Ghostlight/state/map.yaml

experiment:
  name: Ghostlight
  status: active_mvp_build
  phase: whole_machine_authority_rebuild
  premise: >
    Build a durable research and implementation home for socially persistent
    generative agents whose behavior emerges from personality, culture,
    memory, perception, incentives, and situation rather than flat persona
    prompts.

mission:
  ghostlight_dungeon: >
    Build a persistent, Vault-grounded narrative simulation whose WorldKernel
    exclusively owns revisioned world state, while generalized
    Projector-Persona-Interpreter machinery produces bounded proposals for the
    kernel to validate. The rebuilt kernel admits one human, the world
    owner, as controller of one genesis subject; multi-player membership
    existed only in the pre-rebuild body and has no replacement yet.
  primary: >
    Generate psychologically grounded branching scenes, dialogue, actions,
    social consequences, and eventually storylines, consumer behavior,
    faction decisions, and technology/item manifests for Aetheria.
  near_term: >
    Use Delvehold as the first whole-world proving consumer of Ghostlight's
    generic simulation API. Admit a consumer-authored world seed through the
    same AdmitPatch draft admission a produced seed uses (there is no
    publication contract or compiler); simulate
    realm, institution, population, and person-scale politics under a cell
    budget in the hundreds; and let named figures emerge durably from causally
    relevant offscreen pressure. Consumer-supplied boundary subjects remain
    externally owned through generic authority descriptors and typed proposal
    and receipt exchange. Delvehold supplies the authored setting and retains
    players, civic state, dungeons, and quantitative economy; no Delvehold ID,
    schema, or policy becomes privileged Ghostlight core authority. Preserve
    atomicity, scoped knowledge, identity, topology, no-puppeting, and
    model-no-commit invariants. Kalsa remains regression evidence.
  voidbot_goal: >
    Keep the appraiser, relationship/perception updater, and memory machinery
    useful for VoidBot's core companion mission: reading specific humans over
    time, forming grounded opinions about them, noticing misreads, and updating
    trust, concern, irritation, respect, boundaries, and expectations from
    evidence rather than generic friendliness.
  active_fixture: >
    Pallas Species Strikes is reference-only story quality material.
    `pallas-training-loop-v0` is the first small receipt-chain pilot.
    `lucent-hostage-feed-v0` is the current open-ended training-loop draft:
    fifteen post-restart turns through safe-line resolution, with responder
    receipts but coordinator turns still Codex-authored rather than sandboxed.
    Call of the Void and Elysium-era gameplay remain procedural consumer
    targets.

hard_boundaries:
  - The pre-rebuild Ghostlight pipeline is teardown evidence, not an authority to preserve. Do not add a model stage, semantic verifier, reconciliation agent, retry loop, model-routing exception, timeout exception, context adapter, checkpoint, or compatibility path merely to keep it running. Structural ontology and referential integrity belong to the single deterministic reducer.
  - Seal world authority before widening ontology. Only WorldKernel may hold mutable aggregate state, issue canonical IDs, invoke the reducer, or write the journal. The public seam is create/open, immutable snapshot, CommandEnvelope submission, and typed receipt. Empty reductions do not commit; translation gaps remain non-fictional inference/evaluation evidence outside WorldState.
  - Every autonomous authority scope has exactly one decision controller. NarrativePersona preserves the Projector-Persona-Interpreter prose membrane; OperationalAgent may use a permissioned typed view and tools for operator-shaped cognition. Interpretation is total: representable material becomes typed proposals and unrepresented material becomes exact translation gaps. Neither mode changes authority, falls through to the other for a gap or infrastructure fault, or exercises the same opportunity twice. On Ghostlight Dungeon's play path the operational play agent, not the Interpreter, lowers a Persona turn (operator ruling 2026-09-22); the library retains total interpretation for offline simulation.
  - Sparse causal sufficiency, not actor count, defines a valid world horizon. Counts, cover ratios, interestingness, political diversity, and prose quality are evaluation evidence and cannot admit ontology, reject a structurally valid mutation, or declare the world complete. Liveness is a separate authored claim: the seed's WorldScaleIntent (design target 2,400 subjects / 240 cells / 10% cover) is a scale deficit the elaborators pursue, and cover budget is the deliberate choke; validity never waits on it and it never gates admission.
  - Ghostlight Dungeon is a consumer of the Ghostlight library, which serves all GameCult narrative simulation. Dungeon concepts (Session Zero, Vault choice, players, sliders, starting locations) are Dungeon authority and never shape the library; the library offers consumer-neutral capabilities and each consumer supplies its own policy. The world kernel lives in the `ghostlight` library crate; `ghostlight-dungeon` consumes it across a public boundary (L0, commits `108b691` and `f859d2c`). The boundary is sealed by admission (ruling Q1-9): public ID types, ScopeDigest and DecisionOpportunity derive Deserialize, so external code can hold a syntactically valid value, and the kernel rejects every one it did not issue, proven by crates/ghostlight/tests/external_admission.rs.
  - Prompt text is projection, not truth storage.
  - A consumer-supplied ontology or fixed seed may never bypass WorldKernel validation, closed mutation authority, or atomic CultCache commit.
  - Delvehold retains quantitative economy authority. Ghostlight string resource handles and strategic resource effects must not impersonate quantities, prices, recipes, production capacity, inventories, orders, contracts, or conservation semantics.
  - Newspaper layout may reserve typed advertisement slots, but only the economic layer may supply advertiser identity, goods, price, claims, campaign continuity, or payment. Unfilled slots collapse unless the edition explicitly records unsold space; the compositor cannot invent an ad campaign to fill a page.
  - Canonical agent state and per-agent perceived state must remain distinct.
  - Characters act from local knowledge, local perception, local pressure, and bounded affordances.
  - Aetheria prose must support tonal range and ordinary life, not only crisis pressure. Wit, warmth, domesticity, ritual, boredom, wonder, and quiet dread are valid state-grounded modes when they fit the scene.
  - Character intelligence is modeled state, not a default model capability. Make the Ghostlight machinery as smart as possible, but project each character's cognition, metacognition, manipulation skill, inference speed, education, and blind spots only to the level supported by their stat sheet, culture, experience, stress, and current state.
  - Listener misread is first-class; intent and interpretation are not the same object.
  - A causal-horizon classifier is a future simulation-budget router, not a content classifier or state authority. From current player intent and canonical pressure it may propose the smallest causally relevant subject horizon and effective cell budget; the deterministic runtime validates that proposal and alone derives the connected cover, without rewriting the campaign's configured entitlement. Locally self-contained play may collapse to one cell, including an isolated erotic encounter, but world-facing aims such as political seduction retain the subjects needed for their consequences. Urgent clocks, due obligations, and already committed consequences remain canonical inputs and cannot be erased, deferred, or rewritten by horizon classification; the runtime must retain or restore the cells needed to advance them.
  - Human-facing appraisal is a first-class target; VoidBot must be able to read people, form grounded opinions, and revise those opinions over repeated contact.
  - Generated action is an event proposal; deterministic gates and reviewed mutation decide what becomes state.
  - Initiative controls action opportunity, not perception. Every affected participant appraises and mutates from an event before the next actor is projected; the scheduler selects eligible actors from readiness, recovery, load, status, and reaction windows rather than handing everyone a round-robin turn.
  - Fuzzy judgments become reviewed training artifacts before they become trained models.
  - Aetheria generation is source-first; check lore for factions, bodies, locations, institutions, and constraints before projection.
  - Do not import species-comfort assumptions across institutions. AU dry-operation cephalopod labor is bare-minimum productivity support, not Navigator-style or cephalopod-native comfort habitat, unless source lore says otherwise.
  - Elysium futures are branch-local canon indexed by lineage, not single-history Sol facts.
  - Technology exploration must emit game-usable item, component, assembly, supply-chain, compatibility, and provenance data mapped toward Aetheria-Economy.
  - Interactive-fiction fixtures should branch and fold: normalize most consequences into compact state variables and shared-scene conditionals, reserving isolated route splits for major world-changing divergence.
  - Interactive-fiction fixtures require independent artifact review before acceptance; tracked variables must materially affect later affordances, risk, appraisal, callbacks, visual state, or outcomes, unless explicitly marked telemetry-only.
