner and may not repair missing civic residents, replace stale political relation IDs, recreate retired parent relations, or make a partially applied fission appear valid. The old fission function that directly wrote campaign state has been removed.

Immutable Runs 92 and 93 falsify profile-scope inheritance as the routing repair. Run 92 contained 938 active, simulation-eligible Gestalts, while the old direct-profile-membership query found zero realm-routable descendants for Avelune, Veyra, and Bramblewash. Exact canonical topology already contained the answer: Avelune localities descend from loc:avelune-watershed-realm, Veyra localities from loc:veyra-rail-realm, and Bramblewash localities from loc:bramblewash-grain-river-realm. Run 93 at exact source 31125a2 failed before any model call because the now-rejected lineage-scope reconciliation found nothing to change. Preserve both runs as evidence.

The scheduler now calls the shared unique_containing_jurisdiction resolver to derive complexity jurisdiction from canonical Location.container_id ancestry without writing any agency profile; worker admission reuses the same resolver. There is no ReconcileFissionAgencyScopes command, lineage scope-inheritance helper, or agency-scope reconciliation checkpoint. A scheduler fallback that guesses a realm, copies jurisdiction into profile presence, or chooses among ambiguous realm ancestors is forbidden.

Immutable Run 81 at exact source e7ceb2c2807fabb2b0e68aeeeb0aab5948c582a5 and root /var/lib/gamecult/ghostlight-dungeon/acceptance/full-world-delvehold-e7ceb2c-81 is failure evidence for this ownership boundary. Patina commit 0001 advanced revision 15 to 16 and admitted the Hearthcoil children, but left the Hearthcoil civic manifest pointing at missing parent relation rel:hearthcoil-houses-member-blackchalk while the child relation clones existed. Charter's already accepted frozen proposal then failed admission with invalid command: canonical civic system lost a political relation. Preserve the run unchanged; unit ghostlight-full-world-e7ceb2c-81.service, invocation 069f3a5de05b4bd3a972ddf621e29d54, is terminal with an exit code.

Run 81 recovery is an explicit one-boundary repair, not rollback or fission replay. WorldCommand::ReconcileFissionCivicBindings owns deterministic repair on a clone of Run 81. It may select only civic manifests whose stale parent resident or political-relation binding is proven by an existing canonical Gestalt lineage and, for each retired relation, the complete canonical child relation set. It lowers only the resulting SetCivicSystem mutations through the shared mutation kernel, increments the affected manifest version, and binds the repair to a deterministic fission-civic-reconciliation:<digest> source.

The repair uses an unchecked component snapshot only as the bounded workbench needed to represent the known invalid starting state. The mutation application must produce a normally validated next component world; WorldKernel then persists an ordinary world commit and mutation receipt under command kind reconcile_fission_civic_bindings. The acceptance driver publishes one immutable ghostlight.fission_civic_reconciliation_checkpoint.v1 and refuses a checkpoint whose canonical repair is absent or whose command/revision binding disagrees with the campaign. The unchecked snapshot is not a general admission mode, migration authority, cleanup loop, or permission to repair unrelated state.

After that checkpoint, the complexity loop recognizes Patina commit 0001 as already admitted, skips it, and rebases the preserved Charter proposal against the repaired revision. The Run 81 frozen preview and model receipts remain the inference authority; recovery performs no model or elaboration replay.

Region expansion and in-place locality elaboration compose typed place, proposition, population, and institution admission plus exact topology and political-relation changes against one authority snapshot. Locality elaboration anchors every added place beneath one existing canonical jurisdiction and forbids the compiler from duplicating that target. Civic manifests cross-bind governing institutions, resident populations, public civic facts, and local political relations before lowering. CivicSystemSet is the versioned component owner; aggregate Campaign.civic_systems is reconstructed from its accepted state. The mutation reducer owns those canonical component changes; the compiler-validated agency-profile map is still a companion projection and must not be described as component-owned until its migration is complete. Approval commits the complete addition atomically or leaves the coarse place untouched. Repeated Vault retrievals have distinct retrieval receipt identities, while an exact immutable receipt replay is admitted idempotently under the same CultCache CAS.

