WORK_QUESTION also sends her to huginn query over her own plans, frames what she
finds as candidates she weighs, names --cursor, and says every follow-up in her
campaigns is hers whoever filed it. The messages clause is ANSWER_MESSAGES, set
before the question on first lines that carry messages only. Stale prose about
bare later lines is corrected in the body map, MESSAGES_HEADER's comment and one
test name.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
WORK_QUESTION ends every first line, with messages or without, and sends her to
her own mind (huginn campaigns, open, unreported) and to start_self_run. WAKE_ASK
is now only the once-a-day new-thing opener before it. WORK_TAIL ends every later
line (plain, refused, stale, notices, Self replies). WAKE_QUESTION and
TRAFFIC_QUESTION are deleted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The verb walks the giver (Query only), plans with huginn_mind::plan, walks her own root to
resume by what she holds, admits one batch per source receipt with imported_from, and ends
with a verification walk. Settings::source builds the giver's client from explicit flags.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The verb and the tests share one definition of a replay batch: grouped by source receipt
ordinal, the Moved dropped from its own batch, foreign referents listed, oversized or
unordered receipts refused. Deletes the hand-built replay filter in move_tests.rs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A campaign slugged like the mind shares a root with the instance, its stewardships, memories and thoughts, so its Moved froze and closed all of them. A8 refuses such a Moved (MoveOfInstanceRoot); an import of the same campaign is refused already, the instance's records being native writes under its root.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Whoever wrote a batch first decided its attribution: a native writer of a batch already imported was told AlreadyAdmitted and the record kept naming the source, and an import of a batch another source landed read the same. A9 now treats a stored receipt as a replay only when its imported_from equals the candidate's; otherwise the batch meets its own identities at A10 (IdentityCollision). A source naming this mind in another case is another mind, as the instance grammar already rules, and is pinned by a test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Import mode turns derivation off, so it is open to any document whose derived writes native admission would have made: an imported hand-off left the steward's stewardship in force beside it, an imported ruling answered a question the Answered of which was never written and let a native ruling answer it again. A8 now refuses an import (ImportOutsideCampaign) unless each document's root names a campaign this mind holds or the batch carries and no native write has touched that root. Instance-rooted records have no campaign and never qualify. Replays that build a campaign from imports alone are untouched; the move tests that built the receiver natively now build it by import.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A sibling written in the Moved's batch froze with the campaign and never reached the receiver, whose replay stops before the Moved. A8 now refuses any staged document, derived ones included, rooted at a campaign whose Moved is in the same batch (CampaignMoved), on the giver and on import alike.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The giver: (Campaign, Moved) joins the matrix; a Moved to this mind refuses MoveToSelf and a withdrawn Moved MoveIsFinal; any staged document rooted at a moved campaign, derived ones included, refuses CampaignMoved; Docs::closing_resolution reads every other document under the root closed by the Moved, and the image fans status_changed out so an earlier as_of still reads in force. The oracle derives the same fallback independently.
The receiver: PipelineProvenance.imported_from (optional, absent from every other receipt and from the digest) names the source receipt and the externals the batch cites. An import derives nothing, refuses its own instance, a Moved outcome, and an external this mind holds; a listed external stands in for an absent referent. mind-body persona.rs gains one outcome_words arm for the new variant.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Additive resolution v2 variant, bounded as a Slug; the golden gains one line, the published schema one arm. Admission owns when it may be written.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A test with two slept nights pins that covered_through reads each night's own closing (the citation of its run), which no earlier test distinguished from the oldest Slept closing in force.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
SLEEP_GUIDANCE opens on 'Tonight you consolidate your memory.' and drops the contemplation paragraph; the night line closes on what she did with her memory, in the guidance and the schema's description. The module doc names the run the night's consolidation (rulings sleep-day-coverage-ruled, contemplation-own-session). A test pins that the start line carries the consolidation opening and that neither the guidance nor the schema invites her to think, read or look into anything.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ResolutionOutcome::Slept { line, day_through } is how a Sleep run ends when the ledger took her reply; day_through is the last memory of her day she was shown. CitationRole::DayThrough (day_through) makes the memory an A7 referent and a cites/cited edge; admission refuses Slept on any subject but a Sleep run, a day_through that is not a memory admitted before the batch, and skips the in-force check for that role since the night may have consumed it. The outcome alias carries Slept. sleep.rs close admits the typed outcome and covered_through reads only the Slept closing in force and day_through's admission ordinal: SLEPT, THROUGH and the rationale parse are gone, and a hand closing or a withdrawn Slept covers nothing. outcome_words renders Slept as 'slept: <line>'. Published schemas and the envelope golden regenerated from the derivation.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The day began at the previous Sleep run whatever became of it, so the memories past DAY_MAX and a failed
night's whole day never met the disposition cover-the-day requires. A night now closes with where its day was
covered through (the ordinal of the last memory it was shown), and the next day is what was admitted after the
newest night that closed 'slept:'; the first night's day is the 24 hours before it opened. A consolidation is
made by a night, whatever room it keeps, so it is not the next day's memory.
Night::from_settings carries the both-or-neither start check out of the binary where a test reaches it.
Tests pin last_sleep with the unit gone, the window's minutes and its 23 and 59 bounds, and the half-set start.
The spawn prelude leaves one_process for a shared start_session. sleep.rs is the one owner of a night: the night line (her day whole, open items, the tide), SleepReply and its schema, the decoder's ledger (every day memory exactly once, ids her memories in force, one conversation per consolidation, told back, third refusal ends it), admission of whole operations in batches that never split a consolidation, and the closing of the run with her line. The heartbeat opens one Sleep run per listed idle Mind per window (HEARTBEAT_SLEEP_UTC, HEARTBEAT_SLEEP_MINDS); a missed night is not made up and a failed one not retried.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
RunTurn gains Sleep and RunSlot/RunTurn::slot (PersonaTurn and Sleep hold the Persona slot, a Self run the other); live_holder, launch holders and the unit template compare slots, not turns. MemoryOrigin gains Sleep { run }. Admission refuses an unpaired consolidation both ways (MindRefusal::UnpairedConsolidation): a memory that consolidates others without a Superseded resolution of each by it in the batch, and a memory Superseded by memories that do not name it. Published schemas regenerated.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
load() refuses an over-cap file on its length first, so the take(MAX_BYTES + 1) on the read was
reachable only by a file that grew after that check and no test could see it. read_bounded holds the
read; its test grows a file past the cap and requires the read to stop at MAX_BYTES + 1.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ChatDelivery gains tuple index 11, `image: Option<ChatImage>` ([path, mime,
size, sha256], a reference into her per-room image store, never bytes); the
pending kind is gamecult.persona.chat_pending.v2, and v1 answers and records
still decode with no image. chat_image::load is the one place a reference
becomes bytes: exact `<hex sha256 of room id>/<sha256>[.ext]` path with no
traversal or symlink, regular file, 5 MiB declared and actual, declared size
and sha256, png/jpeg/gif/webp magic bytes matching the declared mime. The
persona line carries the image as a base64 image block after its text and an
`attachment role=organ` line saying attached or not shown and why. The
stream-json echo of a line with blocks still counts as our echo. The store is
MIND_PERSONA_IMAGE_STORE; unset, every image is not shown.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