  - Ghostlight scenes should feel like puppets on elastic strings, not puppets on rails. The coordinator supplies playable affordances, gates, resources, clocks, posture constraints, route options, evidence objects, and risk pressure; actors choose locally within those constraints; state folds from observed action rather than from the coordinator forcing a plot outcome.
    - Complete illustrated interactive-fiction fixtures should emit visual art direction for website imagery and replay value, with click-through visual scene segmentation, stable visual character refs for recurring named characters, a global style cue when the visual language matters, one durable base image prompt per distinct section, character visibility and stance controls, and additive modification prompts for branch-visible consequences and scene-state changes; assembled prompts include only actually visible character refs, while continuity notes stay in tooling unless rewritten as concrete visible description.
    - Image prompts must be affirmative target descriptions. Describe visible geometry, materials, composition, lighting, bodies, tools, and state deltas; keep forbidden assumptions in reviewer findings or validation errors instead of feeding negative constructions to imagegen.
    - Generated environment images are concept and material reference, not geometry authority. Multi-angle or branch-consistent illustrated IF needs a durable scene-set source such as a hand-built 3D blockout, procedural scene file, layout asset, or camera map with staging slots and occluders; imagegen paints over camera-specific visual input instead of preserving topology from memory.
    - Visual artifacts are auxiliary illustrated replay and website collateral for the corpus, not core training targets for responder, appraiser, mutator, or relationship models. Visual review judges the playable IF experience and visual plan, not clean-run prose receipts.

live_architecture:
  ghostlight_dungeon_rebuild:
    - The authoritative target map is `docs/architecture/ghostlight-dungeon-mvp.md`.
    - One sealed per-world WorldKernel owns one private revisioned WorldState, reducer, canonical ID allocator, and journal writer across Draft and Active phases. External code receives only create/open, immutable snapshot, submit, and typed receipt surfaces.
    - Every ingress submits one CommandEnvelope. The kernel derives authority from canonical state, lowers through one component mutation algebra, validates one complete candidate, and atomically persists WorldState plus WorldCommit through CultCache CAS.
    - Rejected and no-effect commands do not allocate canonical IDs, advance revision or digests, or append journal rows. Translation gaps, scheduler queues, and DecisionOpportunity values are derived evidence and cannot enter WorldState by recording themselves.
    - The typed ontology owns runtime-issued identities, subjects, decision controllers, components, places, routes, relations, custody, jurisdiction, knowledge, pressure, provenance, and external-owner grants. Aggregate Campaign and legacy component projection are not parallel truth.
    - NarrativePersona and OperationalAgent are centralized proposal interfaces with disjoint explicit authority scopes. Canonical controller assignments and affordance grants determine authority; current executable affordances and opportunities are derived and kernel-revalidated; opportunities and proposals bind to a scope digest over the components their verification reads, not to a revision (ontology v2; landed foundation.v0 still binds to revision until plan step 6 pass 2). Controllers have no commit, verifier, repair, scheduler, or recovery authority.
    - Scheduler queues, covers, transcript, news, surfaces, model receipts, compaction, checkpoints, world-size counts, and qualitative judgments are derived only.
    - Expansion occurs at a typed causal boundary and uses the same mutation vocabulary as seed creation, action, import, individuation, and time. A sparse structurally closed horizon is valid.
    - Pre-rebuild stores and acceptance roots remain immutable evidence. They do not enter the new runtime through a live compatibility writer.
  deployment_authority:
    - Idunn is the GameCult-wide deployment, admission, continuity, and future swarm-scaling control plane. Systemd, container runtimes, and existing proxies execute and route workloads; Idunn decides which exact GameCult incarnation may act. Its actuator boundary must remain replaceable by systemd, Nomad, or Kubernetes rather than absorbing generic scheduling, networking, container, cryptographic, service-mesh, or consensus machinery.
    - Each target repository owns a visible versioned deployment recipe: build, test, package, artifact map, constrained launch declaration, health contract, state semantics, and requested runner profiles. A target may request an affordance; it cannot grant itself host authority. The operator binding selects the workload driver, and that driver alone lowers the launch declaration into process-manager configuration; raw repository-owned unit or container-runtime text is rejected.
    - Idunn operator bindings own admitted source origins and refs, minimum revisions, exact release selection, container images and runner kinds, network, mounts, secrets, identities, capabilities, resources, routing endpoints, rollout policy, retention, and desired replica placement. `gamecult-ops` owns those fleet bindings and substrate provisioning, not target deployment programs.
    - Idunn owns admission and deployment changes to the physical swarm plus continuity supervision of the same admitted body. The deployment brake gates graph-changing deployment; a separately named lifecycle brake may suspend continuity. Continuity may replace only the physical incarnation inside the same admitted generation and preserve its current route. It cannot create a generation, change source, configuration, schema, dependencies, endpoints, or semantic provider eligibility.
    - A sealed plan and release produce only Idunn's sanitized Expected incarnation. The service owns its signed runtime presence and health claim. Odin alone authenticates that observation into Present, correlates Expected and Present, and derives Ready. For writable state, Idunn grants the process-bound write lease before the service opens state. Stable route membership may move only after Ready; route membership and the write lease remain separate authorities. Expected, Present, Ready, and any disagreement remain distinct typed facts.
    - Typed target, action, exact source, recipe digest, runner binding, and deployment identity replace raw persisted shell-command authority. Source fetch and recipe materialization run as the Idunn identity; a narrow privileged boundary consumes sealed inputs and cannot interpret branch heads or mutable worktrees.
    - CultNet through CultLib `85f7024` owns generation-bound dual-proof runtime activation, separate lifecycle brakes, process-write leases, provider-observed capabilities, explicit Expected/observed disagreement, and routed RUDP incarnation admission. Odin through pushed commit `65cf2b2` owns deterministic recipe and binding admission, exact source freezing, sealed releases, durable deployment transactions, and narrow native actuator ports. Its current uncommitted integration is moving Idunn-owned projection and multi-session RUDP transport into those live paths.
    - Ghostlight pushed commit `6a79cb0` implements its provider side: the recipe requests Idunn's runtime bundle, candidate bind, protected activation and provider credentials, process-write-lease path, and admitted state-root binding; the runtime validates Expected and activation, publishes signed Warming, waits for the exact process lease before opening state, and keeps that lease current through bind, Active publication, and serving. It republishes signed Warming for as long as the lease is outstanding and exposes its managed route presence for correlation. CodexConnector pushed commit `ede3c30` implements the corresponding stateless provider contract. Idunn v2 admitted Ghostlight Dungeon on 2026-09-23; CodexConnector is not a Dungeon dependency.
    - The control plane has exactly three durable record classes: an operator command with one frozen dependency order and exact recipe/source inputs, a crash-resumable transaction, and one CAS-owned admitted generation per target. Transactions persist Sealing, Starting, Warming, Fencing, Leasing, AwaitingReady, Routing, Committing, and Complete before their effects. Stateless targets skip only fencing and leasing. Deployment authorization is consumed once at Sealing to Starting. Continuity uses its lifecycle brake and CAS-updates the physical incarnation and monotonic continuity epoch inside the same generation; it does not perform semantic admission.
    - Idunn bootstraps and recovers from its own durable admitted state. Odin is the first managed daemon and the root of the managed semantic graph, never an Idunn startup prerequisite. First-Odin admission still publishes Expected and requires the same signed Present and Ready facts; only the evidence transport is bootstrapped by querying that exact candidate directly. Every other candidate is correlated through the already-admitted Odin stable route.
    - Current Nginx route observation is control-plane evidence only: it binds the rendered membership digest to the on-disk fragment and a post-reload `nginx -T` parse. It does not prove that live workers adopted the generation or that packets reach the exact candidate. Fence clearance and incumbent drain therefore require a separately persisted data-plane observation bound to the route, runtime instance, candidate endpoint, and membership digest.