Every new destination carries an explicit outbound route from the stable origin and a reciprocal return route with the same positive travel time. Place profiles, proposition content, evidence references, discovery locations, containment, route identity, distance, and topology are validated on the component overlay; aggregate rows are reconstructed only from accepted component state. A route map key is local to its exact origin. The component overlay derives its edge identity from (origin_location_id, local_route_id); the player surface uses the route's exact destination field, and accepted region expansion restores the original local key. Reusing road, harbor, or a destination-shaped key under another location cannot overwrite an unrelated edge or make a surface-advertised route fail transition admission.

Governance approval and governed finalization are distinct durable states. When unanimous time, travel, or Persona-cell approval exists but finalization did not commit, the advertised approval operation retries the exact revision- bound finalization even for a member whose approval is already present. This does not add another writer: the same WorldKernel validation and atomic commit path runs again. Duplicate non-unanimous votes, stale boundaries, and committed proposals still reject.

Initial compiler publication is a bounded creation transaction, not a fictional world transition. CampaignRegistry owns discoverability, installs the approved seed into a fresh staging store with one empty-store CAS, and exposes it only by atomic directory rename. It cannot target a published campaign. Named-person materialisation and dematerialisation are resolution transactions over one persistent member identity. They advance world revision to stale old actor-bound commands, advance resolution_epoch, clear the derived cover, and atomically preserve the exact individual delta. They cannot change fictional time or Gestalt-wide knowledge, resources, or pressure; the obsolete GestaltAggregateDelta writer has been deleted. See docs/architecture/ghostlight-transition-algebra.md.

Relationship documents in the schema catalog are revision-bound projections of actor-owned relationship maps; they are not a second relationship writer. Vault manifests summarize the exact provider/source/authority/temporal lanes covered by evidence receipts and do not own Vault content. Strategic tick and gestalt materialization receipts are different: they are atomic commit companions binding the generic world commit to the causal model output or baseline/member presence transition. Materialisation receipts additionally bind the previous and next resolution epochs.

Control Flow

1. Rehydrate from state/map.yaml, notes/fresh-workspace-handoff.md, this file, and notes/ghostlight-implementation-plan.md.
2. Run npm run state:status.
3. Work one bounded organ.
4. Validate the seam that matters.
5. Persist only belief-changing evidence.
6. Commit and push completed work.

Model acceptance also measures useful work per token. Stable contracts precede revision-bound context for cache reuse; each stage receives only the state it can legitimately judge; provider receipts expose cache, prompt, completion, and validation cost per attempt.

Core Surfaces

• state/map.yaml: canonical mission, boundaries, live architecture, next action.
• state/evidence.jsonl: distilled belief-changing evidence only.
• state/evidence.archive.jsonl: older evidence preserved for archaeology.
• state/corpus-coverage.json: accepted/planned fixture coverage ledger.
• notes/fresh-workspace-handoff.md: compact re-entry packet.
• notes/ghostlight-implementation-plan.md: near-term implementation sequence.
• docs/architecture/: detailed contracts and rationale.

Active Artifact Pipeline

Aetheria lore/source context
  -> lore grounding digest / source notes
  -> canonical agent and scene state
  -> projected local context
  -> responder packet
  -> sandboxed responder output
  -> review and leakage audit
  -> observable event record
  -> participant-local appraisal receipts
  -> mutation receipt
  -> updated scene/world/social state
  -> initiative schedule updates readiness, reaction windows, and next actor
  -> sandboxed coordinator continuity and next-beat plan
  -> meta-coordinator review, wiring, and labeled interventions
  -> branch compiler materializes Ink + sidecar + visual plan + compiler notes
  -> IF artifact reviewer audits consequence, fold, and visual continuity
  -> narrative/lore/spatial/visual reviewers audit player-facing quality
  -> accepted fixture / future training corpus + optional illustrated replay collateral

Responder packets are one seam, not the whole project. The branching scene path also requires coordinator receipts, branch compiler artifacts, and independent review before a fixture is accepted.