    - Idunn publishes desired deployment identity and topology into Odin/CultMesh before dependent promotion. Services establish signed runtime presence through normal CultNet/CultMesh activity; configuration cannot impersonate observation. During an Odin outage, Idunn may authenticate narrowly scoped physical continuity evidence, restart an already-admitted generation, and preserve its current route, but it freezes graph-changing deployment, promotion, scaling, and provider selection. Historical Ready cannot authorize the replacement incarnation, and Idunn never emits Present or Ready.

pre_rebuild_architecture:
  ghostlight_dungeon:
    - The authoritative ownership and build map is `docs/architecture/ghostlight-dungeon-mvp.md`.
    - One per-campaign WorldKernel mailbox owns canonical state and revision numbers.
    - Every player, NPC, institution, scheduler, import, and reload transition uses the same typed WorldCommand validation and atomic CultCache commit path.
    - Foreground attempts, NPC reactions, strategic cell outcomes, waits, travel, and approval-gated population fission lower into one closed semantic WorldMutationBatch vocabulary. Means and intended effects remain proposals; only the WorldKernel reducer can change canonical components.
    - The mutation reducer validates a complete batch against an exact authority envelope on an isolated component overlay, advances each touched subject version once, and persists component state, authority, batch, mutation receipt, causal receipt, events, and aggregate compatibility projection atomically. Aggregate campaign rows are rejected by component-only mutation ingress.
    - WorldEffectDelta, ActorStateDelta, and StrategicOutcomeEffect are model-boundary migration inputs, not independent writers. Destination identity resolution routes a genuinely new place to bounded region expansion and an exact reachable canonical place to in-place locality elaboration. Both lower places, propositions, populations, institutions, political relations, topology, and the civic manifest through the same typed mutation reducer. Compiler-validated agency profiles remain a companion projection outside the reducer and are an explicit component-migration frontier. Inhabited destination proposals require a civic manifest whose public authority, selection or succession, resources, and redress facts are structurally cross-bound and independently checked for semantic legibility before approval. Initial publication is a fresh-store creation transaction; named-person materialisation/folding is a resolution transaction that advances revision and resolution epoch, clears the cover, preserves the individual delta, and cannot rewrite Gestalt-wide knowledge, custody, pressure, or fictional time.
    - Full-world acceptance keeps the root compiler bounded-local. The strategic driver may sequentially ask the existing destination compiler agent for at most eight ordered new-region proposals, but only WorldKernel ExpandRegion admission can commit them. An immutable run plan freezes the complete ordered request set; proposal checkpoints close the kernel-commit/checkpoint crash interval; per-region commit checkpoints bind the exact request, origin, committed jurisdiction, kernel receipt, and model-receipt hashes. Resume rejects request drift and trusts only canonical campaign state plus exact receipts. Operator authorization of the autonomous run admits valid branch-local previews without replaying Dungeon's per-preview UI approval, while unresolved canon gaps still stop. The driver, checkpoints, and compiler agents are forbidden world writers.
    - Ghostlight owns generalized Projector to Persona to Interpreter machinery; consuming Personas retain their own canonical minds and commit authority.
    - Player speech address is a bounded proposal over exact co-present simulation-eligible actor IDs. WorldKernel commits the selected Persona response set with the speech turn; every present actor still appraises, while direct addressees receive explicit response duty and observers retain optional agency. A direct addressee must speak or select typed deliberate silence, which lowers deterministically rather than opening a free-text reaction-effect lane.
    - Foreground action assessment derives a closed structural schema from exact current authority. A compact private scope projection receives only the exact attempt and the structurally available lane names; local validation permits it only to subtract. Causally unselected lanes disappear from the assessor schema and information facts stay out of the prompt when knowledge mutation is unselected. Canonical dynamic effect maps cross the strict model boundary as bounded authority-enumerated entry arrays and lower once into WorldEffectDelta after validation. The admission-bound schema gives required strong/ordinary-success lanes minItems 1 only on the admissible branch and forces every inadmissible effect array empty; local validation repeats both rules after lowering. A separate compact semantic verifier then compares the complete four-band effect bundle with the player's exact means and intended effect. Neither stage can reassess difficulty, choose committed effects, expand authority, or commit. One mismatch produces a private semantic-invalid receipt and bounded same-snapshot assessor correction; a second mismatch aborts. Only structurally and semantically verified proposals enter the cache.
    - Mutation-scope and action-assessment proposals are content-addressed by the exact scope, assessor, and verifier models, stable instructions, scoped action-specific schema, and permitted typed packet. Private CultCache cache rows are derived inference evidence only. Revision and expiry bind the consumable assessment and roll but do not invalidate an otherwise identical semantic proposal; cache hits revalidate it, emit an explicit zero-token receipt linked to the source scope, assessment, and verifier receipts, and issue a fresh revision-bound digest. Changed actor state, occupancy, facts, institutions, permissions, contract, boundaries, schema, or model contract changes the key. Eve projections itemize every signed modifier and exact reference.
    - The hosted player story is the chronological lowering of exact committed NarrativeTurn rows. No narrator or verifier model rewrites those turns; historical narration projections are inert and never enter Eve or CultMesh player surfaces.
    - Epiphany consumes the extracted Ghostlight projection crate at an exact Git revision while retaining her canonical Mind, effect admission, and consequence authority.
    - Gestalt Personas own shared population state; durable member deltas preserve specific people between appearances. WorldKernel owns one revision-bound individuation primitive that validates exact Gestalt lineage, location, version, and canonical identifier uniqueness before atomically materializing the member. Public display names are not identity keys and may be ambiguous. The model-facing complexity lane contains only the compact member draft: local ID, name, traits, relationships, goals, and memories. The deterministic tool alone supplies the canonical schema, parent ID and version, location, materialization state, and relevance revisions before shared validation and WorldKernel admission. Foreground presence may call the primitive after exact player speech; strategic waves may call it for at most one selected Gestalt action through an action-bound selector receipt. Resolution owns the exact strategic-individuation validator. The scheduler calls that shared validator at proposal production, records semantic_invalid, and drops an invalid optional proposal before wave assembly; WorldKernel revalidates with the same owner at admission.
    - The multiresolution agency graph derives a connected cohesive/arena attention cover from canonical actors, institutions, and Gestalt-compressed latent subjects under a campaign-selected 1–240 active-cell entitlement; provider concurrency is independently capped at 32. Active cells do not state total world population or complexity. The current full-world target is approximately 2,400 potentially acting entities under a 240-cell cover, about ten percent simultaneous attention. A 1,000-subject, 200-cell fixture remains machinery proof of complete unique coverage and parallel membrane dispatch under a seven-call provider gate, not the product-scale target. Resolution owns cover derivation, Nemesis allocates causal decision windows inside that cover, and WorldKernel retains commit authority.
    - Model-driven strategic cell waves can change remote actors, institutions, gestalts, clocks, and exact-channel news while the absent player remains outside their write authority; the entire wave validates and commits atomically.
    - Population activity effects represent exact attributed attempts to prepare, coordinate, investigate, recruit, obstruct, trade, or communicate; graph scope, locations, channels, and semantics validate before the kernel derives an event, and the effect never claims its own success.
    - Population migration is a separate exact-leaf effect. WorldKernel atomically moves the Gestalt and its agency-profile location along an explicit reachable migration relation; destination populations remain distinct and named members never move by implication.
    - Targetless investigation may inspect an exact current location or unnamed ordinary role, but it cannot invent an actor, response, discovery, or private knowledge.
    - Salient dormant members may emit the same bounded activity vocabulary from their exact location toward their current leaf or adjacent subjects; member activity and migration share one action key, so arena aggregation cannot duplicate or transfer personal agency.
    - Resolution-demand focal IDs are salience hints only; model output cannot force singleton cells or override the player-selected Persona-cell budget.
    - Projectors receive decision-relevant situation state, Personas receive only lived narrative, and Interpreters receive exact action permissions; runtime-owned cell membership and revisions are bound locally rather than copied by a model.
    - Canonical actor cell slices include exact goals, obligations, relationships, and bounded memories. Actor knowledge and Gestalt shared knowledge never become public information channels; channels are concrete report, courier, broadcast, or social routes, and profile maintenance removes legacy overlap and `unknown` placeholders.
    - Each active strategic subject receives a subject-conditional Interpreter schema. Institution, actor, Gestalt, and named-member effect lanes are structurally distinct; movement and population-migration variants are absent when the exact subject has no reachable destination. Semantic retry owns meaning, not type combinations the runtime already knows are impossible.
    - Targetless local preparation, investigation, communication, and obstruction stay bound to the exact supplied location and record only the source's attempt against an unnamed role or local feature. They cannot substitute a convenient canonical target or claim a listener, discovery, damage, disruption, or response.
    - The independent effect verifier receives the same exact typed permissions as the Interpreter. Only supplied canonical destinations can create a travel obligation; places mentioned solely in lived prose remain local texture inside the supplied activity location.
    - An exact subject/effect pair rejected by per-action local validation or the independent effect verifier is excluded from the one same-snapshot Interpreter correction schema. Neither validator can choose a replacement or commit; the Interpreter must select another permitted lane, omit the action, or abort the whole wave without mutation. Cross-action failures do not guess at an offender.
    - Strategic outcome references use one `resource:*` ontology for actor possessions, institution resources, Gestalt resources, and member equipment. The local validator reports the exact action, offending handle, and allowed handle set to the private same-snapshot correction loop while the player receives only a spoiler-free refusal.
    - Each strategic outcome digest receives an action-scoped schema. Only admissible effect kinds exist; the selected kind structurally requires its exact owner and fields, forbids fields owned by other kinds, and binds recipients, existing resources, relations, facts, pressure owners, and references to the exact action slice. Narrative causality remains a resolver/verifier judgment and WorldKernel remains the only writer.
    - Every activity target is one runtime-derived descriptor keyed by authoritative ID, containing the canonical name and current locations. Reachable actor destinations map IDs to names; migration destinations name both population and location. Projectors, Interpreters, and effect verifiers can distinguish an actual target from an unnamed role and cannot turn “go to Reed” into travel to an unrelated permitted place.
    - Strategic pressure transitions receive exact owner IDs and current unresolved strings. Resolutions copy current state; additions must be new. No-op pressure proposals are state-semantic failures, not JSON-shape failures, so the outcome-specific correction receives the rejected bundle while the kernel guard remains absolute. Named-member obligations exist only for social activities that can actually create a promise or debt, never physical obstruction, preparation, or investigation.
    - Structured validation failures retain stage name plus exact instance and schema JSON pointers in private diagnostics. Public strategic refusals remain spoiler-free; model output and chain-of-thought do not become logs or state authority.
    - A structured same-snapshot retry receives only the nearest rejected containing object beside the exact schema pointer, not the full rejected response. Parallel strategic failures retain the exact simulation cell, constituent IDs, and bounded causal chain in operator-only diagnostics while public receipts remain spoiler-free.
    - Cell Projector perspective ownership is schema-bound to exact constituents and selected member exceptions. Ghostlight lowers unique subject-keyed segments into name/location prose and requires the debt-selected focus before the Persona sees the stream.
    - Local world compilation treats direct-seed evidence as canon constraints rather than an exhaustive game map. Missing room-scale geometry, routes, people, procedures, and operational doctrine become explicit branch-local elaboration; only contradiction, an unanchored requested baseline, or a premise-changing ambiguity becomes a material gap.
    - A separate Flash lane extracts exact institution anchors for coarse remote powers. Pro synthesizes playable branch-local strategic doctrine; an independent verifier accepts compatible elaboration, rejects actual canon contradiction, and can never delete an anchored institution into a gap. Every admitted remote doctrine is disclosed in the approval preview as a branch assumption.
    - Strict provider schemas never receive canonical dynamic route, relationship, facet, assignment, or demand-weight maps. Model-facing records carry explicit semantic IDs or fixed axis fields; local validation rejects duplicates and lowers once into the canonical maps. This prevents strict-schema projection from silently turning open maps into empty closed objects.
    - Remote institutions receive deterministic six-axis coarse profiles with distinct self-authority and explicit unknown facets. The Pro agency compiler profiles only locally materialized subjects; finer remote state compiles on demand.
    - Model-stage receipts expose per-attempt provider identity, latency, validation errors, and prompt/completion/cache token usage without storing reasoning content.
    - Budget and pins own `resolution_epoch`; provider concurrency owns a separate configuration epoch and cannot repartition or advance fiction.
    - Approval-gated gestalt fission creates explicit child leaves plus `other/unknown`, preserves inactive parent lineage and member deltas, assigns every scarce parent resource to exactly one child, transfers every named member exactly once, and projects only derived agency profiles and cover state outside the mutation reducer.
    - Existing v0 training fixtures are regression evidence and have no runtime write authority.
    - SessionZeroKernel is the sole pre-world owner of persistent shared/private negotiation, typed contracts, character drafts, boundaries, decisions, invitations, and approvals. The WorldKernel receives only an unanimously approved brief at atomic publication.
    - SessionZeroKernel keeps append-only model-invocation audit history separate from the active preview's exact compiler proof set. Repeated calls with one semantic receipt hash remain distinct audit entries; preview retirement clears only the proof set, and campaign publication receives only the receipts that produced the approved preview. Legacy conflated stores migrate atomically on registry load without changing revision, epochs, or fictional time.
    - SessionZeroKernel remains the identity and state owner for every human-controlled actor during compilation. Public player names and premises may inform the shared world frame, but actor and Gestalt-member outputs may not materialize those reserved people. The model-generated player object is only a provisional starting-position marker; Ghostlight removes it and installs the approved typed characters locally. A collision receives one same-snapshot correction and then rejects atomically.
    - Approved private relationships cross compilation through exact canonical subject IDs. Player references bind to approved actors; otherwise unresolved named people become stable server-generated relationship anchors. The shared world compiler receives no private subject name, identity handle, or relationship. After public topology validation, a separate private stage owns characterization and placement but cannot emit IDs, relationships, narration, facts, gaps, assumptions, or public changes; Ghostlight attaches the opaque ID and owner-only relationship locally. Omission, ambiguity, unknown placement, or collision rejects the candidate atomically, and links to actors, institutions, Gestalts, or named Gestalt members grant no knowledge or authority.
    - Gap-bearing compiler results remain non-canonical exact previews. Host review selection cannot approve them; every active member approval binds shared contract, private character, and the exact world-preview digest. Publication preserves that digest and the accepted evidence gaps and branch assumptions, while the Eve tree visibly renders the player-reviewable world shape without institution-private resources/goals or another player's relationship anchors.
    - The host may discard a retained non-canonical preview through the SessionZeroKernel. This clears preview-bound approvals and preview state, then returns the locked roster to drafting without changing the contract, characters, or fictional time.
    - A material counter clears its prior typed payload, enters the permitted durable channel, removes acceptance authority, and remains unresolved until a same-epoch DM turn atomically installs a fresh decision. Generated opening and role suggestions are non-material; ignoring them cannot block custom compilation. Transcript-only blank contracts and characters fail locally before world compilation.
    - Bounded co-op uses campaign_membership.v1 to bind one to eight authenticated members to exact actors in the existing campaign mailbox. Sequential public actions, actor-filtered surfaces, unanimous time/travel/cell-budget changes, and non-simulatable human actors are implemented; split parties, PvP, private play actions, delegation, late joining, and group lifecycle commands remain unsupported.
    - Contract Review reuses Session Zero against an exact world revision. Unanimous publication may amend forward-looking contract and approved actor ledger fields but cannot rewrite custody, location, topology, knowledge, memory, canon, or history. Boundary tightening becomes immediate anonymous aggregate policy; relaxation waits for publication.
    - `ghostlight.play` is the one stable Eve provider surface across anonymous entry, Session Zero, Contract Review, and campaign play. The browser embeds Eve's canonical provider host and lowering package; it owns only ephemeral drafts, tabs, focus, and rendering.
    - Eve editable bindings are the input model. Operations capture named bindings into `gamecult.eve.command_invocation.v1`; rejected or stale receipts preserve drafts, and accepted receipts may clear exact binding names. HTML forms are lowering detail, not Eve state or payload semantics.
    - Heimdall owns OAuth attempts, Discord callbacks, entitlement evaluation, claims, single-use completion, refresh, and logout. Its required Eve access plugin crosses a private loopback CultNet operation boundary; Ghostlight validates the exact claim and owns only its hashed app session before deriving actor authority from campaign membership.