Tone is a live seam. The system should preserve Aetheria's range instead of defaulting to dry technical crisis prose: comic warmth, domestic routine, ritual memory, weird bureaucracy, noir suspicion, wonder, horror, poetic dread, and procedural systems pressure are all valid when source-grounded and character-local. Adams/Pratchett-style wit-with-stakes is a useful default touchstone for counterbalancing bleakness without dissolving consequence.

Visual replay is a presentation seam, not a core social-model training seam. Illustrated IF fixtures need click-through sections with stable visual_scene_id anchors, stable visual character refs for recurring named characters, a global style cue when the visual language matters, imagegen-ready base prompts, character visibility and stance controls, and branch/state modifiers. This data belongs in a separate .visual.json artifact referenced by the training sidecar, not inside the training annotation itself.

Generated images are not geometry authority. They can establish visual mood, materials, and concept direction, but multi-angle illustrated IF needs a durable scene_set source such as a hand-built 3D blockout, procedural scene file, or layout asset with named cameras and staging slots. For those scenes, imagegen is the painter/render pass over a camera-specific blockout, not the architect of the room.

Important Contracts

• Agent state: schemas/agent-state.schema.json
• Projection examples: schemas/projection-example.schema.json
• Lore grounding: schemas/lore-grounding-digest.schema.json
• Projected local context: schemas/projected-local-context.schema.json
• Coordinator artifacts: schemas/coordinator-artifact.schema.json
• Responder packets: schemas/responder-packet.schema.json
• Responder outputs: schemas/responder-output.schema.json
• Event records: schemas/event-record.schema.json
• Participant appraisals: schemas/participant-appraisal.schema.json
• Reviewed mutations: schemas/reviewed-mutation.schema.json
• Scene-loop bundles: schemas/scene-loop-bundle.schema.json
• Initiative schedules: schemas/initiative-schedule.schema.json
• Ink branch contract: docs/architecture/ink-branching-scenes.md
• Illustrated IF visual pipeline: docs/architecture/illustrated-if-visual-pipeline.md
• Training stages and corpus gates: docs/architecture/training-plan.md
• Corpus coverage ledger: docs/architecture/corpus-coverage-ledger.md

Current Live Examples

Pallas Species Strikes is the active reference-only story fixture:

• examples/lore-grounding/pallas-species-strikes.awakened-labor.v0.json
• examples/agent-state.pallas-species-strikes.v0.json
• examples/coordinator/pallas-species-strikes.branch-and-fold.v0.json
• examples/ink/pallas-species-strikes.branch-and-fold.v0.ink
• examples/ink/pallas-species-strikes.branch-and-fold.v0.training.json
• examples/visual/pallas-species-strikes.branch-and-fold.v0.visual.json
• experiments/pallas-species-strikes/pallas-species-strikes.branch-and-fold-clean-run.v0.md
• experiments/pallas-species-strikes/pallas-species-strikes.visual-scene-review.v1.json

The fixture is not training-ready data for Ghostlight's model stages. It was coordinator-authored without the exact projected-context, sandboxed responder, appraisal, mutation, relationship-update, and true branch-compiler receipts those stages require. Keep it as a reference for story shape, grounding, branch-and-fold presentation, visual planning, and future fixture expectations.

pallas-training-loop-v0 is the first separate training-shaped derivative. It rebuilds only the Kappa threshold beat through actual receipts:

• scene digest and initial state under examples/training-loops/pallas-training-loop-v0/
• projected contexts under examples/projected-contexts/
• responder packets under examples/responder-packets/
• raw no-fork subagent captures under experiments/responder-packets/
• event, appraisal, mutation, review, and bundle receipts under examples/training-loops/pallas-training-loop-v0/
• clean readable transcript under experiments/pallas-training-loop-v0/

It is training-shaped for projector, responder, event resolver, participant appraiser, mutator, relationship/perception updater, and coordinator/story runtime. It is not branch compiler, IF reviewer, visual, or accepted full-fixture coverage data.

lucent-hostage-feed-v0 is the current open-ended training-loop draft. It tests the same receipt-chain organs in a less reference-bound scene: a Lucent Media hostage-feed negotiation inside the media-eye counterweight of a tethered station staring down at a metropolis bubble.

The Lucent bundle includes:

• scene digest, initial state, and branch surface under examples/training-loops/lucent-hostage-feed-v0/
• projected contexts under examples/projected-contexts/
• responder packets under examples/responder-packets/
• raw no-fork subagent captures under experiments/responder-packets/
• event, appraisal, mutation, review, and bundle receipts under examples/training-loops/lucent-hostage-feed-v0/
• clean readable transcript under experiments/lucent-hostage-feed-v0/
• fixture materializer at scripts/materialize_lucent_loop.py
• initiative schedule example at examples/initiative/lucent-hostage-feed-v0.turn-20.initiative.json

Only the fifteen post-restart turns from turn-06 through turn-20 are counted as training-clean responder receipts. The earlier exploratory opening turns are setup/rehearsal context. The loop demonstrates state carryover: feed evidence externalization creates breathing room, breathing room creates a bench-edge substitution, the substitution enables a process-note admission, the admission enables direct hostage leverage to end, and release folds into safe-line confirmation plus non-contact protective handoff.

The current coordinator lesson is explicit: nudge through game-ergonomic state levers rather than forcing plot. Safe lines, evidence locks, security holds, handling categories, posture constraints, route access, clocks, public proof objects, and resource pressure are the elastic strings. Actors pull against those strings from local state; the coordinator records observed action and folds consequences through reviewed mutation.

The coordinator must now be treated as a sandboxable organ in future training-shaped loops. Codex remains the meta-coordinator: it prepares visible input, launches the coordinator worker, reviews the output, labels repairs, and wires structured state between organs. Raw coordinator training data should come from sandboxed coordinator prompts, not from omniscient chat steering.

The initiative scheduler is now an explicit mechanical seam. It decides when an actor is eligible to act from initiative speed, recovery, load, status, and reaction windows; it does not decide what the actor wants or how other participants appraise the event. Every affected participant still appraises and mutates before the scheduler selects the next projected actor.

VoidBot's newer heartbeat routine is the reference shape for turning that seam into a living swarm routine. For Ghostlight, the swarm is the cast: the same heartbeat initiative law selects characters taking turns within a scene, while offstage or maintenance heartbeats handle rumination, sleep consolidation, memory resonance, and reviewed upkeep. See docs/architecture/voidbot-routine-adoption-plan.md.

Pruned Receipts

Old prototype fixture receipts and model-runner files have been removed from the live workspace. Their useful lessons belong in the architecture docs, state map, evidence ledger, and git history. Do not reintroduce deleted receipt paths as active state surfaces.

Missing Or Incomplete Organs

• Contract-governed split parties, private in-play actions, delegation, simultaneous declaration windows, PvP, late joining, permanent departure, and group fork/reset/export
• Deterministic speaker-local input slicer
• Full prompt renderer
• Classifier/appraiser pipeline
• Relationship/perception updater
• State mutator model
• Student projector
• Runtime integration for initiative scheduling beyond validated artifacts
• Branch compiler implementation beyond coordinator-authored fixtures
• IF artifact reviewer implementation beyond manual/frontier review
• Visual scene continuity reviewer implementation beyond prompted specialist review
• Full scene/event loop implementation
• Culture prior engine
• Automatic promotion of branch outcomes into canonical state
• Corpus coverage ledger expansion beyond the current draft Pallas and Lucent receipt-chain rows

Current North Star

Generate high-quality, sandboxed, source-grounded branching-scene samples that can later train specialized Ghostlight models while staying usable by a game engine: exact inputs, exact outputs, provenance, review labels, state mutation receipts, branch compiler artifacts, IF review findings, visual scene plans, and clear branch consequences. The samples should also train tonal control: a fixture needs an intentional prose mode and enough ordinary life for consequence to matter.

Use npm run coverage:status before choosing new fixtures so the corpus grows by coverage need instead of proximity to the nearest interesting disaster.