    - Heimdall access grants and Ghostlight app sessions survive daemon replacement. Each scheduled refresh uses a fresh private-command identity, verifies the signed access claim against the exact returned session without requiring an initial-login account summary, rotates the locally wrapped refresh claim by CAS, and issues a persistent HttpOnly cookie bounded by refresh expiry.
    - Native players use `ghostlight.native.player` on loopback RUDP `127.0.0.1:4102`. Heimdall owns the one-time OAuth attempt and completion; Ghostlight redeems it into the same app-session authority used by the browser. The native client persists only its opaque Ghostlight bearer in a mode-0600 CultCache store, submits the same canonical Eve invocations to the same kernel mailboxes, and sends bounded five-second RUDP keepalives while a long model-backed command remains pending.
    - Odin advertises the redacted native boundary and its four operations but receives no bearer, attempt handle, claim, account, member, actor, or campaign state. A forged native session is denied before surface projection or command admission.
    - Public Ghostlight HTTP exposes only the Eve provider, logical surface, command, and invalidation endpoints plus the typed health probe and static assets. Exact private per-member and operator surfaces remain CultMesh documents; Hermodr is an optional generic materializer, not a runtime dependency.
    - The landed Idunn foundation records an exact selected commit, tree, recipe blob, and Gitlink facts but does not prove Git ancestry, signatures, or object custody. A narrow Idunn-owned source driver must fetch and prove those objects as the Idunn identity before a plan or release can gain runtime consequence. Pushed Odin commit `65cf2b2` lands that source driver, the narrow actuator seams, dynamic systemd isolation, authenticated Ready-provider selection, and protected activation delivery. Odin still vendors CultNet as a gitlink into the retiring standalone repo; the contract it needs is CultLib `85f7024`.
    - Idunn owns Ghostlight deployment and same-release continuity, Odin owns discovery, Heimdall owns account identity, and VoidBot owns Vault retrieval. None can write campaign state. Epiphany is an adjacent consumer and future swarm-capacity provider, not a Ghostlight runtime dependency or authority.
  persistence_spine:
    - The hosted runtime uses Rust CultCache/redb `.cc` stores: one store per campaign plus service auth and CultMesh stores.
    - `state/ghostlight-state.cultcache.jsonl`, `state/branches.json`, and `state/evidence.jsonl` belong to the older research pipeline and have no hosted runtime authority.
    - `schemas/agent-state.schema.json` is also the first shared cross-runtime payload contract. CultNet clients should move `ghostlight.agent_state.v0` documents unchanged inside typed document envelopes instead of inventing forked state ontologies per repo.
  state_model:
    - Layer personality through organization, disposition, behavior, presentation, situational activation, relationships, goals, and values.
    - Canonical authored state has no certainty; perceived overlays carry observed activation, attributed disposition, and confidence.
    - Voice style is a broad communication vector; defensive, comic, tender, ritual, poetic, dry, or evasive verbal behavior should emerge from state, circumstance, relationship, tonal mode, and presentation.
  projection:
    - Project canonical state into character-local operating context before any responder sees it.
    - Include scene facts, relevant memory, relationship read, stakes, embodiment/interface affordances, action affordances, projection controls, retrieved lore, tonal intent, ordinary-life texture, and latent pressure handling.
    - Hide raw state internals such as means, plasticity, current_activation, and numeric dimensions from prompt text.
  responder_packets:
    - `packet_only` tests runtime parity from curated source excerpts.
    - `retrieval_augmented` bakes setting texture into reviewed outputs through scoped retrieval.
    - `responder_scoped_repository_search` allows the responder to inspect declared seed scope, follow bounded relevant AetheriaLore links, and requires consulted refs, followed refs, research trace, plus research summary.
    - Gold responder data must preserve exact visible input, raw output, parsed/reviewed output, hidden-context refs, leakage audit, isolation method, and coordinator interventions.
  training_loop_bundles:
    - Scene-loop bundles are the receipt-chain unit for training-shaped sequential character scenes before branch compilation.
    - A bundle must tie scene-local digest, initial state, coordinator turn artifacts, projected contexts, responder packets, raw responder captures, event records, participant appraisals, reviewed mutations, review summary, and coverage status.
    - Training readiness is per organ. A valid responder turn does not automatically make branch compiler, IF reviewer, visual artifact, or whole-fixture coverage training-ready.
  initiative_scheduler:
    - Initiative scheduling is a deterministic runtime seam between reviewed mutation and the next actor projection.
    - Participants carry initiative speed, next-ready time, reaction bias, interrupt threshold, current load, status, and constraints.
    - Actions carry scale, recovery, initiative cost, interruptibility, commitment, and local affordance basis.
    - Reaction windows are event-triggered opportunities with eligible actors, urgency, expiry, and allowed action scales; they are not automatic responses or hidden-state access.
    - Coordinator overrides must record a reason before the artifact can claim training value.
    - VoidBot's newer heartbeat routine is the reference for turning this seam into the cast swarm's live timing law: characters take scene turns through heartbeat initiative, cooldown begins after turn completion, and offstage agents use slower rumination/sleep turns for memory consolidation, resonance, incubation, and dreams. See `docs/architecture/voidbot-routine-adoption-plan.md`.
  coordinator:
    - The coordinator is a trainable soft organ: it stages scenes, chooses next beats and acting agents, invokes specialist machinery, carries unresolved hooks, emits glue prose, and proposes game-engine-shaped state changes.
    - Future coordinator turns should be sandboxed as their own promptable worker outputs, with exact visible input, raw output, parsed coordinator artifact, review labels, and interventions preserved. Codex acts as meta-coordinator: it scopes, launches, reviews, repairs, and wires Ghostlight organs, but should not silently collapse the trainable coordinator organ back into omniscient chat.
    - Glue prose is training signal, not canonical truth.
    - Coordinator prose should choose an intentional tonal mode for the scene and protect breathing room when the story needs routine, levity, domestic texture, wonder, or slow dread before consequence.
    - The coordinator/narrator may be smarter than the characters for reader service: explain opaque maneuvers, stakes, institutional games, and social tactics in accessible prose without retroactively making the acting characters more self-aware than their state allows.
    - The coordinator nudges by affordance, not decree. Prefer concrete game-ergonomic levers such as safe lines, export locks, security holds, handling categories, visible posture scripts, route access, resource scarcity, clocks, and public proof objects over authorial pressure toward a desired ending.
  branch_compiler:
    - The branch compiler turns fixture briefs, lore digests, scene/world state, actor-local branch candidates, reviewed consequence packets, fold plans, and optional visual replay requirements into playable Ink plus training sidecars, separate visual plan artifacts when illustrated replay is in scope, and compiler notes.
    - The branch compiler owns playable structure, click-through segmentation, conditionals, variables, callbacks, fold materialization, visual scene ids, and image prompt handles; it stores visual prompt data in `.visual.json` artifacts rather than bloating training annotations; it does not own hidden character truth, participant appraisal, or durable social mutation.
  coverage_ledger:
    - `state/corpus-coverage.json` tracks accepted, draft, planned, rejected, and superseded fixtures by faction, movement, flashpoint, timeline lane, tonal mode, collision axis, training target, artifact refs, review status, and economy hooks.
    - `npm run coverage:status` validates the ledger and reports coarse corpus gaps before choosing the next fixture.
  training_targets:
    - Coordinator/story runtime
    - Memory and lore retrieval
    - Projector/state interpreter
    - Character agent/responder
    - Participant appraiser
    - State mutator
    - Relationship/perception updater
    - Branch compiler for Ink materialization, fold/callback structure, and sidecar generation; visual plan generation is auxiliary illustrated replay support when a fixture is meant for website or art presentation
    - Interactive-fiction artifact reviewer for fake variables, cosmetic choices, missing state reads, fake folds, and visual callback gaps
    - Visual scene continuity reviewer for illustrated IF replay, click-through segmentation, imagegen-ready prompts, character visibility, stance control, and branch/state visual modifiers; this reviewer protects entertainment and presentation value, not core social-model training signal
    - Human-facing appraisal and opinion model for VoidBot
    - Evaluator/review classifiers
    - Aetheria-tuned responder
    - Institution, faction, and consumer decision models

active_subgoals:
  - Idunn v2 admits and serves Ghostlight Dungeon on Yggdrasil. Remaining deployment work belongs to its owners (Idunn, Odin, CultLib, Heimdall, gamecult-ops) and is listed under "Open, other owners" in the cut map block "The first deploy, 2026-09-23 (PA.f198-PA.f216)"; Ghostlight's own share is deleting the retired v1 actuator, unit, wiring test and legacy state once gamecult-ops agrees, and subtracting the library's CodexConnector transport.
  - Build the outbound half of the consumer contract (the consumer's read of its own projection and attributed intents toward its subject as a typed response document) and a non-loopback CultMesh authority lease, then connect a Delvehold-owned adapter to the landed inbound ingress (POST /cultnet/world-patch, ConsumerPort, PatchGround::Consumer) without consumer-specific IDs or schemas in Ghostlight.
  - Extend strategic/offscreen named-person individuation beyond the proven emerge-then-act path so people plot across sustained political waves, acquire relationships, fold, and return without granting a cell, arena, or model commit authority.
  - Keep the selectable Kalsa Vault's Public player-safe and Spoilers GM-only evidence lanes intact through Git/Obsidian sync, retrieval, exact receipts, and player projection. Do not import it into the read-only Aetheria recovery index or create a rival Ghostlight semantic index.
  - Grow the 36-case candidate agency corpus toward 300 reviewed, behaviorally distinct attempts that either compose from existing primitives, produce an explicit bargain, or falsify the algebra.
  - Seed worlds from Vaults through the seeded live smoke (notes/local-live-smoke.md) and grow a seeded world toward the 2,400-subject / 240-cell design profile, recording each road failure as a rule in the tree; reject honest evidence gaps instead of borrowing a nearby fixture, cast, or geography.
  - Let append-only agent contexts realize stable-prefix cache reuse naturally without removing context needed for goals, promises, relationships, knowledge, or exact permissions; do not grow sporadic independent prompts such as newspaper filings merely to chase provider cache hits.
  - Keep every model stage proposal-only; malformed, stale, cross-slice, or semantically invalid waves must leave campaign state and fictional time unchanged.
  - Complete separate-account co-op privacy, actor-binding, unanimity, and restart proof when suitable testers or controlled account fixtures are available.

coverage_targets:
  current_lore_counts:
    major_powers: 12
    minor_powers: 21
    movements: 23
    pre_elysium_flashpoints: 24
    defunct_absorbed_powers: 5
  baseline_story_fixtures: 92
  baseline_with_defunct: 97
  practical_first_broad_target: 100-150 reviewed fixtures
  major_power_requirement: founding-era story plus day-in-the-life story
  collision_requirement: every coverage story should involve multiple cultures, factions, movements, institutions, or body/infrastructure assumptions colliding

current_artifacts:
  canonical_docs:
    - docs/architecture/ghostlight-session-zero.md
    - docs/architecture/delvehold-forced-ontology-integration.md
    - notes/documentation-inventory.md
    - docs/architecture/corpus-coverage-ledger.md
    - docs/architecture/prompt-projection-contract.md
    - docs/architecture/projected-local-context.md
    - docs/architecture/sequential-agent-runtime.md
    - docs/architecture/ink-branching-scenes.md
    - docs/architecture/illustrated-if-visual-pipeline.md
    - docs/architecture/aetheria-lore-grounding-architecture.md
    - docs/architecture/sandboxed-responder-packets.md
    - docs/architecture/soft-model-training-artifacts.md
    - docs/architecture/training-plan.md
    - docs/architecture/technology-item-manifest-plan.md
    - docs/architecture/persistence-spine.md
  schemas:
    - schemas/agent-state.schema.json
    - schemas/projection-example.schema.json
    - schemas/lore-grounding-digest.schema.json
    - schemas/corpus-coverage.schema.json
    - schemas/projected-local-context.schema.json
    - schemas/coordinator-artifact.schema.json
    - schemas/responder-packet.schema.json
    - schemas/responder-output.schema.json
    - schemas/event-record.schema.json
    - schemas/participant-appraisal.schema.json
    - schemas/reviewed-mutation.schema.json
    - schemas/scene-loop-bundle.schema.json
    - schemas/initiative-schedule.schema.json
  prompts:
    - prompts/README.md
    - prompts/sandboxed-responder-packet.md
    - prompts/sandboxed-coordinator-turn.md
    - prompts/interactive-fiction-weaver.md
    - prompts/research-sanity-responder.md
    - prompts/narrative-quality-reviewer.md
    - prompts/lore-grounding-reviewer.md
    - prompts/spatial-geometric-cohesion-reviewer.md
    - prompts/visual-scene-continuity-reviewer.md
  live_examples:
    - state/ghostlight-state.cultcache.jsonl
    - tools/ghostlight_state_store.py
    - tools/requirements.txt
    - state/corpus-coverage.json
    - examples/agent-state.call-of-the-void.json
    - examples/projections/call-of-the-void.scene-broken-taxi-oz.jsonl
    - examples/projections/call-of-the-void.scene-broken-taxi-oz.pretty.json
    - examples/lore-grounding/historical-flashpoint.template.json
    - examples/lore-grounding/pallas-species-strikes.awakened-labor.v0.json
    - examples/agent-state.pallas-species-strikes.v0.json
    - examples/coordinator/pallas-species-strikes.branch-and-fold.v0.json
    - examples/ink/pallas-species-strikes.branch-and-fold.v0.ink
    - examples/ink/pallas-species-strikes.branch-and-fold.v0.training.json
    - examples/ink/lucent-hostage-feed.branch-and-fold.v0.ink
    - examples/ink/lucent-hostage-feed.branch-and-fold.v0.training.json
    - examples/ink/lucent-hostage-feed.negotiator-branch.v1.ink
    - examples/ink/lucent-hostage-feed.negotiator-branch.v1.training.json
    - examples/lore-grounding/corvid-collective-founding.v0.json
    - examples/training-loops/corvid-collective-founding-v0/corvid-collective-founding-v0.initial-state.json
    - examples/ink/corvid-collective-founding.branch-and-fold.v0.ink
    - examples/ink/corvid-collective-founding.branch-and-fold.v0.training.json
    - examples/visual/corvid-collective-founding.branch-and-fold.v0.visual.json
    - experiments/corvid-collective-founding-v0/sandbox-packets/corvid-collective-founding-v0.coordinator-packet.md
    - experiments/corvid-collective-founding-v0/sandbox-captures/corvid-collective-founding-v0.coordinator.capture.json
    - experiments/corvid-collective-founding-v0/reviews/corvid-collective-founding-v0.narrative-review.final.json
    - experiments/corvid-collective-founding-v0/reviews/corvid-collective-founding-v0.lore-review.final.json
    - experiments/corvid-collective-founding-v0/reviews/corvid-collective-founding-v0.narrative-review.visual-enabled.json
    - experiments/corvid-collective-founding-v0/reviews/corvid-collective-founding-v0.lore-review.visual-enabled.json
    - experiments/corvid-collective-founding-v0/reviews/corvid-collective-founding-v0.spatial-review.final.json
    - experiments/corvid-collective-founding-v0/reviews/corvid-collective-founding-v0.visual-review.final.json
    - experiments/lucent-hostage-feed-v0/sandbox-packets/lucent-hostage-feed.negotiator-branch.v1.coordinator-packet.md
    - experiments/lucent-hostage-feed-v0/sandbox-captures/lucent-hostage-feed.negotiator-branch.v1.coordinator.capture.json
    - experiments/lucent-hostage-feed-v0/sandbox-packets/lucent-hostage-feed.negotiator-branch.v1.weaver-packet.md
    - experiments/lucent-hostage-feed-v0/reviews/lucent-hostage-feed.negotiator-branch.v1.narrative-review.final.json
    - experiments/lucent-hostage-feed-v0/reviews/lucent-hostage-feed.negotiator-branch.v1.lore-review.final.json
    - experiments/lucent-hostage-feed-v0/reviews/lucent-hostage-feed.negotiator-branch.v1.spatial-review.final.json
    - examples/visual/pallas-species-strikes.branch-and-fold.v0.visual.json
    - experiments/pallas-species-strikes/pallas-species-strikes.branch-and-fold-clean-run.v0.md
    - experiments/pallas-species-strikes/pallas-species-strikes.visual-scene-review.v1.json
    - examples/training-loops/pallas-training-loop-v0/pallas-training-loop-v0.bundle.json
    - examples/training-loops/pallas-training-loop-v0/pallas-training-loop-v0.scene-digest.json
    - examples/training-loops/pallas-training-loop-v0/pallas-training-loop-v0.initial-state.json
    - experiments/pallas-training-loop-v0/pallas-training-loop-v0.clean-run.md
    - examples/training-loops/lucent-hostage-feed-v0/lucent-hostage-feed-v0.bundle.json
    - examples/training-loops/lucent-hostage-feed-v0/lucent-hostage-feed-v0.scene-digest.json
    - examples/training-loops/lucent-hostage-feed-v0/lucent-hostage-feed-v0.initial-state.json
    - examples/training-loops/lucent-hostage-feed-v0/lucent-hostage-feed-v0.review.json
    - examples/initiative/lucent-hostage-feed-v0.turn-20.initiative.json
    - experiments/lucent-hostage-feed-v0/lucent-hostage-feed-v0.clean-run.md
    - scripts/materialize_lucent_loop.py
    - scripts/materialize_lucent_loop_continuation.py
  pruned_receipts:
    - Old prototype fixture receipts and local runner files were removed from the live workspace after their lessons were distilled into docs, state, evidence, and git history.

data_flow:
  - Rehydrate from map, handoff, system map, implementation plan, and `npm run state:status`.
  - Work one bounded organ.
  - Verify the seam that matters.
  - Add distilled evidence only when future belief changes.
  - Steward memory: keep the smallest correct persistent surface current and cut stale steering when it slows re-entry.
  - Commit and push completed work.
  - If state grows faster than understanding, cut it back.

current_status:
  summary: Ghostlight's source teardown is complete and its Idunn provider side is landed at pushed commit `6a79cb0`: executable startup enters the replacement runtime, the legacy scheduler/kernel/Session Zero pipeline modules are absent, one CultCache implementation owns persistent state, and the runtime publishes signed Warming, republishes it while the write lease is outstanding, and exposes managed route presence. Production is cut over: Ghostlight Dungeon is live under Idunn v2 at `https://yggdrasil.gamecult.org/ghostlight/` (runtime `ghostlight-yggdrasil`, state root `/var/lib/gamecult/ghostlight-world-v2`; `/health` names the served commit); the legacy `ghostlight-dungeon.service` is stopped with its old state untouched, and the v1 actuator, unit, wiring test and that state are retired in fact and owed deletion. The first attempted deployment exposed duplicate authority across hard-coded Idunn policy, raw shell commands, the privileged dispatcher, and target-specific gamecult-ops programs, plus a root-versus-Idunn Git ownership failure and stop-old-before-candidate routing. The adopted deployment rebuild uses target-owned visible recipes, Idunn-configured runner and host bindings, candidate readiness behind a stable route, process/write-lease handoff, and separate deployment versus continuity authority. First deploy and play session: the cut map block "The first deploy, 2026-09-23 (PA.f198-PA.f216)" in `docs/architecture/ghostlight-play-agent-cut.md`.
  provider_acceptance_checkpoint: Exact pushed commit `139b8a6` completed Run 60 under `character-newsroom.v10` without world or per-wave replay. Its acceptance witness and terminal status bind the completed page and exact resume lineage. The independently dispatched blind reviewer, shown only the reader-facing fantasy newspaper, read it as a real left-populist civic broadsheet and did not immediately identify procedural generation, so the narrative reverse-Turing criterion passes. The review's substantive criticism is that the three stories feel like three rewrites of one briefing; accepted Run 60 remains immutable. The run used 96,902 prompt tokens and reported zero cache hits. Its delivered typeset artifact is `output/pdf/canopy-ledger-run-60-front-page.pdf`; frozen-source and visual verification remain accepted. Exact pushed `bc2ca39` then produced frozen-fact newsroom-only Run 61 Issues 13, 15, 16, 17, and 18 without world or wave model replay. Provider output proves `special_issue` convergence in Issues 13 and 15, independent `general_issue` beats in Issues 16 through 18, and assignment-selector cache hits. Blind review of Issues 13, 15, 16, and 17 passes both distinct recurring voices and issue-shape diversity, recognizing Ossan, Mera, Corin, and Lysa's biases plus modest cross-issue evolution. Run 62 exercised v12 without world or wave replay and failed only because two lead articles proposed invalid datelines; recurring reporter calls still recorded zero cache hits. Run 63 used exact pushed v13 `a52d57b`; Issues 17 and 18 completed before root stopped the final weekly recomposition, both repeated bylines again recorded zero cache hits, and live services remained unchanged. Preserve Runs 61 through 63 as stopped or completed immutable evidence. Copy defects remain later deadline-correction work rather than a reason to reopen accepted issue artifacts.
  implementation_checkpoint: Pushed commit `6bb6869` makes the replacement mailbox/kernel architecture the crate and executable runtime identity and removes the legacy runtime owner. Pushed commit `13d5136` unifies app sessions, world journal, and controller custody under one CultCache implementation (now consumed from CultLib `85f7024`) and deletes the duplicate legacy CultCache dependency. The committed daemon tree has no old Session Zero, legacy kernel, scheduler, assessor, verifier/reconciliation, or legacy-transition module path. CultNet in CultLib `85f7024` owns the current activation, brake, lease, observed-capability, disagreement, and RUDP-route contracts. Odin `65cf2b2` owns exact source/release actuation and the durable three-record, nine-phase transaction body. Ghostlight `d0510ac` consumes CultCache, CultNet and CultMesh from CultLib `85f7024` instead of vendoring its own generation of them, deleting 19,604 lines of forked substrate; Ghostlight `751b5c4` stops naming its own runtime id, bind, and state root and takes all three from Idunn, which the recipe's required `state_root` argument binding makes mandatory rather than cosmetic; Ghostlight `6a79cb0` and CodexConnector `ede3c30` own their respective provider contracts; `9256648` exposes managed Ghostlight route presence and `6a79cb0` republishes Warming while awaiting the write lease. Live deployment status is in `summary`.
  full_world_acceptance_checkpoint: Run 115 is terminal failed at `/var/lib/gamecult/ghostlight-dungeon/acceptance/full-world-delvehold-0a83034-115`, semantic revision 2, regions 2/8, waves 0/1. Resume2 ended on provider SSE timeout. Resume3 exhausted four reconciliation steps after `inst:kharad-road-keepers` referenced unknown `loc:kharad-rhythm-road`. Preserve the root, receipts, service invocation `d9254cd9b77946aebcf7a7fdae821402`, and failed patch sequence through 8964a92 as immutable evidence. Do not resume it.
  scale_checkpoint: Runs 108 through 115 prove load and failure properties of the pre-rebuild body, not world completeness. Operator directive 2026-09-04: the 2,400-subject / 240-cell / 10% cover profile is deliberate design, not a load fixture; a world feels alive only when actors at every level pursue their own goals, so that detail is generated first and multiresolution simulation is then choked so attention is scarce. The seed carries a `WorldScaleIntent`, the elaborators pursue its derived scale deficit, and cover budget is the choke. The 1,200-actor fixture is a load measure only. Structural admission still cannot require interest, diversity, name uniqueness, or an actor count; validity never waits on a count, liveness is authored. The committed replacement authority suite passes, but no further scale run is admitted until Yggdrasil serves the exact world-v3 release through the rebuilt Idunn recipe/binding/router seam, the live state root satisfies the complete world-v3 allowed-path contract, restart preserves exact journal and digest identity, and no old service, state path, process grant, or route can regain write authority.
  presentation_checkpoint: The historical press-layout and seed-ownership split are complete. `notes/historical-newspaper-layout-grammar.md` remains the durable grammar. Manifest v2 at `output/tex/canopy-ledger-run-61-style-1847-flow-723.manifest.toml` independently binds `style_seed=1847`, `flow_seed=723`, frozen source SHA-256 `8f195140f52a40ba705d6a66987146a1500ae89668e5d82b01d1792eb3afb882`, and the final artifact `output/pdf/canopy-ledger-run-61-style-1847-flow-723.pdf`, SHA-256 `a457f4b1702a7a52480e42fce0039f0dbe677ff32958e98f1c412b346237190c`. An identical seed pair produces byte-identical TeX and PDF; changing only flow preserves the exact style section while materially changing a plausible layout, and changing only style preserves flow topology. Cut-first and cut-midstory templates pass visual inspection; the failed split-card template is deleted. Frozen copy/assets, actual PDF `/BM /Multiply`, and economic-layer advertising authority remain invariant.
  public_reference_checkpoint: The published public architecture is immutable pre-rebuild history, not current rebuild authority. Canonical Ghostlight commit `15ea0f0` owns five archived pages covering the former overview, authority, pipelines, 43 named production stages, and eight titled elaborators. Site commit `2035e799c2cf7470b2bfc70d5a878d5d3be5e90f` publishes a shared mobile Home/Blog/Docs masthead, visibly marks every Docs page as a teardown archive, and publishes the postmortem `The World Counter Lied` at `https://ghostlight.gamecult.org/Blog/the-world-counter-lied`; live HTTP inspection returned 200 for the postmortem and Docs index and found the masthead and archive banner. Do not use the archived pages to steer the whole-machine rebuild. `docs/architecture/ghostlight-dungeon-mvp.md` owns the adopted target; publish replacement architecture only after the replacement body is implemented and verified. The site repository owns public composition and deployment.
  next_action: >
    The play agent (plan step 16) is the live work and the playtest gate. Its
    target is `docs/architecture/ghostlight-play-agent.md` and its cut map is
    `docs/architecture/ghostlight-play-agent-cut.md`, which owns each cut's
    status, findings PA.f1 onward, and every operator and Self ruling; do not
    rebuild that chronology here or in the handoff. Cuts 1 through 14 are
    landed or landing on `codex/ghostlight-dungeon-mvp`. The state they leave:
    one Dungeon-owned operational agent drives a turn through `world.play`,
    now the only human play action, while `world.speak` and the story card are
    deleted (Cut 9, `f1732c0`); the kernel carries a Play authority, `Ruled`
    facts, minting, retirement, affordance grants and a callable Persona turn;
    one play table owns the turn lifecycle with one open turn per world; and
    the Eve client round trip is exercised end to end for the first time,
    which is where the answer path, the opaque per-question token (Cut 13,
    PA.f170) and the play-store migrations came from. Soul judged the
    bar met after Cut 17 without a whole-path run; the first deploy then
    found PA.f198-PA.f216, each by a person or a live counterpart, never a
    test (lesson: Eureka changelog, 2026-09-23). The postmortem is
    `docs/architecture/ghostlight-play-agent-postmortem.md`. Live topology
    (operator ruling 2026-09-23, "put each of the organs on the right
    machine"): Ghostlight Dungeon runs on Yggdrasil beside Heimdall under
    Idunn v2, binding `ghostlight` (Dungeon unit only), ref
    `codex/ghostlight-dungeon-mvp`, at
    `https://yggdrasil.gamecult.org/ghostlight/`; Bonsai 2 stays on Raven's
    GPU and reaches Yggdrasil loopback `127.0.0.1:18080` through Raven's
    `BonsaiLink` task. Heimdall is discovered through Odin at use, not an
    Idunn dependency, until Heimdall is a v2 target. gamecult-ops
    `runbooks/ghostlight-dungeon-yggdrasil.md` owns deploy, link and
    verification. Sign-in works end to end and the operator created a world
    and submitted a turn. Next action (operator, 2026-09-23: "Stop here, we
    have shit to fix"): the fix list in the cut map block "The first deploy, 2026-09-23 (PA.f198-PA.f216)", in order: PA.f212
    (failed turns are not surfaced), PA.f211 (Raven's rss-watchdog restarts
    Bonsai mid-turn; owner gamecult-ops/Raven), PA.f213 (no
    `GHOSTLIGHT_SEED_VAULT_ROOT` on Yggdrasil: configure a vault or stop
    offering seeding), PA.f214, PA.f215, PA.f216; then one Soul pass over
    Ghostlight `1fd52b7` onward plus Heimdall `e8e2832`, Odin `96a55ec` and
    Idunn `9ede4cd`, none of which Soul has reviewed. Other owners'
    follow-ups are listed in that block, not here. Two capabilities the Dungeon brief promises are not built, and the
    operator has named them as gating any wider share: fiction-first risk
    resolution (the kernel draws an affordance's weighted outcome bands with
    no assessment step or modifiers, the play agent cannot author
    affordances, and an act no granted verb expresses is authored as a ruled
    consequence with no draw — the player cannot tell those paths apart) and
    gestalt and institution agency (institutions constrain but never act, and
    advancing the clock only rolls routines and accumulates pressure). Risk
    resolution is the recommended first of the two, because it is an
    authority question as much as a mechanic. After the gate, in the operator's order (2026-09-15): (b) the
    outbound consumer response batch with a non-loopback CultMesh lease,
    shaped as Njordr's signal surface (custody, pressure and dependency,
    route, event deltas; spec owned by GameCult/Njordr
    `docs/architecture/njordr.md`, Ghostlight's obligations in the pointer
    docs/architecture/gamecult-economy-daemon.md); (c) the deletion of
    the retired v1 deployment body and legacy state (see the handoff's
    deployment section); (d) the decision on an
    Eve `world.run_tick` authority and the Eve owner's fourth command-result
    state for an overtaken turn. Inference constraints: lanes route by model
    name (`RoutedInferencePort`, crates/ghostlight/src/sdk_inference.rs), and
    an unclaimed model is refused at open, never fallen back. Three transports
    exist in source. The CodexConnector lane, consumed through the
    `codex-connector` crate pinned in Cargo.toml, is not an option for
    Dungeon inference (operator, 2026-09-23); the Claude SDK sidecar, a
    private length-prefixed msgpack pipe to a Node child, claiming
    `claude`-prefixed models; and, since the play agent's Cut 2, a local
    OpenAI-compatible loopback port (crates/ghostlight/src/local_inference.rs,
    one POST /v1/chat/completions, no credential, inert tool calls), opened
    only when GHOSTLIGHT_LOCAL_ENDPOINT is set and claiming the
    GHOSTLIGHT_LOCAL_MODEL_PREFIX prefix, default `local/`. The local lane
    (Bonsai 2 on Raven, reached at Yggdrasil `127.0.0.1:18080`) is the live
    Dungeon's inference; its reliability is PA.f211 and PA.f215. The sidecar
    was proven only on the workstation, where it inherits the operator's
    ambient Claude login; whether it has any role on Yggdrasil is undecided,
    and deleting it is decided after the gate. There is no Codex subscription
    and no API budget; CodexConnector stays isolated at main `6519289` and is
    not a provider for Dungeon. Operator
    direction: model backends share one standardized CultNet connector API,
    the same one Epiphany uses, and a generic OpenAI-compatible connector on
    it is still required before third parties use the deployment; the local
    lane may become it (the play-agent target's open question 1). Ghostlight
    never holds a credential. The elaborator swarm is drained; its review
    record and idea ledgers are in experiments/elaboration/ (start at its
    README), and the vault additions are in local bundles named there.
    Integration into the vaults is still wanted and deferred until the
    operator has time to review; it is an editorial pass, never a scripted
    merge. Gating rules are in the handoff's re-entry warnings.
  gestalt_population: Gestalt Personas own shared population baselines; persistent member deltas own named individuality; WorldKernel materialization and approval-gated fission preserve lineage and identity. Materialisation/folding changes only representation and the exact member delta, advances resolution epoch, and retires the old cover; it has no Gestalt-wide effect authority. Selected actionable member exceptions are mandatory Projector perspective owners, so aggregation cannot silently erase their decision. Presence projection is limited to nearby active leaves and exact-location dormant members, includes reciprocal player relationship evidence, and may propose an earned cast without committing it. Simulation cells are derived covers only.